HIPAA Notice of Privacy Practices

About This Notice

This Notice of Privacy Practices describes how Pause Health PLLC, doing business as Rubi Health (“Rubi Health,” “we,” “us,” or “our”), may use and disclose your Protected Health Information (PHI), and describes your rights with respect to that information. We are required by law to maintain the privacy of your PHI and to provide you with this Notice.

PHI is individually identifiable health information — including demographic information — that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or the past, present, or future payment for the provision of health care.

We are required to abide by the terms of this Notice while it is in effect. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain as well as PHI we receive in the future.

---

How We May Use and Disclose Your Health Information

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your medical care. Example: Your provider reviews your health history, lab results, and previous visit notes to develop your treatment plan. We may share relevant information with your pharmacy to process a prescription or with a laboratory to process a lab order.

Payment

We may use and disclose your PHI to facilitate payment for the services you receive. Example: We generate a visit receipt or superbill documenting your care, which you may submit to your health insurance plan for potential reimbursement. As a cash-pay practice, we do not submit claims to insurance on your behalf, but we may document visit information to prepare superbills at your request.

Health Care Operations

We may use and disclose your PHI for our internal health care operations, including quality assurance, staff training, compliance activities, and business management. Example: We review patient care records to evaluate the quality of care we provide and ensure clinical standards are met.

Business Associates

We share PHI with vendors and service providers (“business associates”) that help us operate our practice, including AthenaHealth (patient portal, scheduling, and electronic health records) and our clinical messaging platform. Business associates are required by law and by written agreement to protect the privacy and security of your PHI and to use it only as permitted.

Other Permitted Disclosures

We may also use or disclose your PHI without your authorization in the following circumstances, as permitted or required by law:

• As required by law — when mandated by federal, state, or local law
• Public health activities — to report communicable diseases, births, deaths, or suspected abuse or neglect
• Health oversight activities — to government agencies for audits, inspections, or licensure review
• Judicial and administrative proceedings — in response to a court order, subpoena, or discovery request
• Law enforcement — as permitted by law to law enforcement officials
• Serious threats to health or safety — when necessary to prevent a serious and imminent threat to you or others
• Coroners and medical examiners — as necessary to identify a decedent or determine cause of death
• Research — with appropriate privacy protections in place and, where required, your written authorization
• Workers’ compensation — as authorized and necessary under applicable workers’ compensation laws

---

Uses and Disclosures That Require Your Written Authorization

All uses and disclosures of your PHI not described above require your prior written authorization, including:

• Use of your PHI for marketing purposes
• Sale of your PHI
• Most disclosures of psychotherapy notes
• Any other purpose not described in this Notice

You may revoke a written authorization at any time by notifying us in writing, except to the extent we have already acted in reliance on it.

Your Rights

Right to Access Your Health Information

You have the right to inspect and receive a copy of the PHI we use to make decisions about your care, including the right to receive an electronic copy. We may charge a reasonable, cost-based fee. To request access, submit a request through your AthenaHealth patient portal or contact us in writing at the address below.

Right to Request Amendment

If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny your request in limited circumstances — for example, if the information is accurate and complete, or was not created by us. Denied requests will be explained in writing.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we have made of your PHI during the six years prior to your request, other than disclosures for treatment, payment, health care operations, and certain other exceptions. We may charge a reasonable fee for requests made more than once in a 12-month period.

Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. We are not always required to agree, but if we do, we will honor that restriction. Exception: if you pay for a service entirely out of pocket and ask us not to share that information with a health plan, we are required by law to honor that request.

Right to Request Confidential Communications

You may request that we contact you in a specific way or at a specific location — for example, through your patient portal only. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. Contact us at the information below.

Right to Be Notified of a Breach

If your unsecured PHI is involved in a breach, we are required by law to notify you in the manner and timeframe required by HIPAA.

How to Exercise Your Rights

To exercise any of the rights described above, submit a request through your AthenaHealth patient portal or contact us in writing at the address below. We will respond within the timeframes required by law.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of Privacy Practices
• Follow the terms of the Notice currently in effect
• Notify you in the event of a breach of your unsecured PHI
• Not use or disclose your PHI in ways not described in this Notice without your written authorization
• Not retaliate against you for exercising your rights or filing a complaint

---

Changes to This Notice

We reserve the right to change this Notice at any time. Changes may apply to PHI we already hold. The current version is always available on our website and will be provided to you at the start of care or upon request.

---

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

---

Contact Us

For questions about this Notice or to exercise your rights, contact us at:

Effective Date: June 29, 2026  ·  Last Reviewed: June 29, 2026