Effective Date: October 28, 2026 | thevillagesgym.com | 8811wellness.com
Protected Health Information Privacy Policy
⚠ This policy is an internal operational document. It does not substitute for a formal HIPAA Notice of Privacy Practices (NPP), Business Associate Agreements (BAAs), or legal compliance review. All physician partnership arrangements referencing PHI handling should be reviewed by healthcare counsel.
1.Purpose
This policy documents how The Villages Gym (TVG) and its nested program brand 8811. handle Protected Health Information (PHI) received from, or shared with, physician partners and clinical collaborators. It establishes who may access PHI, where it is stored, how it is transmitted, and the safeguards our team follows.
This document may be shared with physician partners upon request to demonstrate operational HIPAA compliance posture.
2.Scope
This policy applies to:
All staff members of D & H Adventures LLC, including trainers, the exercise physiologist, the functional nutritionist, the mindfulness coach, and administrative personnel
Any contractor or vendor with access to client health data
All client health information received through intake forms, physician referrals, care coordination communications, or direct clinical assessments
PHI covered by this policy includes, but is not limited to diagnoses, medications, lab values, imaging reports, physician notes, cardiology workups, and any data that identifies an individual in connection with a health condition or wellness program.
3.PHI Storage: Practice Better
3a. Designated Platform
Practice Better is the sole authorized platform for storing and managing client PHI at TVG and 8811. It is a HIPAA-compliant practice management platform. TVG maintains a Business Associate Agreement (BAA) with Practice Better as required under HIPAA.
All client health records; intake forms, physician referrals, SOAP notes, assessment data, and care coordination documents must be stored within Practice Better. Storage of PHI in non-secured locations — including personal email, personal cloud drives, text message threads, or local device folders — is prohibited.
3b. Data Stored in Practice Better
The following categories of information are maintained in Practice Better client records:
Client contact and demographic information
Health history intake forms and medical clearance documentation
Physician referral letters and clinical notes
SOAP notes and session documentation prepared by TVG staff
Exercise physiologist assessments and program plans
Nutritional assessments and recommendations
Mindfulness and behavioral health intake data
Communications relevant to clinical care coordination
3c. Access Controls Within Practice Better
Access to client records in Practice Better is role-based:
Practice Better accounts are individual and password protected. Shared logins are prohibited. Staff are responsible for logging out of Practice Better when their session is complete, particularly on shared or mobile devices.
4.PHI Transmission to Physician Partners
4a. Authorized Transmission Only
PHI is transmitted to physician partners only when:
The client has signed a written authorization permitting disclosure to the named physician or practice (using TVG's Patient Authorization for Release of Health Information form), OR
The transmission falls within the scope of a signed Wellness Partnership Agreement with the physician, which defines the care coordination relationship and data-sharing parameters
Verbal authorization from a client is not sufficient. A signed authorization form must be on file in Practice Better before any PHI is transmitted.
4b. Approved Transmission Methods
PHI may only be transmitted to physician partners through the following approved, encrypted channels:
Practice Better integrated fax — HIPAA-compliant fax transmitted through the Practice Better platform (covered under existing BAA)
Secure messaging within Practice Better (if the physician partner has access to the shared record)
Paubox encrypted email (tvg-designated account) — end-to-end encryption compliant with HIPAA
Hushmail encrypted email — an acceptable alternative to Paubox if operationally required
Physical delivery of printed records, in a sealed envelope, hand-delivered or sent via USPS certified mail
⚠ Standard Gmail, personal email accounts, standard SMS/text messaging, consumer file-sharing platforms (Google Drive shared links, Dropbox, etc.), and non-Practice Better fax services are NOT approved for PHI transmission. If a physician partner requests transmission through a non-approved channel, contact the Owner before proceeding.
4c. What We Transmit
Transmission to physician partners is limited to the minimum necessary information to accomplish the purpose of the disclosure. Typical transmissions include:
SOAP notes or progress summaries relevant to the physician's patient
Exercise physiologist assessment results or program updates
Flagged observations requiring physician awareness (e.g., elevated resting heart rate, reported symptoms)
Requests for medical clearance or updated clinical guidance
Full client records are not transmitted unless specifically requested by the physician and authorized in writing by the client.
4d. Documentation of Transmissions
Every PHI transmission to an external physician or clinical partner must be documented in the client's Practice Better record. Documentation should note: the date of transmission, the recipient (name and practice), the method used, and a brief description of what was sent. This log serves as the compliance record for each disclosure.
5.Team Responsibilities
All content on our websites — including text, images, logos, graphics, videos, and the 8811. brand identity — is owned by or licensed to D & H Adventures LLC and is protected by applicable copyright, trademark, and intellectual property laws.
You may view and print content from our websites for your own personal, non-commercial use. You may not reproduce, distribute, modify, publicly display, or create derivative works from our content without our prior written permission.
The Villages Gym and 8811. names and logos are trademarks of D & H Adventures LLC. Unauthorized use is prohibited.
6. Breach or Unauthorized Disclosure
Any actual or suspected unauthorized access to, use of, or disclosure of PHI must be reported to the Owner (Heather Sholl) immediately — within the same business day of discovery.
The Owner will:
Assess the scope and nature of the incident
Engage healthcare counsel (Rob James or designated attorney) within 24 hours for guidance on HIPAA breach notification obligations
Document the incident and response actions in writing
Notify affected individuals and HHS if required under HIPAA's Breach Notification Rule
⚠ Do not attempt to self-assess whether an incident rises to the level of a reportable breach. All incidents must go to the Owner, who will involve counsel. When in doubt, report it.
7.Training and Acknowledgment
All team members with access to PHI are required to:
Read and acknowledge this policy upon hire and upon each annual revision
Complete HIPAA awareness training within 30 days of hire (or upon policy adoption for existing staff)
Immediately report any uncertainty about a PHI-related situation to the Owner before taking action
Signed acknowledgments are retained in personnel files maintained by the Owner.
8.Policy Review and Updates
This policy will be reviewed annually and updated whenever there is a material change to: the platforms used to store or transmit PHI, personnel with PHI access, the nature of physician partnerships, or applicable law or regulatory guidance.
The Owner is responsible for initiating each review and distributing updated versions to all relevant team members.
9.Contact Us
If you have questions about these Terms of Service, please contact:
D & H Adventures LLC (The Villages Gym / 8811.)
Address: 8811 Gaylord Dr #100, Houston, TX 77024
Email: heather@thevillagesgym.com