Legal

HIPAA Notice of Privacy Practices

Effective date: January 1, 2025 · Last updated: April 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who We Are

StagesRx operates as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the HIPAA Privacy Rule (45 CFR Part 164). We provide software and services to covered entities including Durable Medical Equipment (DME) suppliers, medical clinics, and healthcare providers.

In providing these services, we create, receive, maintain, and transmit Protected Health Information (PHI) on behalf of our covered entity customers. This Notice describes how we handle PHI and your rights with respect to that information.

2. What Is Protected Health Information (PHI)

Protected Health Information (PHI) is individually identifiable health information that relates to your past, present, or future physical or mental health or condition; the provision of healthcare to you; or the past, present, or future payment for your healthcare. PHI includes information such as:

Your name, address, date of birth, and Social Security number
Medical diagnoses, conditions, and treatment history
Prescription and medical equipment orders
Insurance information and claims data
Any other information that could reasonably be used to identify you

3. How We Use and Disclose PHI

As a Business Associate, we use and disclose PHI only as permitted or required by our Business Associate Agreements with covered entities, and as required by law. Permitted uses and disclosures include:

Treatment

We may use and disclose PHI to facilitate the coordination of care and services. For example, transmitting prescription information between prescribing providers and DME suppliers, or sharing order documentation needed to fulfill a medical equipment request.

Payment

We may use and disclose PHI to support billing and claims processing activities, including verifying insurance eligibility, preparing claims for submission to Medicare, Medicaid, or private insurers, and responding to claim audits and documentation requests.

Healthcare Operations

We may use and disclose PHI to support the healthcare operations of our covered entity customers, including quality assurance, compliance reviews, audit trail maintenance, and workflow management.

As Required by Law

We may disclose PHI when required by federal, state, or local law, including in response to court orders, subpoenas, or lawful requests by government agencies such as the Department of Health and Human Services (HHS) Office for Civil Rights.

For Public Health Activities

We may disclose PHI to public health authorities authorized to collect or receive such information for purposes such as preventing or controlling disease, reporting adverse events, or responding to public health emergencies.

To Avert Serious Threats

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Business Associates

We may disclose PHI to our own subcontractors and service providers (sub-Business Associates) who assist us in providing our services, such as cloud infrastructure providers and security vendors, provided those parties have agreed in writing to protect PHI in accordance with HIPAA.

4. Uses and Disclosures Requiring Authorization

Other uses and disclosures of PHI not described in this Notice will be made only with your written authorization, unless otherwise permitted or required by law. These include most uses of PHI for marketing purposes and the sale of PHI.

If you provide an authorization, you may revoke it at any time by submitting a written request to the covered entity (your DME supplier, clinic, or provider) that holds your records. Revoking an authorization will not affect any actions already taken in reliance on that authorization.

5. Your Rights Regarding PHI

Under HIPAA, you have the following rights regarding your Protected Health Information. To exercise these rights, contact the covered entity (your DME company, clinic, or provider) directly — they are the custodians of your records and process these requests on your behalf.

Right to Access

You have the right to inspect and obtain a copy of your PHI that is maintained in a designated record set. Requests may be subject to a reasonable cost-based fee. We will respond within 30 days of receipt of a complete request.

Right to Amend

You have the right to request an amendment to your PHI if you believe it is inaccurate or incomplete. We may deny your request under certain circumstances, such as if the information was not created by us or is accurate and complete. If denied, you have the right to submit a statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI made in the six years prior to the date of your request. This right does not apply to disclosures for treatment, payment, or healthcare operations, or disclosures made with your authorization.

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to all requested restrictions, but if we do agree, we will comply with the restriction except in emergency situations.

Right to Confidential Communications

You have the right to request that we communicate with you about PHI through alternative means or at alternative locations if you believe that disclosure through normal channels could endanger you.

Right to a Paper Copy of This Notice

You have the right to request a paper copy of this Notice at any time, even if you agreed to receive it electronically. Contact us at the address below.

6. Our Duties

StagesRx is required by law to:

Maintain the privacy of your PHI
Provide you with notice of our legal duties and privacy practices with respect to PHI
Notify you following a breach of your unsecured PHI
Abide by the terms of this Notice

We reserve the right to change our privacy practices and the terms of this Notice at any time. Changes will apply to PHI we already hold as well as PHI we receive in the future. The revised Notice will be posted on our website with a new effective date.

7. Breach Notification

In the event of a breach of unsecured PHI, we will notify the affected covered entity promptly in accordance with our Business Associate Agreement and the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). The covered entity is then responsible for notifying affected individuals, HHS, and, where required, the media.

We maintain an incident response plan and will cooperate fully with covered entities and HHS in any breach investigation.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

StagesRx Privacy Officer — contact us at support@stagesrx.com
U.S. Department of Health and Human Services, Office for Civil Rights — file a complaint online at hhs.gov/hipaa/filing-a-complaint

We will not retaliate against you for filing a complaint.

9. Contact Our Privacy Officer

For questions about this Notice or to exercise your rights, contact us:

StagesRx — Privacy Officersupport@stagesrx.com