THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR § 164.520, and the Texas Medical Records Privacy Act, Texas Health & Safety Code Chapter 181.
Who We Are and How to Contact Us
South Texas Oncology and Hematology PLLC, DBA the START Center for Cancer Care (“we,” “us,” or “our practice”) is a Texas-based oncology care organization and a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164, and under the Texas Medical Records Privacy Act, Texas Health & Safety Code Chapter 181. This Notice applies to all Protected Health Information (PHI) we create, receive, maintain, or transmit.
We are required by law to: maintain the privacy of your PHI; provide you with this Notice of our legal duties and privacy practices; follow the terms of the Notice currently in effect; and notify you following a breach of your unsecured PHI.
Privacy Officer Contact Information
Privacy Officer: Travis Ryals, Chief Information Officer / Dat Privacy Officer
Address: 4383 Medical Dr, San Antonio, TX, 78229
Phone: (210) 593 5872 Email: privacy@thestartcenter.com
Website: https://thestartcenter.com
You may also contact:
- U.S. HHS Office for Civil Rights — hhs.gov/ocr | 1-800-368-1019 | TDD 1-800-537-7697
Texas Attorney General — texasattorneygeneral.gov | 1-800-252-8011
How We May Use & Disclose Your Information Without Authorization
Federal and Texas law permit us to use and disclose your PHI for the following purposes without your written authorization. For each, we use or share only the minimum information necessary.
Treatment
We use and share your PHI to coordinate your cancer care among the physicians, nurses, technicians, and other providers involved in your treatment, including referring providers, radiologists, pathologists, laboratories, imaging providers, palliative care, and hospice providers.
Payment
We use and disclose your PHI to bill and obtain payment for your care, including submitting claims to Medicare, Medicaid, CHIP, private insurers, and other payers, and obtaining prior authorizations and verifying coverage.
Healthcare Operations
We use and disclose your PHI to run our practice and improve care, including quality assessment and improvement, patient safety, training, accreditation, licensing, credentialing, business planning, compliance auditing, and — where used — AI-assisted documentation and administrative tools (see Section 3).
Individuals Involved in Your Care
We may share PHI relevant to your care with a family member, relative, friend, or other person you identify. In an emergency or if you are incapacitated, we may share limited PHI if we believe it is in your best interest.
Required by Law
We will disclose PHI when required by federal or Texas law, including:
Disclosures to law enforcement, courts, subpoenas, and administrative proceedings as permitted under 45 CFR § 164.512(f), and workers’ compensation as authorized by Texas law.
Cancer reporting to the Texas Cancer Registry, Texas Department of State Health Services, under Texas Health & Safety Code Chapters 82 and 161 (mandatory; does not require your authorization).
Public health reporting to prevent or control disease, injury, or disability.
Child abuse or neglect reporting under Texas Family Code § 261.101, and adult protective services reporting under Texas Human Resources Code § 48.051.
| Texas Cancer Registry — Mandatory Reporting As a Texas cancer treatment facility, we are required under Texas Health & Safety Code Chapter 82 to report your cancer diagnosis and treatment information to the Texas Cancer Registry. This reporting does not require your authorization and is protected by state confidentiality provisions. |
Uses and Disclosures That Require Your Written Authorization
Except as described in Section 1, we will not use or disclose your PHI without your signed, written authorization. You may revoke an authorization in writing at any time; revocation does not affect actions already taken. The following always require your authorization:
- Most uses and disclosures of psychotherapy notes (where maintained).
- Marketing communications, as described below.
- Any disclosure that constitutes a sale of PHI, as defined in 45 CFR § 164.501 and Texas Health & Safety Code § 181.006.
Marketing
We will contact you with marketing communications — such as information about programs, services, clinical trials, and cancer care resources — only if you provide explicit written authorization. Your authorization will specify the types of communications and how you will be contacted, and you may revoke it in writing at any time.
Sale of PHI
We do not sell your PHI. The sale of PHI is prohibited under HIPAA (45 CFR § 164.502(a)(5)(ii)) and Texas Health & Safety Code § 181.006.
Artificial Intelligence and Ambient Documentation
Where we use AI-assisted or ambient documentation tools to help clinicians create clinical documentation:
- Any such tool operates under a HIPAA Business Associate Agreement (BAA).
- AI-generated drafts are reviewed, edited, and signed by your clinician before entering your record; no AI system makes final clinical decisions without physician review.
- Audio and raw transcripts are retained only as long as necessary to generate the note, subject to our BAA.
- You will be informed when ambient documentation is used, and you may decline it at any time without affecting your care.
AI-generated documentation that becomes part of your record is subject to the same access and amendment rights described in Section 5.
Research
IRB-approved research protocols, or research with an appropriate waiver of authorization reviewed by a Privacy Board under 45 CFR § 164.512(i). As a cancer care organization, clinical trial participation is governed separately by your signed research consent form.
Specially Protected Categories of Health Information
Certain categories of information receive heightened protection under federal or Texas law and generally require specific consent or meet a stricter standard for disclosure:
Genetic information — Texas Health & Safety Code Chapter 546 and GINA; not disclosed for insurance underwriting or employment.
HIV/AIDS status and test results — Texas Health & Safety Code Chapter 81.
Mental health records — Texas Health & Safety Code Chapter 611.
Your Rights Regarding Your Health Information
To exercise any right, submit a written request to our Privacy Officer (contact information above).
Right to Access and Receive a Copy
You may inspect and obtain a copy of your medical records and other PHI in the designated record set, usually within 30 days (with one permitted extension). You may request an electronic copy. We may charge a reasonable, cost-based fee consistent with Texas Health & Safety Code § 241.154 and 45 CFR § 164.524. We will not charge for records we send electronically at your direction to another provider.
Right to Request Amendment
If you believe your PHI is incorrect or incomplete, you may request an amendment. We will act within 60 days and may deny in limited circumstances, with written reasons and instructions on how to disagree.
Right to an Accounting of Disclosures
You may request a list of certain disclosures of your PHI made in the prior six years that were not for treatment, payment, or health care operations (and other exceptions under 45 CFR § 164.528). We will respond within 60 days.
Right to Request Restrictions
You may request restrictions on how we use or disclose your PHI. We are not generally required to agree, except that we must comply with a request not to disclose PHI to a health plan for a service you paid for in full out of pocket. Requests must be in writing.
Right to Confidential Communications
You may request that we contact you at a specific phone number or address. We will accommodate reasonable written requests without asking your reason.
Right to Receive a Paper Copy
You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. It is also available at our facilities and at https://thestartcenter.com.
Right to File a Complaint Without Retaliation
You may file a complaint with our Privacy Officer or with the HHS Office for Civil Rights. We will not retaliate against you for filing a complaint or exercising any privacy right.
Right to Opt Out of Fundraising
If we contact you for fundraising, each communication will include clear opt-out instructions. Your treatment will not be conditioned on your decision.
Breach Notification
If a breach of your unsecured PHI occurs, we will notify you without unreasonable delay and no later than 60 calendar days after discovery, as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and applicable Texas law.
For breaches affecting 250 or more Texas residents, we will notify the Texas Attorney General under Texas Business & Commerce Code § 521.053.
For breaches affecting 500 or more residents of a state or jurisdiction, we will notify HHS and prominent media as required.
Texas-Specific Rights and Protections
Texas law provides certain protections beyond the federal HIPAA minimum, including:
- Broader scope under the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181).
- Protection of genetic information from disclosure for underwriting or employment (Chapter 546).
- The right to receive your electronic health record and direct it to another provider electronically.
- A possible private right of action for certain violations of Texas health privacy law, in addition to federal remedies.
- Advance directives, out-of-hospital DNR orders, and physician orders for scope of treatment maintained under Texas Health & Safety Code Chapter 166.
Record Retention
We retain records in accordance with applicable Texas and federal law. After the retention period, records are destroyed using secure methods that render PHI unreadable and irretrievable.
Non-Discrimination, Changes to This Notice, and Effective Date
We will not disclose psychotherapy notes (as defined under 45 CFR § 164.501) without your specific written authorization, except in very limited circumstances permitted by law.
The START Center for Cancer Care | Effective Jan 1, 2026
Questions or requests: privacy@thestartcenter.com | (210) 593-5872 | See also: Privacy Policy HIPAA Policy
