Notice of Privacy Practices

HIPAA Privacy Notice & Data Security

Under the Health Insurance Portability and Accountability Act (HIPAA), you have rights regarding your Protected Health Information (PHI). Patient-to-physician communication through PushHealth uses its bank-grade end-to-end encryption and HIPAA-oriented platform. Ayah Health also applies reasonable administrative, physical, and technical safeguards to the systems it uses for intake, clinical documentation, and care coordination.

• Ayah Health does not sell your PHI. Uses for marketing or a sale of PHI require your written authorization unless a narrow legal exception applies.
• Information is transmitted through encrypted connections and access is limited to authorized persons who need it for permitted purposes.
• You have the right to request access to or copies of your digital health chart at any time.
• Our technology vendors — including PushHealth (patient platform), Quest Diagnostics (laboratory services), and Google Cloud (our AI-assisted intake infrastructure) — act as Business Associates under HIPAA and are bound by written Business Associate Agreements to protect your PHI to the same standard we do.
• Some intake information may be processed with AI-assisted technology running within Google Cloud services covered by Ayah Health's Business Associate Agreement. The system collects and organizes patient-provided information and may prepare physician-facing drafts; it does not diagnose, prescribe, place orders, authorize treatment, or independently make clinical decisions. Dr. Akram's review and clinical judgment govern management. See our Telehealth Informed Consent for full detail.

How We May Use & Disclose Your Health Information

We may use and disclose your PHI without a separate written authorization when HIPAA or another law permits or requires it, including for:

• To address workers' compensation matters, respond to lawful health-oversight activity, or assist law enforcement when the applicable legal requirements are met.
• To respond to lawsuits and legal proceedings, including a valid court or administrative order and other process permitted by law.
• To work with a medical examiner, coroner, funeral director, or organ-procurement organization as allowed by law.
• For certain government functions, including military, national-security, and protective-services activities where authorized by law.

Any use or disclosure not described in this notice requires your written authorization unless the law allows otherwise. You may revoke an authorization in writing at any time, except to the extent action has already been taken in reliance on it.

Your Choices

When you tell us your preference, we may share relevant information with family, friends, or another person involved in your care or payment for care, and we may share information for disaster-relief purposes. If you cannot tell us your preference, we may share information when professional judgment and law permit and when it is in your best interest.

We will obtain your written permission before most uses of psychotherapy notes, most marketing uses, or a sale of PHI. Ayah Health does not currently conduct fundraising using patient information. If that changes, any communication will include a clear way to opt out.

Your Rights Regarding Your Health Information

Substance Use Disorder Records

If Ayah Health receives or maintains a substance use disorder patient record protected by 42 C.F.R. Part 2, additional federal confidentiality protections apply. With a valid consent for treatment, payment, and health care operations, a HIPAA-covered recipient may use and redisclose that record as HIPAA permits, subject to Part 2's special restrictions.

• A Part 2 record, or testimony describing its contents, generally may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you give specific written consent or a court order meeting Part 2 requirements authorizes it.
• Separate written consent is required for most uses or disclosures of substance-use-disorder counseling notes.
• If Part 2 information is used for fundraising, you must receive clear advance notice and a meaningful opportunity to opt out.
• A breach involving unsecured Part 2 records is subject to applicable breach-notification requirements.

State Jurisdictional Compliance

Telehealth services delivered by Dr. Ahsan Akram through Ayah Health PLLC are restricted exclusively to patients physically present in the state of Texas or the state of Florida at the time of consultation.

Federal & State Controlled Substances Policy

In strict compliance with DEA guidelines and federal law (including Ryan Haight Act mandates), Ayah Health does NOT prescribe DEA Schedule II–V controlled substances.

Direct-Pay Financial Policy

Ayah Health operates as an independent direct-pay medical service. We do not bill health insurance companies, Medicaid, or Medicare directly. Patients may utilize HSA/FSA cards or standard payment cards. Itemized receipts can be accessed through your patient portal for potential out-of-network reimbursement, though reimbursement is not guaranteed by third-party insurers.

Breach Notification

In the unlikely event that a breach of your unsecured Protected Health Information occurs, Ayah Health PLLC will notify you without unreasonable delay, and in accordance with the timelines and requirements of the HIPAA Breach Notification Rule and applicable state law (Texas or Florida, depending on where your visit takes place).

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you authorize it in writing; you may revoke that permission in writing at any time, except for action already taken in reliance on it.
• We reserve the right to change the terms of this notice, and any changes will apply to information we already have as well as information we receive in the future. Any revised notice will be posted on this page.

Filing a Complaint