Privacy Policy

1. Introduction

Nutripro NY Inc. ("Nutripro," "we," "us," or "our") is a New York State Social Care Network (SCN) approved vendor that provides nutrition services to eligible Medicaid members in the Bronx, NY. We are committed to protecting the privacy and security of your personal information, including Protected Health Information (PHI), in compliance with:

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• The Health Information Technology for Economic and Clinical Health (HITECH) Act
• New York Public Health Law Article 27-F
• New York Civil Rights Law Section 79-l
• The NY SHIELD Act

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our services, including our website and meal assistance programs.

2. Information We Collect

We collect the following categories of information to determine eligibility and provide nutrition services:

3. How We Use Your Information

We use your information solely for the following purposes:

• To determine your eligibility for SCN Enhanced Nutrition Services
• To coordinate and deliver medically tailored meals
• To communicate with you about your application status and services
• To comply with Medicaid reporting requirements and SCN program obligations
• To coordinate with your Managed Care Organization (MCO) and Health Home as required by the SCN program
• To analyze website traffic and measure the effectiveness of our outreach efforts
• To improve the quality of our nutrition services

4. HIPAA Compliance

As a Medicaid vendor handling PHI, we comply with all applicable provisions of HIPAA and the HITECH Act, including:

• Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164): We implement policies and procedures to protect the privacy of PHI, limit uses and disclosures to the minimum necessary, and provide you with rights regarding your health information.
• Security Rule (45 CFR Part 160 and Subparts A and C of Part 164): We implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI).
• Breach Notification Rule: In the event of a breach of unsecured PHI, we will notify affected individuals, the U.S. Department of Health and Human Services (HHS), and the New York State Attorney General as required by law.

5. New York State Specific Protections

In addition to federal HIPAA requirements, we comply with the following New York State laws:

• NY Public Health Law Article 27-F: Provides heightened protections for HIV/AIDS-related information. We will not disclose HIV-related information without your specific written authorization.
• NY Mental Hygiene Law Section 33.13: Protects the confidentiality of mental health records. Mental health information is subject to additional restrictions on disclosure.
• NY Civil Rights Law Section 79-l: Protects the confidentiality of substance use disorder records, consistent with 42 CFR Part 2 federal regulations.
• NY SHIELD Act: We implement reasonable safeguards to protect the security, confidentiality, and integrity of private information of New York residents.
• NY General Business Law Section 899-aa: We will provide timely notification in the event of a security breach involving your personal information.

6. Data Security Measures

We implement the following safeguards to protect your information:

• Administrative: Workforce training on HIPAA compliance, role-based access controls, regular risk assessments, incident response procedures, and Business Associate Agreements (BAAs) with vendors.
• Technical: Encryption of data in transit (TLS/SSL), encryption of data at rest, unique user identification and authentication, automatic session timeouts, and audit logging of access to PHI.
• Physical: Secure data center hosting, facility access controls, workstation security policies, and device and media controls.

7. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies, including tools provided by Google and Meta (Facebook). These tools help us understand site usage and measure the effectiveness of our outreach. By using our website, you consent to the use of these technologies. These tools are used only in connection with our marketing website and are never used to process or transmit PHI.

You may adjust your browser settings to manage cookies, though some features of the site may not function as intended if you do so.

8. When We May Disclose Your Information

We may disclose your PHI without additional authorization only in the following circumstances as permitted by HIPAA and NYS law:

• Treatment, Payment, and Health Care Operations: To coordinate your nutrition services with your health plan and healthcare providers.
• SCN Program Requirements: To your Managed Care Organization (MCO) and the NYS Department of Health as required by the SCN program.
• As Required by Law: When mandated by federal, state, or local law.
• Public Health Activities: For public health reporting as required by the NYS Department of Health.

We will never sell your personal information or use your PHI for marketing purposes. Any disclosure not listed above requires your explicit written authorization.

9. Your Rights Under HIPAA and NYS Law

You have the following rights regarding your health information:

• Right to Access: You may request a copy of your PHI that we maintain.
• Right to Amend: You may request corrections to your PHI if you believe it is inaccurate or incomplete.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI.
• Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI.
• Right to Confidential Communications: You may request that we communicate with you through alternative means or at alternative locations.
• Right to Revoke Authorization: You may revoke any written authorization you have given us at any time, except to the extent we have already acted on it.
• Right to File a Complaint: You may file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. Filing a complaint will not affect your services.

10. Data Retention

We retain your PHI for a minimum of six (6) years from the date of creation or the date when it was last in effect, whichever is later, as required by HIPAA (45 CFR 164.530(j)). New York State law may require longer retention periods for certain types of records. After the applicable retention period, records are securely destroyed in accordance with our data destruction policies.

Website usage data collected through analytics tools is retained according to the data retention settings of those third-party platforms.

11. Children's Privacy

When we collect information about minor children as part of household eligibility determinations, a parent or legal guardian must provide consent. We apply the same HIPAA protections to children's PHI as we do to adult PHI, with additional protections as required by New York State law.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. If we make material changes to how we treat your PHI, we will notify you by posting the updated policy on this page with a new "Last Updated" date. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

13. Contact & Privacy Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or want to file a complaint, please contact our Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr or the New York State Attorney General at ag.ny.gov.