PRIVACY POLICY
Effective Date: 9.1.2025
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices (“Notice”) describes how protected health information may be used or disclosed by KR Hennessey Ventures, Inc. d/b/a Brabo Payroll (“Brabo”) to carry out treatment, payment, health care operations and for other purposes that are permitted or required by law. This Notice also sets out Brabo’s legal obligations concerning an Individual’s protected health information and describes an Individual’s rights to access, amend, and manage that protected health information.
This Notice has been drafted to be consistent with the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), and all regulations implementing HIPAA including what is known as the HIPAA Privacy Rule (45 C.F.R. 164). Any capitalized terms not defined in this Notice should have the meaning under HIPAA or any applicable regulations including the HIPAA Privacy Rule.
If you have any questions or want additional information about this Notice or the policies and procedures described in this Notice, please contact Service at service@brabopayroll.com, 508-356-8266, 65 Cordage Park circle, Suite 120, Plymouth, MA 02360.
Protected health information (“PHI”) is individually identifiable health information, including demographic information, collected from an individual that (1) is created or received by a health care provider, health plan, employer (when functioning on behalf of the group health plan), or a health care clearinghouse, (2) relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual, and (iii) identifies the individual or there is a reasonable basis to believe the information can be used to identify the individual.
PHI disclosed by Brabo in accordance with this Notice and the HIPAA Privacy Rule may be subject to redisclosure by the recipient of the PHI and no longer protected by the HIPAA Privacy Rule.
BRABO’S RESPONSIBILITIES
Brabo is required by law to maintain the privacy of an Individual’s PHI. Brabo is obligated to provide the Individual with a copy of this Notice of Brabo’s legal duties and of its privacy practices with respect to PHI, abide by the terms of the Notice that is currently in effect, and notify the Individual in the event of a breach of the Individual’s unsecured PHI. Brabo reserves the right to change the provisions of this Notice and make the new provisions effective for all PHI that is maintained. If Brabo makes a material change to this Notice, a revised Notice will be e-mailed to the address that Brabo has on record for each Individual if the Individual has agreed to electronic notice and, if not, be mailed.
When using or disclosing PHI or when requesting PHI from another Covered Entity, Brabo will make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request, taking into consideration practical and technological limitations. However, the minimum necessary standard will not apply in the following situations:
disclosures to or requests by a health care provider for treatment;
uses or disclosures made to the Individual;
disclosures made to the Secretary of the U.S. Department of Health and Human Services;
uses or disclosures that are required by law;
uses or disclosures that are required for compliance with the HIPAA Privacy Rule; and uses or disclosures made pursuant to an authorization.
This Notice does not apply to information that has been de‐identified. De‐identified information is health information that does not identify an Individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an Individual. De-identified information is not individually identifiable health information.
POTENTIAL IMPACT OF STATE LAW
The HIPAA Privacy regulations generally do not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other federal laws, rather than the HIPAA Privacy Regulations, might impose a privacy standard under which Brabo will be required to operate. For example, where such laws have been enacted, Brabo will follow more stringent state privacy laws that relate to uses and disclosures of PHI concerning HIV or AIDS, mental health, substance abuse/chemical dependency, genetic testing, reproductive rights, etc.
PERMITTED USES AND DISCLOSURES
Brabo is permitted to use and/or disclose PHI as follows.
TREATMENT, PAYMENT, OR HEALTH CARE OPERATIONS
Brabo may use and disclose PHI for its own treatment, payment, or health care operations and disclose PHI for treatment activities of a health care provider, to another Covered Entity or health care provider for payment activities, and to another Covered Entity for health care operations activities under certain circumstances described in the HIPAA Privacy Rule.
TREATMENT
Brabo may use or disclose PHI so that an Individual may seek treatment. Treatment is the provision, coordination or management of health care and related services. It also includes, but is not limited to, consultations and referrals between one or more of an Individual’s providers. For example, Brabo may disclose to a treating specialist the name of an Individual’s primary care physician so that the specialist may request medical records from that primary care physician.
PAYMENT
Brabo may use or disclose PHI (i) to obtain payment for services provided to an Individual, (ii) to perform utilization review activities, (iii) to review health care services with respect to coverage under a health plan, (iv) for claims management, (v) for collection activities, (vi) for billing, and (vii) for related health care data processing. For example, Brabo may disclose PHI when a provider requests information regarding an Individual’s eligibility for coverage under a health plan or Brabo may use PHI to process a claim for coverage with the Individual’s health plan.
HEALTH CARE OPERATIONS
Brabo may use or disclose PHI to support its business functions. These functions include, but are not limited to, quality assessment and improvement, reviewing provider performance, licensing, other activities related to the creation, renewal, or replacement of a contract of health insurance of health benefits, business planning and business development. For example, Brabo may use or disclose PHI: (1) to provide an Individual with information about a disease management program; (2) to respond to a customer service inquiry from an Individual or (3) in connection with fraud and abuse detection and compliance programs.
OTHER PERMISSIBLE USES AND DISCLOSURES OF PHI
The following is a description of other possible ways in which Brabo may (and is permitted to) use and/or disclose PHI.
REQUIRED BY LAW
Brabo may use or disclose PHI to the extent the law requires the use or disclosure. When used in this Notice, “required by law” means as required by the HIPAA Privacy Rule. For example, Brabo may disclose PHI when required by national security laws or public health disclosure laws.
PUBLIC HEALTH ACTIVITIES
Brabo may use or disclose PHI for public health activities that are permitted or required by law. For example, Brabo may use or disclose PHI for the purpose of preventing or controlling disease, injury, or disability, or it may disclose such information to a public health authority authorized to receive reports of child abuse or neglect. Brabo also may disclose PHI, if directed by a public health authority, to a foreign government agency that is collaborating with the public health authority.
ABUSE OR NEGLECT
Brabo may disclose PHI to a government authority that is authorized by law to receive reports of abuse, neglect, or domestic violence. Additionally, as required by law, Brabo may disclose to a governmental entity, authorized to receive such information, PHI if there is reason to believe that the Individual has been a victim of abuse, neglect, or domestic violence.
HEALTH OVERSIGHT ACTIVITIES
Brabo may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure or disciplinary actions, or civil, administrative, or criminal proceedings or actions. Oversight agencies seeking this information include government agencies that oversee (1) the health care system,
(2) government benefit programs, (3) other government regulatory programs, and (4) compliance with civil rights laws.
LEGAL PROCEEDINGS
Brabo may disclose PHI (1) in the course of any judicial or administrative proceeding, (2) in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and (3) in response to a subpoena, a discovery request, or other lawful process, once Brabo has met all administrative requirements of the HIPAA Privacy Rule. For example, Brabo may disclose PHI in response to a subpoena for such information, but only after first meeting certain conditions required by the HIPAA Privacy Rule.
LAW ENFORCEMENT
Under certain conditions, Brabo may disclose PHI to law enforcement officials. For example, some of the reasons for such a disclosure may include, but not be limited to: (1) it is required by law or some other legal process; (2) it is necessary to locate or identify a suspect, fugitive, material witness, or missing person; or (3) it is necessary to provide evidence of a crime that occurred on the premises of the Covered Entity.
CORONERS, MEDICAL EXAMINERS, FUNERAL DIRECTORS, AND ORGAN DONATION ORGANIZATIONS
Brabo may disclose PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or for the coroner or medical examiner to perform other duties authorized by law. Brabo may also disclose, as authorized by law, information to funeral directors so that they may carry out their duties. Further, Brabo may disclose PHI to organizations that handle organ, eye or tissue donation and transplantation.
RESEARCH
Brabo may disclose PHI to researchers when an institutional review board or privacy board has (1) reviewed the research proposal and established protocols to ensure the privacy of the information and (2) approved the research.
TO PREVENT A SERIOUS THREAT TO HEALTH OR SAFETY
Consistent with applicable federal and state laws, Brabo may disclose PHI if there is reason to believe that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Brabo may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an Individual in certain circumstances.
MILITARY ACTIVITY, NATIONAL SECURITY, AND PROTECTIVE SERVICES
Under certain conditions, Brabo may disclose PHI if an Individual is, or was, Armed Forces personnel for activities deemed necessary by appropriate military command authorities. If an Individual is a member of foreign military service, Brabo may disclose, in certain circumstances, PHI to the foreign military authority. Brabo may also disclose PHI to authorized federal officials for conducting national security and intelligence activities, and for the protection of the President, other authorized persons, or heads of state.
INMATES
If an Individual is an inmate of a correctional institution, Brabo may disclose PHI to the correctional institution or to a law enforcement official for (1) the institution to provide health care to the Individual, (2) the Individual’s health and safety or the health and safety of others, or (3) the safety and security of the correctional institution.
WORKERS’ COMPENSATION
Brabo may disclose PHI to comply with workers’ compensation laws and other similar programs that provide benefits for work‐related injuries or illnesses.
FUNDRAISING ACTIVITIES
Brabo may use or disclose certain PHI for fundraising activities, such as raising money for a charitable foundation or similar entity to help finance its activities with certain conditions. If Brabo does contact the Individual for fundraising activities, Brabo will give the Individual the opportunity to opt‐out or stop receiving such communications in the future.
GROUP HEALTH PLAN DISCLOSURES
Brabo may disclose the PHI of an Individual to a sponsor of the group health plan – such as an employer or other entity – that is providing a health care program to the Individual. Brabo can disclose the PHI of the Individual to that entity if that entity has contracted with Brabo to administer the Individual’s health care program on its behalf.
EMERGENCY SITUATIONS
Brabo may disclose PHI in an emergency situation, or if the Individual is incapacitated or not present, to a family member, close personal friend, authorized disaster relief agency, or any other person previous identified by the Individual. Brabo will use professional judgment and experience to determine if the disclosure is in the best interests of the Individual. If the disclosure is in the best interest of the Individual, Brabo will disclose only the PHI that is directly relevant to the person’s involvement in the care of the Individual.
OTHERS INVOLVED IN YOUR HEALTH CARE
Brabo may disclose PHI to a family member, other relative, close personal friend, or other personal representative that the Individual identifies if Brabo determines in the exercise of professional judgment that the Individual does not object to the disclosure. If an Individual is not present or able to agree to these disclosures of PHI, then, using its professional judgment, Brabo may determine whether the disclosure is in the Individual’s best interest. Such use will be based on how involved the person is in the Individual’s care or in the payment that relates to that care. Brabo may release information to parents or guardians, if allowed by law.
BUSINESS ASSOCIATES
Brabo may contract with persons and entities (Business Associates) to perform various functions on its behalf or to provide certain types of services. To perform these functions or to provide the services, the Business Associates will receive, create, maintain, use or disclose PHI, but only after Brabo requires the Business Associates to agree in writing to contract terms designed to appropriately safeguard PHI. For example, Brabo may disclose PHI to a Business Associate to administer claims or to provide service support or utilization management. Examples of Brabo’s Business Associates would be its third party administrator or broker.
REQUIRED DISCLOSURES OF PHI
The following is a description of disclosures that Brabo is required by law to make.
DISCLOSURES TO THE SECRETARY OF THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES
Brabo is required to disclose PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining Brabo’s compliance with HIPAA.
DISCLOSURES TO AN INDIVIDUAL
Brabo is required to disclose to an Individual most of the PHI in a “designated record set” when the Individual requests access to this information. Generally, a designated record set contains medical and billing records, as well as other records that are used to make decisions about an Individual’s health care benefits. Brabo also is required to provide, upon the Individual’s request, an accounting of most disclosures of PHI that are for reasons other than treatment, payment and health care operations and are not disclosed through a signed authorization.
Brabo will disclose PHI to a person who has been designated by an Individual as his/her personal representative and who has qualified for such designation in accordance with relevant state law. However, before Brabo will disclose PHI to such a person, the person must submit a written notice of his designation, along with the documentation that supports his/her qualification (such as a power of attorney).
Even if the Individual designates a personal representative, the HIPAA Privacy Rule permits Brabo to elect not to treat that individual as the Individual’s personal representative if a reasonable belief exists that: (1) the Individual has been, or may be, subjected to domestic violence, abuse or neglect by such person; (2) treating such person as his personal representative could endanger the Individual, or (3) Brabo determines, in the exercise of its professional judgment, that it is not in its best interest to treat that individual as the Individual’s personal representative.
OTHER COVERED ENTITIES
Brabo may use or disclose PHI to assist health care providers in connection with their treatment or payment activities or to assist another Covered Entity in connection with payment activities and certain health care operations. For example, Brabo may disclose PHI to a health care provider when needed by the provider to render treatment to an Individual, and Brabo may disclose PHI to another Covered Entity to conduct health care operations in the areas of fraud and abuse detection or compliance, quality assurance and improvement activities, accreditation, certification, licensing, or credentialing. This also means that Brabo may disclose or share PHI with insurance carriers in order to coordinate benefits if an Individual has coverage through another carrier.
PLAN SPONSOR
Brabo may disclose PHI to a plan sponsor of the group health plan for purposes of plan administration or pursuant to an authorization request signed by the Individual. Also, Brabo may use or disclose “summary health information” to plan sponsor for obtaining premium bids or modifying, amending or terminating the group health plan. Summary health information summarizes the claims history, claims expenses or types of claims experienced by an Individual for whom a plan sponsor has provided health benefits under a group health plan and from which identifying information has been deleted in accordance with the HIPAA Privacy Rule.
PROHIBITED USES AND DISCLOSURES
SALE OF PHI
Brabo may not sell PHI if Brabo directly or indirectly receives remuneration from on or behalf of the recipient of the PHI in exchange for the PHI without written authorization from the Individual.
REPRODUCTIVE HEALTH CARE
Brabo may not use or disclose PHI to conduct a criminal, civil, or administrative investigation or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care. Brabo may not use or disclose PHI potentially related to reproductive health care for health oversight, judicial and administrative proceeds, law enforcement purposes, and to coroners or medical examiners without a valid attestation from the person requesting the use or disclosure in compliance with applicable law.
USES AND DISCLOSURES OF PHI THAT REQUIRE AN INDIVIDUAL’S AUTHORIZATION
The following uses and disclosures require an authorization from the Individual. Other uses and disclosures of PHI that are not described in this Notice will be made only with an Individual’s written authorization. If the Individual provides Brabo with such an authorization, he/she may revoke the authorization in writing, and this revocation will be effective for future uses and disclosures of PHI. However, the revocation will not be effective for information that has already been used or disclosed, relying on the authorization.
SALE OF PHI
Brabo will request the written authorization of an Individual before Brabo makes any disclosure that is deemed a sale of PHI meaning that Brabo is receiving compensation for disclosing the PHI in this manner.
MARKETING
Brabo will request the written authorization of an Individual to use or disclose the PHI for marketing purposes with limited exceptions, such as when Brabo has face‐to‐ face marketing communications with the Individual or when Brabo provides promotional gifts of nominal value.
PSYCHOTHERAPY NOTES
Brabo will request the written authorization of an Individual to use or disclose any of the Individual’s psychotherapy notes that Brabo may have on file with limited exception, such as for certain treatment, payment or health care operation functions.
AN INDIVIDUAL’S RIGHTS
The following is a description of an Individual’s rights with respect to PHI:
RIGHT TO REQUEST A RESTRICTION
An Individual has the right to request a restriction on the PHI Brabo uses or discloses about him/her for treatment, payment or health care operations. Brabo is not required to agree to any restriction that an Individual may request. If Brabo does agree to the restriction, it will comply with the restriction unless the information is needed to provide emergency treatment.
An Individual may request a restriction by contacting the person(s) or office identified at the beginning of this Notice. It is important that the Individual directs his/her request for restriction to the contact information in this Notice so that Brabo can begin to process the request. Requests sent to individuals or offices other than the one indicated might delay processing the request.
Brabo requires that the request be in writing and include (1) the PHI the Individual wants to limit and (2) how he/she wants to limit Brabo’s use and/or disclosure of the PHI.
RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS
If an Individual believes that a disclosure of all or part of his/her PHI may endanger him/her, that Individual may request that Brabo communicates with him/her regarding PHI in an alternative manner or at an alternative location. For example, the Individual may ask that Brabo only contact the Individual at a work address or via the Individual’s work e‐mail.
The Individual may submit a request for confidential communications by contacting the person(s) or office identified at the beginning of this Notice. It is important that the Individual directs his/her request to the contact information in this Notice so that Brabo can begin to process the request. Requests sent to individuals or offices other than the one indicated might delay processing the request.
Brabo requires that the request be in writing and include (1) that the Individual wants Brabo to communicate his/her PHI in an alternative manner or at an alternative location and (2) that the disclosure of all or part of this PHI in a manner inconsistent with these instructions would put the Individual in danger.
Brabo will accommodate a request for confidential communications that is reasonable and that states that the disclosure of all or part of an Individual’s PHI could endanger that Individual. As permitted by the HIPAA Privacy Rule, “reasonableness” will (and is permitted to) include, when appropriate, making alternate arrangements regarding payment.
Accordingly, as a condition of granting an Individual’s request, he/she will be required to provide Brabo information concerning how payment will be handled. Once Brabo receives all the information for such a request (along with the instructions for handling future communications), the request will be processed usually within 2 business days or as soon as reasonably possible.
Prior to receiving the information necessary for this request, or during the time it takes to process it, PHI may be disclosed. Therefore, it is extremely important that the Individual contact the person(s) or office identified at the beginning of this Notice as soon as the Individual determines the need to restrict disclosures of PHI.
If the Individual terminates the request for confidential communications, the restriction will be removed for all of the Individual’s PHI that Brabo holds, including PHI that was previously protected. Therefore, an Individual should not terminate a request for confidential communications if that person remains concerned that disclosure of PHI will endanger him/her
.
RIGHT TO INSPECT AND COPY
An Individual has the right to inspect and copy PHI that is contained in a “designated record set” subject to certain exceptions. However, the Individual may not inspect or copy psychotherapy notes or certain other information that may be contained in a designated record set in accordance with the HIPAA Privacy Rule.
To inspect and copy PHI that is contained in a designated record set, the Individual must submit a request by contacting the person(s) or office identified at the beginning of this Notice. It is important that the Individual directs his/her request to inspect and copy to the contact information in this Notice so that Brabo can begin to process the request. Requests sent to individuals or offices other than the one indicated might delay the processing of the request. If the Individual requests a copy of the information, Brabo may charge a fee for the costs of copying, mailing, or other supplies associated with that request.
Brabo may deny an Individual’s request to inspect and copy PHI in certain limited circumstances. If an Individual is denied access to information, he/she may request that the denial be reviewed. To request a review, the Individual must contact the person(s) or office identified at the beginning of this Notice. A licensed health care professional chosen by Brabo will review the Individual’s request and the denial. The person performing this review will not be the same one who denied the Individual’s initial request. Under certain conditions, Brabo’s denial will not be reviewable. If this event occurs, Brabo will inform the Individual through the denial that the decision is not reviewable.
RIGHT TO AMEND
If an Individual believes that his PHI is incorrect or incomplete, he/she may request that Brabo amend that information. The Individual may request that Brabo amend such information by contacting the person(s) or office identified at the beginning of this Notice. The request should include the reason the amendment is necessary. It is important that the Individual directs his/her request for amendment to the contact information in this Notice so that Brabo can begin to process the request. Requests sent to individuals or offices other than the one indicated might delay processing the request.
In certain cases, Brabo may deny the Individual’s request for an amendment. For example, Brabo may deny the request if the information the Individual wants to amend is not maintained by Brabo, but by another entity. If Brabo denies the request, the Individual has the right to file a statement of disagreement with Brabo. This statement of disagreement will be linked with the disputed information and all future disclosures of the disputed information will include this statement.
RIGHT OF AN ACCOUNTING
The Individual has a right to an accounting of certain disclosures of PHI made by Brabo other than disclosures to carry out treatment, payment, or health care operations. No accounting of disclosures is required for disclosures made pursuant to a signed authorization by the Individual or his personal representative. The Individual should know that most disclosures of PHI will be for purposes of payment or health care operations, and, therefore, will not be subject to this right. There also are other exceptions to this right. An accounting will include the date(s) of the disclosure, to whom Brabo made the disclosure, a brief description of the information disclosed, and the purpose for the disclosure.
An Individual may request an accounting by submitting a request in writing to the person(s) or office identified at the beginning of this Notice. It is important that the Individual directs the request for an accounting to the contact information in this Notice so that Brabo can begin to process the request. Requests sent to individuals or offices other than the one indicated might delay processing the request.
An Individual’s request may be for disclosures made up to 6 years before the date of the request. The first list requested within a 12‐ month period will be free. For additional lists, Brabo may charge for the costs of providing the list. Brabo will notify the Individual of the cost involved and he/she may choose to withdraw or modify the request before any costs are incurred.
RIGHT TO A COPY OF THIS NOTICE
The Individual has the right to request a copy of this Notice at any time by contacting the person(s) or office identified at the beginning of this Notice. If you receive this Notice on Brabo’s website or by electronic mail, you also are entitled to request a paper copy of this Notice.
COMPLAINTS
An Individual may complain to Brabo if he/she believes that Brabo has violated these privacy rights. The Individual may file a complaint with Brabo by contacting the person(s) identified at the beginning of this Notice. A copy of a complaint form is available from this contact office.
An Individual also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. Complaints filed directly with the Secretary must (1) be in writing, (2) contain the name of the entity against which the complaint is lodged, (3) describe the relevant problems, and (4) be filed within 180 days of the time the Individual became or should have become aware of the problem.
Brabo will not penalize or in any other way retaliate against an Individual for filing a complaint with the Secretary or with Brabo.