HIPAA Privacy and Security Policy

1. Purpose

FemmeKare is a telehealth service operated by SDKare LLC and is not a separate legal entity. 

SDKare LLC adopts this HIPAA Privacy and Security Policy to establish standards for protecting Protected Health Information (“PHI”) and Electronic Protected Health Information (“ePHI”) created, received, maintained, or transmitted in connection with healthcare services provided through FemmeKare. 

This Policy is intended to support compliance, where applicable, with: 

• The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 

• The HIPAA Privacy Rule 

• The HIPAA Security Rule 

• The HIPAA Breach Notification Rule 

• The Health Information Technology for Economic and Clinical Health Act (“HITECH”) 

• 42 CFR Part 2, where applicable 

• Other applicable federal and state privacy and security laws 

This Policy does not replace any additional obligations imposed by applicable federal or state law. 

2. Scope

This Policy applies to PHI and ePHI subject to HIPAA that is created, received, maintained, or transmitted in connection with FemmeKare operations. 

It applies to members of the SDKare LLC workforce who access PHI or ePHI in connection with FemmeKare. 

For purposes of this Policy, “workforce” includes employees and other persons whose conduct, in performing work for SDKare LLC, is under the direct control of SDKare LLC, whether or not they are paid. 

Business Associates and subcontractors that handle PHI are subject to applicable contractual obligations, Business Associate Agreements where required, and applicable HIPAA requirements. 

3. Protected Health Information

For purposes of this Policy, PHI means individually identifiable health information that is created or received by a HIPAA-regulated entity and relates to: 

• An individual’s past, present, or future physical or mental health or condition 

• Healthcare provided to an individual 

• Past, present, or future payment for healthcare 

and that identifies the individual or provides a reasonable basis to believe the individual can be identified. 

PHI may exist in oral, written, or electronic form. 

Electronic Protected Health Information, or ePHI, is PHI that is transmitted by or maintained in electronic media and is subject to the HIPAA Security Rule. 

4. Privacy Officer

SDKare LLC designates the following individual as Privacy Officer for FemmeKare operations: 

Sophie Brown 

Patient Care Manager and Privacy Officer 

Email: sophie.brown@femmekare.com 

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802 

Phone: (520) 800-6043 

The Privacy Officer is responsible for overseeing privacy compliance activities, including: 

• HIPAA privacy policies and procedures 

• Patient privacy rights requests 

• Privacy complaints 

• Workforce privacy guidance 

• Privacy incident coordination 

• Notice of Privacy Practices administration 

• Privacy-related training and compliance documentation 

• Coordination of investigations and corrective actions 

• Coordination with the Security Official and other appropriate personnel 

5. Security Official

SDKare LLC designates the following individual as its Security Official for FemmeKare operations: 

Sophie Brown 

Patient Care Manager and Security Official 

Email: sophie.brown@femmekare.com 

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802 

The Security Official is responsible for overseeing the development and implementation of policies and procedures required by the HIPAA Security Rule, including appropriate oversight of: 

• Security risk analysis 

• Risk management 

• Information access management 

• Administrative, physical, and technical safeguards 

• Security incident response 

• Contingency planning 

• Security evaluations 

• Workforce security requirements 

• Security documentation 

The Security Official will coordinate with appropriate workforce members, service providers, and Business Associates, as necessary, to support the confidentiality, integrity, and availability of electronic Protected Health Information (“ePHI”). 

The Security Official designation and assigned responsibilities will be maintained in SDKare LLC’s HIPAA compliance records. 

6. Notice of Privacy Practices

SDKare LLC maintains a HIPAA Notice of Privacy Practices applicable to healthcare services provided through FemmeKare. 

The Notice describes: 

• Permitted uses and disclosures of PHI 

• Individual privacy rights 

• SDKare LLC’s legal duties regarding PHI 

• Privacy complaint procedures 

• Privacy contact information 

The current Notice will be made available as required by HIPAA, including through the FemmeKare website. 

Where required, SDKare LLC will make a good-faith effort to obtain acknowledgment that an individual received the Notice and will document the acknowledgment or the reason it could not be obtained. 

7. Permitted Uses and Disclosures of PHI

SDKare LLC may use or disclose PHI without written authorization where HIPAA permits or requires the use or disclosure. 

Permitted circumstances may include: 

• Treatment 

• Payment 

• Healthcare operations 

• Public health activities 

• Health oversight activities 

• Research where applicable HIPAA requirements are satisfied 

• Judicial or administrative proceedings 

• Certain law-enforcement purposes 

• Workers’ compensation 

• Certain government functions 

• Coroners, medical examiners, and funeral directors 

• Organ and tissue donation 

• Uses or disclosures required by law 

• Prevention or reduction of a serious threat to health or safety 

Additional conditions, limitations, or more protective legal requirements will be followed where applicable. 

8. Minimum Necessary Standard

Where the HIPAA minimum necessary standard applies, SDKare LLC will make reasonable efforts to limit uses, disclosures, and requests for PHI to the minimum amount reasonably necessary to accomplish the intended purpose. 

Workforce access to PHI will be based on assigned responsibilities and legitimate clinical, operational, or compliance need. 

The minimum necessary standard does not apply in circumstances excluded under HIPAA, including certain disclosures for treatment. 

9. Verification of Identity and Authority

Before disclosing PHI where HIPAA requires verification, SDKare LLC will take reasonable steps to verify: 

• The identity of the person requesting PHI 

• The authority of the requesting person to receive the PHI, where such authority is not already known 

Verification will be performed in accordance with applicable HIPAA requirements and internal procedures. 

10. Uses and Disclosures Requiring Authorization

SDKare LLC will obtain a valid written authorization where HIPAA requires authorization before using or disclosing PHI. 

Authorization may be required for: 

• Most uses and disclosures of psychotherapy notes 

• Marketing activities requiring authorization 

• Sale of PHI 

• Other uses or disclosures not otherwise permitted or required by law 

An individual may revoke an authorization in writing, subject to actions already taken in reliance on the authorization. 

SDKare LLC does not sell PHI. 

11. Substance Use Disorder Records

To the extent SDKare LLC creates, receives, maintains, or transmits records subject to 42 CFR Part 2, those records will be handled according to applicable Part 2 requirements. 

Part 2-protected records will not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against an individual based on the content of those records unless permitted by applicable law, including where required consent or qualifying legal process has been obtained. 

This section does not represent that all FemmeKare records or services are subject to Part 2. 

12. Individual HIPAA Rights

SDKare LLC maintains procedures for responding to applicable individual rights under HIPAA, including requests to: 

• Inspect or access PHI 

• Receive electronic or paper copies of PHI 

• Request amendments to PHI 

• Request restrictions on certain uses or disclosures 

• Request confidential communications 

• Receive an accounting of certain disclosures 

• Receive a copy of the Notice of Privacy Practices 

• Designate a personal representative 

• File a privacy complaint 

Requests will be processed within applicable legal timeframes. 

13. Personal Representatives

SDKare LLC will recognize a personal representative where required by HIPAA and applicable law. 

The identity and legal authority of a personal representative may be verified before PHI is disclosed or a request is processed. 

14. Business Associates

Where required by HIPAA, SDKare LLC will enter into an appropriate Business Associate Agreement before permitting a Business Associate to create, receive, maintain, or transmit PHI on behalf of SDKare LLC. 

Business Associate Agreements will require applicable safeguards and compliance obligations. 

If SDKare LLC becomes aware of a pattern of activity or practice by a Business Associate that constitutes a material breach or violation of its obligations, SDKare LLC will take reasonable steps to cure the breach or end the violation and will take any further action required by applicable law if those efforts are unsuccessful. 

15. Workforce Access and Confidentiality

Access to PHI and ePHI will be limited to workforce members who require access to perform authorized duties. 

Workforce members with access to PHI must: 

• Maintain confidentiality 

• Access only information required for authorized duties 

• Avoid unauthorized uses or disclosures 

• Protect login credentials and authentication information 

• Use approved systems and processes 

• Follow applicable privacy and security procedures 

• Promptly report suspected privacy or security incidents 

Unauthorized access, use, or disclosure of PHI is prohibited. 

16. Workforce Training

SDKare LLC will provide appropriate HIPAA privacy and security training to workforce members whose duties involve PHI or ePHI. 

Training will be provided: 

• To appropriate new workforce members 

• When material changes to policies or procedures affect workforce duties 

• As otherwise reasonably necessary to maintain compliance 

Training activities will be documented as required by law and organizational policy. 

17. Sanctions

Workforce members who fail to comply with HIPAA requirements or applicable SDKare LLC privacy and security policies may be subject to appropriate sanctions consistent with: 

• Applicable law 

• Organizational policies 

• The nature and circumstances of the violation 

Sanctions and corrective actions will be documented where required. 

18. Non-Retaliation and No Improper Waiver of Rights

SDKare LLC prohibits retaliation against: 

• Individuals who exercise HIPAA rights 

• Individuals who submit privacy complaints 

• Workforce members who report suspected violations in good faith 

• Individuals who cooperate with lawful investigations or compliance reviews 

SDKare LLC will not require an individual to waive rights under the HIPAA Privacy Rule as a condition of treatment, payment, enrollment, or eligibility for benefits where such conditioning is prohibited by law. 

19. Mitigation

SDKare LLC will take reasonable and appropriate steps to mitigate, to the extent practicable, any known harmful effect resulting from an impermissible use or disclosure of PHI by SDKare LLC or its Business Associates. 

Mitigation may include corrective measures, recovery or containment of information, additional safeguards, training, disciplinary action, or other steps appropriate to the circumstances. 

20. Administrative Safeguards

SDKare LLC will maintain reasonable and appropriate administrative safeguards for ePHI in accordance with the HIPAA Security Rule. 

Administrative safeguards will address, as applicable: 

• Security management processes 

• Risk analysis 

• Risk management 

• Assigned security responsibility 

• Workforce security 

• Information access management 

• Security awareness and training 

• Security incident procedures 

• Contingency planning 

• Periodic evaluation 

• Business Associate arrangements 

21. Security Risk Analysis and Risk Management

SDKare LLC will conduct and document an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI created, received, maintained, or transmitted by SDKare LLC in connection with FemmeKare. 

Risk-management measures will be implemented to reduce identified risks and vulnerabilities to a reasonable and appropriate level. 

Risk analysis and risk-management activities will be reviewed and updated when reasonably necessary in response to: 

• Changes in information systems 

• Operational changes 

• New or evolving threats 

• Security incidents 

• Material technological changes 

• Changes in legal or regulatory requirements 

22. Required and Addressable Security Specifications

SDKare LLC will implement implementation specifications designated as required under the HIPAA Security Rule. 

For specifications designated as addressable, SDKare LLC will assess whether the specification is reasonable and appropriate in its environment. 

Where an addressable implementation specification is not implemented as written, SDKare LLC will document its assessment and, where appropriate, implement an equivalent reasonable and appropriate alternative consistent with the applicable Security Rule standard. 

23. Security Evaluation

SDKare LLC will periodically conduct technical and nontechnical evaluations to assess compliance with applicable Security Rule requirements. 

Additional evaluations will be performed when material environmental, operational, technological, or regulatory changes affect the security of ePHI. 

Findings will be documented and appropriate corrective action will be taken where necessary. 

24. Physical Safeguards

SDKare LLC will maintain reasonable and appropriate physical safeguards designed to limit unauthorized physical access to ePHI and the systems through which it may be accessed. 

Safeguards and procedures will address, as applicable: 

• Facility access controls 

• Physical access authorization 

• Workstation use 

• Workstation security 

• Device and media controls 

• Hardware and media accountability 

• Disposal of devices and media containing ePHI 

• Reuse of electronic media 

Specific technical or physical configurations may be maintained in internal security documentation and are not required to be publicly disclosed where disclosure could increase security risk. 

25. Technical Safeguards

SDKare LLC will implement reasonable and appropriate technical safeguards for ePHI consistent with the HIPAA Security Rule. 

Such safeguards will address, as applicable: 

• Access control 

• Unique user identification 

• Emergency access procedures 

• Audit controls 

• Integrity of ePHI 

• Person or entity authentication 

• Transmission security 

• Other implementation specifications required or determined reasonable and appropriate under the Security Rule 

Technical safeguards will be selected, maintained, and reviewed based on applicable legal requirements, risk analysis, system capabilities, and identified security risks. 

26. Access Management

Access to systems containing ePHI will be limited according to authorized workforce responsibilities. 

SDKare LLC will maintain procedures for: 

• Authorizing access 

• Establishing appropriate access levels 

• Modifying access when responsibilities change 

• Removing access when access is no longer required 

• Periodically reviewing access where appropriate 

• Preventing unauthorized access 

Access credentials may not be shared. 

27. Security Awareness and Training

SDKare LLC will maintain a security-awareness program appropriate to workforce roles, operations, and identified risks. 

Training and awareness activities may address: 

• Credential and password security 

• Phishing and social-engineering risks 

• Secure handling of PHI 

• Device security 

• Email and messaging risks 

• Remote access practices 

• Incident recognition and reporting 

28. Security Incident Response

Workforce members must promptly report suspected privacy or security incidents, including: 

• Unauthorized access to PHI 

• Improper use or disclosure of PHI 

• Lost or stolen devices containing or providing access to PHI 

• Compromised login credentials 

• Malware or ransomware 

• Phishing incidents 

• Suspicious system activity 

• Other events that may affect PHI or ePHI 

SDKare LLC will: 

• Investigate reported incidents 

• Contain or mitigate harmful effects where practicable 

• Document required findings 

• Implement corrective measures where appropriate 

• Evaluate whether the incident constitutes a reportable breach 

29. Breach Risk Assessment and Notification

An impermissible acquisition, access, use, or disclosure of PHI will be evaluated in accordance with the HIPAA Breach Notification Rule. 

Where required, SDKare LLC will conduct and document a risk assessment considering at least: 

• The nature and extent of the PHI involved, including the types of identifiers and likelihood of re-identification 

• The unauthorized person who used the PHI or to whom the disclosure was made 

• Whether the PHI was actually acquired or viewed 

• The extent to which the risk to the PHI was mitigated 

Where the assessment does not demonstrate a low probability that the PHI was compromised, the incident will be treated as a reportable breach unless a statutory exception applies. 

If a reportable breach of unsecured PHI occurs, SDKare LLC will provide notifications required by law, which may include notification to: 

• Affected individuals 

• The U.S. Department of Health and Human Services 

• The media, where required 

• State regulators or other authorities where applicable law requires notification 

Notifications will be provided without unreasonable delay and within applicable legal deadlines. 

30. Contingency Planning

SDKare LLC will maintain reasonable and appropriate contingency procedures designed to preserve access to ePHI and essential healthcare operations during emergencies or system disruptions. 

Contingency planning will address, where applicable: 

• Data backup 

• Disaster recovery 

• Emergency-mode operations 

• Criticality analysis 

• Periodic testing and revision of contingency procedures 

31. Data Integrity

SDKare LLC will maintain reasonable and appropriate measures intended to protect ePHI from improper alteration or destruction. 

Procedures may include mechanisms for detecting, preventing, or responding to unauthorized modification of ePHI. 

32. Transmission Security

SDKare LLC will use reasonable and appropriate safeguards to protect ePHI transmitted over electronic communications networks. 

Workforce members must use authorized systems and approved procedures when transmitting PHI for clinical, administrative, or business purposes. 

Transmission safeguards will be selected and maintained consistent with the HIPAA Security Rule and applicable risk analysis. 

33. Devices and Electronic Media

Devices and electronic media containing or providing access to ePHI will be handled in accordance with applicable security procedures. 

SDKare LLC will maintain appropriate processes relating to: 

• Assignment and use of devices 

• Movement of devices and media where necessary 

• Storage 

• Disposal 

• Media reuse 

• Removal of PHI prior to disposal or reuse where required 

34. Telehealth Privacy and Security

Telehealth services provided through FemmeKare will be managed in accordance with applicable HIPAA privacy and security requirements. 

Workforce members and healthcare providers using telehealth systems in connection with FemmeKare must: 

• Use authorized systems and workflows 

• Take reasonable steps to prevent unauthorized persons from viewing or hearing PHI 

• Verify patient identity where appropriate 

• Protect login credentials 

• Avoid unauthorized recording of telehealth encounters 

• Avoid unauthorized disclosure of information discussed during telehealth encounters 

Patients are encouraged to participate in telehealth appointments from a private location and to use secure personal devices and networks where reasonably possible. 

35. Record Retention and HIPAA Documentation

Medical records will be retained according to applicable federal law, state medical-record retention requirements, professional requirements, and SDKare LLC record-retention policies. 

HIPAA itself does not establish a universal medical-record retention period. 

HIPAA-required policies, procedures, communications, actions, assessments, and other documentation will be maintained for at least six years from the date of creation or the date when the document was last in effect, whichever is later, unless applicable law requires a longer period. 

36. Deidentification

SDKare LLC may use or disclose health information that has been deidentified in accordance with the HIPAA Privacy Rule. 

Information will be treated as deidentified under HIPAA only when the applicable HIPAA deidentification standard has been satisfied. 

37. More Protective Federal and State Laws

HIPAA establishes federal privacy and security requirements but does not necessarily replace laws that provide greater privacy protections. 

Where applicable federal or state law provides greater privacy protection or imposes stricter requirements than HIPAA, SDKare LLC will comply with the applicable more protective requirement. 

This may include laws governing specific categories of health information. 

38. Privacy Complaints

Individuals may submit HIPAA privacy complaints to: 

Sophie Brown 

Patient Care Manager and Privacy Officer 

SDKare LLC, operating FemmeKare 

Email: sophie.brown@femmekare.com 

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802 

Phone: (520) 800-6043 

Complaints will be documented, reviewed, and addressed in accordance with applicable procedures. 

Individuals may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. 

SDKare LLC will not retaliate against any person for exercising a HIPAA right or filing a privacy complaint. 

39. Regulatory Cooperation

SDKare LLC will provide applicable policies, procedures, documentation, records, and other information to HHS or another authorized oversight authority when required by law. 

Workforce members must cooperate with authorized regulatory reviews, compliance investigations, and lawful audits. 

40. Policy Review and Updates

This Policy will be reviewed periodically and revised when reasonably necessary because of: 

• Changes in applicable law 

• Regulatory guidance 

• Operational changes 

• Technological changes 

• Identified risks or vulnerabilities 

• Security incidents 

• Compliance findings 

• Material changes in privacy or security practices 

Material changes will be communicated to affected workforce members as appropriate. 

41. Documentation

SDKare LLC will maintain documentation required by HIPAA in written or electronic form. 

Documentation may include: 

• Policies and procedures 

• Privacy and security training records 

• Risk analyses and risk-management records 

• Security evaluations 

• Privacy complaints 

• Patient-rights requests 

• Incident-response records 

• Breach assessments 

• Business Associate Agreements 

• Sanction and corrective-action records 

• Notice of Privacy Practices records and acknowledgments 

• Security Official and Privacy Officer designations 

• Other records required to demonstrate compliance 

HIPAA-required documentation will be retained for the period specified in Section 35 of this Policy. 

42. Contact Information

Privacy Officer 

Sophie Brown 

Patient Care Manager and Privacy Officer 

SDKare LLC, operating FemmeKare 

Email: sophie.brown@femmekare.com 

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802 

General Contact 

FemmeKare, operated by SDKare LLC 

Email: support.contact@femmekare.com 
Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802  

Phone: (520) 800-6043