Notice of Privacy Practices

How we may use and disclose your information

Treatment: We may use your PHI and share it with health care professionals involved in your care. For example, we may review records supplied by another clinician, document your evaluation, coordinate follow-up care, or share relevant information with another treating provider.

Payment: We may use and disclose PHI to collect payment for services, process a transaction, or resolve a billing question. If a service is billed to a health plan, we may share information needed for that purpose, subject to your rights described below.

Health care operations: We may use and disclose PHI to operate Haven, improve care, train staff, conduct audits, obtain professional advice, manage records, and meet licensing and compliance obligations. Vendors that handle PHI on our behalf must protect it as required by applicable law.

Florida Medical Marijuana Use Registry

If an authorized physician determines that a certification is appropriate, we may enter, review, and update information in Florida’s Medical Marijuana Use Registry as required or permitted by Florida law. The registry is maintained by the Florida Department of Health. State law specifies who may access registry information and for what purposes, including certain qualified physicians, prescribing practitioners, medical marijuana treatment centers, regulators, and law enforcement agencies under defined circumstances.

Registry access and disclosures by the state are governed by Florida law. A medical evaluation or appointment does not guarantee a physician certification or registry identification card.

Other uses and disclosures permitted or required by law

Subject to applicable conditions and any stricter protections under Florida or federal law, we may use or disclose PHI:

To remind you about appointments or tell you about treatment alternatives or health-related services.

To a family member, caregiver, friend, or another person involved in your care or payment for your care, consistent with your preference and the law.

For disaster relief, when permitted by law.

For public health activities, such as reporting certain diseases, adverse events, or suspected abuse or neglect.

To health oversight agencies for authorized audits, investigations, inspections, or licensing activities.

For research when the legal requirements for doing so are met.

To comply with a law that requires disclosure.

To respond to a court or administrative order, subpoena, or other legal process when the applicable requirements are met.

For law enforcement purposes when permitted by law.

To avert a serious threat to health or safety when permitted by law.

To coroners, medical examiners, funeral directors, or organ procurement organizations when applicable.

For workers’ compensation or certain government functions when authorized by law.

We will apply any stricter confidentiality requirements that govern particular records. Florida law protects patient medical records, and Florida law separately restricts access to identifying information held in the Medical Marijuana Use Registry.

Substance use disorder records subject to 42 CFR Part 2

If we receive or maintain substance use disorder patient records protected by 42 CFR Part 2, additional federal protections apply. We will not use or disclose those records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or the court order and subpoena required by law. Other uses and disclosures of Part 2 records will follow the applicable consent and legal requirements.

Your choices and written authorization

You may tell us your preferences about sharing information with family, friends, caregivers, or others involved in your care. If you cannot tell us your preference, we may share relevant information when we determine that doing so is in your best interest or is otherwise permitted by law.

We generally need your written authorization for: Most uses or disclosures of psychotherapy notes, if we maintain them; uses or disclosures of PHI for marketing when authorization is required by law; a disclosure that constitutes a sale of PHI; and other uses or disclosures that are not described in this notice and are not otherwise permitted or required by law.

We do not sell patient medical records. You may revoke an authorization in writing at any time. Revocation does not undo a use or disclosure we already made in reliance on it.