Bivvy Health is not a HIPAA covered entity, is not a health plan, and is not a medical provider. Because Bivvy does not deliver care and does not hold medical records, Bivvy does not issue a HIPAA Notice of Privacy Practices. The providers who treat you do, and this page explains where to find theirs.
Who holds your medical record
When you start a visit, the treating clinician creates a medical record. That record is created, held, and maintained by the treating provider and DrCare247, who are HIPAA covered entities. Your rights under HIPAA — to get a copy of your record, to ask for a correction, to request an accounting of disclosures, to request restrictions, and to be notified of a breach of your protected health information — run to them.
You will receive their Notice of Privacy Practices when you begin care. You can request a copy at any time through the care portal, or email us at support@bivvyhealth.com and we will point you to the right place.
What Bivvy holds
Bivvy runs the membership: signup, your account, your family roster, and billing. The information Bivvy holds is limited to:
- Your name, date of birth, sex, email, phone, and mailing address;
- The name, date of birth, and sex of any family members you add to your plan;
- Your plan, membership status, and billing history (card numbers are held by Stripe, not by Bivvy); and
- Messages you send us.
Bivvy does not receive your clinical records. Bivvy does not receive your diagnoses, visit notes, test results, or prescriptions.
Your roster covers the children under 18 on your plan. Every member 18 and over holds their own Bivvy account, and their information sits under that account rather than yours. If you pay for an adult member's seat, you see the billing line item for it and nothing about their care.
How Bivvy protects what it holds
Sensitive fields are encrypted in transit and at rest, with field-level encryption backed by managed keys (Google Cloud KMS). Access is limited to the people who need it and is logged. Where a vendor handles information on our behalf and a Business Associate Agreement is appropriate, we put one in place. No system is perfectly secure, but we work to protect your information and we will tell you if something goes wrong.
Getting a copy of your medical record
Request it from the treating provider through the care portal. Bivvy cannot produce your medical record because Bivvy does not have it. If you have trouble reaching the provider, email support@bivvyhealth.com and we will help you get to the right contact.
Your rights in the information Bivvy does hold
You can access, correct, delete, or export your Bivvy account information. See our Privacy Policy for how to make a request and how quickly we respond. If you live in Washington, Nevada, or Connecticut, see also our Consumer Health Data Privacy Policy.
Questions or complaints
Email privacy@bivvyhealth.com. If your concern is about your medical record or the care you received, the treating provider and DrCare247 are the right contacts, and you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.