HIPAA Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to protected health information (“PHI”) created, received, maintained, or transmitted by Square Medical Center LLC in connection with its healthcare operations, including telehealth and services delivered through authorized providers and business associates.

1. Your Rights

Obtain your medical records

You may request to inspect or obtain a paper or electronic copy of your medical records and other health information maintained about you, subject to applicable exceptions.

We will generally provide access within 30 days, as required by applicable law. We may charge a reasonable, cost-based fee when permitted.

Request corrections

You may ask us to correct medical information you believe is incorrect or incomplete.

We may deny a request when legally permitted, but we will explain the decision in writing, generally within 60 days, subject to permitted extensions.

Request confidential communications

You may request that we contact you using a particular telephone number, mailing address, or other reasonable communication method.

We will accommodate reasonable requests in accordance with applicable law.

Request restrictions

You may request limits on certain uses or disclosures of your health information.

We are generally not required to agree to every restriction. However, if you pay for a healthcare item or service entirely out of pocket and request that we not disclose the related information to your health plan for payment or healthcare operations, we will honor that request unless disclosure is required by law.

Request an accounting of disclosures

You may request an accounting of certain disclosures of your PHI for the six years preceding your request, subject to legal exceptions.

One accounting within a 12-month period is generally provided without charge. Additional requests may incur an allowable cost-based fee.

Obtain a copy of this notice

You may request a paper or electronic copy of this Notice at any time, including if you previously agreed to receive it electronically.

Choose a personal representative

A person legally authorized to act for you may exercise your rights, subject to verification of that person's authority and applicable law.

File a complaint

You may complain to Square Medical Center or the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

We will not retaliate against you for filing a complaint.

2. Your Choices

In certain circumstances, you may tell us your preferences about sharing health information with:

• Family members, friends, or others involved in your care or payment.
• People involved in disaster relief.
• Other persons when you are unable to communicate and sharing is legally permitted and consistent with your best interests.

We generally require your written authorization for:

• Marketing uses or disclosures that legally require authorization.
• The sale of PHI.
• Most uses or disclosures of psychotherapy notes, when such notes exist and the relevant rules apply.
• Other uses or disclosures not otherwise permitted by law.

Square Medical Center does not currently conduct promotional email or SMS marketing campaigns or sell patient medical information.

Any fundraising activity involving PHI will comply with applicable authorization, notice, and opt-out requirements. We do not currently conduct patient fundraising campaigns.

You may revoke an authorization in writing, except to the extent we already acted in reliance on it.

3. How We May Use and Disclose Your Information

Treatment

We may use and share your information to provide, coordinate, or manage healthcare.

For example, an authorized clinician may review your medical history or share relevant information with another provider involved in your care.

Payment

We may use and disclose information to bill you, process payments, establish eligibility, obtain authorizations, or collect payment from insurers or other responsible parties.

Healthcare operations

We may use and disclose PHI to manage our practice, evaluate and improve services, support quality assurance, conduct necessary administrative activities, and comply with operational requirements.

Appointment reminders and healthcare communications

We may use appropriate contact information to communicate about appointments, scheduling, follow-up care, and other healthcare-related matters.

Communications will be handled according to applicable privacy requirements and your reasonable confidential-communication requests.

Business associates

We may disclose PHI to authorized service providers who perform healthcare-related functions on our behalf, subject to legally required business associate agreements and safeguards.

Our operational systems include Tebra for electronic medical records, appointments, patient services, and applicable payment functions.

Public health and safety

We may disclose PHI when legally permitted or required for purposes such as disease reporting, prevention of serious threats, reporting abuse or neglect, public health investigations, product recalls, or other authorized public health activities.

Research

We may use or disclose PHI for research only when applicable privacy requirements, authorizations, waivers, or other legal conditions are satisfied.

Legal compliance and oversight

We may disclose PHI when required or permitted for:

• Health oversight activities.
• Legal proceedings and qualifying court orders.
• Law enforcement requests that meet applicable requirements.
• Workers' compensation.
• Certain government functions.
• Organ and tissue donation.
• Coroners, medical examiners, and funeral directors.

Each disclosure is subject to applicable legal limits and conditions.

4. Specially Protected Information

Some information may be subject to additional federal or Florida protections, including certain mental health records, HIV-related information, reproductive healthcare information, and substance use disorder records.

We will apply those additional protections whenever required.

42 CFR Part 2: Square Medical Center has indicated that it does not operate a Part 2 program. Nevertheless, to the extent we maintain patient records received from a program and protected by Part 2, special restrictions apply. Such records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without the consent or legal process required by Part 2, including applicable court-order requirements.

Any specific disclosures involving these categories of information must comply with the relevant law.

5. Our Responsibilities

We are required to:

• Maintain the privacy and security of PHI in accordance with applicable law.
• Provide this Notice and comply with its current terms.
• Use or disclose PHI only as permitted or required by law, or pursuant to a valid authorization.
• Notify affected individuals and other required parties of qualifying breaches in accordance with applicable law.
• Respect applicable rights to access, amend, restrict, and receive an accounting of PHI.
• Maintain appropriate safeguards and legally required business associate relationships.

We will not retaliate against anyone for exercising privacy rights or submitting a complaint.

6. Electronic Health Records and Telehealth

Square Medical Center uses Tebra for relevant patient records and services.

Electronic records, telehealth communications, scheduling, payment services, and patient access are subject to applicable HIPAA and security requirements.

Patients should use authorized patient communication and portal services for sensitive health information instead of ordinary email whenever feasible.

Availability of electronic communications does not waive any legal privacy protections.

7. Changes to This Notice

We may revise this Notice as permitted by law. Revised terms may apply to PHI we maintain, subject to applicable requirements.

Updated notices will be available upon request and posted prominently on our website and at physical care locations when applicable.

8. How to Exercise Your Rights

Send requests or privacy questions to:

We may need to verify your identity or legal authority before processing certain requests.

Do not include sensitive medical information in an unsecured email unless our team has provided an appropriate communication method.

9. Complaints to the U.S. Department of Health and Human Services

You may also file a privacy complaint with the Office for Civil Rights, U.S. Department of Health and Human Services.

Information about submitting a complaint is available at:

https://www.hhs.gov/hipaa/filing-a-complaint/index.html

You will not be penalized for making a complaint.