EFFECTIVE APRIL 13, 2021

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. THIS IS THE OFFICIAL HIPAA AND PRIVACY INFORMATION FOR CHAPTERS HEALTH SYSTEM.

Chapters Health System supports your right to the privacy of your PHI and will not retaliate in any way if you chose to file a complaint.

At Chapters Health System, we understand that medical information about you and your health is personal, which is why we are committed to maintaining the privacy of such information.

Each time you are visited or treated by a healthcare provider or entity that is part of Chapters Health System, a record of the care and services you receive is created. In addition, during the course of your care and treatment health care providers and entities in Chapters Health System may receive records from other healthcare providers and entities involved in your care and treatment. These records created or received during the course of your care will include “protected health information” about you. (Please see the definition of “protected health information” in Section I, below.)

This Notice of Privacy Practices (“Notice”) explains the ways in which your protected health information may be used or disclosed. In addition, this Notice will describe your rights and Chapters Health System’s obligations regarding the use and disclosure of your protected health information.

It is important that you read and understand this Notice before signing any acknowledgment of receipt of such Notice.

If you have any questions regarding the information contained in this Notice, wish to exercise your rights as explained in this Notice, or would like further information concerning your privacy rights, please contact the Privacy Officer for Chapters Health System at:

Chapters Health System, Inc. 12470 Telecom Drive, Suite 301 Temple Terrace, Florida 33637 (813) 871‐8111

Designation as a Single Covered Entity

For purposes of this Notice, and for all purposes permitted under the Health Insurance Portability and Accountability Act of 1996 (the “Act”) and the rules promulgated there under, as such rules may be amended or supplemented from time to time (collectively with the Act, “HIPAA”), the covered entities listed in Exhibit A are affiliated with Chapters Health System and have designated themselves as a single covered entity.

Throughout this Notice, the single covered entity comprised of the companies listed in Exhibit A is referred to as “Chapters.”

This designation may be amended from time to time to add new covered entities that are under the common control and ownership of Chapters Health System, Inc.

I. What is “Protected Health Information” or “PHI”?

Certain sections of HIPAA, in particular 45 C.F.R. Part 160 and Subparts A and E of Part 164 (the “Privacy Rule”), protect all “individually identifiable health information.” Your individually identifiable health information is information that (1) relates to your physical or mental health or condition, the provision of your health care, or the payment for your health care, and (2) either identifies or could be used to identify you.

When your “individually identifiable health information” is maintained by a health care provider or entity subject to HIPAA, such as Chapters, the information is considered “protected health information.” This is true regardless of whether the information is transmitted or maintained in electronic, paper, or oral form.

Many common identifiers you provide to Chapters, such as your name, address, date of birth, and Social Security number, are considered protected health information. In addition, your protected health information may include information about your health history, health status, symptoms, examinations, test results, diagnoses, treatments, procedures, prescriptions, related billing activity and similar types of health‐related information.

Throughout this Notice, “protected health information” may be abbreviated as “PHI.”

II. Permitted Uses and Disclosures of PHI

The following categories describe ways Chapters may use and disclose your PHI without your authorization. Not every use or disclosure in a category will be listed; however, all of the ways Chapters is permitted to use and disclose PHI information will fall within one of the categories.

Treatment, Payment, Health Care Operations and Fundraising

Treatment – Chapters may use or disclose your PHI to provide you with medical treatment or services. In addition, Chapters may disclose information about you to doctors, nurses, medical students or other personnel who are involved in your care and treatment. For example, when personnel from Chapters provide care, treatment, or other services to you, information regarding your condition and the care,  treatment, or services provided will be documented. This information will be shared among your health care providers to make decisions about your course of treatment or, if applicable, your hospice plan of care.

Payment – Chapters may use or disclose your PHI so that the services you receive may be billed and payment collected from you, an insurance company or third party payor. For example, Chapters may send a bill to Medicare, Medicaid, or your private insurer for payment of the care, treatment, or services that Chapters provides to you. The bill may contain information that identifies you, your diagnosis, and procedures, and supplies used. Chapters may also provide your PHI to our business associates, such as billing companies, claims processing companies, and others that process health care claims on behalf of Chapters.

Health Care Operations – Chapters may use or disclose your PHI in connection with the health care operations of Chapters. Health care operations include quality assessment activities, reviewing the competence or qualifications of health care professionals, evaluating provider performance, and other business operations. For example, Chapters may use your health information to provide data for performance improvement activities or outcome studies. Chapters may also provide your PHI to its accountants, attorneys, auditors, consultants, and others to make sure Chapters complies with the various laws governing Chapters.

Fundraising – Chapters may use or disclose your PHI to its business associates or its related foundation in an effort to raise money for Chapters and its operations. The information Chapters releases will be limited to your contact information (such as your name, address and telephone number), the dates you received treatment or services, and the Chapters program providing such treatment or services. If you request that your information not be used or disclosed for fundraising purposes, Chapters will take steps to comply with your request. A description of how you can “opt out” of receiving any fundraising communications will be included with any fundraising materials you receive from Chapters.

Appointment Reminders – Chapters may use or disclose your PHI to remind you that you have an appointment at a Chapters facility or with a Chapters provider.

As Required by Law – Chapters may disclose your PHI for law enforcement purposes and as required by state or federal law. For example, certain laws may require Chapters to report instances of abuse, neglect, or domestic violence; to report certain types of injuries (such as gunshot wounds); or to assist law enforcement in locating a suspect, fugitive, material witness or missing person. Chapters will inform you or your representative if it discloses your PHI because it believes you are a victim of abuse, neglect or domestic violence unless it determines that notifying you or your representative would place you at risk.

In addition, Chapters must provide PHI to comply with an order in a legal or administrative proceeding. Finally, Chapters may be required to disclose your PHI in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made, by us or the requesting party, to contact you about the request or to obtain an order to protect the requested PHI.

Judicial and Administrative Proceedings – Chapters may disclose your Protected Health Information in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.

Business Associates – There may be some services provided by business associates of Chapters, such as a billing, legal, or consulting services. Chapters may disclose your PHI to our business associates so that they can perform the job Chapters has asked them to do. To protect your PHI, Chapters requires its business associates to enter into a written contract that requires them to appropriately safeguard your PHI.

Coroners, Medical Examiners, Funeral Directors – Chapters may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. Chapters may also release your PHI to funeral directors as necessary to carry out their duties.

Disaster Relief – Chapters may disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Disclosure of Information that is Not Individually Identifiable – Any documentation or information that

(a) does not personally identify you and (b) cannot be used to personally identify you, does not constitute PHI. Chapters may use or disclose such documentation or information as required or permitted by applicable law.

Emergencies – Chapters may use or disclose your PHI if you need emergency treatment or if it are required by law to treat you but is unable to obtain your consent. In situations where you are not capable of giving consent (because you are not present or due to your incapacity or medical emergency), personnel of Chapters may, using their professional judgment, determine that a disclosure to your family member or friend is in your best interest. In that situation, Chapters will disclose only the PHI relevant to the person’s involvement in your care and will try to obtain your consent as soon as it reasonably can after treating you.

Health Oversight – Chapters may disclose your PHI to a health oversight agency for activities authorized by law. These activities include audits; civil, administrative, or criminal investigations or proceedings; inspections; licensure or disciplinary actions; or other activities necessary for oversight of the health care system, government programs, and compliance with civil rights laws.

Individuals Involved in Your Care or Payment for Your Care – Chapters may disclose your PHI to your  family members or friends involved in your care or the payment for your care if you verbally agree to do so or if you are given an opportunity to object to such a disclosure and you do not raise an objection. Chapters may also disclose PHI to your family or friends if it can infer from the circumstances, based on our professional judgment that you would not object. For example, Chapters may assume you agree to our disclosure of your PHI to your spouse when you bring your spouse with you to an appointment when treatment or while treatment is discussed. Chapters personnel may also use their professional judgment and experience to make reasonable inferences that it is in your best interest to allow another person to act on your behalf to pick up, for example, filled prescriptions, medical supplies, or X‐rays. Survivors of our hospice patients may elect to receive bereavement services provided by a counselor; in the course of providing such services, Chapters may disclose your PHI.

Military and Veterans – If you are a member of the armed forces, Chapters may release medical information about you as required by military command authorities under certain circumstances. Chapters may also release medical information about foreign military personnel to the appropriate foreign military authority.

National Security and Intelligence Activities – Chapters may disclose PHI to authorized federal officials for the conduct of lawful intelligence, counter‐intelligence, and other national security activities authorized by law.

Organ and Tissue Donation – If you are an organ, tissue, or eye donor (or if you have not indicated that you do not wish to be such a donor), Chapters may release your PHI to organizations that handle organ procurement or organ, tissue, or eye transplantation or to an organ donation bank, as necessary to facilitate such donation and transplantation.

Protective Services for the President and Others – Chapters may disclose your PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Provider Directory – Unless you object, Chapters may include limited information about you in its provider directory while you are a patient, including your name, location (if in a Chapters facility), your general condition (e.g. fair, stable, etc.) and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. Your information and religious affiliation may also be given to a member of the clergy, even if the clergy member does not ask for you by name.

Public Health – Chapters may disclose your PHI to a public health authority that is authorized by law to collect or receive such information, such as for the purpose of preventing or controlling disease, injury or disability; reporting births, deaths or other vital statistics; reporting child abuse or neglect; notifying individuals of recalls of products they may be using; notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition.

Research – Under certain circumstances, Chapters may use or disclose your PHI for research purposes, but only if the use and disclosure of your PHI has been reviewed and approved by a special privacy board or institutional review board, if you provide a written authorization, or if such disclosure is made in accordance with section 405.01, Florida Statutes, and other applicable laws and regulation.

To Avert a Serious Threat to Health or Safety – Chapters may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Such use or disclosure would be to someone able to help prevent the threat.

Treatment Alternatives and Other Health‐Related Benefits and Services – Chapters may use and disclose your PHI to tell you about or recommend possible treatment options or alternatives and to tell you about health related benefits, services or medical education classes that may be of interest to you.

Workers’ Compensation – Chapters may use or disclose your PHI as permitted by laws relating to workers’ compensation or related programs.

III. Uses and Disclosures Requiring Written Authorization

Except as described in this Notice, or as otherwise permitted by law, Chapters will not use or disclose your PHI without your written authorization.

Your written authorization will specify the particular uses or disclosures that you choose to allow. If you do authorize us to use or disclose your PHI for reasons other than treatment, payment or health care operations, you may revoke your authorization in writing at any time by contacting the Privacy Officer for Chapters (see page one of this Notice). If you revoke your authorization in writing, Chapters will no longer use or disclose your PHI for the purposes covered by the authorization. However, your written revocation will not affect action Chapters took in reliance on the authorization prior to your revocation.

Examples of uses and disclosures requiring you written authorization include the following:

Uses and Disclosures of Your Highly Confidential Information. Federal and state law requires special privacy protections for certain health information about you, including alcohol/substance abuse records, mental health records, information about HIV status and treatment, and other health information that is given special privacy protection under Florida or federal laws other than HIPAA (“Highly Confidential Information”). In order for us to disclose any Highly Confidential Information for a purpose other than those permitted by law, we must obtain your authorization.

Psychotherapy Notes – A signed authorization (or court order) is required for any use or disclosure of psychotherapy notes except to carry out certain treatment, payment or health care operations and for use by Chapters for treatment, for training programs or for defense in a legal action.

Marketing – A signed authorization is required for the use or disclosure of your PHI for a purpose that encourages you to purchase or use a product or service except for certain limited circumstances. This does not include face‐to‐face communications with you concerning products or services that may be of benefit to you and about prescriptions you have already been prescribed.

Sale of Protected Health Information – A signed authorization is required for the use or disclosure of your PHI in the event that Chapters receives remuneration for such use or disclosure, except under certain circumstances as allowed by federal or State law.

IV.  Your Rights Concerning PHI

Although your health records are the physical property of Chapters, you have certain rights with regard to the information Chapters maintains about you. You have the right to:

Receive a Paper Copy of this Notice – You have the right to receive a paper copy of this Notice upon request.

Access, Inspect, and Copy PHI – You have the right to access, inspect, and copy your PHI for as long as Chapters maintains your medical record. In order to exercise such right, you must make a written request for access to the Privacy Officer at the address listed on the first page of this Notice. Chapters may charge you a reasonable fee for the processing of your request and the copying of your medical record pursuant to applicable state law. In certain circumstances, Chapters may deny your request to access your PHI, and you may request that Chapters reconsider its denial. Depending on the reason for the denial, another licensed health care professional chosen by Chapters may review your request and the denial.

Request Restrictions – You have the right to request a restriction or limitation on the use or disclosure of your PHI for the purpose of treatment, payment or health care operations, except for in the case of an emergency. In order to exercise such right, you must make a written request for a restriction to the Privacy Officer at the address listed on the first page of this Notice. You also have the right to request a restriction on the information Chapters discloses to a family member or friend who is involved with your care or the payment of your care. Please note that, in certain circumstances, Chapters is not legally required to agree to your request for a restriction. Chapters will always notify you in writing of its decision regarding your restriction requests.

Restrict Disclosure for Services Paid by You in Full – You have the right to restrict the disclosure of your PHI to a health plan if the PHI pertains to health care services for which you paid in full directly to Chapters.

Request Amendment – You have the right to request that Chapters amend your PHI if you believe it is incorrect or incomplete, for as long as Chapters maintains your medical record. In order to exercise such right, you must make a written request for amendment to the Privacy Officer at the address listed on the first page of this Notice. Your request should include detailed information and documentation supporting your request. Please note that Chapters may deny your request to amend if (a) Chapters did not create the PHI at issue, (b) your request pertains to information that Chapters does not maintain, (c) your request pertains to information that you are not permitted to inspect or copy (such as psychotherapy notes), or

(d) Chapters determines that the PHI is accurate and complete.

Accounting of Disclosures – You have the right to request an accounting of disclosures of your PHI made by Chapters (or by other persons or entities on behalf of Chapters) during the six (6) years prior to the date of your request. Such right does not apply to disclosures made for treatment, payment or health care operations purposes or for other types of disclosures specifically exempted by law. In order to exercise such right, you must make a written request for an accounting to Privacy Officer at the address listed on the first page of this Notice. Your written request should indicate in what form you want the accounting (for example, on paper or electronically, if available) and the specific time period for which you are requesting the accounting. The first accounting you request within a twelve (12) month period will be complimentary. For additional accountings, Chapters may charge you for the costs of providing the accounting. Chapters will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Confidential Communications – You have the right to request that Chapters communicate with you about your PHI by certain means or at certain locations. For example, you may specify that Chapters call you only at your home phone number. In order to exercise such right, you must make a written request to the Privacy Officer at the address listed on the first page of this Notice. Your request must specify how and where Chapters may contact you.

Notice of a Breach – You have the right to be notified if Chapters or one of its business associates becomes aware of a breach of your unsecured PHI.

V.  Chapters’ Duties and Rights Concerning PHI

Chapters is required by law to maintain the privacy of your PHI, to provide you with this Notice of Privacy Practices describing its legal duties and privacy practices with respect to PHI, and to notify you following a breach of unsecured PHI. In so doing, Chapters is required to abide by the terms of the Notice of Privacy Practices currently in effect.

As noted in the section pertaining to your rights, you are entitled to a copy of the Notice of Privacy Practices currently in effect.

Chapters reserves the right to change the terms of this Notice at any time and to make the new provisions effective for all PHI maintained by Chapters. If and when this Notice is revised, Chapters will notify you by posting a copy on our website at www.chaptershealth.org. In addition, Chapters will post the current Notice at our location(s) with its effective date identified on the first page of the Notice.

You may request and obtain a copy of the current Notice at any time by contacting the Privacy Officer of Chapters Health System at the address and telephone number provided on the first page of this Notice.

VI.  Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Chapters or the Secretary of the Department of Health and Human Services (”HHS”). For additional information regarding how to file a complaint with HHS, please visit the following webpage: www.hhs.gov/ civil‐rights/filing‐a‐complaint/index.html. To file a complaint with Chapters, please contact the Privacy Officer or Corporate Compliance Officer for Chapters Health System at:

Chapters Health System, Inc. 12470 Telecom Drive, Suite 301 Temple Terrace, Florida 33637 813.871.8111

Chapters supports your right to the privacy of your PHI and will not retaliate in any way if you chose to file a complaint.

09 – Exhibit A – Chapters Health Single Covered Entity Affiliate Listing (click to view or download Affiliate Listing)

09 – Form_ Notice of Privacy Practices rev CH Legal – rev 10-19-2022 (click to view or download the full Notice of Privacy Practices document)