Notice of Privacy Practices (HIPAA)

CUBE OneCare is a platform operated by CUBE Collective LLC (the "Platform Operator"). Customers of the platform — healthcare providers, clinics, hospitals, employers sponsoring group health plans, and other HIPAA-regulated entities (collectively, "Covered Entities") — are the parties that hold the provider relationship with individuals ("Patients") and are responsible for issuing a Notice of Privacy Practices to those Patients.

This template is offered to Covered Entities as a starting point. Before distribution to Patients, the document should be adapted to the Covered Entity's specific uses and disclosures of Protected Health Information ("PHI") and reviewed by the Covered Entity's HIPAA Privacy Officer and outside counsel.

The Covered Entity may use and disclose PHI without specific Patient authorization for the following purposes allowed by HIPAA:

• Treatment. Coordinating care across providers, including sharing records with specialists, labs, and pharmacies involved in the Patient's care.
• Payment. Submitting claims to payers, verifying eligibility, and collecting outstanding balances.
• Healthcare operations. Quality assessment, credentialing, audits, training, accreditation, and similar administrative activities.
• Public-health and safety disclosures. Reporting to public-health authorities, the FDA, or in cases of abuse and neglect when required by law.
• Legally required disclosures. Responses to subpoenas, court orders, and law-enforcement requests, subject to HIPAA's verification requirements.
• Business associates. Sharing PHI with vendors (including the Platform Operator) solely pursuant to a signed Business Associate Agreement.

Any other use or disclosure — including marketing communications, sale of PHI, and most uses of psychotherapy notes — requires specific, revocable, written authorization from the Patient.

Patients of the Covered Entity have the following rights under HIPAA:

• Right to access. To inspect or obtain a copy of their PHI maintained in designated record sets, in the form and format requested if readily producible.
• Right to amend. To request amendment of PHI that the Patient believes is inaccurate or incomplete.
• Right to accounting of disclosures. To receive a list of certain disclosures the Covered Entity has made of the Patient's PHI in the past six years.
• Right to restrict. To request restrictions on uses and disclosures for treatment, payment, or healthcare operations, which the Covered Entity is not required to grant except for disclosures to a health plan for services paid in full out-of-pocket.
• Right to confidential communications. To request that communications be sent by alternative means or to alternative addresses.
• Right to a paper copy. Of this Notice, even if the Patient has agreed to receive electronic notices.
• Right to breach notification. To be notified promptly, and in any case within 60 days, if the Covered Entity or a Business Associate discovers a breach of unsecured PHI concerning the Patient.

CUBE Collective LLC acts as a Business Associate of the Covered Entity when it processes PHI on the Covered Entity's behalf. Our obligations to the Covered Entity are governed by the signed Business Associate Agreement (see /legal/baa), which controls in the event of any inconsistency with the platform's general Terms of Service or Privacy Policy.

The Platform Operator does not use PHI for its own commercial purposes, does not sell PHI, and does not use PHI to train general-purpose machine-learning models (see /legal/ai-disclosure).

A Patient who believes the Covered Entity has violated their privacy rights may file a complaint directly with the Covered Entity's designated HIPAA Privacy Officer, or with the U.S. Department of Health & Human Services, Office for Civil Rights at the address published on hhs.gov. The Covered Entity will not retaliate against a Patient for filing a complaint.

The Covered Entity reserves the right to change this Notice and make the new terms effective for all PHI it maintains. The most recent version will be posted in the Patient Portal and available on request.