HIPAA Compliance Policy

Last updated: January 2026

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") establishes federal standards for the privacy and security of Protected Health Information ("PHI"). MedicalMarijuanaCards.us takes HIPAA compliance seriously and applies these standards to information we collect, store, and share in the course of providing our services.

What HIPAA covers

HIPAA's Privacy Rule and Security Rule apply to "covered entities" (health-care providers who transmit PHI electronically, health plans, and health-care clearinghouses) and their "business associates" (vendors that handle PHI on a covered entity's behalf). The licensed physicians who evaluate you through our platform are covered entities. We act as a business associate of those physicians and have signed Business Associate Agreements ("BAAs") with each one.

What information is PHI

• Your medical history relevant to a marijuana evaluation.
• The physician's certification or non-certification decision.
• Notes from your telehealth visit.
• Your name, date of birth, address, and other identifiers when combined with the above.

How we safeguard PHI

• Administrative safeguards: documented policies, role-based access controls, mandatory privacy and security training for staff, and regular risk assessments.
• Physical safeguards: servers hosted in SOC 2 Type II audited data centers with restricted physical access.
• Technical safeguards: end-to-end encryption in transit (TLS 1.2+), encryption at rest, multi-factor authentication for staff, audit logging, and routine vulnerability testing.
• Vendor management: only HIPAA-compliant vendors with signed BAAs handle any PHI on our behalf — including telehealth video platforms, cloud storage, and payment processors that touch PHI.

Your HIPAA rights

Under HIPAA, you have the right to:

• Access your PHI and obtain a copy of your medical record.
• Request a correction if information in your record is inaccurate or incomplete.
• Request restrictions on certain uses and disclosures of your PHI.
• Request confidential communications at an alternative address or by an alternative method.
• Receive an accounting of disclosures showing certain disclosures we have made of your PHI.
• Receive a paper copy of any electronic notice of privacy practices.
• File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

When we may disclose PHI without your authorization

HIPAA permits limited disclosures without authorization, including: for treatment, payment, and health-care operations; when required by law; to public-health authorities for legally mandated reporting; in response to a valid subpoena or court order; and to prevent a serious and imminent threat to health or safety. State law may impose additional restrictions or, in some cases, additional permitted disclosures (for example, certain state medical-cannabis registry submissions).

Breach notification

If a breach of unsecured PHI affecting you occurs, we will notify you without unreasonable delay and no later than 60 days after discovery, in accordance with the HIPAA Breach Notification Rule. Notice will describe what happened, what information was involved, the steps we are taking, and what you can do to protect yourself.

Filing a complaint with HHS

You may file a complaint directly with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr. We will not retaliate against you for filing a complaint.

Contact our Privacy Officer

Email: contact@medicalmarijuanacards.us with subject line "Privacy Officer."