1. PHO’S RESPONSIBILITY TO PROTECT YOUR HEALTH INFORMATION

PHO is required by law to maintain the privacy and security of your PHI. PHO is also required to provide you with this Notice explaining PHO’s legal duties, privacy practices, and your rights concerning your health information. PHO must follow the privacy practices described in the version of this Notice that is currently in effect.

​

PHO uses administrative, technical, and physical safeguards designed to protect PHI from unauthorized access, use, disclosure, alteration, loss, or destruction. These safeguards may include access controls, authentication requirements, role-based permissions, secure clinical systems, workforce training, appropriate vendor agreements, incident-response procedures, physical security controls, and other safeguards appropriate to the information and systems involved.

​

PHO must notify you when required by law if a breach of unsecured PHI occurs that may have compromised the privacy or security of your information. HHS’s current model notice expressly requires covered providers to state these responsibilities. HHS.gov

​

2. HOW PHO MAY USE AND DISCLOSE YOUR PHI FOR TREATMENT

PHO may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This may include sharing appropriate information with physicians, advanced practice registered nurses, nurses, laboratories, pharmacies, specialists, consultants, or other healthcare professionals involved in your treatment.

​

For example, a PHO provider may review your laboratory results and share clinically relevant information with another professional participating in your care. PHO may also transmit an authorized prescription or patient-specific medication order to an appropriate pharmacy when necessary for your treatment.

​

PHO will limit uses and disclosures to information reasonably appropriate for the purpose and will apply additional restrictions where required by law.

​

3. HOW PHO MAY USE AND DISCLOSE YOUR PHI FOR HEALTHCARE OPERATIONS

PHO may use and disclose PHI as reasonably necessary to operate its healthcare practice and support patient care. Healthcare operations may include quality assessment, quality improvement, care coordination, credentialing, professional review, staff training, compliance activities, audits, legal services, risk management, patient-safety activities, business planning, operational review, and other activities permitted under HIPAA.

​

For example, PHO may review patient-care information to evaluate whether clinical or administrative processes are working appropriately, identify opportunities to improve care, or verify that healthcare professionals are meeting applicable standards.

​

Operational systems such as QCommand Center, Airtable, internal PHO portals, or management dashboards are not substitutes for PHO’s clinical medical record. Detailed clinical information should be maintained in PHO’s approved clinical record environment, currently Elation Health, unless a specific operational system and field have been approved for the information involved.

​

4. HOW PHO USES PHI FOR PAYMENT AND FINANCIAL ADMINISTRATION

PHO is a cash-pay healthcare practice. PHO does not accept or bill Medicare, Medicaid, or commercial health insurance for PHO’s own services.

PHO may nevertheless use PHI as reasonably necessary to collect payment directly from you, document services provided, process authorized payment transactions, maintain financial records, respond to billing questions, investigate disputed transactions or chargebacks, verify patient-specific product orders, and perform other lawful financial administration related to your care.

​

PHO may also disclose appropriate information to independent third-party laboratories, such as Quest Diagnostics or Labcorp, when necessary to support laboratory services that you have authorized. Those laboratories may independently bill your health insurance or bill you directly according to their own arrangements. The fact that PHO shares information necessary to coordinate outside laboratory services does not mean that PHO accepts or bills your insurance.

​

5. THIRD-PARTY LABORATORIES

PHO may coordinate laboratory testing through independent laboratories, including Quest Diagnostics and Labcorp. When laboratory testing is ordered, PHO may disclose information reasonably necessary for the laboratory to perform the ordered tests, identify you, process the laboratory order, report results, and carry out the laboratory’s lawful healthcare and payment functions.

​

Quest Diagnostics and Labcorp are independent healthcare entities and maintain their own privacy, billing, insurance, and operational practices. They may accept your health insurance for eligible laboratory testing according to their own network participation and payer rules. PHO’s cash-pay model remains separate from the laboratory’s billing relationship with you or your insurer.

​

6. PHARMACIES, COMPOUNDING FACILITIES, AND PATIENT-SPECIFIC MEDICATION ORDERS

PHO may disclose appropriate PHI to an authorized pharmacy, compounding facility, outsourcing facility, or other healthcare supplier when necessary to fill a prescription, prepare a compounded medication, fulfill a patient-specific medication order, communicate relevant clinical information, address a medication-safety concern, or otherwise support your treatment.

​

PHO does not maintain general standing inventory of unassigned patient medications for anticipated future sale. Medications and treatment products are ordered specifically for individual patients following the applicable assessment, healthcare-provider evaluation, clinical determination, patient authorization, and payment process. When PHO communicates with an independent pharmacy or supplier, that entity remains responsible for its own privacy, security, licensing, dispensing, compounding, labeling, shipping, quality, and other legal obligations.

​

7. BUSINESS ASSOCIATES AND OTHER SERVICE PROVIDERS

PHO may use outside companies or professionals to perform services on PHO’s behalf. When an outside party performs a function that makes it a HIPAA Business Associate and the law requires a Business Associate Agreement, PHO requires the appropriate contractual protections before PHI is disclosed for that purpose. Business Associates may support functions such as electronic health records, information technology, secure communications, data hosting, compliance, accounting, legal services, administrative services, security, or other healthcare operations. The fact that PHO uses a vendor does not automatically authorize that vendor to receive PHI. PHO seeks to disclose only the information appropriate to the function being performed and to use contractual protections required by applicable law.

​

8. USES AND DISCLOSURES REQUIRED OR PERMITTED BY LAW

PHO may use or disclose PHI without your written authorization in circumstances permitted or required by law. These circumstances may include public health activities, healthcare oversight, professional licensing matters, reporting required by law, legally authorized law-enforcement activities, judicial or administrative proceedings, workers’ compensation matters, certain governmental functions, organ and tissue donation activities, coroners and medical examiners, funeral directors, and activities necessary to prevent or reduce a serious threat to health or safety. Such disclosures are not automatic merely because information is requested. PHO must determine that an appropriate legal basis exists and must comply with any conditions, limitations, or additional confidentiality rules applicable to the information involved. HHS’s current model NPP identifies these permitted categories, including public health and safety, research, compliance with law, organ donation, medical examiners and funeral directors, workers’ compensation, law enforcement, government activities, and litigation. HHS.gov

​

9. PUBLIC HEALTH AND SAFETY

PHO may disclose PHI for legally permitted public-health and safety purposes. Depending on the circumstances, this may include reporting certain diseases or conditions, assisting with product recalls, reporting adverse medication reactions, reporting suspected abuse, neglect, or domestic violence where permitted or required, and preventing or reducing a serious and imminent threat to the health or safety of a person or the public.

PHO will make such disclosures only as permitted or required by applicable law.

​

10. HEALTH OVERSIGHT, LICENSING, AND REGULATORY ACTIVITIES

PHO may disclose PHI to legally authorized health-oversight agencies and regulatory authorities for activities such as audits, investigations, inspections, licensure review, disciplinary proceedings, healthcare compliance, credentialing oversight, or other governmental functions authorized by law.

This may include disclosures to agencies such as the U.S. Department of Health and Human Services, the Florida Department of Health, professional licensing boards, AHCA where applicable, or other legally authorized oversight bodies.