HIPAA Notice of Privacy Practices (NPP)

This Notice describes how medical information about you may be used and disclosed, and how you can access this information. Please review carefully.

Our Duty to Protect Your Health Information

Summit Cardiac is committed to protecting the privacy of your protected health information (PHI). PHI includes any information that identifies you and relates to your past, present, or future physical or mental health condition, the care you have received, or payment for that care. We are required by federal law (the Health Insurance Portability and Accountability Act, or HIPAA) to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, and follow the terms currently in effect.

Permitted Uses and Disclosures of Your PHI

We may use and disclose your PHI for the following purposes without your written authorization:

• Treatment — to provide, coordinate, or manage your cardiac recovery care, including communication with your cardiologist, hospital discharge team, and other clinicians involved in your care.
• Payment — to obtain payment for services, including communications with private-pay billing arrangements, HSA/FSA administrators, or long-term-care insurers you have designated.
• Healthcare operations — for quality assessment, training, and the clinical oversight activities necessary to run a safe, evidence-based program.
• Required by law — when required by federal, state, or local law.
• Public health and safety — to prevent or lessen a serious and imminent threat to your health or safety, or that of the public.

Your Rights as a Patient

• Right to access — request to inspect and obtain a copy of your PHI.
• Right to amend — request correction of your PHI if you believe it is inaccurate or incomplete.
• Right to an accounting of disclosures — request a list of certain disclosures we have made of your PHI.
• Right to request restrictions — ask us to limit how we use or disclose your PHI for treatment, payment, or operations.
• Right to confidential communications — request that we contact you at a specific number or address.
• Right to a copy of this Notice — request a paper copy of this Notice at any time.

Our Duties

We are required by law to maintain the privacy of your PHI, provide you with this Notice, follow the terms currently in effect, and notify you if we are unable to fulfill a request you have made regarding your rights. We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain — including information created or received before the changes were made. When we make a material change, we will update the "Last Updated" date above and notify active patients within 60 days.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact below, or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not face retaliation for filing a complaint.

To Request a Copy

To request a paper copy of this Notice, ask questions about its contents, or exercise any of the rights listed above, contact our Privacy Officer using the details below.

Telehealth Consent

Summit Cardiac's recovery program includes both in-home visits by a registered nurse and remote (telehealth) services. By submitting a patient inquiry, referral, or by participating in our program, you acknowledge and consent to the following:

Scope of Telehealth Services

• Synchronous telehealth — real-time audio and/or video check-ins between you and your Summit Cardiac nurse.
• Asynchronous telehealth — secure messaging, photo and document sharing, and review of recorded vital signs between scheduled visits.
• Remote monitoring devices — clinical-grade equipment deployed in your home may transmit recorded data (including cardiac rhythm, blood pressure, oxygen saturation, and weight) to your care team. Equipment in current use includes the KardiaMobile 6L (single-lead ECG), Welch Allyn ProBP 3400 (blood pressure), and Masimo MightySat (pulse oximeter).

Limitations — Emergencies

Telehealth is not for emergencies. If you experience chest pain, sudden shortness of breath, fainting, sudden weakness or numbness, severe bleeding, or any other life-threatening symptom, call 911 immediately or go to the nearest emergency department. Do not wait for a Summit Cardiac check-in. Once you are safe, please notify our team so we can coordinate with your hospital and cardiologist.

Voluntary Participation

Participation in telehealth is voluntary. You may decline any telehealth interaction, request an in-home visit instead, or withdraw your consent entirely at any time by notifying our Privacy Officer in writing. Your continued care will not be conditioned on agreeing to telehealth.

Other Acknowledgments

• Telehealth interactions will be documented in your clinical record just like in-person visits.
• Technical failures may occasionally interrupt a session; if this occurs, your nurse will reschedule or follow up by phone.
• Telehealth services are delivered within the State of California. If you relocate outside California during your program, we will refer you to a comparable in-home program in your new service area.

Patient Disclosures

The disclosures below describe Summit Cardiac's clinical scope, business model, and relationships — so you can make an informed decision before submitting information.

Payment Model — Private Pay

Summit Cardiac is a private-pay service. We do not bill Medicare, Medi-Cal, or any commercial insurance carrier. This is an intentional choice: it allows us to maintain the one-nurse-per-patient model and the visit frequency that clinical outcomes require, rather than what insurance will reimburse. Many patients use HSA/FSA funds or long-term-care insurance to cover program costs; some submit their Summit Cardiac receipts to their insurer for partial reimbursement — eligibility depends on your specific plan.

Not a Provider Network or Staffing Agency

Summit Cardiac does not bill hospital systems, is not a hospital-owned entity, and is not a staffing agency. We are an independent, nurse-led clinical service. We do not hold an agency relationship with any hospital, cardiology group, or discharge-planning team that refers patients to us. After enrollment, your Summit Cardiac nurse communicates with your cardiologist and discharge planner as a clinical courtesy — but the care plan is independently developed and delivered by Summit Cardiac.

Clinical Scope

Summit Cardiac's clinical scope is limited to post-hospital cardiac recovery management in Greater Los Angeles (Westwood, Brentwood, Beverly Hills, Santa Monica, Pacific Palisades, Malibu, Calabasas, Encino, Tarzana, Woodland Hills, and the surrounding LA communities). We are not a 24/7 hospital service, we do not provide primary cardiac intervention, and we do not replace your cardiologist or hospital's emergency services.

Privacy Officer — Contact Block

For any privacy-related request, complaint, or to withdraw a previously granted consent, contact our Privacy Officer using the details below. We respond to all requests within five (5) business days.

Response time SLA: acknowledgement within 1 business day; resolution within 5 business days.