PRIVACY NOTICE

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We maintain protocols to ensure the security and confidentiality of your personal health information (PHI). We have physical security in our building, passwords to protect databases, compliance audits and virus/intrusion detection software. Within our practice, access to your information is limited to those who need it to perform their jobs. Each employee is required to be trained in HIPAA rules and sign a consent form accepting responsibility for maintaining PHI.

At the offices of MCR Health, Inc., we are committed to treating and using protected health information about you responsibly. This Notice of Privacy Practices describes the personal information we collect and how and when we use or disclose that information. It also describes your rights as they relate to your protected health information. This Notice is effective as February 16, 2026, and applies to all protected health information as defined by federal regulations. Changes have been made to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), the 2013 Omnibus Rule, and the Genetic Information Nondiscrimination Act.

Understanding Your Health Record:

Each time you visit MCR Health, Inc., your visit is noted in your record. Typically, this record contains your symptoms, examination/test results, diagnoses, treatment, and a plan for care or treatment. This information, often referred to as your health/medical record, serves as a:

• Basis for planning your care and treatment.
• Means of communication among the many health professionals who contribute to your care legal
  document describing the care you received.
• Means by which you or a third-party payer can verify that services billed were provided
• Source of data for medical research.
• Source of information for public health officials charged to improve the health of the state and nation
• Source of data for our planning and marketing.
• Tool by which we can assess and continually work to improve the care we render and outcomes we achieve.

Understanding what is in your record and how your health information is used helps you to ensure its accuracy, to better understand who, what, when, where, and why others may access your health information and to make more informed decisions when authorizing disclosure to others. An Electronic Health Record (EHR) is often used in practices instead of written paper. The EHR provides security, can be accessed by providers, and can help ensure medications prescribed do not interact with other medicine(s). MCR Health, Inc does use an electronic medical records system.

Your Health Information Rights:

Although your health record is the physical property of MCR Health, Inc., the information belongs to you. 

You have the right to:

• Obtain a copy of this notice of privacy practices upon request. Request privacy protection for PHI
  (45 CFR§l64.522).
• Obtain a paper copy of this Notice upon request, even if you previously agreed to receive it electronically.
• Obtain and inspect a copy of your health record (reasonable copy fees apply in accordance with state law). Receive a copy (paper or electronic) of your PHI in the Designated Record Set (as defined by law), within 30 days of signed request (digital signature can be utilized for EHR purposes).
• Request that we transmit a copy of your protected health information directly to another person you designate, in writing, pursuant to law.
• Request an Amendment of your health record, which requires health care professionals to include your changes in your record. Obtain an accounting of certain disclosures of your health information, including who has requested your medical record. Request confidential communications of your PHI.
• Request restriction(s) on certain uses and disclosures of your health information.
• Request a restriction on disclosures of your protected health information to a health plan for services for which you have paid in full out of pocket, as required by law.
• Submit a complaint. If you believe your rights under privacy practices are being denied or your PHI is not
  being protected, you can file a complaint with the health care provider and the Office of Civil Rights.
• Receive notification of a breach of your unsecured protected health information, as required by law.

For further information on HIPAA: www.hhs.gov/hipaa
For more information on the HIPAA Omnibus Rule: www.hhs.gov/hipaa/for-professionals/privacy

Our Responsibilities:

Our practice is a “Covered Entity” and we are required to:

• Maintain the privacy of your health information
• Ensure confidentiality, integrity, and availability of ePHI. Create policies/procedures to maintain protection of PHI.
• Provide you with the notice as to our legal duties and privacy practices with respect to PHI we collect.
• Abide by the terms of this Notice currently in effect.
• Notify you if there is a breach of your unsecured protected health information without unreasonable delay, and no later than 60 days from discovery of the breach.
• Comply with your requested restriction on disclosures of protected health information to a health plan when you have paid for services in full, out of pocket.
• Accommodate reasonable requests to communicate your protected health information by alternative means or at alternative locations.
• We reserve the right to change practices and to make the new provisions effective for all PHI we maintain. We keep a posted copy of the current notice in our facility containing the effective date. In addition, each time you visit our facility for treatment, you may obtain a copy of the current notice in effect upon request. We will not use or disclose your health information in any manner, even as noted in the section Examples of Disclosures for Treatment, payment and family/friend/personal representative without your authorization, which you may revoke, except to the extent that action has already been taken. In some situations, a health care provider can share information with a family member or personal representative when he/she is either present or not present with you if the circumstances require or infer a need.

Breach of Personal Health Information:

Pursuant to 45 CFR §§ 164.400–164.414, health care providers and their business associates are required to notify you if there is a breach (unauthorized acquisition, access, use, or disclosure) of your unsecured protected health information. We will notify you without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach. In cases where a breach affects 500 or more individuals, we are also required to notify the Secretary of Health and Human Services and prominent media outlets serving the affected area.

Substance Use Disorder Treatment Records

If you receive substance use disorder treatment at our facility or if we receive such records, records of that treatment are additionally protected under 42 CFR Part 2. These records may not be disclosed without your written consent except as expressly permitted by 42 CFR Part 2.

For More Information or to Report a Problem:

If you have questions and would like additional information, you may contact our Compliance Officer by calling 941-776-4000. If you believe your privacy rights have been violated, you can either file a complaint with the Office for Civil Rights, or U.S. Department of Health and Human Services (OCR). There will be no retaliation for filing a complaint with either our practice or the OCR. The address for the OCR regional office for Florida is as follows:

OFFICE FOR CIVIL RIGHTS
U.S. Department of Health and Human Services
Atlanta Federal Center, Suite 3B70
61 Forsyth Street, SW., Atlanta, GA 30303-8909

You may also file a complaint online at www.hhs.gov/ocr/complaints. Complaints must generally be filed within 180 days of the date you knew or should have known of the alleged violation.

Examples of Disclosures for Treatment, Payment, Family/Friend/Personal Representative, and Health Operations:

• We will use your health information for treatment.
• We may provide medical information about you to health care providers, our practice personnel or third parties who are involved in the provision, management or coordination of your care. For example: Information obtained by a nurse, physician, or healthcare provider will be recorded in your record and used to determine the course of treatment for you. Your medical information may             be shared among healthcare professionals involved in your care.
• We will use your health information for billing, collection and payment purposes.
• We may disclose your information so that we can collect or make payment for the healthcare services you receive.  For example: If you participate in a health insurance plan, we disclose necessary information to that plan to obtain payment for your care.
• We will use your health information for family/friend/personal representatives.
• We may disclose your information, as needed, to a family member, a friend or someone who is responsible for your care. For example: Following emergency surgery, you remain unconscious from the anesthesia and the surgeon informs your spouse of your condition.
• We will use your health information for regular healthcare operations.
• We may disclose your health information for our routine operations. These uses are necessary for certain administrative, financial, legal, and quality improvement activities that are necessary to run our practice and support the core functions.
• Appointment reminders.
  • We may disclose medical information to provide appointment reminders (e.g., contacting you at the phone number provided to us and leaving a message as an appointment reminder).
• Decedents.
  • Consistent with applicable law, we may disclose health information to a coroner, medical examiner or funeral director.
• Public health.
  • As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury or disability.
• Research
  • We may disclose information to researchers when their research has been approved and the researcher has obtained a required waiver from the Institutional Review Board/Privacy Board, who has reviewed the research proposal.
• Organ procurement organizations.
• Consistent with applicable law, we may disclose health information to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs for the purpose of donation and transplant.
• As required by law.
  • We may disclose health information as required by law. This may include reporting a crime, responding to a court order, grand jury subpoena, warrant, discovery request, or other legal process, or complying with health oversight activities, such as audits, investigations and inspections, necessary to ensure compliance with government regulations and civil rights laws.
• Specialized government functions.
  • We may disclose health information for military and veteran’s affairs or national security and       intelligence activities.
• Business associates/sub-contractors.
  • There are some services provided to our organization through contracts with business associates (BA) and sub-contractors, such as billing, data analysis, or transcription services. To protect your PHI, when these services are contracted the law requires the BA/sub-contractor (including EHR vendors) to appropriately safeguard your information, and as such must be compliant with all HIPAA privacy laws and security rules.
• Practice marketing.
  • We will not use your protected health information for marketing purposes without your written authorization, except for face-to-face communications and promotional gifts of nominal value. Any marketing communication for which we receive financial remuneration from a third party requires your authorization.
• Sale of protected health information.
  • We will not sell your protected health information without your written authorization, as required under 45 CFR § 164.508(a)(4).
• Fundraising communications.
  • We may contact you to raise funds for our organization. You have the right to opt out of receiving fundraising communications, and we will include instructions on how to do so with each communication.
• Food and Drug Administration (FDA).
  • We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs or replacement.
• Personal representative.
  • We may disclose information to your personal representative (a person legally responsible for your care and authorized to act on your behalf in making decisions related to your health care).
• To avert a serious threat to health/safety and disaster relief.
  • We may disclose your information when we believe in good faith that this is necessary to prevent a serious threat to your safety or that of another person. This may include cases of abuse, neglect, or domestic violence. Unless you object, we may disclose health information about you to an organization assisting in a disaster relief effort.
• Uses and disclosures requiring your written authorization.
  • We are required to obtain your written authorization for uses and disclosures of psychotherapy notes (where applicable), uses and disclosures for marketing purposes, and disclosures that constitute a sale of your protected health information. You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.
• Communication with family.
  • Unless you object to health professionals, using their best judgment, may disclose to family/personal friend health information relevant to that person’s involvement in your care or payment related to your care. We may notify these individuals of your location and general condition.
• Genetic health information
  • Genetic health information is also PHI. However, any genetic health information used for underwriting purposes is prohibited.
• Electronic Use of Personal Health Information (PHI).
  • If we utilize Electronic Health Records (EHR), or other electronic method(s), we may transfer your health information electronically, as needed for payment, treatment, or health care operations, unless you request otherwise.
• Other Uses and Disclosures.
  • In the case we have other uses and disclosures not described herein and which are prohibited by law, we will contact you and request your written authorization.