HIPAA Notice of Privacy Practices (NPP)

Last updated: November 9, 2025
Applies to: Skin Savvy Med Spa (“we,” “us,” “our”)
Contact (Privacy Officer): 508-440-5542 · darcey@skinsavvymedspa.com · 36–38 Mechanic St, Foxboro, MA 02035

Our Responsibilities

We are a “covered entity” under HIPAA. We are required to:

Maintain the privacy and security of your Protected Health Information (“PHI”).
Provide you this Notice describing our privacy practices.
Follow the terms of this Notice and notify you if a breach compromises the privacy or security of your PHI.

We utilize EMS Aesthetic Record as our electronic medical record (EMR) and practice management platform. We maintain Business Associate Agreements (BAAs) with vendors who create, receive, maintain, or transmit PHI on our behalf, including EMS Aesthetic Record.

How We May Use and Disclose Your PHI (Examples)

Treatment: To provide, coordinate, or manage your care (e.g., sharing information with referring providers, pharmacies, or labs).
Payment: To bill and collect payment (e.g., insurers, billing services).
Health Care Operations: Quality assessment, training, licensing, audits, or compliance.
As Required by Law: Public health reporting, law enforcement, health oversight, judicial/administrative proceedings, workers’ compensation.
To Avert a Serious Threat: When necessary to prevent serious threat to health or safety.
With Your Authorization: Uses/disclosures not described here will require your written authorization, which you may revoke at any time (except where we have already relied on it).

We do not sell PHI or use it for marketing without your written authorization.

Your Rights

Right to Inspect and Get a Copy: You may request to see or obtain an electronic or paper copy of your medical record and other PHI; we will provide a copy or summary within a reasonable time and may charge a reasonable fee as allowed by law.
Right to Request an Amendment: If you believe your record is incorrect or incomplete, you may request an amendment.
Right to an Accounting of Disclosures: You may request a list of certain disclosures we made of your PHI.
Right to Request Restrictions: You may request restrictions on our use or disclosure of your PHI. We will consider all requests and will agree when required by law.
Right to Request Confidential Communications: You may request that we contact you in a certain way (e.g., at work or by mail).
Right to a Paper Copy: You may ask for a paper copy of this Notice at any time.

Confidentiality & Security

We implement administrative, technical, and physical safeguards that meet HIPAA Security Rule standards. EMS Aesthetic Record encrypts PHI in transit and at rest (as provided by the vendor) and limits access to authorized personnel. We maintain policies for access control, data minimization, and workforce training.

Breach Notification

If we discover a breach of unsecured PHI, we will notify you without unreasonable delay and consistent with applicable law.

Record Retention (Massachusetts)

We retain adult patient medical records for at least seven (7) years from the last patient encounter. For minors, records are retained for the longer of seven (7) years from the last encounter or until the patient turns 18.

Questions or Complaints

To exercise any right or file a complaint:
508-440-5542 · darcey@skinsavvymedspa.com · 36–38 Mechanic St, Foxboro, MA 02035
You may also file a complaint with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.