VitalCare Health is committed to protecting the privacy and confidentiality of your health information. This Notice of Privacy Practices (“Notice”) explains how we may use and disclose your Protected Health Information (“PHI”), your rights regarding your PHI, and our responsibilities under federal and Minnesota law.

This Notice applies to healthcare services provided by VitalCare Health through in-person appointments, telehealth services, and related healthcare services. Our practice operates on a cash-pay basis and does not submit claims to health insurance companies for our services.

Our Legal Responsibilities

We are required by law to:

• Maintain the privacy of your PHI.
• Provide you with this Notice describing our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify you following a breach of unsecured PHI when notification is required by law.

For purposes of this Notice, “we,” “us,” and “our” refer to VitalCare Health, its workforce members, and other individuals who provide services on our behalf as permitted by law.

1. WHAT IS PROTECTED HEALTH INFORMATION?

Protected Health Information (PHI) is individually identifiable information relating to your health, healthcare, or payment for healthcare.

PHI may include:

• Your name and contact information
• Date of birth
• Medical history
• Symptoms and diagnoses
• Medications and allergies
• Laboratory or diagnostic results
• Treatment information
• Clinical notes
• Prescriptions
• Information discussed or exchanged during an in-person visit
• Information discussed or exchanged during a telehealth visit
• Information concerning payment for our services

Because our practice is cash-pay, we generally do not collect or maintain health insurance information for billing purposes.

2. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

We may use or disclose your PHI without obtaining a separate written authorization when permitted by HIPAA and applicable Minnesota law.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare, whether that care is provided in person or through telehealth.

For example, we may share relevant information with another healthcare professional involved in your care, including a specialist, pharmacy, laboratory, or other healthcare provider.

Payment

Although our practice does not bill health insurance companies, we may use and disclose information necessary to obtain payment directly from you and maintain appropriate financial records.

For example, we may use your name, appointment information, services provided, and payment information to process your payment.

Healthcare Operations

We may use or disclose PHI for certain healthcare operations, including:

• Quality assessment and improvement
• Patient safety activities
• Staff training
• Compliance activities
• Auditing
• Credentialing
• Business administration
• Security activities
• Technology and system management

Appointment Reminders

We may contact you to remind you about appointments or provide information about scheduled healthcare services, including in-person and telehealth appointments.

Treatment Alternatives and Health-Related Services

We may contact you about treatment alternatives or other health-related services that may be relevant to your care.

Business Associates

We may disclose PHI to companies or individuals that perform services for us involving PHI. These may include:

• Telehealth technology providers
• Electronic health record vendors
• Secure communication providers
• Cloud service providers
• Appointment and scheduling platforms
• Other service providers supporting our healthcare operations

Where required by HIPAA, we will enter into written Business Associate Agreements with these providers.

3. OTHER USES AND DISCLOSURES PERMITTED OR REQUIRED BY LAW

We may use or disclose your PHI without your authorization when permitted or required by applicable law, including for certain purposes such as:

• Required by Law: We may disclose PHI when federal, Minnesota, or other applicable law requires us to do so.
• Public Health: We may disclose PHI for certain public health activities permitted by law, including activities related to preventing or controlling disease, injury, or disability.
• Abuse, Neglect, or Domestic Violence: We may disclose PHI when permitted or required by law to report suspected abuse, neglect, or domestic violence.
• Health Oversight: We may disclose PHI to government agencies conducting legally authorized oversight activities.
• Judicial and Administrative Proceedings: We may disclose PHI in response to an appropriate court or administrative order or other lawful process where permitted by law.
• Law Enforcement: We may disclose PHI to law enforcement officials when permitted or required by applicable law.
• Serious Threats to Health or Safety: We may disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, as permitted by law.
• Workers’ Compensation: We may disclose PHI as necessary to comply with workers’ compensation laws.
• Organ and Tissue Donation: Where applicable, we may disclose information for purposes relating to organ, eye, or tissue donation and transplantation.
• Coroners, Medical Examiners, and Funeral Directors: We may disclose information to coroners and medical examiners as permitted by law and, in certain circumstances, to funeral directors.
• Research: We may use or disclose PHI for research when permitted under applicable federal and state requirements.

4. USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION

Most uses and disclosures of psychotherapy notes, where separately maintained, require your written authorization except where otherwise permitted by law.

We will also obtain your written authorization when required by HIPAA for certain uses and disclosures of PHI, including:

• Marketing
• Sale of PHI
• Other uses or disclosures that require authorization under HIPAA

If you provide an authorization, you may generally revoke it in writing at any time, except to the extent we have already relied on it.

5. IN-PERSON CARE AND YOUR PRIVACY

When you receive healthcare services at a VitalCare Health facility, we take reasonable administrative, physical, and technical measures to protect the privacy and confidentiality of your health information.

These safeguards may include:

• Conducting consultations and examinations in appropriate private areas.
• Limiting access to patient records to authorized personnel.
• Protecting paper and electronic health records from unauthorized access.
• Taking reasonable steps to prevent unauthorized individuals from overhearing confidential conversations.
• Verifying patient identity when appropriate.
• Securely storing and disposing of records containing PHI.
• Maintaining appropriate privacy and security procedures for patient registration and check-in.

Although we take reasonable precautions, no physical environment can be guaranteed to be completely free from privacy or security risks.

6. TELEHEALTH AND YOUR PRIVACY

When you receive healthcare through telehealth, your PHI may be transmitted electronically.

We use reasonable administrative, physical, and technical safeguards designed to protect your information. However, no electronic communication system can be guaranteed to be completely secure.

For your protection, we recommend that you:

• Participate in your appointment from a private location.
• Use a secure internet connection where possible.
• Protect your computer, smartphone, or tablet with a password.
• Keep your operating system and applications updated.
• Do not share your patient portal password.
• Avoid conducting consultations on public computers.
• Use headphones where appropriate to reduce the possibility of others overhearing your consultation.
• Take reasonable steps to prevent unauthorized individuals from viewing or hearing your telehealth appointment.

Telehealth Recording

We generally do not record telehealth visits.

If we intend to record a telehealth consultation, we will provide appropriate notice and obtain any consent or authorization required by applicable law.

Patients should understand that recording a consultation themselves may be subject to applicable federal and state laws.

7. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have certain rights regarding your PHI.

Right to Inspect and Obtain a Copy

You generally have the right to inspect and obtain a copy of PHI that may be used to make decisions about you, subject to certain legal exceptions.

You may request your records in an electronic or paper format, where available and required by law.

We may charge a reasonable, cost-based fee where permitted by applicable law.

Right to Request an Amendment

You may request that we correct or amend PHI that you believe is inaccurate or incomplete.

We may deny a request in certain circumstances permitted by law. If we deny your request, we will explain the reason and provide information about your rights.

Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI.

We are not required to agree to every requested restriction.

However, if you pay for a healthcare service completely out of pocket and request that we not disclose information concerning that service to your health plan for purposes of payment or healthcare operations, we will generally honor that request unless disclosure is required by law.

Because our practice is cash-pay and does not ordinarily submit claims to health plans, this situation may arise less frequently.

Right to Request Confidential Communications

You may request that we communicate with you about your healthcare in a particular way or at a particular location.

For example, you may request that we:

• Contact you by email rather than telephone.
• Contact you at a particular telephone number.
• Send correspondence to a specified address.
• Use a particular method of communication for telehealth-related information.

We will accommodate reasonable requests where required by law.

Right to an Accounting of Disclosures

You generally have the right to request a list of certain disclosures of your PHI made by us during a specified period.

Certain disclosures are excluded from this accounting, including disclosures made for treatment, payment, and healthcare operations where permitted by HIPAA.

Right to a Copy of This Notice

You have the right to receive a paper copy of this Notice at any time.

You may also obtain an electronic copy from our website, if available.

Right to Receive Notice of a Breach

You have the right to receive notification following a breach of your unsecured PHI when notification is required by law.

8. MINNESOTA HEALTH RECORD PRIVACY

In addition to federal HIPAA protections, Minnesota law provides specific protections for health records.

The Minnesota Health Records Act, Minnesota Statutes Chapter 144, generally requires appropriate patient consent before health records are released, subject to exceptions established by law.

We will comply with applicable Minnesota requirements when collecting, using, maintaining, and disclosing your health records through either in-person or telehealth services.

Where Minnesota law provides greater privacy protection than federal law, we will comply with the applicable legal requirements.

9. SENSITIVE HEALTH INFORMATION

Certain categories of information may receive additional protection under federal or Minnesota law.

Depending on the services we provide, this may include information relating to:

• Mental health
• Substance use disorder treatment
• HIV/AIDS
• Genetic information
• Reproductive healthcare
• Sexual health
• Other specially protected healthcare services

We will comply with additional federal and Minnesota requirements applicable to such information.

10. REPRODUCTIVE HEALTHCARE INFORMATION

Federal and state law may provide specific protections for reproductive healthcare information.

Where applicable, we will comply with restrictions governing the use and disclosure of reproductive healthcare information.

We will not use or disclose protected reproductive healthcare information for purposes prohibited by applicable law.

Where a specific authorization, attestation, or other legal safeguard is required, we will follow those requirements.

11. MINORS AND PERSONAL REPRESENTATIVES

Parents, guardians, and other personal representatives may have authority to make healthcare decisions for a patient under applicable law.

However, there are circumstances under Minnesota law in which a minor may consent to certain healthcare services independently.

When a patient has the legal right to consent to particular healthcare services, confidentiality requirements may restrict what information can be disclosed to a parent or guardian.

These confidentiality requirements apply regardless of whether the services are provided in person or through telehealth.

We will determine personal representative rights in accordance with applicable law.

12. YOUR RIGHT TO FILE A PRIVACY COMPLAINT

If you believe your privacy rights have been violated, you may submit a complaint to us.

You will not be retaliated against for filing a complaint.

Contact Our Privacy Officer

Abdirizak Nuno, MD
VitalCare Health
2600 East 25th Street, Upstairs Suite
Minneapolis, MN 55406

Telephone: +1 (612) 633-7898
Email: info@vitalcarehealth.org

You may also submit a complaint to:

U.S. Department of Health and Human Services
Office for Civil Rights

You are not required to contact us before filing a complaint with HHS.

13. OUR RESPONSIBILITIES

We are required by law to:

• Maintain the privacy of your PHI.
• Provide you with this Notice describing our legal duties and privacy practices.
• Notify you following a breach of unsecured PHI when notification is required by law.
• Follow the terms of the Notice currently in effect.

We reserve the right to change our privacy practices and this Notice.

If we make a material change to our privacy practices, we will make the revised Notice available as required by law.

14. EFFECTIVE DATE AND AVAILABILITY

Effective Date: August 20, 2026

This Notice is effective as of the date stated above.

A current copy of this Notice will be available upon request and may also be made available electronically through the VitalCare Health website.

VITALCARE HEALTH

2600 East 25th Street, Upstairs Suite
Minneapolis, MN 55406

Telephone: +1 (612) 633-7898
Email: info@vitalcarehealth.org

Protecting your privacy—whether your care is delivered in person or virtually—is a fundamental part of our commitment to you.