Vista Verde Homes – Medicaid Meals Program 501(c)(3) nonprofit | EIN: 99-1152633 | Salt Lake County, Utah, United States Effective Date: June 2026

​

Vista Verde Homes is a 501(c)(3) nonprofit organization whose mission is to serve as a community resource navigator and referral source. We provide free, voluntary assistance by offering education about available public and community resources, conducting basic non-clinical eligibility pre-screening (where required by partners), and facilitating referrals to appropriate third-party programs and services — such as meal options potentially aligned with Medicaid or other public benefits.

​

We do not provide healthcare, clinical services, nutritional counseling, case management, benefit enrollment, eligibility determinations, or any form of medical or therapeutic support. Our interactions are informational and connective only.

​

1. Our HIPAA Status

​

We are not a HIPAA "Covered Entity." HIPAA's covered-entity obligations apply to healthcare providers, health plans, and healthcare clearinghouses that transmit protected health information (PHI) in connection with covered transactions (e.g., billing or claims). Vista Verde Homes is none of these. We do not provide, coordinate, or deliver any healthcare, medical, clinical, diagnostic, or treatment services; transmit health information in standard HIPAA transactions; act as a health plan, insurer, or clearinghouse; enroll individuals in Medicaid, Medicare, managed care, or any insurance program; or make medical-necessity determinations, clinical judgments, or benefit-eligibility decisions on behalf of any agency or payer.

​

Because we do not function as a covered entity, the obligations HIPAA places on covered entities — including the formal Notice of Privacy Practices under 45 CFR § 164.520 — do not apply to us in that capacity.

​

Business-associate status. Because we collect identifiable health-coverage information (including your Medicaid CIN) and handle it to coordinate referrals with Medicaid Managed Care Plans, Social Care Networks, and healthcare providers, we create, receive, maintain, or transmit PHI on behalf of covered entities and therefore act as a business associate under HIPAA. In that role, we handle PHI in accordance with a Business Associate Agreement (BAA) with each such entity and HIPAA's applicable Privacy and Security Rule requirements. Participation with Vista Verde Homes does not, by itself, create any provider-patient relationship, fiduciary duty, clinical responsibility, or ongoing case-management obligation.

​

2. No Medical, Clinical, Nutritional, Enrollment, or Decision-Making Services

​

To be explicit, Vista Verde Homes does not and will not offer medical advice, diagnosis, treatment, prescriptions, or referrals for clinical care; provide nutritional assessments, therapy, counseling, meal planning, or dietary prescriptions; determine, certify, or influence eligibility for Medicaid, Medicare, SNAP, meal programs, or any other benefits; submit applications, claims, authorizations, or appeals on behalf of individuals; manage cases, coordinate care, or follow up on health outcomes; or represent or act as an agent for CMS, any state Medicaid agency, managed care organization, insurer, or government program. All referrals are informational only — individuals independently contact and work directly with the referred organization or agency, and choose their own provider or vendor.

​

3. Information We Collect — Minimum Necessary

​

We collect only the limited information needed to understand whether you may qualify for programs and to make a referral. Depending on the screening, this may include contact and identifying details (such as name, date of birth, address, phone, and email), whether you are enrolled in Medicaid, your Medicaid Client Identification Number (CIN), and limited, self-reported, general health-related information (for example, whether a health condition affects your diet or nutrition).

​

We collect your Medicaid CIN because it is needed to confirm your enrollment and to submit a referral to the Medicaid Managed Care Plan or Social Care Network that reviews your eligibility. Your CIN and the related information you provide are health-related information; because we handle this information to coordinate referrals with covered entities, we treat it as protected health information (PHI) and handle it under HIPAA's requirements and a Business Associate Agreement (see Section 1). Providing any information is entirely voluntary; you may skip any question or withdraw consent at any time without penalty, though we may be unable to submit a referral without the information a program requires.

​

We do not collect detailed clinical records. Diagnoses, treatment histories, clinical notes, lab results, and similar details are collected — where needed — by the program, plan, provider, or Social Care Network that actually determines eligibility and provides services, under their own authorizations, not by us. We apply a strict "minimum necessary" approach and limit ourselves to routing-level information.

​

4. Specially Protected Information

​

We do not collect, through our screening, information about HIV/AIDS status, mental-health or substance-use treatment, genetic information, or other categories that receive heightened legal protection — including information protected under New York Public Health Law Article 27-F (HIV/AIDS-related information). If a program you are referred to needs such information, that program collects it directly from you under the specific written authorization the law requires. 

​

5. How We Use and Share Information — Minimum Necessary & Referral-Only

​

Any information shared with us is used exclusively to educate about resource options, perform basic non-clinical pre-screening to identify suitable referral pathways, and facilitate introductions or referrals (with your express consent where required). We apply a strict "minimum necessary" standard. Information is never:

• Used for clinical decision-making, diagnosis, treatment, or health assessments;

• Sold, rented, or traded, or used for advertising, marketing of third-party products, fundraising unrelated to our core mission, solicitation, research, or commercial purposes;

• Disclosed beyond the specific partner(s) directly involved in the requested resource (and only with your consent when applicable).

Once referred, third-party organizations (meal providers, government agencies, healthcare entities) handle information independently under their own policies and legal obligations. We have no control over their practices and assume no responsibility for how they manage or use data post-referral.

​

6. Privacy and Security Safeguards

​

Although our obligations differ from those of a covered entity (except where we act as a business associate), we implement reasonable safeguards consistent with the sensitivity of the information we handle: data access restricted to trained staff/volunteers on a need-to-know basis; secure digital tools, encryption for transmissions where practical, and password protections; confidentiality agreements and training for all personnel; data minimization and retention limited to the time needed for referral completion; and regular privacy-practice reviews. Where we act as a business associate, we maintain safeguards consistent with the HIPAA Security Rule and our BAA, and use platforms appropriate to the sensitivity of the data. We cannot guarantee absolute security against every risk, but we prioritize reducing exposure through these measures.

​

7. Referrals Are Informational Only — No Guarantees or Liability

​

As a referral source, we offer suggestions based on publicly available information and self-reported details; we do not guarantee acceptance, availability, approval, quality, timeliness, or outcomes of any referred service; we do not supervise, endorse, or share legal liability with any third-party provider; and all decisions, services, and communications occur directly between you and the referred entity. Individuals retain complete autonomy to accept, decline, or pursue any referral — or seek services elsewhere — at any time.

​

8. Alignment with Public Goals — But Full Independence

​

Our work supports broader objectives like food security and access to public resources, consistent with federal/state guidance for community outreach. However, we are fully independent: we do not represent or act on behalf of any government agency, payer, or program; and we do not determine benefits, submit documentation, bill for healthcare services, or receive payment tied to the volume or value of services individuals receive. Where we are compensated for marketing, outreach, education, or navigation services by an authorized payer, that compensation is a fixed fee for those services, not reimbursement for healthcare and not tied to referral volume or value. (See our Funding Disclosure.)

​

9. Records We Maintain (Non-Clinical Only)

​

For accountability, we may keep internal logs such as consent records for sharing referral information, basic referral-activity summaries, and privacy-practice documentation. These exist for program integrity, grant compliance, and internal review. PHI handled in any business-associate capacity is maintained under the applicable BAA.

​

10. Your Rights and Voluntary Participation

​

Everything is voluntary. You may ask questions about our practices at any time, decline to provide or withdraw any information, request no further contact, and (for SMS) reply STOP to stop text messages. If your information is held by a HIPAA-covered provider or by us in a business-associate capacity, you also have the HIPAA rights described by that entity's Notice of Privacy Practices.

​

11. Contact for Questions

Vista Verde Homes — Medicaid Meals Program Salt Lake County, Utah, United States Email: info@medicaidmeals.org