Hurtt Family Health Clinic (HFHC) Notice of Privacy Practices & Website Privacy Policy

Your Privacy Matters

Hurtt Family Health Clinic (HFHC) respects the privacy and dignity of the individuals, families, and communities we are privileged to serve. This notice explains how we protect your information, how we collect, use, disclose and share it, your rights, and how to get help.

PART 1: NOTICE OF PRIVACY PRACTICES (HIPAA)

Who This Applies To

This applies to your Protected Health Information (PHI), including medical, billing, and health records.

Which Notice Applies

This Notice applies to Protected Health Information (PHI) under The Health Insurance Portability and Accountability Act (HIPAA). Website and online data practices are addressed separately and do not apply to medical records.

Our Responsibilities

We are required to:

• Maintain the privacy and security of your PHI – We protect your health information using administrative, technical, and physical safeguards to prevent unauthorized access, use, or disclosure.
• Provide this Notice and follow its terms – We give you this Notice explaining our privacy practices and are required to follow the policies described in it.
• Limit use and disclosure of your information – We only use or share your information when necessary for care, operations, or as permitted or required by law.
• Obtain authorization when required – We will ask for your written permission before using or sharing your information for purposes not allowed under law.
• Notify you of breaches – If your information is compromised, we will notify you promptly in accordance with legal requirements.
• Support your rights – We ensure you can access, review, and exercise your rights regarding your health information without barriers or retaliation.
• Apply additional protections for substance use disorder records and minors – We follow stricter federal and state laws that provide extra confidentiality protections for these sensitive records.
• Ensure non-discrimination and accessibility – We provide equitable access to services and information, including language assistance and accommodations for disabilities.
• Train staff and require partners to safeguard your information – We train our workforce and require business partners to follow privacy and security standards to protect your information.

How We Safeguard Your Information

We use administrative, technical, and physical safeguards to protect your information. No system is completely secure.

What Information and data we collect:

• Registration information – Information you provide when signing up for services, programs, or communications.
• Billing and payment information – Information used to process payments and manage financial transactions.
• Communications – Information from emails, inquiries, forms, or surveys you complete.
• Device and connection log data – Technical information such as IP address, browser type, and system activity.
• Authentication data – Information used to verify your identity and secure access to systems.
• Analytics data – Data about how you use our website to help improve functionality and services.
• Location data – General geographic information derived from your device or IP address.
• Cookies and tracking data – Information collected through cookies and similar technologies to enhance user experience.

We Use Your Information To:

Provide and improve services – To deliver care, improve access, and enhance programs based on patient and community needs.

Respond to inquiries – To answer questions, provide support, and ensure timely and accurate responses.

Communicate with you – To send updates, reminders, and important service-related communications.

Analyze usage and trends – To understand how services are used and improve functionality and patient experience.

Maintain security – To protect systems, detect fraud, and safeguard your information.

Meet legal and contractual obligations – To comply with healthcare laws, grant requirements, and operational responsibilities.

We may share your information for the following purposes:

• Treatment, Payment, and Operations – To provide care, coordinate services, and manage healthcare operations.
• Registration and communication – To manage your interactions and respond to your needs.
• Service improvement and customization – To tailor programs and enhance care delivery.
• Data analysis and trends – To better understand community needs and improve outcomes.
• Public health and safety – To protect individuals and the community.
• Health oversight activities – For audits, investigations, inspections, and regulatory compliance.
• Legal proceedings and law enforcement – When required by law or legal process.
• Workers’ compensation – As authorized by law.
• Research (with safeguards) – To support health improvements while protecting your privacy.
• Serious threats to health or safety – To prevent or reduce harm.
• Military and national security – When required by applicable laws.
• Appointment reminders and communications – To support continuity of care.

Uses and Disclosures That Require Authorization

We require written authorization for:

• Marketing
• Sale of PHI
• Psychotherapy notes
• Use of images
• Any use not described in this Notice

You may revoke authorization at any time in writing.

Use of Photos, Videos, and Images

We will only use identifiable images with written consent. You may decline or withdraw consent at any time without affecting your care.

Fundraising Communications

We may contact you for fundraising. You may opt out at any time without affecting your care.

Your Rights

• Access your records – You can inspect or receive a copy of your health and billing records, with limited exceptions.
• Request corrections – You may ask us to correct information in your record if you believe it is incorrect or incomplete.
• Request restrictions (including out-of-pocket protections) – You may request limits on how we use or share your information. If you pay in full out-of-pocket for a service, you may request that we not share that information with your health plan.
• Request confidential communications – You may ask us to contact you in a specific way (for example, by phone or mail) or at a specific location.
• Receive an accounting of disclosures – You can request a list of certain disclosures we have made of your information, excluding those for treatment, payment, and operations.
• Receive a paper copy – You can request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Be notified of breaches – You have the right to be notified if your unsecured health information is compromised.
• Choose a representative – You may designate someone (such as a legal guardian or authorized representative) to act on your behalf regarding your health information.
• File a complaint without retaliation – You may file a complaint if you believe your privacy rights have been violated, and you will not be penalized or retaliated against.

Special Protections

Additional protections apply to substance use disorder records and minors under California law.

Changes to This Notice

We may update this notice at any time. The latest version will be available online and in our clinics.

Complaints

Privacy Officer: James Walter
Hurtt Family Health Clinic
Phone: 714-247-0300
Email: patientadvocacy@hurttclinic.org
Address: 14642 Newport Ave, Suite 300. Tustin, CA 92780

You may also file a complaint with the U.S. Department of Health and Human Services.

PART 2: WEBSITE PRIVACY POLICY

Information We Collect

We may collect:

• Information you provide (name, email, forms)
• Automatically collected data (IP address, device, usage)
• Cookies and tracking data
• Information from third parties

How We Use Website Information

We use information to:

• Provide and improve services
• Respond to inquiries
• Communicate with you
• Analyze usage and trends
• Maintain security
• Meet legal obligations

Sharing Information

We share information with service providers, as required by law, or with your consent. We do not sell your data.

Data Retention

We retain information only as long as necessary for services, legal compliance, and operational needs.

Security

We use safeguards to protect information, but no system is completely secure.

Cookies and Tracking Technologies

We use cookies to improve functionality and user experience. You may manage cookies in your browser settings.

Third-Party Websites

We are not responsible for third-party privacy practices. If you use links to leave the Site, any information you provide to these third parties is not covered by this Privacy Policy.

Children’s Privacy

We do not knowingly collect personal information from children under 13.

California Privacy Rights

California residents may request access, deletion, and information about data sharing.

Accessibility & Non-Discrimination

HFHC complies with federal civil rights laws and WCAG 2.1 Level AA standards and provides free language and accessibility services.

Federal Status

Hurtt Family Health Clinic is a Health Center Program grantee under 42 U.S.C. § 254b and a Federal Tort Claims Act (FTCA) deemed facility.

Contact

Hurtt Family Health Clinic
Privacy Officer: James Walter
Phone: 714-247-0300
Email: patientadvocacy@hurttclinic.org
Address: 14642 Newport Ave, Suite 300, Tustin, CA 92780

Effective Date: May 1, 2026
Last Updated: May 6, 2026