Marula Rehab Telehealth - Breach Notification Disclosure

Marula Rehab Telehealth is committed to protecting the privacy and security of your health information. In accordance with federal law, Utah law, and telehealth‑specific confidentiality requirements, we provide the following disclosure regarding how we handle any unauthorized access, use, or disclosure of your protected health information (“PHI”).

 

1. Definition of a Breach

• A breach is defined under the HIPAA Breach Notification Rule (45 C.F.R. § 164.402) as:
• “The acquisition, access, use, or disclosure of protected health information in a manner not permitted by HIPAA which compromises the security or privacy of the information.”
• A breach may include:
• Unauthorized access to telehealth session data
• Loss or theft of devices containing PHI
• Improper disclosure of SUD or alcohol‑treatment information
• Cybersecurity incidents affecting stored or transmitted PHI
• Unauthorized access to patient portals or telehealth platforms
• Under Utah Code § 13‑44‑202, a breach also includes unauthorized acquisition of computerized personal information that compromises its security, confidentiality, or integrity.

2. Our Duty to Notify You

• If Marula Rehab Telehealth discovers a breach of your PHI, we are legally required to notify you without unreasonable delay, and no later than 60 days from the discovery of the breach, as required by:
• HIPAA Breach Notification Rule (45 C.F.R. § 164.404)
• HITECH Act (42 U.S.C. § 17932)
• Utah Data Breach Notification Act (Utah Code § 13‑44‑202)
• If the breach involves substance use disorder treatment information, additional protections may apply under 42 U.S.C. § 290dd‑2 and 42 C.F.R. Part 2, depending on the nature of the program and the information involved.

3. How We Will Notify You

• Notification will be provided in writing and may be delivered by:
• First‑class mail
• Secure electronic communication (if you have consented to electronic notices)
• If contact information is outdated or insufficient, we may use:
• Substitute notice
• Website posting
• Local media notice (required for breaches affecting 500+ individuals)

4. What the Breach Notice Will Include

• Your notification will include all elements required by 45 C.F.R. § 164.404(c):
• A description of what happened, including the date of the breach and discovery
• The types of information involved (e.g., name, date of birth, diagnosis, treatment details)
• Whether the information was encrypted or otherwise protected
• Steps you should take to protect yourself
• What Marula Rehab Telehealth is doing to investigate, mitigate harm, and prevent future breaches
• Contact information for questions or assistance

5. Notification to Government Agencies

• If a breach affects:
• Fewer than 500 individuals: We will notify the U.S. Department of Health & Human Services (HHS) annually.
• 500 or more individuals: We will notify HHS without unreasonable delay, and We will notify prominent media outlets as required by 45 C.F.R. § 164.406.
• Under Utah Code § 13‑44‑202(5), we may also be required to notify:
• Utah Attorney General
• Utah Department of Health & Human Services
• Consumer reporting agencies (in certain cases)

6. Protection of Telehealth Data

• Marula Rehab Telehealth uses:
• HIPAA‑compliant encrypted telehealth platforms
• Secure, encrypted data storage
• Access controls and authentication
• Audit logs and monitoring
• Cybersecurity safeguards required under HIPAA Security Rule (45 C.F.R. §§ 164.302–318)
• If a breach involves telehealth session data, we will disclose:
• Whether video, audio, chat, or file‑sharing data was affected
• Whether the telehealth platform vendor was involved
• Whether third‑party systems were impacted

7. Your Rights After a Breach

• You have the right to:
• Receive a complete breach notification
• Request copies of your medical records
• Request amendments to your records
• Request restrictions on disclosures
• File a complaint with Marula Rehab Telehealth
• File a complaint with the U.S. Department of Health & Human Services Office for Civil Rights (OCR)
• File a complaint with the Utah Department of Health & Human Services
• You will not be retaliated against for exercising your rights.

8. Contact Information

• If you believe your information has been compromised or you have questions about a breach notification, contact:
• Marula Rehab Telehealth
• Privacy & Compliance Office Phone: Contact Email: HIPAA‑secure email Address: 2728 N. Canyon Rd. Pleasant Grove Utah 84062