• To provide you with or coordinate health-care treatment and services. For example, we may review your health history form to form a diagnosis and treatment plan, consult with other doctors about your care, delegate tasks to ancillary staff, call in prescriptions to your pharmacy, disclose needed information to your family or others so they may assist you with home care, arrange appointments with other health-care providers, schedule lab work for you, etc.;
• To bill or collect payment from you, an insurance company, a health-benefits plan or another third party. For example, we may need to verify your insurance coverage, submit your PHI on claim forms in order to get reimbursed for our services, obtain pretreatment estimates or prior authorizations from your health plan or provide your x-rays because your health plan requires them for payment; or
• To run our office, assess the quality of care our patients receive and provide you with customer service. For example, to improve efficiency and reduce costs associated with missed appointments, we may contact you by telephone, mail, or otherwise remind you of scheduled appointments, we may leave messages with whomever answers your telephone or e-mail to contact us (but we will not give out detailed PHI), we may call you by name from the reception area, we may tell you about health related products and complementary or alternative treatments that may interest you, we may review your PHI to evaluate our staff's performance, or our privacy officer may review your records to assist you with complaints. If you prefer that we not contact you with appointment reminders or information about treatment alternatives or health-related products and services, please notify us in writing at our address listed above and we will not use or disclose your PHI for these purposes.

Special Rules - Notwithstanding anything else contained in this Notice, only in accordance with applicable law, and under strictly limited circumstances, we may use or disclose your PHI without your permission, Consent or Authorization for the following purposes:

• When required under federal, state or local law;
• When necessary in emergencies to prevent a serious threat to your health and safety or the health and safety of other persons;
• When necessary for public health reasons (e.g. prevention or control of disease, injury or disability; reporting information such as adverse reactions to anesthesia; ineffective or dangerous medications or products; suspected abuse, neglect or exploitation of children, disabled adults or the elderly; or domestic violence);
• For federal or state government health-care oversight activities (e.g. civil rights laws, fraud and abuse investigations, audits, investigations, inspections, licensure or permitting, government programs, etc.);
• For judicial and administrative proceedings and law enforcement purposes (e.g. in response to a warrant, subpoena or court order; by providing PHI to coroners, medical examiners and funeral directors to locate missing persons, identify deceased persons or determine cause of death);
• For workers' compensation purposes (e.g. we may disclose your PHI if you have claimed health benefits for a work-related injury or illness);
• For intelligence, counterintelligence or other national security purposes (e.g. Veterans Affairs, U.S. military command, other government authorities or foreign military authorities may require us to release PHI about you);
• For organ and tissue donation (e.g. if you are an organ donor we may release your PHI to organizations that handle organ, eye or tissue procurement, donation and transplantation);
• For research projects approved by an Institutional Review Board or a privacy board to ensure confidentiality (e.g. if the researcher will have access to your PHI because involved in your clinical care, we will ask you to sign an Authorization);
• To create a collection of information that is "de-identified" (e.g. it does not personally identify you by name, distinguishing marks or otherwise and no longer can be connected to you);
• To family members, friends and others, but only if you verbally give permission; we give you an opportunity to object and you do not; we reasonably assume, based on our professional judgment and the surrounding circumstances, that you do not object (e.g. you bring someone with you into the exam room during treatment or into the conference areas when we are discussing your PHI); we reasonably infer that it is in your best interest (e.g. to allow someone to pick up your records because they knew you were our patient and you asked them in writing with your signature to do so); or it is an emergency situation involving you or another person (e.g., your minor child or ward) and, respectively, you cannot consent to your care because you are incapable of doing so or you cannot consent to the other person's care because, after a reasonable attempt, we have been unable to locate you. In these emergency situations we may, based on our professional judgment and the surrounding circumstances, determine that disclosure is in the best interests of you or the other person, in which case we will disclose PHI, but only as it pertains to the care being provided and we will notify you of the disclosure as soon as possible after the care is completed.

Minimum Necessary Rule - Our Staff will not use or access your PHI unless it is necessary to do their jobs (e.g. janitorial staff will not access your PHI). Also, we disclose to others outside our staff only as much of your PHI as is necessary to accomplish the recipient's lawful purposes. For example, we may use and disclose the entire contents of your medical record:

• To you (and your legal representatives as stated above) and any one else you list on a Consent or Authorization to receive a copy of your records;
• To health-care providers for treatment purposes (e.g. making diagnosis and treatment decisions or agreeing with prior recommendations in the medical record);
• To the U.S. Department of Health and Human Services (e.g. in connection with a HIPAA complaint);
• To others as required under federal or Florida law;
• To our privacy officer and others as necessary to resolve your complaint or accomplish your request under HIPAA (e.g. clerks who copy records need access to your entire medical record).

In accordance with the law, we presume that requests for disclosure of PHI from another Covered Entity (as defined in HIPAA) are for the minimum necessary amount of PHI to accomplish the requester's purpose. Our privacy office will individually review unusual or non-recurring requests for PHI to determine the minimum necessary amount of PHI and disclose only that. For non-routine requests or disclosures, the Plan's Privacy Officer will make a minimum necessary determination based on, but not limited to, the following factors:

• The amount of information being disclosed;
• The number of individuals or entities to whom the information is being disclosed;
• The importance of the use or disclosure;
• The likelihood of further disclosure;
• Whether the same result could be achieved with de-identified information;
• The technology available to protect confidentiality of the information; and
• The cost to implement administrative, technical, and security procedures to protect confidentiality.

If we believe that a request from others for disclosure of your entire medical record is unnecessary, we will ask the requester to document why this is needed, retain that documentation and make it available to you upon request.

Incidental Disclosure Rule - We will take reasonable administrative, technical, and security safeguards to ensure the privacy of your PHI when we use or disclose it (e.g. we require employees to talk softly when discussing PHI with you, we use computer passwords and change them periodically [e.g. when an employee leaves our practice], we allow access where PHI is stored or filed only when we are present to supervise and prevent unauthorized access).

Business Associate Rule - Business Associates and other third parties (if any) that receive your PHI from us will be prohibited from re-disclosing it unless required to do so by law or you give prior express written consent to the re-disclosure. Nothing in our Business Associate agreement will allow our Business Associate to violate this re-disclosure prohibition.

Super-confidential Information Rule - If we have PHI about you regarding HIV testing, alcohol or substance-abuse diagnosis and treatment, or psychotherapy and mental-health records (super-confidential information under the law), we will not disclose it under the General or Health-care Treatment, Payment and Operations Rules (see above) without you first signing and properly completing our Consent form (i.e., you specifically must initial the type of super-confidential information we are allowed to disclose). If you do not specifically authorize disclosure by initialing the super-confidential information, we will not disclose it unless authorized under Special Rules authorize us to do so), we will comply with state and federal law that requires us to warn the recipient in writing that re-disclosure is prohibited.

Changes to Privacy Policies Rule - We reserve the right to change our privacy practices (by changing the terms of this Notice) at any time as authorized by law. The changes will be effective immediately upon us making them. They will apply to all PHI we create or receive in the future, as well as to all PHI created and received by us in the past (i.e., to PHI about you that we had before the changes took effect). If we make changes, we will post the changes Notice along with its effective date, in our office. Also, upon request, you will be given a copy of our current Notice.

Authorization Rule - We will not use or disclose your PHI for any purpose or to any person other than as stated in the rules above without your signature on a specifically worded, written Authorization form (not a Consent or an Acknowledgment). If we need your Authorization, we must obtain it on our Authorization form, which is separate from any Consent or Acknowledgment we may have obtained from you. We will not condition treatment on whether you sign the Authorization (or not).

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

If you got this Notice via e-mail or Web site, you have the right to get, at any time, a paper copy by asking for one. Also, you have the following additional rights regarding PHI we maintain about you:

To Inspect and Copy - You have the right to see and get a copy of your PHI including, but not limited to, medical billing records by submitting a written request to our privacy officer on our Request to Inspect, Copy or summarize form. Original records will not leave the premises, will be available for inspection only by appointment with our privacy officer who will ensure that no alterations or deletions are made. We will be able to provide you with copies at any time during our office hours. We may charge you a fee not to exceed Florida law to recover our costs (including postage, supplies and staff time as applicable, but excluding staff time for search and retrieval) to duplicate or summarize your PHI. We will not condition release of the copies or summary in regards to an outstanding balance (if you have one), but we may condition release of the copies or summary on payment of the cost involved. We will respond to requests in a timely manner, without delay for legal review, in less than 30 days if your request is submitted in writing or on our form or otherwise, and in 10 business days or less if malpractice litigation or pre-suit production is involved. We may deny your request in certain limited circumstances (e.g., we do not have the PHI, it came from a confidential source, etc.). If we deny your request, you may ask for a review of that decision. If required by law, we will select a licensed health-care professional who is not affiliated with us, we will ensure a Business Associate agreement is executed that prevents re-disclosure of your PHI without your consent by the outside professional.

To request Amendment / Correction - If another doctor involved in your care tells us in writing to change your PHI, we will do so as expeditiously as possible upon receipt if the changes and will send you written confirmation that we have made the changes. If you think PHI we have about you is incorrect, of that something important is missing from your records, you may ask us to amend or correct it (so long as we have it) by submitting a Request for Amendment/Correction form to our privacy officer. We will normally act upon your request within 60 days from receipt, but we may extend our response time (within the 60 day period) no more than once and by no more than 30 days, in which case we will notify you in writing why and when we will be able to respond. If we grant your request, we will let you know within five business days, make the changes by noting (not deleting) what is incorrect or incomplete and adding to it the changed language and send the changes to the person you ask us to and persons we know may rely on incorrect or incomplete PHI to your detriment (or already have). We may deny your requests under certain circumstances (e.g., it is not in writing, it does not give a reason why you want the change, we did not create the PHI you want changed and the entity that did can be contacted, it was complied for use in litigation, or we determine it is accurate and complete). If we deny your request we will tell you: why and how to file a complaint with is if you disagree, that you may submit a written disagreement with our denial (and we may submit a written rebuttal and give you a copy of it), that you may ask us to disclose your initial request and our denial when we make future disclosures of PHI pertaining to your request, and that you may complain to us and the U.S. Department of Health and Human Services.

To an Accounting of Disclosures - You may ask us for a list of those who got your PHI from us by submitting a Request for Accounting of Disclosures for to us. The list may not cover some disclosures (e.g., PHI given to you, given to your legal representative, given to others for treatment, payment or health-care operations purposes). Your request must state in what form your want the list (e.g., paper or electronically) and the time period you want us to cover,which may be up to butt no more than six years (excluding dates before April 14, 2003). If you ask us for this list more than once in a 12-month period, we may charge you a reasonable, cost-based fee to respond, in which case we will tell you the cost before we incur it and let you choose if you want to withdraw or modify your request to avoid the cost.

To Request Restrictions - You may ask us to limit how your PHI is used and disclosed (i.e. in addition to our rules as set forth in this Notice) by submitting a written Request for Restrictions on Use/Disclosure form to us (e.g., you may not want us to disclose your surgery to family members or friends involved in paying for our services or providing your home care). If we agree to these additional limitations, we will follow them except in an emergency where we will not have time to check for limitations. Also, in some circumstances we may be unable to grant your request (e.g., we are required by law to use or disclose your PHI in a manner that you want restricted; you signed an Authorization form, which you may revoke, that allows us to use or disclose your PHI in the manner you want restricted; in an emergency).

To Request Alternative Communications - You may ask us to communicate with you in a different way or at a different place by submitting a written Request for Alternative Communication form to us. We will not ask you why and we will accommodate all reasonable requests (including, e.g., to send appointment reminders in envelopes rather than postcards, to send your PHI to a post office box instead of your home address, to communicate with you at a telephone number other than your home number). You must tell us the alternative means or location you want us to use and explain to our satisfaction how payments to us will be made if we communicate with you as you request.

To Complain or Get More Information - We will follow our rules as set forth in this Notice. If you want more information or if you believe your privacy rights have been violated (e.g., you disagree with a decision of ours about inspection/copying, amendment/correction, accounting of disclosures, restrictions or alternative communications), we want to make it right. We never will penalize you for filing a complaint. To do so, please file a formal written complaint within 180 days with:

The U.S. Department of Health & Human Services
Office of Civil Rights
200 Independence Ave, S.W.
Washington, D.C., 20201
(877) 696-6775 (toll free)

Or submit a written Complaint form to us at the following address:
Charlene Balsinger, Privacy Officer
3510 NW 43rd Street
Gainesville, Florida 32606
(352) 377-1705
(352) 377-1093 Fax