Patient Communications Privacy Policy For Text Messaging, Email & Voicemail

• We text, email, and leave voicemails only with your consent, and only for the purposes you agreed to the following: appointment reminders, scheduling, care coordination, billing, and (if you separately opt in) practice updates.
• Text messages and standard email are not encrypted end-to-end. We keep protected health information (PHI) in them to the minimum necessary and send detailed clinical information through our secure patient portal instead.
• Reply STOP to any text to stop texts. Reply HELP for help. You can withdraw consent for email or voicemail at any time by calling (910) 621-7410.
• Your phone number, email address, and opt-in consent are never sold or shared with third parties for marketing.
• Consent to receive texts, emails, or voicemails is not a condition of receiving care.

• HIPAA Privacy Rule  permits us to use PHI for treatment, payment, and health care operations, and requires us to accommodate reasonable requests to receive communications by alternative means (45 C.F.R. §164.522(b)). HHS guidance confirms that covered entities may communicate with patients by unencrypted text or email when the patient has been informed of the risk and chooses that channel.
• HIPAA Security Rule  requires administrative, physical, and technical safeguards for electronic PHI; we apply them as described in Section 7.
• Telephone Consumer Protection Act (TCPA) and FCC rules  require prior express consent for automated texts and calls to mobile numbers; health-care treatment messages are permitted with consent, marketing messages require prior express written consent.
• CTIA Messaging Principles and carrier A2P 10DLC requirements  require clear opt-in, STOP/HELP handling, and a public statement that opt-in data is not shared.
• North Carolina law  including N.C. Gen. Stat. §75-60 et seq. (Identity Theft Protection Act, breach notification), §90-21.20B (confidentiality of medical information), and N.C. Medical Board rules on patient communications and record retention.

You opt in to text messages by one of the following: checking the text-message consent box on our intake or website form, providing your mobile number to our staff and verbally agreeing to receive texts (documented in your chart), or texting us first. When you opt in, you will receive a one-time confirmation text describing the program and how to opt out.

TEXT-MESSAGE CONSENT LANGUAGE USED ON OUR FORMS

By providing my mobile number and checking this box, I agree to receive text messages from Sandhills Functional Medicine, PLLC at the number provided, including appointment reminders, scheduling, care-coordination, billing, and account messages. Message frequency varies. Message and data rates may apply. Reply STOP to cancel at any time or HELP for help. Consent is not a condition of purchase or of receiving care. I understand that text messages are not encrypted and may be viewed by anyone with access to my phone. See our Communications Privacy Policy at sandhillsfunctionalmedicine.com/communications-privacy-policy.html.

Marketing texts (promotions, new services, events) require a separate, clearly labeled opt-in and are never bundled with treatment or appointment messages. You can stop marketing texts while continuing to receive appointment reminders.

By providing your email address on an intake, website, or scheduling form you consent to receive transactional and care-related email. Marketing and educational email requires a separate opt-in, and every such email includes an unsubscribe link.

By providing a telephone number you consent to us calling and, if you do not answer, leaving a limited voicemail as described in Section 3. If you do not want voicemails left, or want them left only at a specific number, tell us and we will note it in your chart.

Standard SMS and email travel over networks we do not control, can be misdirected if a number or address changes, and can be read by anyone with access to your device or account. By opting in, you acknowledge these risks and choose these channels anyway. You may switch to portal-only communication at any time.

• Confidential communications  you may ask us to contact you only by a certain method or at a certain location (e.g., "text only, never call my work number"). We will accommodate all reasonable requests without asking why (45 C.F.R. §164.522(b)).
• Restrictions  you may ask us to limit what we include in messages beyond what this policy already provides.
• Access  you may request copies of text and email communications that are part of your designated record set.
• Accounting  you may request an accounting of certain disclosures of your PHI.
• Revocation you may revoke any consent under this policy at any time; revocation is prospective and does not affect messages already sent.

Requests may be made in person, by phone, by portal message, or in writing to the Privacy Officer at the address in Section 11.

Your mobile number, email address, message content, and opt-in/opt-out status are used only to deliver the communications described in this policy and to maintain required consent records. We share them only with:

• Decoda Health and its sub-processors, under HIPAA Business Associate obligations, solely to deliver and store messages;
• Telecommunications carriers, solely to route messages to your device;
• Others as required by law or as described in our Notice of Privacy Practices.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties. We do not sell contact information or message content.

If a message containing PHI is sent to the wrong number or address, or a messaging system is compromised, we follow the HIPAA Breach Notification Rule (45 C.F.R. §§164.400–414) and the North Carolina Identity Theft Protection Act (N.C. Gen. Stat. §75-65). Depending on the risk assessment, this may include notifying you without unreasonable delay and no later than 60 days after discovery, notifying the U.S. Department of Health and Human Services, and notifying the North Carolina Attorney General.

If you receive a message from us that was not intended for you, please do not forward it; reply or call (910) 621-7410 so we can correct our records, then delete it.

We may revise this policy as law, carrier requirements, or our systems change. The effective date at the top of this page will be updated, the current version will always be posted at this address, and material changes will be communicated through the channels you have consented to.