Notice of Privacy Practices

If you have questions about this Notice, please contact our Privacy Officer using the information in Section 10.

1. Who Follows This Notice

This Notice describes the privacy practices of Pinnacle Health Campus and the health care providers who deliver care on our Jacksonville campus.

These providers participate in a clinically integrated care setting and may share your health information with one another for treatment, payment, and health care operations as permitted by law.

The following services follow this Notice:

• Family Medicine & Rehab
• Grace Spine
• Synexis Lab
• Next Gen Pharmacy

Each provider remains responsible for the clinical care it provides and follows the terms of this Notice when using or sharing your health information.

Glam Teeth and DocLink may operate under separate privacy practices and terms. Please review the privacy information provided by those services directly.

2. Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your protected health information, or PHI.
• Give you this Notice describing our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

We will use or share your information only as described in this Notice or as otherwise permitted or required by law.

When your written authorization is required, you may revoke that authorization in writing at any time. Revocation does not affect uses or disclosures already made while the authorization was in effect.

3. How We May Use and Share Your Health Information

Treatment

We may use and share your health information with physicians, nurses, chiropractors, therapists, pharmacists, laboratory staff, and other professionals involved in your care.

For example, your provider may order laboratory testing and review the results as part of your treatment.

Payment

We may use and share your health information to bill for services and receive payment from you, your health plan, or another payer.

For example, we may send information about your visit to your health insurer so it can process payment for your services.

Health Care Operations

We may use and share health information to operate our campus, improve care, train staff, evaluate quality, and carry out other health care operations permitted by law.

Appointment Reminders and Health-Related Services

We may contact you to:

• remind you about appointments;
• tell you that prescriptions are ready;
• provide information about treatment options; or
• tell you about health-related services that may be relevant to you.

People Involved in Your Care or Payment

We may share relevant information with a family member, friend, or another person you identify who is involved in your care or helps pay for your care.

If you cannot tell us your preference, such as during an emergency or if you are unconscious, we may share relevant information when permitted by law and when we believe doing so is in your best interest.

Business Associates

We may share health information with companies that perform services for us, including billing, information technology, records management, and other support services.

When a company qualifies as a HIPAA business associate, it must agree to appropriately protect the information it receives.

4. Other Ways We May Use or Share Your Information

The law permits or requires us to use or share health information for certain purposes. Applicable legal requirements must be satisfied before information is disclosed.

These purposes may include:

• As required by law: when federal, state, or local law requires disclosure.
• Public health and safety: including preventing disease, reporting births and deaths, reporting adverse reactions to medications, product recalls, and suspected abuse, neglect, or domestic violence.
• Serious threats to health or safety: when necessary to prevent or lessen a serious and imminent threat.
• Health oversight activities: including audits, investigations, inspections, and licensure activities.
• Lawsuits and legal actions: in response to a court or administrative order or other legal process as permitted by law.
• Law enforcement: for purposes permitted by applicable law.
• Coroners, medical examiners, and funeral directors: as needed for them to perform their duties.
• Organ and tissue donation: to organizations involved in organ, eye, or tissue procurement.
• Research: when the research has been approved through a process that protects your privacy.
• Workers' compensation: for workers' compensation claims and similar programs.
• Military, national security, and protective services: for authorized government functions.
• Correctional institutions: when you are an inmate or otherwise in lawful custody and disclosure is permitted by law.

If we maintain substance use disorder patient records protected by 42 CFR Part 2, those records may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a qualifying court order and subpoena as required by law.

5. Uses and Disclosures Requiring Written Authorization

We generally require your written authorization for:

• most uses and disclosures of psychotherapy notes;
• marketing purposes when authorization is required;
• the sale of your health information; and
• other uses and disclosures not otherwise permitted by this Notice or by law.

You may revoke an authorization in writing at any time.

Revocation will not affect information already used or disclosed while the authorization was valid.

6. Your Choices and Fundraising

You have choices regarding certain ways we use and share your information.

You may tell us your preferences regarding:

• sharing information with family members, close friends, or others involved in your care or payment for care;
• certain disaster-relief situations;
• marketing activities for which authorization is required; and
• fundraising communications.

We may contact you for fundraising efforts that support Pinnacle Health Campus.

You may tell us not to contact you again for fundraising purposes. Choosing to opt out will not affect your treatment or payment for care.

If a fundraising communication would use information from substance use disorder records protected by 42 CFR Part 2, we will provide clear notice in advance and give you a choice about whether to receive fundraising communications that use that information.

7. Special Protections for Substance Use Disorder Patient Records

Certain substance use disorder, or SUD, patient records receive additional protection under federal law at 42 CFR Part 2.

These protections apply to records covered by Part 2 that we create, receive, maintain, or transmit.

We will use and disclose Part 2 records only as permitted by HIPAA, Part 2, and other applicable law.

If you provide consent allowing Part 2 records to be used or disclosed for treatment, payment, or health care operations, those records may be used and shared for those purposes as permitted by law.

Investigations and Legal Proceedings

Your Part 2 records, and testimony describing information contained in those records, may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless:

• you provide the specific written consent required by law; or
• disclosure is authorized by a qualifying court order together with a subpoena or other legal process required under Part 2.

Fundraising Using Part 2 Information

If a fundraising communication would use information from your Part 2 records, we will provide clear and conspicuous notice in advance and give you a choice about whether to receive that communication.

Complaints Concerning Part 2 Records

You may file a complaint concerning the privacy of Part 2 records with Pinnacle Health Campus or with the U.S. Department of Health and Human Services Office for Civil Rights.

8. Redisclosure and More Protective Laws

Redisclosure of Health Information

When we disclose health information as permitted by law, the person or organization receiving that information may be permitted to disclose it again. In some circumstances, information that is redisclosed may no longer be protected by the HIPAA Privacy Rule.

Redisclosure of Substance Use Disorder Records

Substance use disorder patient records protected by 42 CFR Part 2 receive additional protections.

If you provide consent allowing your Part 2 records to be used or disclosed for treatment, payment, and health care operations, a HIPAA-covered entity or business associate that receives those records may generally redisclose them as permitted by HIPAA.

Part 2 records remain subject to restrictions on their use or disclosure in civil, criminal, administrative, or legislative investigations or proceedings against you unless you provide the written consent required by law or disclosure is authorized by a qualifying court order and subpoena or other legal process.

More Protective State and Federal Laws

Florida and other applicable laws may provide additional privacy protections for certain types of health information, including:

• HIV/AIDS information and sexually transmitted disease test results;
• mental health records;
• substance use disorder treatment records;
• genetic testing information; and
• other specially protected health information.

When applicable state or federal law provides greater privacy protection than HIPAA, we follow the more protective requirement.

9. Your Rights Regarding Your Health Information

Get an Electronic or Paper Copy of Your Medical Record

You may ask to see or obtain an electronic or paper copy of your medical record and other health information we maintain about you.

We will generally provide a copy or summary within the time required by law.

A reasonable, cost-based fee may apply.

Ask Us to Correct Your Medical Record

You may ask us to correct health information that you believe is inaccurate or incomplete.

If we deny the request, we will explain the reason in writing within 60 days.

Request Confidential Communications

You may ask us to contact you in a specific way or send communications to a different address.

We will accommodate reasonable requests.

Ask Us to Limit What We Use or Share

You may ask us to limit certain uses or disclosures of your health information.

We are not always required to agree.

If you pay in full out of pocket for a service or health care item, you may ask us not to disclose information about that service to your health insurer for payment or health care operations.

We will honor that request unless disclosure is required by law.

Get a List of Certain Disclosures

You may request an accounting of certain disclosures of your health information made during the period permitted by law.

The accounting does not include every type of disclosure, including certain disclosures for treatment, payment, and health care operations.

Get a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

We will provide a paper copy promptly.

Choose Someone to Act for You

If another person is legally authorized to act for you, such as through a medical power of attorney or guardianship, that person may exercise your privacy rights.

We will verify that person's authority before taking action.

File a Complaint

You may file a complaint if you believe your privacy rights have been violated.

We will not retaliate against you for filing a complaint or exercising your privacy rights.

Exercise Your Rights

To make a privacy request or ask questions about your rights, contact our Privacy Officer using the information below.

We may ask you to complete a written request form.

10. Complaints and Contact Information

If you believe your privacy rights have been violated, you may file a complaint with Pinnacle Health Campus or with the U.S. Department of Health and Human Services Office for Civil Rights.

You may also file a complaint with:

We will not retaliate against you for filing a complaint.

11. Changes to This Notice

We may change the terms of this Notice.

Changes may apply to all health information we maintain, including information created or received before the change.

The current Notice will be available:

• upon request;
• at our campus; and
• on our website at pinnaclehealthcampus.com/notice-of-privacy-practices.

Effective Date: September 30, 2026

Last Updated: September 30, 2026

Language assistance is available free of charge. Call (904) 617-0976. Hay servicios de asistencia lingüística disponibles de forma gratuita. Llame al (904) 617-0976.