SARASOTA MEMORIAL HEALTH CARE SYSTEM

NOTICE OF PRIVACY PRACTICES

REVISED EFFECTIVE NOVEMBER 2021

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW THIS CAREFULLY

WHO WILL FOLLOW THIS NOTICE:

This joint Notice describes the privacy practices of the Sarasota Memorial Health Care System (SMHCS) and includes:

• All SMHCS Workforce members, defined under HIPAA in 45 C.F.R. §160.103, as our team members, volunteers, trainees, medical, nursing and other health care students authorized to assist with your care while you are in the hospital, or another one of SMHCS’s affiliated entities or locations.
• All members of the medical staff and allied health professionals for their practices within SMHCS facilities
• Other entities that provide health care services to you in a way that is integrated with our services at one or more of our facilities and their health care professionals, employees, students, volunteers and other personnel.

SMHCS participates in an Organized Health Care Arrangement (OHCA) under the Health Insurance Portability and Accountability Act. An OHCA is an arrangement that allows SMHCS entities to share protected health information with each other. SMHCS may share your protected health information with members of the SMHCS Medical Staff and other independent medical professionals in order to provide treatment, payment and healthcare operations through the OHCA. In addition to providing treatment to a common set of patients, members of the medical staff of SMHCS and other medical professionals under the OHCA jointly perform health care operations activities such as peer review, quality improvement, medical education and other services for SMHCS.

All SMHCS hospitals, employed physicians, doctor offices, entities, facilities, home care programs, skilled nursing facilities, other services and affiliated facilities follow the terms of this Notice. All of these hospitals, doctors, entities, facilities, home care programs, skilled nursing facilities, other services and affiliated facilities may share your health information with each other for reasons of treatment, payment and health care operations as described below.

As of the Effective Date of this Notice, the following entities and facilities make up Sarasota Memorial Health Care System (SMHCS):

• Sarasota Memorial Hospital-Sarasota
• Sarasota Memorial Hospital-Venice
• Cape Outpatient Surgery Center
• Sarasota Memorial Clinical Research Center
• Sarasota Memorial Sleep Disorders Centers
• First Physicians Group of Sarasota
• SMH Physician Services, Inc.
• Sarasota Memorial Nursing and Rehabilitation Center
• Bayside Center for Behavioral Health
• Sarasota Memorial Heart and Vascular Services
• Sarasota Memorial Breast Health Center
• Sarasota Memorial Hospital Auxiliary, Inc.
• Sarasota Memorial HealthFit
• Sarasota Memorial Memory Disorders Clinic
• Sarasota Memorial Geriatrics, Inc.
• Sarasota Memorial ER & Health Care Center-­North Port Medical Plaza
• Sarasota Memorial Healthcare Center at University Parkway
• Sarasota Memorial Healthcare Center at Heritage Harbour, Blackburn Point and Clark Road
• Sarasota Memorial Urgent Care Centers at University Parkway, Stickney Point, Heritage Harbour, Venice, Bee Ridge and St. Armands
• Radiation Oncology Center at University Parkway
• Brian D. Jellison Cancer Institute
• SMH Rx Express

All of the employees of these entities and facilities will follow the terms of this Notice. This list may not reflect recent acquisitions, construction or sales of entities, sites, or locations. From time to time, an updated list of SMHCS affiliated entities may be found on SMHCS’ website, or by calling (941) 917-­1275.

UNDERSTANDING YOUR MEDICAL INFORMATION

Medical information is information about your past, present or future healthcare that may identify you (such as your name, address, social security number), as well as your symptoms, examinations, test results, diagnoses, treatment, and plans for future care. This medical and billing information is protected by law and is frequently referred to as “Protected Health Information,” or PHI.

OUR PLEDGE REGARDING MEDICAL INFORMATION

We understand that your medical information is personal. We are required by law to:

• Make sure your medical information is private;
• Give you this Notice of our legal duties;
• Follow the terms of this Notice;
• Provide you with notice if the privacy or security of your PHI is breached.

This Notice of Privacy Practices will tell you about the ways in which we may use and disclose your medical information. It also describes your rights, as well as certain responsibilities that we have, regarding your medical information. We understand that information about you and your health is very personal. Therefore, we strive to protect your privacy as required by law. We will only use and disclose your PHI as allowed by law.

We are committed to excellence in the provision of state-­of-­the-­art health care services through the practice of patient care, education, and research. Therefore, as described below, your health information will be used to provide you care and may be used to educate health care professionals and for research purposes. We train our staff and workforce to be sensitive about privacy and to respect the confidentiality of your PHI.

HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION ABOUT YOU

The following categories describe different ways that we may use and disclose your medical information without your written authorization. All of the ways we are permitted to use and disclose information will fall within one of these categories:

• For Treatment: We may use or disclose your medical information to provide, coordinate or manage your healthcare treatment and related services. This information may be shared with doctors, nurses, advanced practice providers, technicians, health care students, or others who are involved in your care. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition we may share medical information about you in order to coordinate the different things you may need, such as prescriptions, lab work, and x-rays. It may also be necessary to disclose medical information about you to people outside Sarasota Memorial Health Care System who are involved in your medical care after you leave our care. For example, we may disclose your medical information to a home health agency or to a physician to whom you have been referred. This is to ensure that the agency or physician has the necessary information to diagnose or treat you.
• For Payment: We may use and disclose medical information about you so that the treatment services you receive may be billed to, and payment may be collected from you, an insurance company, or a third party. Before you receive scheduled services, we may share information about these services with your health plan(s) to obtain prior approval or to determine whether your insurance will cover the treatment. For example, we may need to give your insurance company information about your surgery so they will pay us or reimburse you for the surgery. Also, we may tell your insurance company about a treatment or service you are going to receive in order to determine whether your plan will cover the treatment or service.
• For Healthcare Operations: We may use or disclose medical information about you as needed for our business activities and health care operations. These uses and disclosures allow us to improve the quality of care we provide and reduce healthcare costs. Examples of these activities include, but are not limited to:
• Reviewing and improving the quality, efficiency and cost of care that we provide to you and other patients.
• Evaluating the skills, qualifications, and performance of healthcare providers taking care of you.
• Providing training programs for students, trainees, healthcare providers or non-­healthcare professionals (for example, billing clerks) to help them practice or improve their skills.
• Cooperating with outside organizations that assess the quality of care we provide. These organizations might include government agencies or accrediting bodies like the Joint Commission and the DNV GL Healthcare.
• Cooperating with outside organizations that evaluate, certify or license healthcare providers, staff or facilities in a particular field or specialty. For example, we may use or disclose health information so that one of our nurses may become certified in a specific field of nursing.
• Sharing information with Sarasota Memorial Public Safety to maintain safety at our facilities.
• Assisting various people who review our activities. Health information may be seen by doctors reviewing services provided to you, and by accountants, lawyers and others who assist us in complying with applicable laws.
• Conducting business management and general administrative activities related to our organizations and services we provide.
• Resolving grievances within our organizations.
• Complying with this Notice and with applicable laws.
• Review the quality of our treatment and services, or to send you a patient satisfaction survey.

The sharing of your PHI for treatment, payment, and health care operations may happen electronically. Electronic communications enable fast, secure access to your information for those participating in and coordinating your care to improve the overall quality of your health and prevent delays in treatment.

• Health Information Exchanges: We participate in initiatives to facilitate this electronic sharing, including, but not limited to, Health Information Exchanges (HIEs) which involve coordinated information sharing among HIE members for purposes of treatment, payment, and health care operations. Patients may opt-­out of some of these electronic sharing initiatives, such as HIEs. Sarasota Memorial Health Care System will use reasonable efforts to limit the sharing of PHI in such electronic sharing initiatives for patients who have opted-­out. If you wish to opt-­out, please contact us by following the instructions on our website or by calling (941) 917-­6622.
• Business Associates: We may share your medical information with third party “business associates” who perform various services for our health care system. For example, we may send your medical information to a company that assists us in billing, to a transcription service that assists us in maintaining your medical record, or to a copy service that assists us in copying your medical record. The law requires our business associates to appropriately safeguard your medical information.
• Appointment Reminders: We may contact you by phone or leave a message to remind you of an appointment, or request you call the office or hospital.
• Treatment Alternatives: We may use and disclose your medical information to tell you about or recommend treatment options or alternatives, as long as we are not using your information for marketing purposes, as defined under the law.
• Health-­Related Benefits and Services: We may use your medical information to contact you and offer other health-­ related services or medical education that may be of interest to you, as long as we are not marketing to you. For example, we may send you a newsletter by using your name and U.S. mail address.
• Personal Health Records System (PHR): We may use your medical information and health history provided by you for purposes of providing this service to you, as well as communicating with you through the use of a PHR.
• Individuals Involved in Your Care: We may disclose your medical information to a family member or other person you allow to be present and involved in your care, such as a friend, relative or spouse. We will only disclose medical information relevant to that person’s involvement in your care or payment for your care. In an emergency situation we may use and disclose your medical information to locate and notify a family member, a personal representative, or another person responsible for your location and general condition. We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts to locate a family member or other persons who may be involved in some aspect of caring for you. If you are unable to agree or object to this disclosure, we may disclose such information as we deem is in your best interest based on our professional judgment.
• Facility Directory: If applicable, we may include limited information about you in the facility directory while you are a patient at the hospital or one of our related health care companies. For example, this information may include your name, location in the hospital, your general condition (e.g., fair, stable, etc.), and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. However, directory information, including your religious affiliation, may be released to a member of the clergy even if they don’t ask for you by name.

You have the right to object to being listed in the directory. If you are unable to agree or object, we may include the information we deem is in your best interest based on our professional judgment. In addition, we may also disclose information about you during a disaster relief effort so that your family can be notified. If you do not want your information listed in the hospital directory, please notify Registration when you arrive or call the facility’s Patient Registration Office.
• Research: We may use and disclose your PHI, including PHI generated for use in a research study, as permitted by law for research, subject to your explicit authorization and/or oversight by the Sarasota Memorial Hospital Institutional Review Board (IRB), committees charged with protecting the privacy rights, and safety of human subject research, or a similar committee. For example, a research project may involve comparing the health and recovery of all patients with the same condition who received one medication to those who received another. Also, clinicians may request our clinical research staff to review your medical information to see if you would be eligible for a study. All research projects, however, are subject to a special approval process. In all cases where your specific authorization has not been obtained, your privacy will be protected by confidentiality requirements evaluated by such a committee. For example, the IRB may approve the use of your health information with only limited identifying information to conduct outcomes research to see if a particular procedure is effective.
• Fundraising Activities: We may use your health information to contact you or your legal representative in an effort to raise money for Sarasota Memorial Health Care System and its operations. We would only use contact information, such as your name, address and phone number, department of service, treating physician, outcome information, health insurance status and dates you received treatment or services. We may send you information about the Sarasota Memorial Healthcare Foundation, an organization that raises funds in support of Sarasota Memorial Health Care System. Sarasota Memorial Healthcare Foundation may solicit fundraising donations from you; however, should you decide to opt out of receiving future information you will be given the opportunity to do so. If you would like to opt out at the time of your visit or if you have previously signed a consent authorizing the provision of information to the Sarasota Memorial Healthcare Foundation for fundraising purposes, please let the registrar know that you would like to opt out now from any future provision of information. You may also call the Foundation at 941-917-­1286, email them through the Contact Us screen at www.smhf.org, or write to them at SMHF, 1515 South Osprey Avenue, Suite B-­4, Sarasota, Florida, 34239 and ask them to remove you from their mailing list.
• As Required By Law: We will disclose your medical information under special situations as required by federal, state, or local law or other judicial or administrative proceedings.
• Military and National Security: We may disclose your medical information to authorized Federal officials for conducting national security and intelligence activities, including the provision of protective services to the President. We may also be required to disclose medical information of members of the Armed Forces:
  • For activities deemed necessary by appropriate military command authorities, or
  • To foreign military authorities if you are a member of that foreign military service.
• Workers’ Compensation: We may disclose your medical information to workers’ compensation and other programs providing benefits for work-­related injuries or illnesses.
• Organ and Tissue Donation: We may release medical information to organizations that handle organ procurement, organ, eye or tissue transplantation, or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
• To Avert a Serious Threat to Health or Safety: We may use or disclose medical information about you for public health activities. For example, we may use and disclose medical information about you to agencies when necessary to prevent a serious threat to your health and safety or the health and safety of others. Any disclosure, however, would only be to someone able to help prevent or reduce the threat.
• Public Health Risks: We may disclose your health information to appropriate government authorities for public health activities. These activities generally include the following:
  • To prevent or control disease, injury, or disability;
  • To report births and deaths;
  • To report child abuse or neglect;
  • To report reactions to medications or problems with products;
  • To entities regulated by the Food and Drug Administration, if necessary, to report adverse events, product defects, or to participate in product recalls;
  • To notify people of recalls of products they may be using;
  • To certain registries (such as the Cancer Registry) as required by law if your condition meets applicable definitions;
  • To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
  • To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure when required or authorized by law.
• Health Oversight Activities: We may disclose medical information to a government health oversight agency for activities authorized by law such as audits, investigations, inspections, and licensure. Government oversight agencies include government benefit programs, government regulatory programs and civil rights laws, etc.
• Legal Proceedings: If you are involved in a lawsuit or a dispute, we may disclose your medical information in response to a court or administrative order. We may also disclose your medical information in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement: We may disclose your medical information if required to do so by a law enforcement official for law enforcement purposes:
  • In response to a court order, subpoena, warrant, summons, or similar process;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • Pertaining to a victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • About a death we believe may be the result of criminal conduct;
  • About criminal conduct at the hospital or any of our health care companies; and
  • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.
• Coroners, Medical Examiners, and Funeral Directors: We may release your medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose your medical information to a funeral director, as authorized by law, in order for the director to carry out assigned duties.
• Inmates: We may release your medical information to the correctional institution or law enforcement official holding you in custody. This release would be necessary:
  • For the institution to provide you with health care;
  • To protect your health and safety or the health and safety of others; or
  • For the safety and security of the correctional institution.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

• You have the following rights regarding medical information we maintain about you:
  • The Right to Access and Copy: You have the right to access and obtain a copy of your medical information that may be used to make decisions about your care. This includes medical and billing records, health plan enrollment, payments, adjudicated claims, and case or medical management record systems, but may not include psychotherapy notes or other information that is subject to laws that prohibit access.
    If we maintain your records electronically, and you request to access your information electronically, we will provide you with access to your information in the form and format you request, if possible. If it is not possible, we will provide you with the information in a readable electronic form and format to which you agree.
    We may deny your request to access and copy in certain limited circumstances. Written notice of denial will be provided; this may include electronic communication if appropriate. If you are denied access to your medical information you may request that the denial be reviewed, subject to the laws regarding whether a denial is reviewable. Another licensed health care professional chosen by the hospital or one of our related health care companies will review your request and the denial. This health care professional will not be the person who denied your initial request, and we will comply with the outcome of that review.
    To access and request a copy of your medical information, please contact the appropriate Privacy Officer or the hospital’s Health Information Management Department by calling the telephone number listed on the last page of this Notice. A fee may be charged for making copies. We will respond to your request within 30 days, or will let you know within 30 days that we need additional time to respond to the request (if the information you request is not maintained or accessible on-­site).

  Note: The right to access belongs primarily to the individual who is the subject of the PHI, but a person who is legally authorized to act on behalf of the individual regarding health care matters is granted the same right of access. An individual’s legal authority to act on behalf of an individual with regard to health care matters is determined by state law. Any person, who requests PHI, as well as the person’s authority to have access to the information, will be verified in accordance with SMHCS policies and procedures.

  You may also ask us, in a written request signed by you, to send a copy of your PHI to another person who you designate.

  • The Right to Amend:If you think that the medical information we have about you is incorrect or incomplete, you may ask us to amend, or correct the information. You have the right to request an amendment for as long as the information is kept by, or for, our hospital or one of our related health care companies. To request an amendment, please contact the appropriate Privacy Officer or the hospital’s Health Information Management Department by calling the telephone number listed on the last page of this Notice. Reasonable efforts will be taken to communicate the amendment to others in the network within a reasonable time frame.
    You will be required to provide a reason that supports your request. Please note that we may deny your request if you ask us to amend information that:
    • Was not created by us, unless the author or entity that created the information is no longer available to make the amendment;
    • Is not part of the medical information kept by or for our hospital or our related health care companies;
    • Is not part of the information which you would be permitted to review and copy;
    • We believe the information is accurate and complete.
    
    If your request is denied, but you continue to dispute the accuracy of the information, you will be provided an opportunity to file a statement of disagreement. This statement of disagreement will be provided with any subsequent disclosure of disputed PHI. Please contact the appropriate Privacy Officer or the hospital’s Health Information Management Department by calling the telephone number listed on the last page of this Notice.
    Note: Changes to non-­clinical information such as changes of address, insurance information, date of birth, etc. are not amendments and may be routinely processed.
    
  • The Right to Request Restriction. You have the right to restrict or request a limit on the use and disclosure of your medical information for treatment, payment and health care operations as described previously in this Notice. Additionally, you have the right to request restrictions on disclosure of information to individuals involved in your care.
    Except as described below, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment, or until the agreement is terminated by either you or SMHCS. Termination of the agreement to restrict will not apply to information that SMHCS is required to restrict.
    To request a restriction or limitation please contact the appropriate Privacy Officer, or the hospital’s Health Information Management Department by calling one of the telephone numbers on the last page of this Notice. Your request must specify:
    • The information you want to limit;
    • Whether you want to limit our use, disclosure, or both; and
    • To whom you want the limits to apply, for example to your spouse.
    
    We are required to agree to your request to restrict disclosure of your PHI to a health plan or other third party payor if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and, the information pertains solely to a health care service or item that you, or a third party other than the health plan or other third party payor, have paid for in full.
  • The Right to Request Confidential Communications (Alternative Ways): You have the right to request that we communicate with you about medical matters in a certain way, at a certain time, or at a certain location. For example, you may ask that we only contact you at work or by U.S. mail. To request confidential communications, you must make your request in writing to the appropriate Privacy Officer listed on the last page of this Notice or the hospital’s Health Information Management Department. Your request must specify how or where you wish to be contacted.
  • The Right to an Accounting of Disclosures. We will notify you, as required by law, if we use or disclose your protected health information in an unauthorized way. Additionally, you have the right to request an “accounting of disclosures” of your medical information. This is a list of the disclosures of your medical information that we made to others.
    The list does not include disclosures made:
    • For treatment, payment, and health care operations;
    • To you;
    • Incidental disclosure;
    • In accordance with an authorization;
    • Through our hospital directory;
    • For national security or intelligence purposes; and
    • To correctional institutions or law enforcement officials.
    
    To request an accounting of disclosures, you must submit your request in writing to the appropriate Privacy Officer listed on the last page of this Notice or the hospital’s Health Information Management Department. Your request must state:
    
    • A time period for which you want the accounting.
    • In what form you wish to receive the accounting (for example, paper or electronically).

    The first accounting you request within a twelve-­month period will be free. For additional accountings, a fee may be charged for providing the list. We will notify you of the fee before any costs are incurred.
    

  • The Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice and you may request a copy at any time from any member of our staff. The Notice also is available to download on our corporate website (www.smh.com) and listed department/facility webpages.
  
  If you have any questions regarding these rights please contact one of our privacy officers using the telephone contact list on the last page of this Notice, or ask any member of our staff to contact a privacy officer for you.
  

OTHER USES OF YOUR MEDICAL INFORMATION

• Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written permission. We will ask your written permission before we use or disclose health information, for example for the following purposes:
  • Psychotherapy notes made by your individual mental health provider during a counseling session, except for certain limited purposes related to treatment, payment and health care operations, or other limited exceptions, including government oversight and safety.
  • Certain marketing activities, including if we are paid by a third party for marketing statements as described in your executed authorization.
  • Sale of your health information except certain purposes permitted under the regulations.

  If you give us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. We are unable to take back any disclosures that we have already made, and, we are required by law to retain our records of the care that we provided to you.

  Sarasota Memorial Health Care System's website (www.smh.com) and subsidiary websites (including but not limited to www.firstphysiciansgroup.com, www.smhfit.com, www.smhheart, www.smhbariatrics.com) use cookies to enhance the user experience. Uses include, but are not limited to, navigation improvements, content use and accessibility.
  All of the browsing data is aggregated and anonymous, and is not directly used in Sarasota Memorial Health Care System's marketing, which meets all current internet data privacy laws.
  Should you wish to manage the cookies our sites use, please use this guide.

FLORIDA LAW

• In the event that Florida Law requires us to give more protection to your health information than stated in this Notice or required by federal law, we will give that additional protection to your health information. We will comply with additional state law confidentiality protections relating to treatment for mental health and drug or alcohol abuse.

COMPLAINTS

• If you believe your privacy rights have been violated, you may call 917-­9000 and ask for Sarasota Memorial Health Care System’s Director of Risk Management/Privacy Officer or submit your complaint in writing to the Director of Risk Management/Privacy Officer, Sarasota Memorial Hospital, 1700 South Tamiami Trail, Sarasota, Florida 34239. If we cannot resolve your concern, you also have the right to file a written complaint with the Secretary of the United States Department of Health and Human Services.
  The quality of your care will not be jeopardized nor will you be penalized for filing a complaint.

CHANGES TO THIS NOTICE

• We reserve the right to change this Notice of Privacy Practices. We also reserve the right to apply any changes to this Notice to the medical information that is already in our possession as well as to any future medical information. We will post a copy of our current Notice of Privacy Practices, including the effective date, in each of our health care locations as well as posting it prominently on our corporate website (www.smh.com) and listed department/facility webpages. In addition, whenever changes to the Notice occur, we will offer you a copy of the latest Notice of Privacy Practices each time you register at one of our facilities.

ACKNOWLEDGEMENT

TELEPHONE CONTACT LIST