Notice of Privacy Practices — your information, protected.

Our duties

We are required by law to maintain the privacy and security of your protected health information, to give you this Notice of our legal duties and privacy practices, to follow the terms of the Notice currently in effect, and to notify you if a breach of your unsecured protected health information occurs. We may change this Notice. Changes may apply to information we already have about you as well as to new information. The revised Notice will have a new effective date. The current Notice will be posted on our website, available at any location where we see patients, and given to you on request.

How we use and share your health information

Treatment. We use your health information to provide, coordinate, and manage your care, and we share it with other professionals who are treating you. Example: we send relevant history to a laboratory or specialist so the correct test can be ordered and interpreted, or we discuss your plan with a covering clinician.

Payment. We use and share your health information to bill and collect payment. Example: we use it to charge a membership or visit fee, process a payment, prepare a receipt or superbill, or respond to a health plan asking about a service. If you pay for a service or item in full out of pocket and ask us not to share that information with your health plan for payment or our operations, we will honor that request unless a law requires us to share it.

Health care operations. We use and share your health information to run the Practice and improve care. Example: we review records for quality and safety, train staff under supervision, or contact you about an appointment or a result.

Reminders and health-related services. We may contact you to remind you of an appointment, to tell you about treatment alternatives, or to tell you about health-related products or services that may interest you. We will use the contact method you request when it is reasonable to do so.

Other uses and disclosures that do not require your authorization

We may also use or disclose your information when federal or Florida law allows or requires it, after we meet the conditions that law sets. Examples include public-health reporting, reporting suspected abuse or neglect, health-oversight activities such as a licensing-board review, disclosures required by law, including to the U.S. Department of Health and Human Services to confirm we comply with federal privacy law, responding to a court order, warrant, subpoena, or other lawful process, limited disclosures to law enforcement, disclosures to prevent or lessen a serious and imminent threat, workers’ compensation disclosures, disclosures to coroners or funeral directors, organ-procurement disclosures when applicable, and research disclosures permitted by the Privacy Rule. We also share information with business associates that perform services for us, such as our electronic record, telehealth platform, laboratory, or payment processor, under a business associate agreement. Florida law is sometimes stricter than HIPAA. When it is, we follow the stricter rule. Under Florida Statutes § 456.057, we generally do not release your record or discuss your condition with anyone other than you, your legal representative, and practitioners involved in your care, unless you authorize the release in writing or another legal exception applies. We keep a record of disclosures of your medical record to a third party, including the purpose of the request.

Uses that require your written authorization

Any use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time. We will stop future uses covered by that authorization, but we cannot take back a disclosure already made, and we must keep records of care already provided. We will not use or share your information for marketing that requires an authorization, for the sale of your information, or for most uses of psychotherapy notes, without your written authorization. We do not sell protected health information, and we do not use genetic information for underwriting. We do not currently contact patients for fundraising. If we ever do, you may opt out, and treatment will not depend on that choice.

Substance use disorder records

Some substance use disorder treatment records are also protected by 42 U.S.C. § 290dd-2 and 42 CFR Part 2. To the extent we create, receive, or maintain those records, we will not use or disclose them in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order and a subpoena that meets Part 2. We will not use those records for fundraising unless we first give you a clear notice and a choice. This Practice is not a federally assisted Part 2 program. If we receive Part 2 records from another program, we protect them as Part 2 requires.

Your choices

You may tell us whether to share information with family, close friends, or others involved in your care or payment for your care, and whether to share information in a disaster-relief situation. If you cannot tell us your preference, we may share information if we believe it is in your best interest. We do not keep a hospital directory.

Your rights

To use a right, contact the Privacy Officer in writing or by secure message.

• You may ask us to limit how we use or share your information for treatment, payment, or operations. We are not required to agree, unless you paid for the service or item in full out of pocket and ask us not to share that information with your health plan for payment or operations. We will agree to that request unless a law requires disclosure. If we agree to any other restriction, we will follow it unless the information is needed for emergency treatment.
• You may ask us to contact you in a specific way or at a specific address. We will agree to all reasonable requests.
• You may inspect or get a paper or electronic copy of the health information we use to make decisions about you. We will act within 30 days. If we need more time, we may take one 30-day extension and will tell you why in writing. If we keep the record electronically, you may ask for an electronic copy, and you may direct us to send a copy to another person you name in a signed request. We may charge a reasonable, cost-based fee, not more than the actual cost of copying allowed by Florida Statutes § 456.057 and HIPAA. We will not withhold your records because of an unpaid bill. We may deny access only in the limited cases the law allows, and we will explain any denial in writing.
• You may ask us to amend information you believe is incorrect or incomplete. The request must be in writing and must say why the change is needed. We will respond within 60 days. We may deny the request, and if we do we will tell you why in writing and explain your right to submit a statement of disagreement.
• You may ask for a list of certain disclosures made in the six years before your request. The list does not include disclosures for treatment, payment, and operations, or disclosures you authorized. One accounting in any 12-month period is free.
• You may ask for a paper copy of this Notice at any time, even if you received it electronically. We will provide it promptly.

If a person has legal authority to act for you, that person may exercise these rights after we verify the authority. Florida law may limit a parent’s access to parts of a minor’s record.

Complaints

You may complain to us or to the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint. Write the Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, call 1-877-696-6775, or visit https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

Telehealth and messages

We document telehealth to the same standard as in-person care. We do not record a visit unless you agree in advance. Email and standard text messages may not be fully secure. If you ask us to use them, you accept that risk for those messages. Do not use email or text for an emergency. Call 911.

Certain information, including HIV test results, mental-health records, substance use disorder records, and genetic information, has extra protection, and we disclose it only as that law allows. We keep records for at least the period required by Florida law and professional standards. If we close or relocate and are no longer available, we will notify patients and offer a copy of the record as Florida Statutes § 456.057 requires.