NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL AND RESEARCH-RELATED INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Effective Date: January 1, 2026
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
This Notice of Privacy Practices describes how Cardio Renal Institute (CARE), a clinical research organization, may use and disclose your protected health information (PHI), which includes information in any form—written, electronic, or oral, to carry out treatment, payment, or health care operations, and for other purposes that are permitted or required by law. It also describes your rights regarding your health information.
We are required by the Health Insurance Portability and Accountability Act (HIPAA) and applicable Idaho state laws to maintain the privacy of your PHI and to provide you with this Notice of our legal duties and privacy practices.
HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION
Uses and Disclosures for Research Purposes
As a clinical research organization, we conduct research studies to advance medical knowledge and improve patient care. We may use and disclose your PHI for research purposes under the following circumstances:
With Your Authorization: We will obtain your written authorization before using or disclosing your PHI for most research purposes. You have the right to revoke this authorization at any time in writing, though revocation will not affect uses and disclosures already made in reliance on your authorization.
For Research Studies You Participate In: When you enroll in a research study, we will use and disclose your PHI as described in the informed consent and HIPAA authorization forms you sign.
Institutional Review Board (IRB) or Privacy Board Approval: We may use or disclose your PHI for research purposes when an IRB or Privacy Board has approved a waiver of authorization, determined that the research poses minimal risk to your privacy, and meets other regulatory requirements.
Preparatory to Research: We may use or disclose your PHI to researchers preparing a research protocol or for similar purposes, provided the PHI is not removed from our facility.
Research on Decedents: We may use or disclose PHI about individuals who have died for research purposes when authorized by law.
De-identified Information: We may use and disclose de-identified health information that does not identify you for research and other purposes without your authorization.
Other Uses and Disclosures
Treatment: We may use and disclose your PHI to provide, coordinate, or manage your health care and related services in connection with research activities.
Payment: We may use your PHI to process compensation payments to you for completed study visits and to make payments to third parties on your behalf as part of your research participation. We do not bill insurance companies or collect payments from you for research services. Information shared with study sponsors uses identification numbers, not your PHI.
Health Care Operations: We may use and disclose your PHI for business operations, quality improvement, research oversight, and compliance activities.
Appointment Reminders and Health-Related Communications: We may contact you about your healthcare, appointment reminders, research opportunities, and regulatory notices using the phone numbers and email addresses you provide. This may include automated calls, pre-recorded messages, texts, or emails. You may opt out of these communications at any time. Because texts and emails are not encrypted, we limit the amount of PHI they contain to protect your privacy.
Business Associates: We may disclose your PHI to contractors and vendors (business associates) who perform services on our behalf, such as data analysis, laboratory services, or IT support. These business associates are required to protect your PHI.
As Required by Law: We will disclose your PHI when required by federal, state, or local law.
Public Health Activities: We may disclose your PHI to public health authorities for purposes such as preventing or controlling disease, injury, or disability, and reporting adverse events or product defects to the FDA.
Health Oversight Activities: We may disclose your PHI to health oversight agencies for audits, investigations, inspections, or licensure activities.
Legal Proceedings: We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process.
Research Sponsors and Regulatory Agencies: We may disclose your PHI to research sponsors, the FDA, and other regulatory agencies as required by law or research protocols.
Law Enforcement: We may disclose your PHI to law enforcement officials for limited purposes, including reporting certain injuries or responding to a warrant.
Military, Veterans, National Security, and Protective Services: We may disclose your PHI to military authorities (if you are armed forces personnel), the Department of Veterans Affairs, authorized federal officials for national security or intelligence activities, or to provide protective services for government officials.
To Avert a Serious Threat: We may use or disclose your PHI if necessary to prevent or lessen a serious and imminent threat to health or safety.
Workers’ Compensation: We may disclose your PHI for workers’ compensation or similar programs.
Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to these individuals to carry out their duties.
Uses and Disclosures Requiring Your Authorization
Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke such authorization at any time in writing, except to the extent we have already relied on your authorization. We will not sell your PHI without your written authorization. We will not use or disclose your PHI for marketing purposes without your written authorization, except for face-to-face marketing communications or for promotional gifts of nominal value. We will not receive financial remuneration in exchange for your PHI without your written authorization, except as permitted by law.
YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
You have the following rights regarding your PHI:
Right to Inspect and Copy
You have the right to access research records used to make decisions about your care. However, if you are participating in a research study that includes treatment, access to certain PHI created for that study may be temporarily suspended during the study if you agreed to this limitation in your research consent form. You will have full access to this information once the study is complete.
Response Time: We will respond to your request within 30 days of receipt. If we need additional time, we may extend the response period by up to 30 additional days, and we will notify you of the delay and the expected response date.
Fees: We may charge a reasonable, cost-based fee for copying, postage, and summarizing your PHI.
Exclusions – We May Deny Your Request to Inspect or Copy in Certain Circumstances:
We may deny your request to inspect and copy your PHI in the following situations:
- Psychotherapy Notes: Records of private counseling sessions that are kept separate from your medical record.
- Information Compiled in Reasonable Anticipation of Litigation: PHI compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
- Research Records: PHI created or obtained for a clinical research study in which you are receiving study-related interventions or procedures, while the research is in progress, provided you agreed to temporary suspension of access in your research consent form. You will have full access to this information once the research study is completed.
- Clinical Laboratory Improvements Amendments (CLIA) Restrictions: Certain laboratory test results as prohibited by CLIA.
- Information Obtained from Someone Other than a Health Care Provider Under a Promise of Confidentiality: If access would be reasonably likely to reveal the source of the information.
- Threat to Health or Safety: If a licensed health care professional determines that access is reasonably likely to endanger your life or physical safety or that of another person.
- Reference to Another Individual: If the PHI makes reference to another person (other than a health care provider) and a licensed health care professional determines that access is reasonably likely to cause substantial harm to that other person.
- Requested by Personal Representative: If the request is made by your personal representative and a licensed health care professional determines that providing access is reasonably likely to cause substantial harm to you or another person.
- Correctional Institution or Law Enforcement Custody: If you are an inmate or in law enforcement custody and access would jeopardize your health, safety, security, or that of others.
Review Rights: For certain denials, you have the right to have the denial reviewed by a licensed health care professional who was not directly involved in the denial. We will comply with the outcome of the review.
Right to Amend
If you believe your PHI is incorrect or incomplete, you may request that we amend it for as long as we maintain the information. We may deny your request if the PHI was not created by us, is not part of the records we maintain, is not available for inspection, or is accurate and complete.
Right to an Accounting of Disclosures
You have the right to receive a list of certain disclosures we have made of your PHI within the six years prior to your request (or a shorter period if you specify). This does not include disclosures for treatment, payment, health care operations, disclosures made to you, disclosures authorized by you, and certain other exceptions.
Right to Request Restrictions
You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations, or to individuals involved in your care. We are not required to agree to your request except in limited circumstances required by law.
Right to Request Confidential Communications
You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may request that we contact you only at work or by mail. We will accommodate reasonable requests.
Right to a Paper Copy of This Notice
You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. You may request a copy from our Privacy Officer.
Right to Be Notified of a Breach
You have the right to be notified in the event of a breach of your unsecured PHI.
SUBSTANCE USE DISORDER RECORDS UNDER 42 CFR PART 2
If we create, receive, maintain, or transmit records related to substance use disorder (SUD) diagnosis, treatment, or referral for treatment, federal regulations under 42 CFR Part 2 provide additional protections beyond HIPAA. These heightened protections apply to any information that would identify you as having or seeking treatment for a substance use disorder.
What Records Are Protected Under Part 2? Part 2 applies to records that:
Relate to a patient’s substance use disorder diagnosis, treatment, or referral for treatment
Would identify you as having or seeking such services
Were created or obtained by a federally assisted SUD program or in connection with SUD-related services
Uses and Disclosures of SUD Records
Under Part 2, we may use and disclose your SUD records in the following circumstances:
With Your Written Consent: We will obtain your specific written consent before disclosing SUD records to third parties. Your consent must identify the specific information to be disclosed, the recipient, and the purpose of the disclosure. You may revoke your consent at any time.
Internal Communications: We may use and share SUD records internally among our staff for treatment, payment, and health care operations related to your SUD services.
Medical Emergencies: We may disclose SUD records without your consent to medical personnel in a bona fide medical emergency when necessary to prevent or treat immediate threat to your health or safety.
Research: We may disclose SUD records for research purposes with your written consent, or in certain limited circumstances without consent when an Institutional Review Board (IRB) approves the research and determines that appropriate safeguards are in place.
Court Orders: We may disclose SUD records in response to a court order that meets specific Part 2 requirements, including findings that the disclosure is necessary and that the public interest and need for disclosure outweigh potential injury to you, your treatment relationship, or the SUD treatment program.
Crime on Premises or Against Personnel: We may disclose SUD records to law enforcement in response to a crime committed on our premises or against our personnel.
Child Abuse and Neglect Reporting: We may report suspected child abuse and neglect to appropriate state or local authorities as required by state law.
Qualified Service Organizations (QSOs) and Business Associates: We may disclose SUD records to qualified service organizations and business associates who provide services to us and agree to comply with Part 2 requirements.
Prohibition on Re-Disclosure
When we disclose SUD records with your consent, recipients are prohibited from re-disclosing the information unless:
You provide further written consent specifically authorizing the re-disclosure
The re-disclosure is permitted under Part 2 regulations
Your Rights Regarding SUD Records
In addition to the rights described elsewhere in this Notice, you have specific rights regarding SUD records protected under Part 2:
Right to Access: You have the right to access and copy your SUD records, subject to reasonable restrictions to safeguard PHI of other patients and certain other limited exceptions.
Right to Request Amendment: You may request amendments to your SUD records if you believe information is inaccurate or incomplete.
Right to an Accounting: You have the right to receive an accounting of disclosures of your SUD records made with your written consent.
Right to Revoke Consent: You may revoke your consent for disclosure of SUD records at any time, except to the extent that we have already acted in reliance on your consent.
Notice to Recipients
When we disclose SUD records pursuant to your consent or as otherwise permitted by Part 2, we will include a written notice that states: “This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.”
Penalties for Violations
Federal law provides penalties for unauthorized disclosure of SUD records. Any person who violates Part 2 may be subject to a fine in accordance with 42 CFR § 2.4.
IDAHO STATE LAW CONSIDERATIONS
Idaho law provides additional protections for certain types of health information:
Mental Health Information: Idaho law (Idaho Code § 66-348) provides specific protections for mental health records and may require additional authorization for disclosure.
HIV/AIDS Information: Idaho law (Idaho Code § 39-610) requires specific written authorization for disclosure of HIV test results.
Genetic Testing Information: Idaho law (Idaho Code § 39-8303) restricts the use and disclosure of genetic testing information.
Substance Use Disorder Records (42 CFR Part 2): Federal regulations (42 CFR Part 2) provide heightened protections for records related to substance use disorder (SUD) diagnosis, treatment, or referral. These protections apply to information we create, receive, maintain, or transmit that identifies you as having or seeking treatment for a substance use disorder. See the dedicated section below for complete details on how Part 2 protections apply.
When federal and state laws differ, we will follow the law that provides greater privacy protection.
OUR RESPONSIBILITIES
We are required by law to:
Maintain the privacy of your PHI
Provide you with this Notice of our legal duties and privacy practices
Follow the terms of the Notice currently in effect
Notify you if we are unable to agree to a requested restriction
Accommodate reasonable requests for confidential communications
Notify you in the event of a breach of your unsecured PHI
We reserve the right to change our privacy practices and the terms of this Notice. If we make changes, the new Notice will apply to all PHI we maintain. We will post the revised Notice in our facilities and on our website, and we will make copies available upon request.
REPORT A PROBLEM
If you believe your privacy rights have been violated, you may file a complaint with Cardio Renal Institute’s Privacy Officer or with the U.S. Department of Health and Human Services (HHS).
To file a complaint with us:
Cardio Renal Institute (CARE)
Attention: Privacy Officer
4511 Zebe Ave,
Chubbuck, ID 83202
Phone: 208-220-3634
Email: amna@cardiorenalinstitute.com
To file a complaint with HHS:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/
You will not be penalized or retaliated against for filing a complaint.
CONTACT INFORMATION
For more information about our privacy practices, or if you have questions or concerns, please contact our Privacy Officer, Amna Mannan, at Cardio Renal Institute.
Effective Date: January 1, 2026
This Notice replaces all previous versions.