HIPAA Disclaimer

Vista Verde Homes – Medicaid Meals Program 501(c)(3) nonprofit | EIN: 99-1152633 | Salt Lake County, Utah, United States Effective Date: June 2026

Vista Verde Homes is a 501(c)(3) nonprofit organization whose mission is to serve as a community resource navigator and referral source. We provide free, voluntary assistance by offering education about available public and community resources, conducting basic non-clinical eligibility pre-screening (where required by partners), and facilitating referrals to appropriate third-party programs and services — such as meal options potentially aligned with Medicaid or other public benefits.

We do not provide healthcare, clinical services, nutritional counseling, case management, benefit enrollment, eligibility determinations, or any form of medical or therapeutic support. Our interactions are informational and connective only.

1. Our HIPAA Status

We are not a HIPAA "Covered Entity." HIPAA's covered-entity obligations apply to healthcare providers, health plans, and healthcare clearinghouses that transmit protected health information (PHI) in connection with covered transactions (e.g., billing or claims). Vista Verde Homes is none of these. We do not provide, coordinate, or deliver any healthcare, medical, clinical, diagnostic, or treatment services; transmit health information in standard HIPAA transactions; act as a health plan, insurer, or clearinghouse; enroll individuals in Medicaid, Medicare, managed care, or any insurance program; or make medical-necessity determinations, clinical judgments, or benefit-eligibility decisions on behalf of any agency or payer.

Because we do not function as a covered entity, the obligations HIPAA places on covered entities — including the formal Notice of Privacy Practices under 45 CFR § 164.520 — do not apply to us in that capacity.

Business-associate status. Because we collect identifiable health-coverage information (including your Medicaid CIN) and handle it to coordinate referrals with Medicaid Managed Care Plans, Social Care Networks, and healthcare providers, we create, receive, maintain, or transmit PHI on behalf of covered entities and therefore act as a business associate under HIPAA. Where we act under a Business Associate Agreement (BAA) with such an entity, we handle PHI in accordance with that BAA and HIPAA's applicable Privacy and Security Rule requirements. Where no BAA is in place, we hold the same information as a non-covered entity and protect it under our own safeguards and applicable law, including the New York SHIELD Act and the FTC Health Breach Notification Rule. Participation with Vista Verde Homes does not, by itself, create any provider-patient relationship, fiduciary duty, clinical responsibility, or ongoing case-management obligation.

2. No Medical, Clinical, Nutritional, Enrollment, or Decision-Making Services

To be explicit, Vista Verde Homes does not and will not offer medical advice, diagnosis, treatment, prescriptions, or referrals for clinical care; provide nutritional assessments, therapy, counseling, meal planning, or dietary prescriptions; determine, certify, or influence eligibility for Medicaid, Medicare, SNAP, meal programs, or any other benefits; submit benefit applications, claims, authorizations, or appeals on behalf of individuals; manage clinical care or follow up on health outcomes; or represent or act as an agent for CMS, any state Medicaid agency, managed care organization, insurer, or government program.

What we do: with your express consent, we submit a referral to the Medicaid Managed Care Plan, Social Care Network, or community organization that can help, and we follow up with you and with that organization until you are connected or you tell us to stop. The organization we refer you to decides whether you qualify and what services you receive; we do not. You may accept, decline, or withdraw from any referral at any time, and you may contact any organization directly instead of going through us.

3. Information We Collect — Minimum Necessary

We collect only the limited information needed to understand whether you may qualify for programs and to make a referral. Depending on the screening, this may include contact and identifying details (such as name, date of birth, address, phone, and email), whether you are enrolled in Medicaid, your Medicaid Client Identification Number (CIN), and limited, self-reported, general health-related information (for example, whether a health condition affects your diet or nutrition).

We collect your Medicaid CIN because the Medicaid Managed Care Plan or Social Care Network that reviews your eligibility uses it to identify you in a referral. We do not independently verify your Medicaid eligibility. Your CIN and the related information you provide are health-related information; because we handle this information to coordinate referrals with covered entities, we treat it as protected health information (PHI) and handle it under HIPAA's requirements where we act under a Business Associate Agreement, and under our own safeguards and applicable law otherwise (see Section 1). Taking part is entirely voluntary and you may withdraw consent at any time without penalty. A few fields are required because a program cannot accept a referral without them; those fields are marked as required on the form, and everything else may be left blank.

We do not collect detailed clinical records. Diagnoses, treatment histories, clinical notes, lab results, and similar details are collected — where needed — by the program, plan, provider, or Social Care Network that actually determines eligibility and provides services, under their own authorizations, not by us. We apply a strict "minimum necessary" approach and limit ourselves to routing-level information.

4. Specially Protected Information

We do not collect, through our screening, information about HIV/AIDS status, mental-health or substance-use treatment, genetic information, or other categories that receive heightened legal protection — including information protected under New York Public Health Law Article 27-F (HIV/AIDS-related information). If a program you are referred to needs such information, that program collects it directly from you under the specific written authorization the law requires.

5. How We Use and Share Information — Minimum Necessary & Referral-Only

Any information shared with us is used exclusively to educate about resource options, perform basic non-clinical pre-screening to identify suitable referral pathways, and facilitate introductions or referrals (with your express consent where required). We apply a strict "minimum necessary" standard. Information is never:

Used for clinical decision-making, diagnosis, treatment, or health assessments;

Sold, rented, or traded, or used for advertising, marketing of third-party products, fundraising unrelated to our core mission, solicitation, research, or commercial purposes;

Disclosed beyond the specific partner(s) directly involved in the requested resource (and only with your consent when applicable).

Once referred, third-party organizations (meal providers, government agencies, healthcare entities) handle information independently under their own policies and legal obligations. We have no control over their practices and assume no responsibility for how they manage or use data post-referral.

6. Privacy and Security Safeguards

Although our obligations differ from those of a covered entity (except where we act as a business associate), we implement reasonable safeguards consistent with the sensitivity of the information we handle: data access restricted to trained staff/volunteers on a need-to-know basis; secure digital tools, encryption in transit and at rest, and password protections; confidentiality agreements and training for all personnel; data minimization and retention limited to the time needed for referral completion; and regular privacy-practice reviews. Where we act as a business associate, we maintain safeguards consistent with the HIPAA Security Rule and our BAA, and use platforms appropriate to the sensitivity of the data. We cannot guarantee absolute security against every risk, but we prioritize reducing exposure through these measures.

7. Referrals Carry No Guarantees

We submit referrals with your consent and follow up until you are connected, but we do not determine eligibility and we cannot promise a result. We do not guarantee acceptance, availability, approval, quality, timeliness, or outcomes of any referred service, and we do not supervise, endorse, or share legal liability with any third-party provider. Eligibility decisions, services, and clinical communications occur between you and the referred entity. You retain complete autonomy to accept, decline, or pursue any referral — or seek services elsewhere — at any time.

8. Alignment with Public Goals — But Full Independence

Our work supports broader objectives like food security and access to public resources, consistent with federal/state guidance for community outreach. However, we are fully independent: we do not represent or act on behalf of any government agency, payer, or program; and we do not determine benefits, submit documentation, bill for healthcare services, or receive payment tied to the volume or value of services individuals receive. Where we are compensated for marketing, outreach, education, or navigation services by an authorized payer, that compensation is a fixed fee for those services, not reimbursement for healthcare and not tied to referral volume or value. (See our Funding Disclosure.)

9. Records We Maintain (Non-Clinical Only)

For accountability, we may keep internal logs such as consent records for sharing referral information, basic referral-activity summaries, and privacy-practice documentation. These exist for program integrity, grant compliance, and internal review. PHI handled in any business-associate capacity is maintained under the applicable BAA.

10. Your Rights and Voluntary Participation

Everything is voluntary. You may ask questions about our practices at any time, decline to provide or withdraw any information, request no further contact, and (for SMS) reply STOP to stop text messages. If your information is held by a HIPAA-covered provider or by us in a business-associate capacity, you also have the HIPAA rights described by that entity's Notice of Privacy Practices.

11. Contact for Questions

Vista Verde Homes — Medicaid Meals Program Salt Lake County, Utah, United States Email: info@medicaidmeals.org