Notice of Privacy Practices

1. Who follows this Notice

This Notice applies to Dr. Miami Clinic and its workforce only to the extent Dr. Miami Clinic maintains PHI as a HIPAA covered healthcare provider. It does not automatically apply to a separate company, clinician, medical group, pharmacy, or laboratory.

Independent clinicians and medical groups available through MD Integrations make their own clinical decisions and may maintain the official medical record. Their own Notices of Privacy Practices control the records they maintain. This Notice applies to a participating provider only if that provider expressly adopts it as permitted by HIPAA.

When Dr. Miami Clinic receives PHI solely as a business associate for another covered entity, the covered entity’s notice and the applicable Business Associate Agreement—not this Notice—govern that PHI. Business associates and subcontractors do not become parties to this Notice merely because they provide services involving PHI.

2. How we may use and disclose PHI without written authorization

HIPAA permits or requires uses and disclosures in circumstances including:

• Treatment: to coordinate care, obtain clinical review, issue or manage a prescription, communicate with a pharmacy, consult another provider, or support follow-up care.
• Payment: to collect program or clinical fees, process transactions, confirm payment status, coordinate pharmacy payment, and perform billing or collection activities permitted by law.
• Healthcare operations: for quality assessment, patient support, credentialing, compliance, audits, training, legal services, security, fraud prevention, and other permitted operations.
• Business associates: to vendors performing services involving PHI, subject to written safeguards required by HIPAA.
• Appointment, refill, and care communications: to contact you about treatment, prescriptions, refills, support, treatment alternatives, or health-related services that may interest you, as permitted by law.
• People involved in your care or payment: to a family member, personal representative, or other person involved in your care or payment when you agree, do not object, or the law otherwise permits.
• As required by law: when a federal, state, or local law requires a use or disclosure.
• Public health and safety: for disease prevention, product recalls, adverse-event reporting, suspected abuse or neglect, or prevention of a serious and imminent threat, as authorized by law.
• Health oversight: for audits, inspections, investigations, disciplinary matters, licensure, and other authorized oversight activities.
• Legal proceedings and law enforcement: in response to a qualifying court order, subpoena, administrative request, or other lawful process, subject to HIPAA safeguards.
• Workers’ compensation and other government functions: as authorized by applicable law.
• Coroners, medical examiners, funeral directors, and organ donation: as permitted for identification, duties required by law, or donation and transplantation.
• Research: only when approved or otherwise permitted under HIPAA and applicable research rules.

We use and disclose only the minimum necessary PHI when the minimum-necessary rule applies. That rule does not generally apply to disclosures to a healthcare provider for treatment, disclosures to you, disclosures made under your authorization, or disclosures required by law.

3. Your choices and uses requiring written authorization

Tell us your preference if you want us to share relevant PHI with family, close friends, or others involved in your care or payment, or for disaster-relief assistance. We follow your instructions when you are able to tell us your choice. If you cannot tell us, we may share information when permitted by law and when we believe it is in your best interest.

Uses or disclosures not otherwise permitted or required by law will be made only with a valid written authorization. This generally includes most uses of psychotherapy notes, the sale of PHI, and uses of PHI for marketing when HIPAA requires authorization. We do not sell PHI.

If you sign an authorization, you may revoke it in writing at any time, except to the extent action has already been taken in reliance on it or another legal exception applies. A privacy notice is not a substitute for an authorization when authorization is required.

If we contact you for fundraising, you may tell us not to contact you again. If we maintain Part 2 records, we will provide the separate advance notice and choice required before using those records for fundraising communications.

4. Your rights concerning PHI

Subject to HIPAA’s conditions and exceptions, you may:

• Inspect or obtain a copy: request an electronic or paper copy of PHI in a designated record set. We generally respond within 30 days, subject to any extension or exception permitted by law. A reasonable, cost-based fee may apply when allowed by law.
• Request a correction: ask to amend PHI you believe is incorrect or incomplete. A request may be denied for reasons permitted by law, with a written explanation. We generally act on an amendment request within 60 days, subject to any extension permitted by law.
• Request confidential communications: ask us to contact you in a particular way or at a particular location. Reasonable requests will be accommodated as required by law.
• Request restrictions: ask us not to use or disclose certain PHI. We are not always required to agree. When you pay a provider in full out of pocket and ask that provider not to disclose the related information to a health plan for payment or operations, the provider will honor the request when HIPAA requires it.
• Receive an accounting: request a list of certain disclosures made during the six years before your request, or a shorter period if you request one, subject to disclosures HIPAA excludes from an accounting. The first accounting in a 12-month period is free; a reasonable fee may apply to additional requests after advance notice.
• Receive this Notice: obtain a paper or electronic copy at any time, including if you previously agreed to receive it electronically.
• Choose a representative: have a person with lawful authority exercise rights on your behalf after we verify that authority.
• Complain without retaliation: submit a privacy complaint to us or the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

The organization maintaining the requested record is responsible for fulfilling the request. We may direct you to your treating provider or medical group when it maintains the official clinical record.

5. Our responsibilities

• We are required by law to maintain the privacy and security of PHI we maintain.
• We will notify affected individuals following a breach of unsecured PHI when required by law.
• We must follow the duties and privacy practices described in the Notice currently in effect and make a copy available to you.
• We will not use or disclose PHI other than as described here or permitted by law unless you authorize it in writing.
• We maintain safeguards and require business associates to protect PHI as required by HIPAA.

6. More protective federal and state laws

Some information may receive additional protection under federal or state law, including certain information involving substance-use-disorder treatment records, mental health, HIV or sexually transmitted infections, genetic testing, and other specially protected records. We will obtain consent or authorization when a more protective law requires it and will not use or disclose records in a way prohibited by applicable law.

To the extent we maintain records protected by 42 C.F.R. Part 2, those records, or testimony describing their contents, may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against the patient unless the patient gives specific written consent or both a qualifying court order and subpoena authorize the use or disclosure after the process required by Part 2. A subpoena or similar legal request by itself is not sufficient.

7. Questions, requests, and complaints

Contact the Privacy and Compliance Office using the information below. Please identify the record or request involved and the treating provider, if known.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, through the HHS complaint portal, by mail, or by telephone using the current contact information published by HHS. You will not be retaliated against for filing a complaint.

We will make a good-faith effort to obtain your written or electronic acknowledgment that you received this Notice. Signing or declining to sign an acknowledgment does not waive a privacy right, authorize a use or disclosure, or prevent treatment or other permitted services.

8. Changes to this Notice

We may change this Notice and make the revised terms effective for PHI already maintained as well as information received in the future. The current Notice will be posted on this website and made available upon request. Material changes will be communicated as required by law.