Your Health Information Privacy Rights

Divine Grace Medical Care, led by Maria Roselyn Calungcaguin, APRN, is a Florida-licensed medical practice providing in-person and telehealth primary care services. We are required by law to maintain the privacy and security of your Protected Health Information (PHI), to provide you with this notice of our legal duties and privacy practices, and to notify you following a breach of unsecured PHI.

We comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule, the HIPAA Security Rule, the HITECH Act, and applicable Florida statutes governing medical confidentiality, including Florida Statutes Chapter 456 and Chapter 395.

We may use and disclose your PHI for the following primary purposes:

• Treatment: To provide, coordinate, and manage your medical care. For example, we may share information with specialists, laboratories, or pharmacies involved in your treatment, including via telehealth platforms.
• Payment: To bill and collect payment for services rendered. As a self-pay practice, this includes processing your payments and providing receipts.
• Healthcare Operations: For practice management, quality improvement, staff training, and administrative functions essential to operating our practice.
• Appointment Reminders & Communications: To contact you about appointments, test results, treatment alternatives, and other health-related benefits via phone, secure messaging, email, or SMS.
• Telehealth Services: To conduct virtual consultations using HIPAA-compliant, encrypted video conferencing technology.

The following uses and disclosures of your PHI will be made only with your explicit written authorization:

• Uses and disclosures of psychotherapy notes (if applicable).
• Marketing communications for which we receive financial remuneration.
• Disclosures that constitute a sale of your protected health information.
• Any other uses or disclosures not described in this notice.

You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance upon it.

We may also use or disclose your health information without your authorization in certain situations, including:

• As Required By Law: When disclosure is mandated by federal, state, or local law.
• Public Health & Safety: To public health authorities for disease control, reporting adverse events, or preventing serious threats to health or safety.
• Abuse, Neglect, or Domestic Violence: To government authorities if we suspect abuse, neglect, or domestic violence, as required by Florida law.
• Health Oversight: To health oversight agencies for audits, investigations, inspections, and licensure activities.
• Judicial & Law Enforcement: In response to a court order, subpoena, or lawful law enforcement request.
• Decedents: To a coroner, medical examiner, or funeral director as necessary to carry out their duties.
• Research: Under limited circumstances for medical research, subject to strict privacy safeguards.
• Workers' Compensation: As authorized by and to the extent necessary to comply with laws relating to workers' compensation.

Under HIPAA, you have the following rights concerning your PHI:

• Right to Inspect and Copy: You may request to review and obtain paper or electronic copies of your medical records and billing records.
• Right to Amend: You may request an amendment to your records if you believe information is inaccurate or incomplete.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI.
• Right to Request Restrictions: You may request limits on how we use or disclose your information for treatment, payment, or operations.
• Right to Confidential Communications: You may request that we communicate with you in a certain way or at a specific location.
• Right to a Paper Copy of This Notice: You may request a printed copy of this notice at any time, even if you previously agreed to receive it electronically.
• Right to Breach Notification: You will be notified in writing without unreasonable delay following a breach of your unsecured PHI.

To exercise any of these rights, submit a written request to our Privacy Officer using the contact information below.

• Maintain the privacy and security of your protected health information.
• Provide you with this notice of our legal duties and privacy practices.
• Follow the terms of the notice currently in effect.
• Notify you promptly in the event of a breach affecting your unsecured PHI.
• Train all workforce members on HIPAA compliance and confidentiality.

We reserve the right to change the terms of this notice and to make the new notice provisions effective for all PHI we maintain. The revised notice will be posted in our office and on our website.

Divine Grace Medical Care provides telehealth services to Florida residents. Telehealth communications are conducted through HIPAA-compliant, encrypted platforms. However, no electronic transmission is ever 100% secure. By participating in telehealth services, you acknowledge and accept the inherent risks of electronic communication.

Telehealth services are available only to patients physically located within the State of Florida at the time of the consultation, in accordance with Florida telehealth regulations.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.