Version 1.0 | Effective September 15, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice is intended to satisfy the HIPAA Notice of Privacy Practices requirements applicable to MDTelemed LLC to the extent MDTelemed LLC is a HIPAA covered health care provider for the relevant functions. It is distinct from the Website & Consumer Privacy Policy, which addresses broader website, tracking, cookie, consumer-data, and state privacy matters.
3. PURPOSE AND SCOPE
This Notice explains how MDTelemed LLC may use and disclose protected health information (PHI), the privacy rights available to patients, MDTelemed's legal duties, and how to contact MDTelemed or file a complaint. Because MDTelemed intends to provide telemedicine nationally, more protective state law may supplement or control particular uses, disclosures, access rights, minor confidentiality, reproductive/sexual-health information, genetic information, mental-health information, and other specially protected records.
4. WHO THIS NOTICE APPLIES TO
This Notice applies to MDTelemed LLC's covered health-care functions and to workforce members and persons acting for MDTelemed as permitted by HIPAA. The final production version must accurately identify any separate professional medical entities, organized health care arrangement, affiliated covered entities, or other entities that share this Notice. A shared or joint notice must not be implied unless the legal requirements are actually satisfied.
5. MDTelemed's TELEMEDICINE MODEL
MDTelemed provides care through human MD physicians. Services may use video, audio-only/telephone, asynchronous intake/questionnaires, and secure messaging when clinically appropriate and legally permitted. MDTelemed may order laboratory testing, imaging, and other diagnostic services. MDTelemed does not permit Schedule II-V controlled-substance prescribing through the platform.
6. AI-ASSISTED DOCUMENTATION
MDTelemed may use an AI-assisted telescribe to help document a physician-patient encounter. The AI tool is not an autonomous physician, does not independently diagnose or prescribe, and does not replace the treating MD's clinical judgment. Information processed for documentation remains subject to applicable privacy, security, contracting, and record-management requirements.
7. WHAT IS PROTECTED HEALTH INFORMATION
PHI generally includes individually identifiable health information created or received by a HIPAA covered entity or business associate that relates to health, health care, or payment for health care and is protected by HIPAA. Information may be protected by other federal or state laws even when HIPAA does not apply.
8. TREATMENT
We may use and disclose your PHI to provide, coordinate, or manage your health care. For example, your treating physician may review your history and may share relevant information with a laboratory, imaging facility, pharmacy, specialist, hospital, or another treating provider when permitted by law.
9. PAYMENT
We may use and disclose PHI for payment-related activities as permitted by law. MDTelemed is currently described as a cash/self-pay service, but payment functions can still include processing charges, responding to billing questions, issuing receipts or permitted documentation, collecting amounts owed, and handling refunds. This Notice does not promise insurance billing or network participation.
10. HEALTH CARE OPERATIONS
We may use and disclose PHI for health care operations permitted by HIPAA, such as quality assessment and improvement, patient-safety activities, physician evaluation, credentialing, compliance, auditing, legal services, business planning, customer service, training, fraud/abuse detection, and certain administrative functions.
11. BUSINESS ASSOCIATES
We may disclose PHI to business associates that perform services for or on behalf of MDTelemed when HIPAA permits and required contractual safeguards are in place. Examples can include technology, hosting, communications, payment, documentation, support, analytics used for covered functions, security, and professional services. This Notice does not invent a fixed vendor list.
12. APPOINTMENT AND CARE COMMUNICATIONS
We may contact you about appointments, follow-up, test results, referrals, care coordination, medication matters, portal activity, or other health-related communications as permitted by law. You should keep your contact information current and tell us about reasonable confidential-communication requests.
13. TREATMENT ALTERNATIVES AND HEALTH-RELATED SERVICES
HIPAA may permit communications about treatment alternatives, case management, care coordination, or health-related services. Marketing communications that require authorization will not be treated as ordinary health care operations merely because they involve health.
14. REQUIRED BY LAW
We may use or disclose PHI when required by federal, state, or other applicable law, but only to the extent and under the conditions the law requires.
15. PUBLIC HEALTH
As permitted or required by law, PHI may be disclosed for public-health activities, such as disease reporting, public-health surveillance, certain product recalls, or other authorized public-health functions.
16. ABUSE, NEGLECT, OR DOMESTIC VIOLENCE
We may make disclosures concerning suspected abuse, neglect, or domestic violence when applicable law permits or requires them and applicable safeguards are satisfied.
17. HEALTH OVERSIGHT
PHI may be disclosed to authorized health-oversight agencies for activities such as audits, investigations, inspections, licensure, disciplinary matters, or other legally authorized oversight.
18. JUDICIAL AND ADMINISTRATIVE PROCEEDINGS
We may disclose PHI in response to qualifying court or administrative processes when HIPAA and other applicable law permit or require disclosure. A subpoena or request does not automatically authorize unrestricted release of an entire medical record.
19. LAW ENFORCEMENT
We may disclose PHI for law-enforcement purposes only as permitted by HIPAA and other applicable law. Requests are evaluated according to their legal authority, scope, and any additional state protections.
20. CORONERS, MEDICAL EXAMINERS, AND FUNERAL DIRECTORS
We may disclose PHI to coroners, medical examiners, and funeral directors as permitted by law for their authorized duties.
21. ORGAN AND TISSUE DONATION
Where applicable and permitted, PHI may be disclosed to organizations involved in organ, eye, or tissue donation and transplantation.
22. RESEARCH
PHI may be used or disclosed for research only when HIPAA's authorization or applicable waiver/approval requirements are satisfied. MDTelemed does not claim that every internal analysis constitutes research.
23. SERIOUS THREAT TO HEALTH OR SAFETY
HIPAA may permit disclosure of PHI to avert a serious and imminent threat to health or safety when the regulatory requirements are met and disclosure is consistent with applicable law and professional standards.
24. SPECIALIZED GOVERNMENT FUNCTIONS
HIPAA permits specified disclosures for certain military, veterans, national-security, protective-service, correctional, and other specialized governmental functions. MDTelemed will apply these provisions only when legally applicable.
25. WORKERS' COMPENSATION
PHI may be disclosed as authorized by and to the extent necessary to comply with workers' compensation or similar programs, subject to applicable law.
26. USES AND DISCLOSURES REQUIRING AUTHORIZATION
Uses and disclosures not otherwise permitted by HIPAA or another applicable law generally require your written authorization. If you give an authorization, you may revoke it in writing as allowed by law, except to the extent action has already been taken in reliance on it.
27. PSYCHOTHERAPY NOTES
Most uses and disclosures of psychotherapy notes, when the HIPAA definition applies, require authorization subject to limited exceptions. Ordinary mental-health progress notes are not automatically 'psychotherapy notes' under HIPAA.
28. MARKETING
Uses or disclosures of PHI for marketing require authorization when HIPAA requires it. MDTelemed's promotional email or text program must be separately coordinated with HIPAA, TCPA and other communications/consumer requirements; consent to receive care is not automatically consent to every promotional communication.
29. SALE OF PHI
MDTelemed will not sell PHI in a manner that requires HIPAA authorization without obtaining the authorization required by law. The technical meaning of 'sale of PHI' is governed by HIPAA and should not be confused with every vendor payment or service arrangement.
30. FUNDRAISING
If MDTelemed conducts HIPAA-regulated fundraising, required notice and opt-out rights will be provided. No fundraising program is promised by this Notice.
31. SUBSTANCE USE DISORDER RECORDS
HIPAA Notice requirements were modified to address certain substance use disorder patient records protected by 42 CFR Part 2, with compliance changes effective in 2026. MDTelemed does not offer OUD/buprenorphine treatment under the current service model. Whether MDTelemed is itself a Part 2 program is a separate legal determination and must not be assumed merely because psychiatric care is offered.
32. PART 2 INFORMATION RECEIVED BY A HIPAA ENTITY
When MDTelemed lawfully receives records protected by 42 CFR Part 2, their use, disclosure, redisclosure, segregation, consent, and notice treatment must comply with the applicable HIPAA/Part 2 framework and any more protective law.
33. REPRODUCTIVE HEALTH NPP CHANGES
The 2024 HIPAA reproductive-health rule was substantially affected by a federal court ruling in June 2025. HHS states that several reproductive-health NPP provisions were vacated, while remaining NPP modifications were not disturbed and had a February 16, 2026 compliance date. MDTelemed will follow the current operative federal rule and will not publish vacated requirements as if they remain law.
34. MORE STRINGENT STATE LAW
HIPAA can be supplemented by state law that is more stringent. Because MDTelemed intends national practice, the Notice and operational workflows must account for applicable state restrictions rather than assume a single Nevada privacy rule governs all patients.
35. YOUR RIGHT TO INSPECT AND OBTAIN A COPY
You generally have the right to inspect and obtain a copy of PHI in a designated record set as provided by HIPAA, subject to permitted exceptions. MDTelemed has indicated that patient records can be made available in PDF format. Applicable law governs timing, fees, form/format, denials, and review rights.
36. ELECTRONIC COPY
If PHI is maintained electronically and applicable law requires an electronic copy in a requested form or format that is readily producible, MDTelemed will provide it as required. This Notice does not promise CSV, Excel, HL7, FHIR, or other formats that have not been verified as supported.
37. RIGHT TO REQUEST AMENDMENT
You may request amendment of PHI in a designated record set as permitted by HIPAA. MDTelemed may deny a request for reasons allowed by law. A request for amendment does not permit deletion or silent rewriting of the original medical record.
38. RIGHT TO AN ACCOUNTING OF DISCLOSURES
You may request an accounting of certain disclosures of PHI as provided by HIPAA. The accounting does not include every use or disclosure; statutory and regulatory exclusions apply.
39. RIGHT TO REQUEST RESTRICTIONS
You may ask MDTelemed to restrict certain uses or disclosures for treatment, payment, or health care operations. MDTelemed generally is not required to agree to every requested restriction, except where HIPAA creates a mandatory restriction.
40. SELF-PAY RESTRICTION TO HEALTH PLAN
When HIPAA's requirements are satisfied, a patient who pays a health care item or service out of pocket in full may require a covered provider not to disclose PHI about that item or service to a health plan for payment or health care operations. Because MDTelemed is currently self-pay, this right can be particularly relevant if a health-plan disclosure would otherwise occur.
41. CONFIDENTIAL COMMUNICATIONS
You may request that MDTelemed communicate with you about medical matters by alternative means or at alternative locations. Reasonable requests will be handled as required by law.
42. PAPER COPY
You have the right to obtain a paper copy of this Notice upon request even if you agreed to receive it electronically.
43. PERSONAL REPRESENTATIVES
A legally authorized personal representative may exercise privacy rights on your behalf to the extent required by HIPAA and applicable state law. Authority must be verified, and exceptions may apply in abuse, neglect, endangerment, minor-consent, or other circumstances.
44. MINORS
Parents and guardians often act as a minor's personal representative, but important exceptions exist. State law may allow minors to consent to specified services and may protect the confidentiality of those services. MDTelemed must apply the law of the relevant jurisdiction rather than automatically release every pediatric record to a parent.
45. DECEASED PERSONS
HIPAA protects a decedent's PHI for the period established by law. Personal representatives and family disclosures are governed by HIPAA and applicable state law.
46. BREACH NOTIFICATION
MDTelemed is required to provide breach notifications when the HIPAA Breach Notification Rule or other applicable law requires them. Not every security incident is legally a reportable breach; each event must be assessed under the governing standard.
47. MDTelemed'S DUTY TO PROTECT PHI
MDTelemed is required by law to maintain the privacy and security of PHI, provide this Notice where required, follow the duties and privacy practices described in the current Notice, and notify affected individuals when legally required following a breach.
48. SECURITY LANGUAGE
This Notice does not promise specific encryption algorithms, audit certifications, uptime, backup geography, MFA implementation, or security architecture that has not been independently verified. MDTelemed will maintain safeguards required by applicable law and its verified security program.
49. WEBSITE, COOKIES, PIXELS, AND TRACKING TECHNOLOGIES
Website and app tracking can raise HIPAA, FTC, state consumer-health-data, wiretap, privacy, advertising, and consent issues. MDTelemed's use of cookies, analytics, pixels, session technologies, or advertising tools must be governed by the separate Website & Consumer Privacy Policy and technical compliance program. This NPP does not authorize disclosure of PHI to advertising vendors merely because a cookie banner exists.
50. PORTAL AND ELECTRONIC COMMUNICATION
Patient portals, email, SMS, and secure messaging carry privacy and security risks. MDTelemed will use these channels according to applicable law, verified technical safeguards, and patient communication preferences where required.
51. RECORDING AND AI TELESCRIBE CONSENT
If audio is captured or processed for AI telescribing, MDTelemed must comply with applicable consent, wiretap/recording, HIPAA, state privacy, retention, and vendor-contract requirements. This Notice does not by itself substitute for any separate recording consent required by law.
52. TELEMEDICINE PRIVACY
Patients should use a reasonably private location and device when possible. MDTelemed will use reasonable safeguards, but cannot control people physically present at the patient's location, the patient's device security, or networks outside MDTelemed's control.
53. FAMILY AND FRIENDS INVOLVED IN CARE
With your agreement, opportunity to object, authorization, or as otherwise permitted by HIPAA, MDTelemed may share relevant PHI with family, friends, caregivers, or others involved in your care or payment for care. Disclosures should be limited to information relevant to that person's involvement.
54. DISASTER RELIEF
When permitted by HIPAA, MDTelemed may disclose limited PHI to authorized disaster-relief organizations or others to assist with notification and coordination.
55. COMMUNICATION PREFERENCES
You are responsible for keeping contact details accurate. Shared phones, family email accounts, voicemail, unlocked devices, and notification previews can expose information to others. Tell MDTelemed if you need a reasonable confidential-communication arrangement.
56. NO RETALIATION FOR PRIVACY COMPLAINTS
MDTelemed will not retaliate against you for exercising HIPAA rights or filing a good-faith privacy complaint.
57. COMPLAINTS TO MDTelemed
You may complain if you believe your privacy rights were violated. Send privacy complaints to: MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107; Support@MDTelemed.com. The production Notice should identify the formal privacy official/title and a verified phone number before publication if required by the final contact architecture.
58. COMPLAINTS TO HHS OCR
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Filing an internal complaint is not a prerequisite to exercising a right to complain to HHS.
59. NOTICE DELIVERY
For a direct-treatment covered provider, the HIPAA Notice generally must be provided no later than the first service delivery, including electronic service delivery, with special timing for emergency treatment. MDTelemed should provide the Notice electronically during registration/first service and keep it continuously accessible on its website.
60. ACKNOWLEDGMENT OF RECEIPT
MDTelemed should make the HIPAA-required good-faith effort to obtain acknowledgment of receipt of the Notice at first service delivery. A patient's refusal to acknowledge receipt does not eliminate lawful care or lawful HIPAA uses/disclosures; MDTelemed should document the effort and reason acknowledgment was not obtained.
61. ELECTRONIC ACKNOWLEDGMENT
HIPAA permits electronic acknowledgment mechanisms. MDTelemed's registration workflow should preserve auditable evidence of the Notice version presented, date/time, patient action, and any documented refusal or inability to acknowledge.
62. WEBSITE POSTING
A covered entity maintaining a website that provides information about customer services or benefits must prominently post and make its Notice available there. MDTelemed should provide a durable, printable copy and not bury the Notice solely inside account settings.
63. NOTICE AVAILABILITY
A current copy of this Notice will be made available to any person who asks for it as required by law.
64. CHANGES TO THIS NOTICE
MDTelemed may change this Notice and its privacy practices as permitted by law. Material changes require revision and distribution/availability steps required by HIPAA. The revised Notice may apply to PHI MDTelemed already maintains to the extent permitted by law.
65. STATE-SPECIFIC ADDENDA
MDTelemed may use state-specific privacy addenda where necessary. These addenda should be incorporated into the Notice architecture and patient-location workflow so that more stringent requirements are not lost inside a generic national notice.
66. RELATIONSHIP TO WEBSITE PRIVACY POLICY
The Website & Consumer Privacy Policy governs categories of data and activities beyond HIPAA PHI, including general website visitors, cookies, analytics, advertising technologies, consumer-health-data statutes, and state consumer privacy rights. Where HIPAA and another privacy law both apply, MDTelemed will apply the controlling requirements.
67. RELATIONSHIP TO MEDICAL RECORD POLICY
Medical-record access, amendment, retention, release, proxy access, and legal holds are addressed in related MDTelemed policies. Those operational policies must remain consistent with this Notice.
68. RELATIONSHIP TO BEHAVIORAL HEALTH POLICY
Psychiatric and behavioral-health information may receive additional protection under state law. Part 2 applies only when its statutory/regulatory conditions are met; psychiatric treatment alone does not automatically make MDTelemed a Part 2 program.
69. RELATIONSHIP TO PEDIATRIC POLICY
Minor consent and confidentiality vary by state and service. Pediatric portal access, proxy access, billing communications, pharmacy communications, laboratory results, and record release must be configured to avoid exposing confidential minor services unlawfully.
70. RELATIONSHIP TO MARKETING/SMS POLICY
Clinical reminders and promotional communications are legally distinct. MDTelemed should preserve opt-in/opt-out records and apply HIPAA, TCPA, CAN-SPAM, state automatic-renewal/consumer law, and other applicable rules to the appropriate communication.
71. RELATIONSHIP TO QUALITY/PEER REVIEW
HIPAA permits qualifying health-care operations, including certain quality activities, but that does not mean every QA document is part of the patient's designated record set or that every peer-review document is privileged. Related MDTelemed policies address those distinctions.
72. NO WAIVER OF MORE PROTECTIVE RIGHTS
Nothing in this Notice is intended to waive a privacy, confidentiality, access, consent, or complaint right that applicable law makes nonwaivable.
73. EFFECTIVE DATE
Effective September 15, 2026 | Version 1.0
74. CONTACT
MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Privacy Contact: Support@MDTelemed.com
75. PATIENT RIGHTS — QUICK REFERENCE
Get a copy of your health information as provided by law. Ask us to correct or amend qualifying health information. Request confidential communications. Ask us to limit certain uses or disclosures. Receive the mandatory self-pay health-plan restriction when HIPAA's conditions are satisfied. Request an accounting of certain disclosures. Get a paper copy of this Notice. Choose someone legally authorized to act for you. Complain to MDTelemed or HHS OCR without retaliation.
76. PRIMARY REFERENCES
45 C.F.R. § 164.520 — HIPAA Notice of Privacy Practices. 45 C.F.R. Parts 160 and 164 — HIPAA Privacy, Security, Breach Notification, and Enforcement Rules. U.S. Department of Health and Human Services, Office for Civil Rights, Notice of Privacy Practices for Protected Health Information. HHS, Revised February 2026 Model Notice of Privacy Practices for HIPAA Covered Health Care Providers. HHS, Model Notices of Privacy Practices — February 2026 Part 2-related updates. 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2 — confidentiality of substance use disorder patient records, when applicable. HHS, HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy — current guidance regarding the June 18, 2025 partial vacatur and surviving NPP modifications. Applicable state medical-privacy, mental-health, minor-consent/confidentiality, genetic, HIV/STI, reproductive-health, consumer-health-data, biometric, breach-notification, and medical-record laws.
80. RELATED MDTelemed POLICIES
Website & Consumer Privacy Policy; Terms of Use; Patient Bill of Rights & Responsibilities; Telehealth Informed Consent; Pediatric Care & Minor Rights; Behavioral Health; Data Security & Cybersecurity; Grievances & Complaints; Medical Records Access; Records Retention; Breach/Incident Response; Third-Party Business Associates & BAAs; Quality Assurance & Peer Review; and later state/privacy addenda as adopted.