Notice of Privacy Practices (NPP)
Effective Date: April 1, 2026 | Covered Entity: Valor Massage LLC
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Protected Health Info
Your treatment notes, intake records, diagnoses, and payment details are safeguarded under federal HIPAA laws.
Your Patient Rights
You have the right to inspect, copy, amend, and request restrictions or an accounting of disclosures of your records.
Strict BAAs & Safeguards
All digital scheduling, EHR, and billing vendors execute mandatory HIPAA Business Associate Agreements (BAAs).
1. Our Legal Duty & Commitment to HIPAA
Valor Massage LLC is required by law to maintain the privacy and security of your Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable North Carolina state laws.
We are required to provide you with this Notice of Privacy Practices detailing our legal duties, our privacy practices, and your rights regarding your PHI. We are obligated to follow the terms of this Notice currently in effect.
2. How We May Use and Disclose Your Health Information
We may use or disclose your PHI for treatment, payment, and healthcare operations without requiring your prior written authorization:
- For Treatment: We may share your health information with licensed massage therapists, physical therapists, chiropractors, physicians, or VA healthcare coordinators involved in your care to provide customized bodywork and clinical rehabilitation.
- For Payment: We use and disclose PHI to bill and collect payment from you, health savings accounts (HSA/FSA), the VA Community Care Network (VACCN), or third-party payers for services rendered.
- For Healthcare Operations: We may use PHI to evaluate clinical quality, assess practitioner performance, conduct training, run internal audits, and maintain compliance.
- Appointment Reminders & Communications: We may contact you via phone, SMS, secure portal message, or email to confirm appointments or send care-related reminders.
- Required by Law or Public Health: We may disclose PHI when required by federal or state mandate, court order, public health reporting (e.g., disease control), worker's compensation, or health oversight activities.
3. Business Associate Agreements (BAAs) & Encryption
To operate our clinical practice, we utilize third-party digital infrastructure vendors for electronic health record (EHR) management, online appointment scheduling, telehealth communication, secure intake forms, and billing processing.
Mandatory Business Associate Agreements: Every technology platform, cloud host, or service provider that handles, processes, or stores PHI on our behalf is legally bound by a HIPAA Business Associate Agreement (BAA). These agreements mandate that vendors enforce equivalent administrative, technical, and physical safeguards.
Named Business Associate: Valor Massage LLC has executed a HIPAA-compliant Business Associate Agreement (BAA) with Personameant Solutions LLC, our technology and infrastructure partner. This agreement ensures that Personameant Solutions LLC adheres to all HIPAA Security and Privacy Rule requirements when handling, processing, or storing Protected Health Information (PHI) on our behalf, including breach notification obligations and data safeguarding protocols.
Technical Security Standards: All electronic PHI (ePHI) is encrypted both in transit (using TLS 1.2+ protocol) and at rest (using AES-256 bit encryption). Access to health data is protected by role-based authorization, automated session timeouts, multi-factor authentication, and audited log controls.
4. Your Individual Rights Under HIPAA
As a patient of Valor Massage, you possess specific federal rights regarding your protected health records:
Right to Inspect & Copy
You have the right to inspect and obtain an electronic or paper copy of your medical and billing records. Requests must be made in writing; copies are provided within 30 days.
Right to Amend Records
If you feel your health information is incorrect or incomplete, you may submit a written request to amend your file. We will review and respond in writing within 60 days.
Accounting of Disclosures
You can request a list (an accounting) of disclosures of your health information made for purposes other than treatment, payment, or routine healthcare operations for up to 6 years prior.
Right to Request Restrictions
You have the right to request restrictions on how we use or share your PHI for treatment or payment. If you pay out-of-pocket in full, you may restrict disclosures to your health insurer.
Confidential Communications
You may request that we communicate with you in a specific way or at an alternative location (e.g., calling a cell phone instead of home, or mailing to a P.O. Box).
Paper Copy of This Notice
You are entitled to receive a physical paper copy of this Notice of Privacy Practices at any time upon request at our physical office locations.
5. Breach Notification Obligations
In the unlikely event of an unauthorized acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of your health data, Valor Massage is required by law to notify affected individuals without unreasonable delay, and no later than 60 days following discovery of the breach. Notifications will include the nature of the event, steps taken to mitigate harm, and protective guidance.
6. Right to File a Complaint
If you believe your privacy rights have been violated, or if you disagree with a decision we made regarding access to your health records, you have the right to file a complaint directly with Valor Massage or with the Secretary of the U.S. Department of Health and Human Services (HHS).
We will not retaliate against you in any way for filing a complaint.
To file a complaint with HHS:
Office for Civil Rights, U.S. Department of Health and Human Services
200 Independence Avenue, S.W., Washington, D.C. 20201
Phone: 1-870-368-1019 | TDD: 1-800-537-7697 | Web: www.hhs.gov/ocr/privacy/hipaa/complaints/
7. Privacy Officer Contact Information
To exercise your HIPAA rights, request a copy of your records, or contact our Privacy Officer regarding health data concerns:
Email Privacy Officer
contact@valormassage.com
Phone
(910) 514-6251
