Foundry Functional Medicine · Telehealth · Indiana
HIPAA Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We are required by law to maintain the privacy of protected health information, to provide individuals with notice of our legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information. We must follow the privacy practices that are described in this Notice while it is in effect. This Notice takes effect on 07/27/2026 and will remain in effect until we replace it.
We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by applicable law, and to make new Notice provisions effective for all protected health information that we maintain. Because Foundry Functional Medicine LLC is a telehealth practice without a public office, when we make a significant change in our privacy practices we will post the revised Notice prominently on our website at www.foundryfunctionalmedicine.com, make it available through our patient portal, and provide copies upon request.
How you get this Notice
Because we deliver much of our care electronically, we generally provide this Notice to you electronically, automatically and at the time you first request service from us, and we provide it in person when you are seen at our office.
You may request a copy of our Notice at any time. For more information about our privacy practices, or for additional copies of this Notice, please contact us using the information listed at the end of this Notice.
How We May Use and Share Your Health Information
We may use and disclose your health information for different purposes, including treatment, payment, and health care operations. For each of these categories, we have provided a description and an example. Some information, such as HIV-related information, genetic information, alcohol and/or substance abuse records, and mental health records may be entitled to special confidentiality protections under applicable state or federal law. We will abide by these special protections as they pertain to applicable cases involving these types of records. This means that some uses and disclosures that HIPAA would otherwise permit — including for treatment, payment, or health care operations, or without your authorization — are prohibited or materially limited by other applicable law. Where that is the case, we follow the stricter rule. The section on substance use disorder records below explains the most significant example.
Treatment
While we are providing you with health care services, we may share your protected health information (PHI) including electronic protected health information (ePHI) with other health care providers, business associates and their subcontractors or individuals who are involved in your treatment, billing, administrative support or data analysis. These business associates and subcontractors through signed contracts are required by Federal law to protect your health information. We may also disclose medical information about you to people outside of Foundry Functional Medicine LLC who may be involved in your health care. We may disclose your protected health information from time to time to another physician or health care provider (e.g., specialist) who, at the request of your provider, becomes involved in your care by providing assistance with your health care diagnosis or treatment.
Technology we use in your care
In addition, we may use or disclose your protected health information when using technology applications that rely on machine learning and artificial intelligence to support health care treatment, payment, research, and health care operations functions, and as otherwise permitted by applicable law, including HIPAA. Your treatment team may use these technologies, which may include video or audio, to support various aspects of your care, such as tasks like summarizing medical information, automating workflows and processing health data, which may be integrated into standard systems. These tools are designed to enhance decision-making and efficiency but not replace the professional clinical judgment of your health care team.
Telehealth
Because we deliver care both through telehealth and, at times, in person, your PHI — including electronic PHI transmitted and stored through our telehealth and recordkeeping systems — is handled electronically for most purposes.
Payment
We may use and disclose your health information to obtain reimbursement for the treatment and services you receive from us or another entity involved with your care. Payment activities include billing, collections, claims management, and determinations of eligibility and coverage to obtain payment from you, an insurance company, or another third party.
Foundry is a cash-only practice. We do not file claims with health plans and we do not participate in Medicare or Medicaid. In practice, our payment activities are billing and collecting from you. If you ask us for an itemized receipt (a superbill) to submit to your insurer yourself, we will prepare it for you.
Healthcare Operations
We will use and disclose your health information to keep our practice operable. Examples of personnel who may have access to this information include, but are not limited to, our medical records staff, insurance operations, health care clearinghouses and individuals performing similar activities. We may use and disclose your protected health information to tell you about appointments and other matters related to your care, to respond to a customer service inquiry from you, to seek payment for claims for services provided to you, to review provider performance, or in connection with fraud and abuse detection and compliance programs. We may contact you by mail, telephone, text or email. We may leave voice messages at the telephone number you provide, and we may respond to your emails. We may also use and disclose protected health information to tell you about possible treatment options, disease management programs, health-related benefits, new services or alternatives that may be relevant to your health care.
Individuals Involved in Your Care or Payment for Your Care
We may disclose your health information to your family or friends or any other individual identified by you when they are involved in your care or in the payment for your care. Additionally, we may disclose information about you to a patient representative. If a person has the authority by law to make health care decisions for you, we will treat that patient representative the same way we would treat you with respect to your health information. We may disclose such information as necessary for your health care or payment for your health care, if, based on our professional judgment, we determine that it is in your best interest.
Disaster Relief
We may use or disclose your health information to assist in disaster relief efforts.
Required by Law
We may use or disclose your health information when we are required to do so by law. (Court or administrative orders, subpoena, discovery request or other lawful process.) We will use and disclose your information when requested by national security, intelligence and other State and Federal officials and/or if you are an inmate or otherwise under custody of law enforcement.
Substance Use Disorder Records — Extra Protection
Foundry does not provide substance use disorder treatment and does not create SUD treatment records. In limited situations, however, we may receive SUD treatment records about you from a program that is subject to the federal regulations at 42 C.F.R. Part 2 — for example, when we request your records to coordinate your care. Part 2 protects those records more strictly than HIPAA does, and it keeps protecting them after they reach us.
What that means in practice
▪ Part 2 prohibits or materially limits some uses and disclosures of those records that HIPAA would otherwise allow, including for treatment, payment, and health care operations, and including disclosures that would not otherwise need your authorization. Where Part 2 applies, we follow Part 2.
▪ We will not re-disclose a Part 2 record we receive about you except as Part 2 permits — generally, only with your written consent or as Part 2 otherwise specifically allows.
▪ If you give written consent, a single consent can cover future uses and disclosures for treatment, payment, and health care operations, and you may revoke that consent at any time (except to the extent someone has already acted on it).
▪ You have the right to an accounting of disclosures of your Part 2 records, and the right to ask us to restrict how they are used or disclosed.
Legal proceedings
Part 2-protected SUD treatment records (or testimony relaying the content of those records) may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless the disclosure is based on your written consent or a court order that meets Part 2 requirements (including notice and an opportunity to be heard); any such court order must be accompanied by a subpoena or other legal requirement compelling disclosure. A subpoena, search warrant, or other legal demand, standing alone, is not enough.
If you believe your Part 2 rights have been violated, you may complain to us using the contact information at the end of this Notice, or to the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
Other Ways the Law Lets or Requires Us to Share Information
Abuse or Neglect
We may disclose your health information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the possible victim of other crimes. This information will be disclosed only to the extent necessary to prevent a serious threat to your health or safety or that of others. Indiana law also requires us to report suspected child abuse or neglect, and suspected abuse, neglect, or exploitation of an endangered adult.
Public Health Activities
We may disclose your health information for public health activities, including disclosures to:
▪ Prevent or control disease, injury or disability;
▪ Report child abuse or neglect;
▪ Report reactions to medications or problems with products or devices;
▪ Notify a person of a recall, repair, or replacement of products or devices;
▪ Notify a person who may have been exposed to a disease or condition; or
▪ Notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence.
National Security
We may disclose to military authorities the health information of Armed Forces personnel under certain circumstances. We may disclose to authorized federal officials, health information required for lawful intelligence, counterintelligence, and other national security activities. We may disclose to correctional institution or law enforcement official having lawful custody the protected health information of an inmate or patient.
Secretary of HHS
We will disclose your health information to the Secretary of the U.S. Department of Health and Human Services when required to investigate or determine compliance with HIPAA.
Worker’s Compensation
We may disclose your PHI to the extent authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs established by law.
Law Enforcement
We may disclose your PHI for law enforcement purposes as permitted by HIPAA, as required by law, or in response to a subpoena or court order.
Health Oversight Activities
We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections, and credentialing, as necessary for licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Food and Drug Administration
We may disclose your protected health information to a company as required by the Food and Drug Administration for the purpose of quality, safety or effectiveness of FDA-regulated products or activities, which include: to report adverse events, product defects or problems; biologic product deviations; to track products; to enable product recalls; to make repairs or replacements; or to conduct post- marketing surveillance, and/or to respond to inquiries from the manufacturer of medical equipment, all as required.
Judicial and Administrative Proceedings
If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, discovery request, or other lawful process instituted by someone else involved in the dispute, but only if efforts have been made, either by the requesting party or us, to tell you about the request or to obtain an order protecting the information requested.
Research
We may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information.
Coroners, Medical Examiners, and Funeral Directors
We may release your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to enable them to carry out their duties.
Things We Will Not Do Without Your Written Permission
Marketing Health-Related Services
We will not use your health information for marketing purposes unless we have your written authorization to do so. We must obtain your authorization for any marketing communication for which we receive payment from a third party. No authorization is required for a face-to-face communication with you or for a promotional gift of nominal value.
We do not conduct fundraising and will not use your health information to solicit donations.
Sale of PHI
We are prohibited to disclose PHI without an authorization if it constitutes remuneration (getting paid in exchange for the PHI). “Sale of PHI” does not include disclosures for public health, certain research purposes, treatment and payment, and for any other purpose permitted by the Privacy Rule, where the only remuneration received is “a reasonable cost-based fee” to cover the cost to prepare and transmit the PHI for such purpose or a fee otherwise expressly permitted by law. Corporate transactions (i.e., sale, transfer, merger, consolidation) are also excluded from the definition of “sale.” We do not sell your health information.
Psychotherapy notes
Psychotherapy notes, if any exist, will not be used or disclosed without your written authorization, except in the narrow circumstances the law allows.
Appointment Reminders
We may use your health records to remind you of recommended services, treatment or scheduled appointments.
Anything Else
We may disclose and/or share protected health information (PHI) including electronic disclosure with other health care professionals who provide treatment and/or service to you. These professionals will have a privacy and confidentiality policy like this one. Health information about you may also be disclosed to your family, friends and/or other persons you choose to involve in your care, only if you agree that we may do so. Immunization records for students may be released to a school without an authorization if the information disclosed is limited to proof of immunization and we obtain your agreement. If an individual is deceased you may disclose PHI to a family member or individual involved in care or payment prior to death. Psychotherapy notes will not be used or disclosed without your written authorization. Genetic Information Nondiscrimination Act (GINA) prohibits health plans from using or disclosing genetic information for underwriting purposes. Uses and disclosures not described in this notice will be made only with your signed authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
Your Rights
Access
You have the right to look at or get copies of your health information, with limited exceptions. You must make the request in writing. You may obtain a form to request access by using the contact information listed at the end of this Notice. You may also make your request in writing using the contact information at the end of this Notice. If you request information that we maintain on paper, we may provide photocopies. If you request information that we maintain electronically, you have the right to an electronic copy. We will use the form and format you request if readily producible. We will charge you a reasonable cost-based fee for the cost of supplies and labor of copying, and for postage if you want copies mailed to you. Contact us using the information listed at the end of this Notice for an explanation of our fee structure. We will act on your request within 30 days, and we will tell you in writing if we need one 30-day extension. You may also direct us in writing to send a copy of your electronic health record to a person or entity you designate. Where Indiana law limits what a provider may charge for copies of a medical record, we will not exceed that limit, and we will consider reducing or waiving the charge if the cost is a hardship for you.
If you are denied a request for access, you have the right to have the denial reviewed in accordance with the requirements of applicable law.
Disclosure Accounting
With the exception of certain disclosures, you have the right to receive an accounting of disclosures of your health information in accordance with applicable laws and regulations. To request an accounting of disclosures of your health information, you must submit your request in writing to the Privacy Official. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to the additional requests. The accounting covers the six years before your request, and your first accounting in any 12-month period is free.
Right to Request a Restriction
You have the right to request additional restrictions on our use or disclosure of your PHI by submitting a written request to the Privacy Official. Your written request must include (1) what information you want to limit, (2) whether you want to limit our use, disclosure or both, and (3) to whom you want the limits to apply. We are not required to agree to your request except in the case where the disclosure is to a health plan for purposes of carrying out payment or health care operations, and the information pertains solely to a health care item or service for which you, or a person on your behalf (other than the health plan), has paid our practice in full.
Alternative Communication
You have the right to request that we communicate with you about your health information by alternative means or at alternative locations. You must make your request in writing. Your request must specify the alternative means or location, and provide satisfactory explanation of how payments will be handled under the alternative means or location you request. We will accommodate all reasonable requests. However, if we are unable to contact you using the ways or locations you have requested we may contact you using the information we have.
Use of Unsecure Electronic Communications
If you choose to communicate with us via unsecure electronic communication, such as regular email or text message, we may respond to you in the same manner in which the communication was received and to the same email address or account from which you sent your original communication. Before using any unsecure electronic communication to correspond with us, note that there are certain risks, such as interception by others, misaddressed/ misdirected messages, shared accounts, messages forwarded to others or messages stored on unsecured, portable electronic devices. By choosing to correspond with us via unsecure electronic communication, you are acknowledging and agreeing to accept these risks. Additionally, you should understand that use of email is not intended to be a substitute for professional medical advice, diagnosis or treatment. Email communications should never be used in an emergency.
Amendment
You have the right to request that we amend your health information. Your request must be in writing, and it must explain why the information should be amended. We may deny your request under certain circumstances. If we agree to your request, we will amend your record(s) and notify you of such. If we deny your request for an amendment, we will provide you with a written explanation of why we denied it and explain your rights.
Right to Notification of a Breach
It is presumed that any acquisition, access, use or disclosure of PHI not permitted under HIPAA regulations is a breach. We are required to complete a risk assessment, and if necessary, inform HHS and take any other steps required by law. You will be notified of the situation and any steps you should take to protect yourself against harm due to the breach. Indiana law may also require us to notify you and the Indiana Attorney General of a breach of your personal information.
Electronic Notice
You may receive a paper copy of this Notice upon request, even if you have agreed to receive this Notice electronically on our Web site or by electronic mail (e-mail).
Questions and Complaints
If you want more information about our privacy practices or have questions or concerns, please contact us.
If you are concerned that we may have violated your privacy rights, or if you disagree with a decision we made about access to your health information or in response to a request you made to amend or restrict the use or disclosure of your health information or to have us communicate with you by alternative means or at alternative locations, you may complain to us using the contact information listed at the end of this Notice. You also may submit a written complaint to the U.S. Department of Health and Human Services. You may file that complaint with the HHS Office for Civil Rights at 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-800-368-1019, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will also give you the address on request.
We support your right to the privacy of your health information. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.
How to Reach Us
Our Privacy Officer: Bradley Rund, FNP-BC
Telephone: 317-401-6610
Email: bradley@foundryfxmed.com
Website: www.foundryfunctionalmedicine.com
Foundry Functional Medicine LLC · HIPAA Notice of Privacy Practices · Version 4 · Effective 07/27/2026