Your Privacy
The Fishtown Medicine HIPAA Notice of Privacy Practices explains how we safeguard, use, and disclose your protected health information (PHI). It covers your rights, our legal duties, the limits on data sharing, and how to file a complaint. We never sell PHI or use it for marketing.
We work at the pace of your trust. This Notice of Privacy Practices ("Notice") explains how Fruition Medicine PLLC d/b/a Fishtown Medicine ("Fishtown," "we," "us," "our") safeguards, uses, and discloses your protected health information ("PHI") and describes your rights under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and related state laws. Creating an account, receiving care, or communicating with us confirms you have received and understand this Notice.
We work at the pace of your trust.
1. Your Rights
| You may… | What it means | How to exercise |
|---|---|---|
| Access your record | View, download, or request paper copies, usually within 30 days, in the form/format you request (electronic if readily producible). You may also direct us to send it to anyone you designate. | Submit a written request to the Privacy Officer. |
| Correct your record | Ask us to amend incomplete or inaccurate information. | Written request; approval or denial (with reason) within 60 days. |
| Request confidential communications | Ask us to contact you at a specific phone, email, or address. | Written request; we honor reasonable requests. |
| Limit PHI we use/share | Request limits on treatment, payment, or operations disclosures. | Written request; we may decline but honor any approved limits except emergencies. |
| Restrict disclosure to your health plan when you self-pay | If you pay in full out-of-pocket for an item or service, we will not share that PHI with your health plan unless required by law. | Written request at or before the time of service. |
| Receive an accounting of disclosures | Get a six-year history of non-routine disclosures. | Written request; first list each 12 months is free. |
| Receive a paper copy of this Notice | Ask at any time, even if you agreed to electronic delivery. | Phone, email, portal, or in person. |
| Appoint a representative | Someone with medical power of attorney or legal guardianship can act for you. | Provide legal documentation. |
| File a complaint | Do so without fear of retaliation. | See § 10. |
2. Our Legal Duties
We are required by law to:
- keep your PHI private;
- provide this Notice explaining our privacy practices;
- follow the terms of the Notice currently in effect; and
- notify you if a breach compromises the privacy or security of your PHI.
Material changes trigger immediate updates in our portal, on our website, and (on request) in paper form.
3. How We May Use & Disclose PHI Without Written Authorization
- Treatment: diagnose, treat, coordinate care, and consult with other clinicians.
- Payment: submit claims, process billing, collect fees.
- Healthcare Operations: quality improvement, audits, training, licensing.
- Business Associates: share PHI with vendors (EHR, billing, cloud services) that sign HIPAA-required BAAs.
- Public Health & Safety: disease reporting, recalls, abuse/neglect reporting.
- Health Oversight: regulator inspections and investigations.
- Legal Proceedings: court orders, subpoenas, warrants.
- Workers' Compensation: as authorized by law.
- Research: with IRB approval or a valid privacy-board waiver.
- Organ/Eye Donation coordination.
- Serious Threat: avert imminent harm to health or safety.
- Special Government Functions: military, national security, corrections.
- Routine Communications: appointment reminders, test results, care coordination, or information about health-related benefits or services that may interest you.
Note on health-plan disclosures: We never share PHI with a health plan unless coverage or payment is required, for example, billing labs, prescriptions, imaging studies, or prior authorizations.
4. Uses & Disclosures That Never Occur Here
We do not:
- use PHI for marketing communications;
- sell PHI; or
- release psychotherapy notes (if we maintain any) without your written authorization.
Any other use or disclosure of PHI not described in this Notice will occur only with your written authorization, which you may revoke at any time (except where already relied upon).
5. Extra Protections for Sensitive Information
We comply with all federal and state laws that give added protection to:
- HIV-related information
- Substance-use-disorder records (42 CFR Part 2)
- Mental-health treatment notes
- PHI related to lawful reproductive care (per the 2024 HHS reproductive-health rule)
Genetic Information: We never use genetic data for insurance underwriting or discriminatory purposes. Raw genetic data received for clinical interpretation is permanently deleted once processing is complete.
6. Safeguarding Your Information
| Measure | What we do |
|---|---|
| Encryption | PHI encrypted in transit and at rest. |
| Access Controls | Role-based, minimum-necessary permissions. |
| Audit Logs | Continuous monitoring for improper access. |
| Secure Messaging | HIPAA-compliant SMS, video, and portal. |
| Patient Responsibilities | Use strong passwords and secure personal devices. |
6.1 Website Chat Tool (Not a PHI Channel)
Our public website includes a third-party chat widget (Fin, formerly Intercom) so visitors can ask general questions about how our practice operates - services, pricing, scheduling, neighborhood coverage, and similar non-clinical topics. The website chat is not a HIPAA-covered channel and should not be used to share protected health information. If you need to discuss symptoms, treatment, medications, lab results, or any individually identifiable health information, please use the Ultralight patient portal, our HIPAA-compliant Spruce line, or a scheduled telehealth visit instead. Messages sent through the website chat are routed through Fin's systems under their own terms and privacy policy and are not stored in your medical record.
7. Data Retention & Destruction
We retain PHI for at least 7 years (or longer if law requires) and then destroy it using HIPAA-compliant methods.
8. Changes to This Notice
We may update this Notice to reflect legal or operational changes. Revised versions take effect when posted to https://fishtownmedicine.com/about/privacy-policy. Material changes are also announced via portal message or email. Continued use of our services constitutes acceptance of the revised Notice.
9. Acknowledgement of Receipt
HIPAA requires that we make a good-faith effort to obtain your written or electronic acknowledgement that you received this Notice. Care is not conditioned on signing; refusal is documented.
10. Questions, Requests, or Complaints
Privacy Officer Fishtown Medicine 2418 E York St, Philadelphia, PA 19125 Phone: (267) 360-7927 Email: compliance@fishtownmedicine.com
You may also contact the U.S. Department of Health & Human Services Office for Civil Rights (OCR) Phone: (800) 368-1019 TTY: (800) 537-7697
We will not retaliate against you for filing a complaint.
Your trust drives us. Thank you for letting Fishtown Medicine protect your privacy while delivering preventive, personalized care.
Frequently Asked Questions
Common Questions
Ready when you are
Dr. Ash reads every intake himself, and answers questions personally - usually within a few hours.
Related Intelligence
Performance Physical Philadelphia: 4 Tests That Predict How You Age
A standard physical screens for disease. A performance physical measures how well you are aging. The 4 functional tests - VO2 max, grip strength, mobility, and body composition - that predict healthspan, and how we track them in Philadelphia.
Social Health Is Healthspan: What 80+ Years of Research Says About Relationships and Longevity
A Philadelphia internal medicine doctor on the 80-plus years of research connecting relationships, community, and how long and well you actually live - and what to do about it in your day-to-day.
Environment: The Silent Third Party
How we think about the physical world that shapes your biology hour by hour. Air, water, light, the house you live in, the city around it, and the digital inputs you bring inside.
New patients
Talk it through with Dr. Ash.
If anything you read here raised a question, start with a short intake - your story in your own words. Dr. Ash reads every one personally, and you can text or email us anytime.