HealthPoint Privacy Policy and Notice of Privacy Practices
Effective Date: March 1, 2026
About This Notice
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices describes how HealthPoint may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or health care operations, and for other purposes permitted or required by law. It also describes your rights to access and control your protected health information.
We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and other applicable federal and state privacy laws to maintain the privacy of your health information and to provide you with this notice of our legal duties and privacy practices.
HealthPoint applies the HIPAA 'minimum necessary' standard and limits uses and disclosures of PHI to the minimum amount necessary to accomplish the intended purpose, except where otherwise permitted or required by law.
What is Protected Health Information (PHI)?
Protected Health Information is information about you—including demographic information—that may identify you and relates to your past, present, or future physical or mental health or condition and related health care services.
Certain substance use disorder (SUD) treatment records may be subject to additional federal confidentiality protections under 42 CFR Part 2 beyond HIPAA requirements, which are described in this notice.
How We May Use and Disclose Your Health Information
Treatment: We may use and disclose your PHI to provide, coordinate, or manage your health care and related services.
Payment: We may use and disclose your PHI as needed to obtain payment for health care services provided to you.
Healthcare Operations: We may use or disclose your PHI to support quality improvement, compliance, training, accreditation, and other business activities necessary to operate our practice.
Uses and Disclosures Requiring Your Written Authorization
Other uses and disclosures of your PHI not described in this notice will be made only with your written authorization, including:
- Most uses and disclosures of psychotherapy notes
- Marketing communications (unless face-to-face or involving nominal promotional gifts)
- Sale of PHI
You may revoke any authorization in writing at any time, except to the extent that we have already taken action in reliance upon your authorization.
Your Privacy Rights
You have the right to:
Inspect and copy your health information
- Request an amendment
- Request restrictions on certain uses and disclosures
- Request confidential communications by alternative means or locations
- Receive an accounting of certain disclosures
- Receive a paper copy of this Notice
- Be notified in the event of a breach of your unsecured PHI
Special Protections for Substance Use Disorder (SUD) Records
Records relating to substance use disorder diagnosis, treatment, or referral are protected under 42 CFR Part 2 and cannot be disclosed without your written consent except as specifically permitted by those regulations.
SMS Text Message Communications
HealthPoint may use SMS text messaging for certain communications, subject to consent and regulatory requirements.
Clinical Messaging (HIPAA-Compliant Platforms)
For clinical communications containing PHI, HealthPoint uses HIPAA-compliant platforms covered by Business Associate Agreements, including Phreesia and CareMessage.
While SMS messaging may involve inherent security risks, these platforms are configured to meet HIPAA security standards. By opting in, you acknowledge and accept these risks for convenience.
Clinical messaging complies with applicable provisions of the Telephone Consumer Protection Act (TCPA) and applicable healthcare-related exemptions.
Non-Clinical Employment SMS Communications
HealthPoint may use SMS messaging (including RingCentral or similar platforms) for employment-related communications such as interview scheduling and HR notifications.
Applicants opt in by providing a mobile phone number in their resume or employment application materials and acknowledging consent to receive employment-related SMS communications.
Message frequency varies. Message and data rates may apply.
Reply STOP to opt out or HELP for assistance.
Consent to receive SMS messages is not a condition of employment.
HealthPoint registers applicable SMS campaigns in accordance with The Campaign Registry (TCR) requirements and complies with 10DLC registration obligations.
No mobile opt-in data or consent information will be shared with third parties for marketing purposes. Information may be shared only with service providers supporting message delivery or as required by law.
Changes to This Notice
We reserve the right to change the terms of this Notice and make the new provisions effective for all PHI we maintain. Updated versions will be posted and made available upon request.
Questions and Complaints
If you believe your privacy rights have been violated, you may contact:
Privacy Officer
HealthPoint
1602 Rock Prairie Road, Suite 300
College Station, TX 77845
Phone: (979) 695-3400
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.
Document Version: 1.1
Last Revised: March 2, 2026
Next Review Date: March 1, 2027
