Notice of Privacy Practices

This notice applies to Balto Health Inc. (“Balto,” “we” or “us”). It covers the health information we create or receive when we provide telehealth care and help you with insurance coverage, prior authorizations, appeals and access to medications, including through our website.

If you have questions about this notice, contact our Privacy Officer at privacy@balto.com.

We use and share your health information to care for you, to get coverage and payment for your care, and to run our organization. We can do these things without your written permission.

• To treat you. Our clinicians use your health information to evaluate you, create a treatment plan and prescribe medications, and we share it with other professionals involved in your care. For example, a Balto physician reviews your medical history during a telehealth visit and sends your prescription to your pharmacy.
• To get coverage and payment for your care. We use and share your health information with health plans, pharmacies and others to confirm coverage, request prior authorizations, file appeals and bill for our services. For example, we send your health plan the clinical information it needs to approve a prior authorization or reconsider a denial.
• To run our organization. We use your health information to run our practice, improve your care and train our staff. For example, we review how long prior authorizations take so we can speed up the process.
• To contact you. We may contact you by phone, text message or email about appointments, prescriptions, the status of your coverage requests, and other matters related to your care.
• With our service providers. We share information with companies that help us provide our services, such as our telehealth platform, cloud storage and billing vendors. They must protect your information under written agreements with us.

The law allows or requires us to share your information in other ways, usually for purposes that serve the public good. We must meet the law’s conditions before we share it for these purposes.

• Public health and safety: to prevent disease, report adverse reactions to medications, report suspected abuse, neglect or domestic violence, and prevent or reduce a serious threat to anyone’s health or safety.
• Research: when the law’s conditions are met, such as approval by a review board.
• Complying with the law: when state or federal law requires it, including sharing information with the U.S. Department of Health and Human Services to show we’re complying with federal privacy law.
• Health oversight: with agencies authorized by law to oversee health care, for activities such as audits, investigations and licensing.
• Lawsuits and legal actions: in response to a court or administrative order, or to a subpoena.
• Law enforcement and special government functions: for law enforcement purposes or with a law enforcement official, and for special government functions such as military, national security and presidential protective services.
• Workers’ compensation: for workers’ compensation claims.
• Organ and tissue donation: with organ procurement organizations.
• Medical examiners and funeral directors: when a person dies.

Your choices. You can tell us whether to share information with family, close friends or others involved in your care or in paying for it, and whether to share it in a disaster relief situation. If you can’t tell us your preference, for example if you’re unconscious, we may share your information if we believe it’s in your best interest, and we may share it when needed to lessen a serious and imminent threat to health or safety.

We never do these without your written permission (an authorization):

• use or share your information for marketing;
• sell your information;
• share psychotherapy notes, in most cases; or
• use your story, image or health information in patient stories, testimonials or other public content.

Other uses. We’ll use or share your information in ways not described in this notice only with your written permission. You may revoke your permission in writing at any time, except to the extent we’ve already acted on it.

You have these rights about your health information. To use any of them, contact our Privacy Officer at privacy@balto.com.

• Get a copy of your records. You can ask to see or get an electronic or paper copy of your medical and billing records and other health information we have about you. We’ll provide a copy or a summary, usually within 30 days of your request, and may charge a reasonable, cost-based fee.
• Ask us to correct your records. If you think information we have about you is incorrect or incomplete, you can ask us to correct it. We may say no, but we’ll tell you why in writing within 60 days.
• Ask us to contact you confidentially. You can ask us to contact you in a specific way, such as at a particular phone number or email address, or to send mail to a different address. We’ll say yes to all reasonable requests.
• Ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment or our operations. We don’t have to agree, and we may say no if it would affect your care. If you pay for a service or item out of pocket in full, you can ask us not to share that information with your health plan for payment or our operations, and we’ll say yes unless a law requires us to share it.
• Get a list of those we’ve shared your information with. You can ask for a list (an accounting) of the times we’ve shared your health information in the six years before your request, who we shared it with and why. It won’t include disclosures for treatment, payment or our operations, disclosures you asked us to make, and certain others. We’ll provide one list a year for free and may charge a reasonable, cost-based fee for another within 12 months.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you’ve given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We’ll confirm the person has this authority before we act.
• File a complaint if you believe your privacy rights have been violated (see below).

• The law requires us to maintain the privacy and security of your protected health information.
• We’ll let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We won’t use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by letting us know in writing.

Changes to this notice. We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, on our website.

Complaints. If you believe your privacy rights have been violated, you can file a complaint with our Privacy Officer using the contact information below.