Legal

HIPAA & Health Information Statement

Effective and last updated: October 23, 2026

Holistic Pathways Legal Advisors reviews medical records as part of legal nurse consulting engagements for attorneys. This statement explains how we protect health information, when the Health Insurance Portability and Accountability Act (HIPAA) applies to our work, and what attorneys and the public should know.

Do not send medical records, patient names, dates of birth, medical record numbers or other protected health information (PHI) through this website, its contact form or ordinary email. The form is for a brief, de-identified description of a matter. After an engagement is confirmed, records move only through an encrypted channel set up for that matter.

1. Our role under HIPAA

Holistic Pathways does not treat patients or bill health plans, so in its consulting work it is not a HIPAA "covered entity." This statement is therefore not a Notice of Privacy Practices under 45 CFR 164.520. HIPAA can still apply to an engagement, depending on who retains us:

• Plaintiff-side engagements: records usually reach us through the patient's own attorney, under a HIPAA-compliant authorization (45 CFR 164.508), subpoena or court order (45 CFR 164.512(e)). A Business Associate Agreement is generally not required, but we apply the same safeguards.
• Defense-side engagements: when the retaining firm is a business associate of a covered entity, such as defense counsel for a hospital, physician group or insurer, we act as its subcontractor business associate (45 CFR 160.103). We sign a Business Associate or subcontractor agreement before receiving any PHI.

2. Our commitments when we act as a business associate

• Use and disclose PHI only as the Business Associate Agreement permits or the law requires, limited to the minimum necessary for the engagement.
• Keep administrative, physical and technical safeguards that meet the HIPAA Security Rule (45 CFR Part 164, Subpart C).
• Report any use or disclosure not permitted by the agreement, including a breach of unsecured PHI, to the retaining firm without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410), or sooner if the agreement requires.
• Require any subcontractor that handles PHI to agree in writing to the same restrictions.
• Help the covered entity respond to individuals' requests for access, amendment or an accounting of disclosures, when the agreement requires.
• Make our practices and records available to the U.S. Department of Health and Human Services when required to show compliance.
• Return or securely destroy PHI when the engagement ends, unless a litigation hold or law requires us to keep it.

3. Safeguards on every engagement

• PHI is encrypted in transit and at rest.
• Access is limited to the reviewing clinician and any staff bound by a signed confidentiality agreement.
• Multi-factor authentication protects every device and account with access to case materials.
• PHI is never sent through personal email or unsecured file-sharing services, and never through this website or its form provider.
• Records are kept only as long as the engagement, a litigation hold or the law requires, then destroyed using methods consistent with HHS guidance for making PHI unusable, unreadable or indecipherable.

4. Specially protected records

Some records carry protections beyond HIPAA. We flag them at intake, follow any protective order, and handle them under the applicable rules, including:

• substance use disorder treatment records covered by 42 CFR Part 2, including its limits on redisclosure;
• psychotherapy notes and mental health records protected by state law, such as the Michigan Mental Health Code;
• HIV/AIDS, communicable disease and genetic test information, including information protected by the Genetic Information Nondiscrimination Act; and
• records of minors and reproductive health information protected by state law.

5. Protective orders and litigation holds

When a court has entered a protective order or qualified protective order, we follow its terms for use, storage, return and destruction of records. When counsel issues a litigation hold, we preserve the covered materials until counsel releases the hold in writing.

6. If you are a patient

If your records are part of a legal matter we are working on, your HIPAA rights, such as access, amendment and accounting of disclosures, are exercised through the healthcare provider or health plan that holds your records, or through your attorney. You can also contact us and we will direct your request to the right party. You may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints.

7. Questions

How a specific engagement will handle PHI can be agreed and documented in writing before any records are exchanged. Contact intake@holisticpathwaylegal.com or +1 (248) 249-2725.