HIPAA Privacy & Security Compliance Outline

Effective Date: September 7, 2026

Riviv Mobile IV LLC (“Riviv Mobile IV,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of our clients’ personal and health information.

Because Riviv Mobile IV provides IV hydration and wellness services, we recognize the importance of protecting information that may identify a client and relate to their health, medical history, treatment, or services received.

This outline describes the general measures Riviv Mobile IV takes to protect client information and support compliance with applicable federal and state privacy and security requirements, including HIPAA where applicable.

1. What Is HIPAA?

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996.

HIPAA establishes federal requirements designed to protect certain individually identifiable health information and regulate how covered entities and their business associates use, disclose, and safeguard that information.

HIPAA's Privacy Rule addresses the use and disclosure of protected health information (“PHI”), while the Security Rule establishes administrative, physical, and technical safeguards for electronic protected health information (“ePHI”).

The primary goals of HIPAA include protecting:

  • Confidentiality — preventing unauthorized people from accessing health information.

  • Integrity — protecting information from unauthorized alteration or destruction.

  • Availability — ensuring authorized personnel can access information when it is needed to provide appropriate services.

2. What Information Do We Protect?

Depending on the services provided, Riviv Mobile IV may collect or maintain information such as:

  • Client name

  • Date of birth

  • Contact information

  • Appointment information

  • Medical history

  • Allergies

  • Current medications

  • Relevant medical conditions

  • Treatment information

  • IV therapy information

  • Vital signs and assessment information

  • Consent forms

  • Health questionnaires

  • Payment and billing information

  • Communications related to services

  • Other information that may identify a client and relate to healthcare services

Information that identifies an individual and relates to their health, healthcare services, or payment for healthcare may constitute protected health information when HIPAA applies.

3. Minimum Necessary Access

Riviv Mobile IV follows a minimum necessary access approach.

Employees, contractors, healthcare professionals, and other authorized personnel are provided access to client information only when that access is reasonably necessary to perform their assigned duties.

For example, an employee who does not need access to a client's complete medical history should not have unrestricted access to that information.

HIPAA's Privacy Rule generally requires covered entities to make reasonable efforts to limit uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose.

4. Administrative Safeguards

Riviv Mobile IV maintains administrative policies and procedures designed to protect client information.

These measures may include:

  • Designating responsible personnel for privacy and security functions

  • Establishing written privacy and security policies

  • Conducting periodic security risk assessments

  • Establishing procedures for responding to suspected privacy or security incidents

  • Providing workforce privacy and security training

  • Establishing appropriate access controls

  • Maintaining documentation of applicable compliance activities

  • Applying appropriate disciplinary measures for violations of privacy or security policies

  • Periodically reviewing and updating policies and procedures

HIPAA's Security Rule requires regulated entities to conduct an appropriate risk analysis and implement reasonable and appropriate safeguards based on identified risks.

5. Employee and Contractor Training

Riviv Mobile IV requires personnel who have access to protected health information to receive appropriate privacy and security training.

Training may include:

  • HIPAA privacy requirements

  • Proper handling of client information

  • Password and account security

  • Appropriate use of electronic devices

  • Secure communication practices

  • Recognizing phishing and other security threats

  • Reporting suspected privacy or security incidents

  • Proper disposal of confidential information

  • Appropriate use and disclosure of client information

Personnel may be subject to disciplinary action for violations of Riviv Mobile IV privacy and security policies.

HIPAA requires workforce training appropriate to an individual's functions and appropriate sanctions for workforce members who violate applicable privacy policies or requirements.

6. Physical Safeguards

Riviv Mobile IV takes reasonable steps to prevent unauthorized physical access to client information.

Safeguards may include:

  • Securing paper records containing protected information

  • Restricting access to areas where confidential information is stored

  • Securing computers, tablets, and mobile devices

  • Using passwords or other access controls

  • Preventing unauthorized viewing of client records

  • Properly disposing of documents containing confidential information

  • Securely disposing of electronic devices or storage media when appropriate

HIPAA's physical safeguards address facility access, workstation security, and devices and media containing ePHI.

7. Technical Safeguards

Riviv Mobile IV uses appropriate technical safeguards designed to protect electronic client information.

Depending on the systems used by Riviv Mobile IV, safeguards may include:

  • Unique user accounts

  • Strong passwords

  • Multi-factor authentication where available and appropriate

  • Role-based access

  • Automatic device locking

  • Encryption where appropriate

  • Secure data transmission

  • Access logging and monitoring

  • Secure backups

  • Malware and security protections

  • Regular software and security updates

HIPAA's Security Rule addresses access controls, authentication, audit controls, integrity protections, and transmission security for ePHI.

8. Mobile Device Security

Because Riviv Mobile IV provides mobile services, protecting information accessed through mobile devices is particularly important.

Riviv Mobile IV may require:

  • Password-protected phones, tablets, and computers

  • Automatic screen locking

  • Authorized applications and systems

  • Secure connections when accessing client information

  • Restrictions on storing PHI directly on personal devices

  • Immediate reporting of lost or stolen devices

  • Remote security or device-management capabilities where appropriate

  • Restrictions against unauthorized sharing of client information

Personnel should never leave a device containing client information unattended or accessible to unauthorized individuals.

9. Secure Communication

Riviv Mobile IV takes reasonable steps to ensure that client information is communicated through appropriate and secure methods.

Personnel should avoid transmitting sensitive health information through unsecured communication methods when a more secure method is available.

Client information should not be discussed in public areas where unauthorized individuals may overhear the conversation.

Personnel should verify the identity and authorization of individuals before disclosing protected information.

10. Business Associates and Third-Party Vendors

Riviv Mobile IV may use third-party companies to provide services such as:

  • Electronic health record or client-management systems

  • Appointment scheduling

  • Secure communications

  • Payment processing

  • Cloud storage

  • Information technology services

  • Website hosting

  • Other business or healthcare-related services

When a third party qualifies as a HIPAA business associate, Riviv Mobile IV will use appropriate written agreements, including Business Associate Agreements (“BAAs”) where required.

HIPAA requires covered entities to obtain appropriate assurances from business associates that create, receive, maintain, or transmit ePHI on their behalf and to establish required contractual protections.

11. Privacy of Client Conversations

Riviv Mobile IV personnel are expected to protect the confidentiality of client conversations.

Personnel should:

  • Discuss client information only with individuals who have a legitimate need to know

  • Avoid discussing clients in public areas

  • Avoid discussing client information with friends or family members

  • Verify authorization before releasing information

  • Avoid leaving confidential information visible or unattended

  • Use discretion when communicating with clients at mobile treatment locations

12. Social Media and Photography

Riviv Mobile IV will not publicly identify clients or disclose protected health information through social media, marketing materials, photographs, testimonials, or other public communications without appropriate authorization when required.

Employees and contractors are prohibited from photographing or recording clients, medical records, treatment information, or other confidential information for personal or unauthorized purposes.

Client testimonials, photographs, or other marketing content must be handled in accordance with applicable privacy requirements and appropriate authorization procedures.

13. Breach and Security Incident Response

Riviv Mobile IV maintains procedures for responding to suspected or confirmed privacy and security incidents.

Examples of potential incidents include:

  • Lost or stolen devices

  • Unauthorized access to a client record

  • Sending information to the wrong person

  • Unauthorized disclosure of client information

  • Cybersecurity attacks

  • Phishing incidents

  • Ransomware

  • Improper disposal of confidential records

  • Unauthorized employee access

Personnel are required to report suspected privacy or security incidents promptly.

Riviv Mobile IV will investigate reported incidents, take appropriate steps to contain and mitigate potential harm, and make notifications when required by applicable law.

HIPAA's Security Rule requires procedures for identifying, responding to, mitigating, and documenting security incidents.

14. Client Privacy Rights

Depending on applicable law and the circumstances, clients may have rights concerning their protected health information, including rights to:

  • Request access to certain health information

  • Request correction of certain information

  • Request information regarding uses and disclosures

  • Request restrictions in certain circumstances

  • Receive applicable privacy notices

  • File a privacy complaint without retaliation

Riviv Mobile IV will handle applicable requests in accordance with federal and state requirements.

HIPAA's Privacy Rule provides individuals with specific rights concerning their PHI.

15. Record Retention and Disposal

Riviv Mobile IV maintains records according to applicable legal, regulatory, clinical, and business requirements.

When confidential information is no longer required to be retained, it will be disposed of using reasonable safeguards appropriate to the type of information.

Paper records containing protected information should be securely destroyed rather than placed in ordinary trash.

Electronic information and storage devices should be securely deleted, destroyed, or otherwise disposed of in accordance with applicable policies.

16. Regular Security Review

HIPAA compliance is an ongoing process rather than a one-time certification.

Riviv Mobile IV will periodically review its privacy and security practices to identify potential risks and determine whether additional safeguards or policy changes are appropriate.

This may include reviewing:

  • Information systems

  • Access permissions

  • Mobile devices

  • Third-party vendors

  • Employee access

  • Security incidents

  • Physical security

  • Data storage

  • Backup procedures

  • Privacy policies

  • Employee training

HIPAA requires regulated entities to periodically evaluate the effectiveness of security measures and modify safeguards as necessary.

17. Employee Responsibility

Every Riviv Mobile IV employee, contractor, healthcare professional, and authorized workforce member who has access to client information is responsible for protecting that information.

Employees must:

  • Access only information necessary for their role

  • Keep login credentials confidential

  • Never share passwords

  • Secure devices when unattended

  • Follow Riviv Mobile IV privacy and security policies

  • Report suspected violations immediately

  • Never access client records out of curiosity

  • Never disclose client information without proper authorization

  • Follow applicable HIPAA and state privacy requirements

Unauthorized access, use, or disclosure of client information may result in disciplinary action, termination of access, termination of employment or contract, and/or other appropriate action.

18. Our Commitment to Clients

Riviv Mobile IV understands that clients trust us with sensitive personal and health information.

Our commitment is to:

Protect it.
Limit access to it.
Use it responsibly.
Secure it appropriately.
And respect the privacy of every client we serve.

Riviv Mobile IV continually works to maintain reasonable and appropriate administrative, physical, and technical safeguards designed to protect client information from unauthorized access, use, disclosure, alteration, or destruction.

Questions or Privacy Concerns

If you have questions regarding Riviv Mobile IV's privacy practices or believe your information may have been improperly accessed, used, or disclosed, please contact:

Riviv Mobile IV LLC
Email: Info@goriviv.com
Website: www.goriviv.com

Riviv Mobile IV will review privacy concerns and respond in accordance with applicable law and company policy.