Privacy Policy

Part 1. Notice of Privacy Practices (NPP) & NYS Pediatric Policy

Last updated: October 18, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU OR YOUR CHILD MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

General Commitment

Our pediatric practice is dedicated to protecting the privacy of your child's Protected Health Information (PHI). Because this is a solo medical practice, the attending physician also serves as the practice Privacy Officer. All administrative, clinical, and digital operations are managed directly to ensure strict HIPAA and state compliance.

Hybrid Care & Digital Communication

We provide care through both in-person clinic visits and telehealth services.

  • Telehealth Platforms: We utilize secure, encrypted, HIPAA-compliant audiovisual platforms to conduct remote consultations. Virtual visits are treated with the exact same privacy protections as an in-office exam.

  • Patient Portal: Our secure Patient Portal is the primary, encrypted channel for sharing test results, clinical forms, managing appointments, and exchanging clinical messages.

  • Business Email & BAA Security: Our practice uses a secure, enterprise-grade business email system backed by a formal Business Associate Agreement (BAA). This ensures that all patient data stored within our email infrastructure is fully encrypted and compliant with federal privacy standards.

  • Email & Text Communications with Parents: While our internal email environment is secure, standard emails and text messages (SMS) sent to your personal accounts travel over open networks and are not entirely encrypted on your end. We will not transmit highly sensitive clinical PHI via standard email or SMS unless you explicitly request it after receiving our risk disclosure, or unless we utilize a secure, message-encryption service that requires a password/pin to open.

Special New York State Pediatric & Minor Privacy Rules

In accordance with New York State law, the privacy of a minor's medical records involves distinct boundaries:

  • Parental Access: Generally, parents or legal guardians have full access to their child's medical records as the authorized personal representative.

  • Minor Assent & Minor-Protected Care: Under NYS law, minors can independently consent to certain types of healthcare (such as reproductive health, substance use treatment, or mental health counseling in specific circumstances). PHI associated with minor-consented care is strictly confidential and cannot be disclosed to parents or legal guardians without the minor patient's explicit written authorization.

  • Age of Majority: Once a patient reaches 18 years of age, all rights to access and control their medical records transfer solely to them. Parental access is revoked at that time unless the 18-year-old signs an explicit authorization.

Patient & Guardian Rights

You and your child (depending on their age and legal status) have the right to:

  • Inspect and receive an electronic or paper copy of the medical and billing records (processed within 30 days under HIPAA, though NYS law requires records to be provided within 10 days of a written request).

  • Request amendments to incorrect or incomplete health records.

  • Request restrictions on sharing certain data (e.g., if you pay out-of-pocket in full for a service, you have the right to restrict disclosures to your health insurance plan).

  • File a formal privacy complaint directly with our office or the U.S. Department of Health and Human Services.

Part 2. Our Website and Patient Portal Privacy

Information Collected Automatically (Cookies & Analytics)

  • Website Browsing: Our public website is built using Squarespace. When you browse our site, Squarespace automatically collects basic, non-personal technical data (like the type of web browser you use or the time you spent browsing). We use this purely to make sure our website loads correctly and works well on phones and computers. We do not use sneaky tracking tools or advertising cookies that follow you around the internet or tie your web browsing back to your child’s health identity.

  • No Tracking of Health Data: We do not use marketing trackers, tracking pixels (such as Meta Pixel), or third-party advertising cookies that link your public web browsing habits to your identity or health information.

Information You Provide Voluntarily

  • Contact Forms: If you use a contact form on our website, the information is used solely to respond to your inquiry (such as scheduling an appointment). Do not submit sensitive clinical symptoms or medical history through public web contact forms.

  • Our Patient Portal (Elation Passport): For anything involving your child’s actual medical care, we use a specialized, secure portal called Elation Passport. This portal is completely separate from our public website. It is an encrypted, HIPAA-compliant, bank-level secure environment designed specifically for healthcare.

  • Where to Share Medical Info: Please do not use our website's standard contact or booking forms to share private medical details or symptoms. Those public forms are just for general inquiries. All sensitive health conversations, lab results, and medical messages should be sent safely through your Elation Passport account.

Changes to this Policy

This Privacy Policy may be revised from time to time as we add new features and services, as laws change, and as industry privacy and security best practices evolve. We display a version number and a date at the top of this Privacy Policy so that it will be easier for you to know when there has been a change. If we make any change to this Privacy Policy regarding use or disclosure of Personal Information, we will provide advance notice on this Website. Small changes or changes that do not significantly affect individual privacy interests may be made at any time and without prior notice.

We encourage you to check this page regularly. If you provide information to us, access, or use our site in any way after this Privacy Policy has been changed, you will be deemed to have consented and agreed to such changes. The most current version of this Privacy Policy will be available on the web page at all appropriate times and will supersede all previous versions of this Privacy Policy.

Your continued use of this website after changes to this Privacy Policy are posted constitutes acceptance of each revised Privacy Policy regarding any information that we collect from you after the Privacy Policy is posted. If you do not agree to the terms of this Privacy Policy or any revised Privacy Policy, please do not use this website.

QUESTIONS

If you have any questions about this Privacy Policy or about Cutler Pediatric Medicine’s handling of your information, please contact info@cutlerpediatric.com.