Privacy Policy

We may collect information about your location when you access or use our website or services. When you use our website in connection with health care services, treatment, payment, or health plan operations, your location information may constitute protected health information (“PHI”) or electronic protected health information (“ePHI”) subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”). This clause describes our collection, use, and disclosure of location information that may be PHI.

1. Types of Location Information. We may collect:
   1. Approximate Location. We may derive your approximate location from your IP address, which provides general information about your city, state, or region.
   2. Precise Location. Only with your express authorization, we may collect precise location data from GPS, wireless networks, cell towers, Bluetooth signals, or other location-enabled services on your device.
2. Collection Methods. Location information may be collected through:
   1. IP address analysis when you visit our website.
   2. Device settings and sensors, including GPS functionality, only if enabled and expressly authorized by you.
   3. Wi-Fi access points and cellular network information detected by your device, with your permission.
   4. Information you provide directly, such as entering a location in a search field or form.
3. Permitted Uses and Disclosures. We will use and disclose location information that is PHI only as permitted or required by HIPAA, including:
   1. Treatment. To provide, coordinate, or manage your health care and related services, including referrals and consultations.
   2. Payment. To obtain payment or reimbursement for health care services provided to you, including eligibility verification and claims processing.
   3. Health Care Operations. To support our business functions such as quality assessment, care coordination, case management, population health management, fraud and abuse detection and compliance, and business planning and development.
   4. Required by Law. When we are required by federal, state, or local law to disclose location information.
   5. Authorized by You. For purposes you specifically authorize in writing, including any uses or disclosures described in a separate written authorization you provide.
   6. Other HIPAA-Permitted Purposes. For public health activities, health oversight, judicial and administrative proceedings, law enforcement purposes, research (with appropriate authorizations or waivers), to avert serious threats to health or safety, and other purposes permitted under 45 C.F.R. §§ 164.510, 164.512.
4. Minimum Necessary Standard. Except where otherwise required by law or for treatment purposes, we will limit the collection, use, and disclosure of location information to the minimum necessary to accomplish the intended purpose.
5. No Sale of PHI; Marketing Restrictions. We will not sell your location information if it constitutes PHI. We will not use or disclose location information that is PHI for marketing purposes without your prior written authorization, except as permitted by HIPAA for refill reminders or communications about health-related products or services we currently provide.
6. Safeguards. We implement administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of location information that is ePHI, in compliance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). These safeguards include encryption, access controls, audit logs, and secure transmission protocols.
7. Business Associates and Service Providers. We may disclose location information that is PHI to our business associates and service providers who perform functions on our behalf or assist us in providing services to you. All such business associates are required to enter into written agreements obligating them to safeguard your PHI and use or disclose it only as permitted by HIPAA and the business associate agreement.
8. User Permissions and Controls.
   1. Authorization for Precise Location. We will collect precise location data (GPS or similar sensor-based location) only after obtaining your express written authorization that complies with HIPAA requirements (45 C.F.R. § 164.508) when such information is PHI and the collection is for a purpose requiring authorization.
   2. Device-Level Controls. You may enable or disable location services through your device’s settings. Disabling location services will prevent collection of precise location data from GPS and similar sensors.
   3. Browser Settings. Most web browsers allow you to control location permissions. You may accept or deny location access requests when prompted.
   4. Right to Revoke Authorization. If you have provided written authorization for use or disclosure of location information, you may revoke that authorization at any time by submitting a written revocation to compliance@flournoyhealthsystems.org. Revocation will not affect uses or disclosures we made in reliance on your authorization before we received your revocation.
   5. Impact of Declining Location Services. If you decline to permit location data collection, certain features or functionality of our website or services that depend on location information may not be available or may be limited. We will not condition treatment, payment, enrollment, or eligibility for benefits on your provision of an authorization for use or disclosure of location information, except in limited circumstances permitted by HIPAA.
9. Notice of Privacy Practices. This clause supplements our Notice of Privacy Practices, which provides additional detail about how we collect, use, and disclose PHI, and describes your rights under HIPAA. You may review our current Notice of Privacy Practices at [WEBSITE URL] or request a paper copy by contacting compliance@flournoyhealthsystems.org.
10. Retention. We retain location information only as long as necessary to fulfill the purposes described in this clause and our Notice of Privacy Practices, or as required by law. Our retention practices comply with HIPAA’s requirements and Georgia law governing medical records retention.
11. Breach Notification. In the event of a breach of unsecured location information that is PHI, we will provide notice to you and, where required, to the Secretary of the U.S. Department of Health and Human Services and the media, in accordance with the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D).
12. Your HIPAA Rights. You have rights under HIPAA with respect to location information that is PHI, including the right to access, amend, receive an accounting of disclosures, request restrictions, request confidential communications, and file a complaint. These rights are described in detail in our Notice of Privacy Practices.