Notice of Privacy Practices

Who this notice is from

This Notice of Privacy Practices is issued by Tickortreat Medical, P.A., a Delaware professional corporation that provides telehealth evaluation and prescription of single-dose doxycycline prophylaxis for Lyme disease prevention following qualifying tick bites. Tickortreat Medical, P.A. is the “covered entity” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that is responsible for protecting your health information.

Tickortreat Medical, P.A. receives administrative, technology, billing, and support services from Tickortreat LLC, which operates the Tickortreat website and platform. Tickortreat LLC is a HIPAA “business associate” of Tickortreat Medical, P.A. under a Business Associate Agreement executed between the two entities on July 31, 2026, and is contractually bound to protect your protected health information to the same standard as Tickortreat Medical, P.A.

This Notice applies to all protected health information held by Tickortreat Medical, P.A. and by Tickortreat LLC acting on its behalf, in any form — electronic, paper, or oral.

Our duties

Tickortreat Medical, P.A. is required by law to:

• Maintain the privacy and security of your protected health information
• Give you this Notice of our legal duties and privacy practices with respect to your health information
• Follow the terms of the Notice that is currently in effect
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information
• Train our workforce on HIPAA compliance and maintain a designated Privacy Officer

We reserve the right to change the terms of this Notice. Any change will apply to all protected health information we maintain. We will post any revised Notice on this page prominently, and the effective date of the revised Notice will be stated at the top.

How we may use and disclose your protected health information

Uses and disclosures that do not require your authorization

HIPAA permits Tickortreat Medical, P.A. to use and disclose your protected health information without your separate written authorization for the following purposes:

Treatment. We use your health information to evaluate your tick-bite exposure, make a clinical decision about whether single-dose doxycycline prophylaxis is appropriate for you, and, where appropriate, transmit a prescription to the pharmacy you select. We may also share your information with other healthcare providers you ask us to coordinate with (for example, your primary care provider or your pharmacist).

Example: We transmit your prescription electronically through our e-prescribing network to the retail pharmacy you select at intake.

Payment. We use your information to process payment for your clinical evaluation.

Example: We provide a receipt and, on request, an itemized superbill that you may submit to your insurance carrier for potential reimbursement.

Health care operations. We use your information for quality assurance, clinical protocol review and improvement, peer review of our clinicians, training, and routine administrative functions necessary to run the service.

Example: Our Medical Director conducts a stratified random sample review of signed encounters for protocol adherence and documentation quality.

Business associates. We disclose your protected health information to Tickortreat LLC and to other business associates (our hosting provider, e-prescribing partner, and productivity suite) under HIPAA Business Associate Agreements that bind them to the same privacy and security standards that apply to us.

As required by law. We will disclose your health information when required to do so by federal, state, or local law.

Public health activities. We may disclose your information to public health authorities for purposes such as disease reporting, adverse-event reporting to the FDA, and the prevention or control of disease.

Health oversight activities. We may disclose your information to health oversight agencies for activities authorized by law — including audits, investigations, inspections, licensure, and disciplinary actions.

Judicial and administrative proceedings. We may disclose your information in response to a court or administrative order, or in certain circumstances in response to a subpoena or discovery request.

Law enforcement. We may disclose your information to law enforcement officials in limited circumstances specified by HIPAA, such as to comply with a court order or in response to a grand jury subpoena.

Serious threats to health or safety. We may use and disclose your information when necessary to prevent or lessen a serious and imminent threat to your health or safety or that of the public.

Victims of abuse, neglect, or domestic violence. We may disclose your information to appropriate authorities if we reasonably believe you are a victim of abuse, neglect, or domestic violence, consistent with applicable law.

Uses and disclosures that require your written authorization

For any use or disclosure of your protected health information outside the categories above, we will obtain your explicit written authorization first. In particular, authorization is required for:

• Marketing — any communication that encourages you to purchase a product or service, other than communications about the service you are already receiving
• The sale of protected health information — we do not and will not sell your PHI
• Most uses and disclosures of psychotherapy notes (not applicable to the Tickortreat service, which does not provide psychotherapy)

You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.

Your rights

As the subject of protected health information held by Tickortreat Medical, P.A., you have the following rights. To exercise any of them, contact our Privacy Officer at the address below.

Right to access. You may inspect and request a copy of your protected health information, in paper or electronic format. We will respond within 30 days of your request. We may charge a reasonable, cost-based fee for copies, consistent with HIPAA.

Right to amend. You may request that we correct inaccurate or incomplete information in your records. We will respond within 60 days. If we deny the request, we will tell you why in writing, and you will have the right to submit a statement of disagreement that becomes part of your record.

Right to request restrictions. You may request that we restrict how we use or disclose your protected health information for treatment, payment, or healthcare operations. We will consider the request but are not required to agree in all cases, except where HIPAA specifically requires us to agree — for example, we must agree to a restriction on disclosure to a health plan if you have paid for the service in full out of pocket.

Right to confidential communications. You may request that we communicate with you about your health information in a particular way or at a particular location — for example, by email only rather than by phone, or at an address other than your home.

Right to an accounting of disclosures. You may request a list of certain disclosures of your protected health information made by us or by our business associates in the six years prior to your request. This list excludes disclosures for treatment, payment, or healthcare operations, and certain other categories specified by HIPAA.

Right to a paper copy of this Notice. You may request a paper copy of this Notice of Privacy Practices at any time, even if you have already received or viewed it electronically.

Right to breach notification. If your unsecured protected health information is affected by a breach, Tickortreat Medical, P.A. will notify you promptly in accordance with the HIPAA Breach Notification Rule at 45 CFR 164.400 et seq., and in no event later than 60 days after discovery of the breach.

Right to file a complaint. You may file a complaint with Tickortreat Medical, P.A.’s Privacy Officer (see contact information below) or directly with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you, and will not take any adverse action, for filing a complaint, exercising any right under this Notice, or participating in a complaint investigation. Filing a complaint will not affect your ability to receive care from Tickortreat Medical, P.A. in any way.

Changes to this Notice

Tickortreat Medical, P.A. reserves the right to change this Notice at any time. Any change will apply to all protected health information we maintain, including information created or received before the change. If we materially change this Notice, we will post the revised Notice prominently on this page in accordance with 45 CFR 164.520, and the revised effective date will be stated at the top.

A paper copy of the current or any prior version of this Notice is available on request.

Contact information

For questions about this Notice, to exercise your HIPAA rights, or to file a complaint with us:

Privacy Officer
Tickortreat Medical, P.A.
Townshend, Vermont
hello@tickortreat.com
(802) 365-1415

To file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online: hhs.gov/ocr/privacy/hipaa/complaints
• Phone: 1-800-368-1019 (TDD: 1-800-537-7697)
• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201

This Notice of Privacy Practices is accompanied by the general Tickortreat Privacy Policy, which addresses website operations, cookies, non-patient visitor data, and the free tick identification tool.