eternalHealth Privacy Practices

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice of Privacy Practices describes how eternalHealth may use and disclose your Protected Health Information (“PHI”) in accordance with applicable law, including the Health Insurance Portability and Accountability Act (“HIPAA”), regulations promulgated under HIPAA including the HIPAA Privacy and Security Rules. It also describes your rights to access and control your PHI. PHI is about you, including demographic information, that may identify you and that relates to any of the following:

  1. Your past, present or future physical or mental health or condition;
  2. The provision of health care to you; and
  3. The past, present, or future payment for the provision of health care to you.

We Are Legally Required to Safeguard your Protected Health Information

We are required by law to:

  • Provide you with a copy of this Notice of Privacy Practices;
  • Maintain the privacy of your PHI;
  • Comply with the duties and privacy practices described in this Notice; and
  • Notify you following a breach that may have compromised the security or privacy of your PHI.

How We May Use and Disclose Your PHI

The law allows us to use and disclose your PHI for certain purposes without obtaining your written authorization. This section provides examples of each of these circumstances.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

  • Treatment: We may use or disclose your PHI for you to obtain treatment. For example, your physician may send us information regarding your diagnosis so we can arrange additional services.
  • Payment: We may use or disclose your PHI to provide payment for the treatment you receive. For example, we send information to your vision plan to complete payment for your eye care.
  • Health Care Operations: We may use or disclose your PHI for our health care operations. For example, we may use your PHI to conduct audits or to gauge the quality of care provided by the providers in our provider networks.

Your Rights to make Choices about Certain Disclosures

For certain PHI, you can tell us what your choices are about what information we share. If you have a preference about how we share your information in the situations listed below, let us know. If you tell us clearly what your preferences are, we will follow your preferences:

In these circumstances, you have the right and choice to request that we:

  • Share information with your family, named close friends, or anyone who helps pay for your care; and
  • Share information during a disaster relief situation.

If you are unable to indicate a preference (e.g., if you are unconscious) we may proceed to share your information after determining that to do so is in your best interest. Additionally, we may share your information when needed to lessen a serious and imminent threat posed to health or safety.

Other Uses and Disclosures of Your PHI that Do Not Require Authorization

We are also allowed to disclose your PHI without your authorization in the following circumstances:

  • To Comply with the Law. We disclose PHI when we are required to do so by federal, state or local law.
  • For Public Health Activities. For example, we disclose PHI when we report to a public health authority for purposes such as public health surveillance or public health investigations. If directed by that health authority, we’ll also disclose your PHI to a foreign government agency that is collaborating with the public health authority.
  • For Reports About Victims of Abuse, Neglect, or Domestic Violence. We will disclose your PHI in these reports only if we are required or authorized by law to do so, or if you otherwise agree.
  • To Health Oversight Agencies. We will provide your PHI as requested to government agencies with the authority to investigate or audit our operations.
  • For Lawsuits and Disputes. If you’re involved in a lawsuit or dispute, we may disclose your PHI in response to a subpoena or court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process filed by someone else involved in the dispute, but only if the party seeking your PHI provides us with satisfactory assurances that you’ve been given notice of the request, and that the party seeking your PHI has obtained a protective order for the information requested.
  • To Law Enforcement. Under certain limited circumstances, we may disclose your PHI to law enforcement officials. For example, disclosures may be made in response to a warrant or subpoena or for the purpose of identifying or locating a suspect, witness or missing persons or to provide information about victims of crimes.
  • To Coroners, Medical Examiners and Funeral Directors. We may disclose your PHI to facilitate the duties of these individuals.
  • For Purposes of Organ Procurement. We may disclose your PHI to facilitate organ donation and transplantation.
  • For Research Purposes. Under certain circumstances, we may disclose your PHI to researchers who are conducting a specific research project. For certain research activities, an Institutional Review Board (“IRB”) or Privacy Board may approve uses and disclosures of your PHI without your authorization.
  • To Avoid Harm. We may disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the public.
  • For Special Government Functions. For example, we may disclose your PHI to authorized federal officials for intelligence and national security activities that are authorized by law.
  • Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official if necessary to provide you with health care, protect the health and safety of others, or provide for the safety of the correctional institution.
  • For Workers’ Compensation Purposes. We may provide your PHI to comply with workers’ compensation laws.

Impact of Other Laws

State and other federal laws may have additional requirements that we must follow or may be more stringent than HIPAA regarding the use and disclosure of your PHI. If there are specific, more restrictive requirements, even for some of the purposes described above, we may not disclose your PHI without your written permission as required by such laws.

Uses and Disclosures of PHI Requiring Your Authorization

Use and disclosures of your PHI for other purposes may be made only with your written authorization and unless we have your authorization we will not:

  • Use or disclose your PHI for marketing purposes; and
  • Share psychotherapy notes (to the extent we have any).

If you give us written authorization for a use or disclosure of your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the purposes specified in the written authorization, except to the extent we have already taken action in reliance on the authorization, or if your authorization was obtained as a condition of you obtaining insurance coverage and the law allows us to contest a claim or the policy . To revoke an authorization, make a written request to our Privacy Officer, using the contact information below.

We Will Never Sell your PHI for marketing purposes.

Your Rights Regarding Your PHI

You have the following rights regarding your PHI. All requests or communications to us to exercise your rights discussed below must be submitted in writing to the Privacy Officer at the contact information listed below.

The Right to Choose How We Communicate with You

  • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
  • We will consider all reasonable requests and must agree to the request if you clearly state we could endanger you by not agreeing.

The Right to Access and Receive Copies of Your PHI

  • Subject to certain exceptions, you may look at and copy your PHI if you make this request in writing. You may ask for a paper copy or, if your PHI is maintained electronically, an electronic copy of your PHI. We may deny your request in certain limited circumstances. If we deny your request, we will tell you in writing and let you know if you may request a review of the denial. We reserve the right to charge you a fee authorized by law to complete your request. Alternatively, we may provide you with a summary or explanation of your PHI, if you agree to that and to the cost, in advance.

The Right to Amend Your PHI

  • If you believe the PHI we have about you is incomplete or incorrect, you may ask us to amend it. Any such request must be made in writing and must tell us why you think the amendment is appropriate.
  • We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. Additionally, we may deny your request if you ask us to amend information that:
    • is not part of the medical information kept by or for eternalHealth;
    • was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
    • is already accurate and complete.
  • If we deny your request, you have the right to file a statement of disagreement with us, which will become part of your record with us.

The Right to Get a List of the Disclosures We Have Made

  • You have the right to request an accounting of disclosures we make of your PHI. Please note that certain disclosures need not be included in the accounting we provide to you. Your request must state a time period, which may not go back more than six years. If you request this accounting more than once in a 12-month period, we may charge you a reasonable fee.

The Right to Request Limits on Uses and Disclosures of Your PHI

  • You have the right to request that we limit how we use or disclose your information. Except under limited circumstances, we are not required to agree to your request, but if we do, we will abide by our agreement (except in an emergency).

The Right to Get a Paper Copy of This Notice

  • Even if you have agreed to receive this Notice by email, you have the right to request a paper copy as well. You may obtain a paper copy of this Notice by contacting the Privacy Officer using the contact information below. You may also view the Privacy Policy here.
  • Changes to the Terms of this Notice: We reserve the right to make changes to this Notice as permitted by law and to make the revised Notice effective for PHI we already have about you as well as any information we obtain in the future, as of the effective date of the revised Notice. The new Notice will be available upon request, on our website, and we will mail a copy to you.


If you believe your privacy rights have been violated, you may file a complaint with eternalHealth or with the Secretary of the federal Department of Health and Human Services Office of Civil Rights.
You can file a complaint with the Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling +1 (877) 696-6775, or visiting
To file a complaint with us, you must make that complaint in writing and send it to our Privacy Officer using the contact information below. You may also contact our Privacy Officer if you have questions or comments about our privacy practices. We will not retaliate against you for filing a complaint.
For more information about any of our privacy practices, to exercise your privacy rights, or to file a complaint, contact our privacy officer at:
eternalHealth Privacy Officer
376 Boylston St.
Boston, MA 02116
+1 (857) 557-6007

Page Last Updated On: February 13, 2023
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
This link will leave, opening a new window.
Tom Cunniffe

Tom Cunniffe

Director of Operations 

Tom Cunniffe comes to eternalHealth with over 20 years of healthcare operations’ experience, having held leadership positions in Call Center, Enrollment, Credentialing, UAT and Reimbursement teams. Tom has worked with Medicaid, Commercial and Medicare lines of business and has consistently built teams who are metrics driven with proven successful outcomes. Making sure our business strives for an efficient, best-in-class customer experience is at the center of Tom’s philosophy.

Tom has a bachelor’s degree from Fordham University and a master’s in business administration from University of Massachusetts at Amherst.

Tom Lawless

Tom Lawless

Chief Financial Officer

Tom Lawless has spent the past 20+ years building, sustaining, and growing new healthcare-related programs that balance fiscal responsibility & prudence with creativity & innovation, focusing on models of care that are novel, person-centered, and improve the social welfare of those who are served. He is very excited to continue doing so in his role as the Chief Financial Officer of eternalHealth.

Tom comes to eternalHealth from a not-for-profit, member-centric, health insurance cooperative. He helped the company continuously strive toward its dual goals of thriving financially, while keeping members at the very epicenter of its mission and service model. While there, Tom also spearheaded the creation of a brand new private, charitable foundation, which will be meaningfully giving back to those in need in the surrounding communities for years to come. Previously, Tom worked in the finance department of a successful hospice that provided high-quality care to persons experiencing their unique and poignant end-of-life journeys, assuring that the appropriate financing was always available. Tom’s career began as a civil servant in the Wisconsin Medicaid program, where he helped to create a program that expanded the institutional entitlement to care into home and community-based settings. Starting with only a blueprint in hand, the program now serves more than 57,000 frail elders and disabled adults and is considered a national model. Growing into a senior leadership role, Tom was a key architect of an innovative financing model, through which the public and private sectors successfully collaborated to better the lives of persons in great need.

Tom holds undergraduate and graduate degrees from the University of Chicago, with additional graduate work in economics completed at the University Wisconsin-Madison.

This link will leave, opening a new window.
This link will leave, opening a new window.