HIPAA Policy

Protected Health Information is individually identifiable health information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for healthcare services. PHI includes information in any form — written, electronic, or oral — that can be used to identify you.

We may use or disclose your PHI without your authorization in the following limited circumstances:

• Medical emergencies — to medical personnel treating a condition that poses an immediate threat to your health
• Reporting crimes on premises or against program personnel — to law enforcement if a crime is committed or threatened on our premises or against our staff
• Child abuse or neglect — as required by Florida law (mandatory reporting)
• Court orders — in response to a valid court order that meets the specific requirements of 42 CFR Part 2
• Research — for approved research purposes with appropriate safeguards and approvals
• Audit and evaluation — to authorized federal, state, or local agencies conducting audits or evaluations of our program

All other uses and disclosures require your written authorization. You may revoke any authorization in writing at any time, except to the extent that we have already acted in reliance on it.

You have the following rights with respect to your PHI:

• Right to Access — You have the right to inspect and obtain a copy of your PHI maintained in our records. We may charge a reasonable fee for copies. We will respond to your request within 30 days.
• Right to Amend — You may request an amendment to your PHI if you believe it is inaccurate or incomplete. We may deny your request in certain circumstances and will provide a written explanation.
• Right to an Accounting of Disclosures — You may request a list of disclosures we have made of your PHI for purposes other than treatment, payment, healthcare operations, or disclosures you authorized in writing.
• Right to Request Restrictions — You may request restrictions on certain uses and disclosures of your PHI. We are not required to agree to all requests but will comply if we do agree.
• Right to Confidential Communications — You may request that we communicate with you about health matters using a specific method or at a specific location (e.g., sending correspondence to a different address).
• Right to a Paper Copy — You have the right to obtain a paper copy of this Notice of Privacy Practices at any time upon request.

In the event of a breach of your unsecured Protected Health Information, we will notify you as required by HIPAA and applicable state law. Notification will be made without unreasonable delay and no later than 60 days after discovery of the breach. The notification will include a description of the breach, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for further questions.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. You will not be retaliated against for filing a complaint.