SARASOTA MEMORIAL HEALTH CARE SYSTEM

NOTICE OF PRIVACY PRACTICES

Revised Effective February 2026

Sarasota Memorial Health Care System (SMHCS) respects your privacy and is legally required to maintain the privacy of your protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) and Federal rules for Substance Use Disorder (Part 2). This Notice describes how medical information about you may be used and disclosed and how you can get access to this information.

WHO WILL FOLLOW THIS NOTICE:
This joint Notice applies to:

• All SMHCS workforce members (as defined in 45 C.F.R. §160.103), including team members, volunteers, trainees, and health profession students authorized to assist with your care at SMHCS entities and locations.
• All members of the medical staff and allied health professionals for their practice within SMHCS facilities
• Other entities that provide health care services integrated with our services at one or more of our facilities and their health care professionals, employees, students, volunteers, and other personnel.

SMHCS participates in an Organized Health Care Arrangement (OHCA) under HIPAA. An OHCA allows participating covered entities to share PHI with each other to support joint operations. SMHCS may share your PHI with members of the SMHCS Medical Staff and other independent medical professionals to provide treatment, payment, and healthcare operations through the OHCA (e.g., peer review, quality improvement, medical education).
As of the Effective Date of this Notice, the following entities and facilities are a part of SMHCS.  This list is subject to change. An updated list of affiliated entities and locations may be posted on our website from time to time.

• Sarasota Memorial Hospital- Sarasota
• Sarasota Memorial Hospital- Venice
• SMH Physician Services, Inc. d/b/a First Physicians Group of Sarasota
• Sarasota Memorial Nursing and Rehabilitation Center
• Cornell Behavioral Health Pavilion
• Sarasota Memorial Outpatient Services at The Heart Pavilion
• Sarasota Memorial Breast Health Center
• HealthFit
• Sarasota Memorial Memory Disorders Clinic
• Sarasota Memorial Health Care Center & ER at North Port 
• Sarasota Memorial ER at Lakewood Ranch
• Sarasota Memorial Health Care Centers at Blackburn Point, Cattleridge, Clark Road, Heritage Harbour, University Parkway, and Venice
• Sarasota Memorial Endoscopy Center at Hillview Street
• Sarasota Memorial Urgent Care Centers at Bee Ridge, Heritage Harbour, St. Armands, Stickney Point, University Parkway, Venice, and South Venice
• Sarasota Memorial Radiation Oncology Center at University Parkway
• The Brian D. Jellison Cancer Institute
• SMH Rx Express
• Community Specialty Clinic
• Sarasota Memorial Internal Medicine at Newtown
• Gulf Coast Medical Management
• Kolschowsky Research and Education Institute
• Sarasota Memorial Outpatient Diabetes & Nutrition Services
• Waldemere Medical Plaza Diagnostic Center at Sarasota Memorial
• Sarasota Memorial Outpatient Rehabilitation at Bee Ridge
• Sarasota Memorial Outpatient Speech Pathology
• Sarasota Memorial Radiology Services
• Sarasota Memorial Hospital Rehabilitation Pavilion
• Sarasota Memorial Sleep Disorder Center
• Sarasota Memorial Cardiopulmonary Rehab at The Heart Pavilion

UNDERSTANDING YOUR MEDICAL INFORMATION
Medical information includes information about your past, present, or future healthcare that may identify you (such as your name, address, social security number), as well as your symptoms, examinations, test results, diagnoses, treatment, and plans for future care. This medical and billing information is protected by law and is frequently referred to as “Protected Health Information” (PHI).

OUR PLEDGE REGARDING MEDICAL INFORMATION
We understand that your medical information is personal. We are required by law to:

• Make sure your medical information is private;
• Give you this Notice of our legal duties;
• Follow the terms of this Notice; and
• Notify you following a breach of unsecured PHI, as required by law.

We are committed to excellence in patient care, education, and research. Your PHI may be used and disclosed for these purposes as permitted by law, and we train our workforce to protect confidentiality.

HOW WE MAY USE AND DISCLOSE YOUR MEDICAL INFORMATION WITHOUT YOUR WRITTEN AUTHORIZATION

• For Treatment: We may use and disclose PHI to provide, coordinate, or manage your care and related services. This information may be shared with doctors, nurses, advanced practice providers, technicians, health care students, or others who participate in your care. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, we may share medical information about you in order to coordinate the different things you may need, such as prescriptions, lab work, and x-rays. It may also be necessary to disclose medical information about you to people outside SMHCS who participate in your medical care after you leave our care. For example, we may disclose your medical information to a home health agency or to a physician to whom you have been referred. This is to ensure that the agency or physician has the necessary information to diagnose or treat you.
• For Payment: We may use and disclose your PHI so that services may be billed to, and payment collected from, you, a health plan, or a third party. Before you receive scheduled services, we may share information about these services with your health plan(s) to obtain prior approval or to determine whether your insurance will cover the treatment. For example, we may need to give your insurance company information about your surgery so they will pay us or reimburse you for the surgery. 
• For Health Care Operations: We may use and disclose PHI for our business activities and health care operations. These uses and disclosures allow us to improve the quality of care we provide and reduce healthcare costs. Examples of these activities include, but are not limited to:
  • Reviewing and improving the quality, efficiency, and cost of care that we provide to you and other patients.
  • Evaluating the skills, qualifications, and performance of healthcare providers taking care of you.
  • Providing training programs for students, trainees, healthcare providers, or non-healthcare professionals (for example, billing clerks) to help them practice or improve their skills.
  • Cooperating with outside organizations that assess the quality of care we provide. These organizations might include government agencies or accrediting bodies like the Joint Commission and the DNV GL Healthcare.
  • Cooperating with outside organizations that evaluate, certify or license healthcare providers, staff or facilities in a particular field or specialty. For example, we may use or disclose health information so that one of our nurses may become certified in a specific field of nursing.
  • Sharing information with Sarasota Memorial Public Safety to maintain safety at our facilities.
  • Assisting various people who review our activities. Health information may be seen by doctors reviewing services provided to you, and by accountants, lawyers and others who assist us in complying with applicable laws.
  • Conducting business management and general administrative activities related to our organizations and services we provide.
  • Resolving grievances within our organizations.
  • Complying with this Notice and with applicable laws.
  • Review the quality of our treatment and services, or to send you a patient satisfaction survey
• Electronic Sharing and Health Information Exchanges: Electronic communications enable fast, secure access to your information for those participating in and coordinating your care to improve the overall quality of your health care and prevent delays in treatment. We may share PHI electronically to support treatment, payment, and health care operations, including through participation in Health Information Exchanges (HIEs). Where permitted, patients may opt-out of certain HIE sharing by following instructions on our website or by calling (941) 917-6622.  SMHCS will use reasonable efforts to respect your HIE opt-out choices, subject to legal requirements and exceptions (for example, emergencies).  
• Business Associates: We may disclose PHI to third party “business associates” that perform various services for our health care system (e.g., billing, transcription, record copying) under contracts requiring them to appropriately safeguard your PHI.
• Appointment Reminders: We may contact you by phone, text, mail, or patient portal to remind you of an appointment or to request that you contact us.
• Treatment Alternatives: We may tell you about or recommend treatment options or alternatives, as long as we are not using your PHI for marketing, as defined under the law, without your authorization.
• Health-Related Benefits and Services: We may contact you and offer other health-related services or medical education that may be of interest to you, as long as we are not marketing to you. For example, we may send you a newsletter by using your name and U.S. mail address.
• Personal Health Records Systems (PHR): We may use information you provide to operate a PHR and to communicate with you through that service.
• Individuals Involved in Your Care or Payment: We may disclose your PHI to a family member or other person you allow to be present and involved in your care, such as a friend, relative, or spouse. We will only disclose PHI relevant to that person’s involvement in your care or payment for your care. If someone has legal authority (for example, medical power of attorney or guardian), that person can use your rights after we verify their authority. In an emergency situation or if you are incapacitated, we may use and disclose your information in your best interests, consistent with your known preferences and professional judgment. We may also disclose limited PHI to disaster relief organizations to help locate a family member or other persons responsible for your care.
• Facility Directory (where applicable): While you are a patient in our facility, we may include your name, location in the hospital, general condition (e.g., fair, stable, etc.), and religious affiliation in a facility directory. Except for religious affiliation, this information may be disclosed to people who ask for you by name. Clergy may receive this directory information even if they do not ask for you by name.
  You have the right to object to being listed in the directory. If you are unable to agree or object, we may include information we deem is in your best interest based on our professional judgment. If you do not want your information listed in the hospital directory, please notify Registration when you arrive or call the facility’s Patient Registration Office.
• Research: We may use and disclose PHI, including PHI generated for use in a research study, as permitted by law for research, subject to your written authorization and/or oversight by the Sarasota Memorial Hospital Institutional Review Board (IRB). For example, a research project may involve comparing the health and recovery of all patients with the same condition who received one medication to those who received another. Also, clinicians may request our clinical research staff to review your medical information to see if you would be eligible for a study. All research projects, however, are subject to a special approval process. For example, the IRB may approve the use of your health information with only limited identifying information to conduct outcomes research to see if a particular procedure is effective. In all cases where your specific authorization has not been obtained, your privacy will be protected as required by applicable regulations and oversight.
• Fundraising: We may use limited information to contact you or your legal representative in an effort to raise money for SMHCS and its operations. We would only use contact information, such as your name, address and phone number, department of service, treating physician, outcome information, health insurance status and dates you received treatment or services. We may send you information about the Sarasota Memorial Healthcare Foundation, an organization that raises funds in support of SMHCS. Sarasota Memorial Healthcare Foundation may solicit fundraising donations from you; however, should you decide to opt out of receiving future information, you will be given the opportunity to do so. If you would like to opt out at the time of your visit or if you have previously signed a consent authorizing the provision of information to the Sarasota Memorial Healthcare Foundation for fundraising purposes, please let the registrar know that you would like to opt out now from any future provision of information. You may also call the Foundation at 941-917-1286, email them through the Contact Us screen at www.smhf.org, or write to them at SMHF, 1515 South Osprey Avenue, Suite B-4, Sarasota, Florida, 34239 and ask them to remove you from their mailing list.
• As Required by Law: We will disclose PHI when required by Federal, state, or local law or other judicial or administrative proceedings. If other laws provide greater protection than HIPAA, we will comply with the more stringent law. See also the “Florida Law” section below for additional state-specific protections.
• Military and National Security: We may disclose PHI to authorized Federal officials for national security and intelligence activities, including the provision of protective services to the President. We may also be required to disclose medical information of members of the Armed Forces:
  • For activities deemed necessary by appropriate military command authorities, or
  • To foreign military authorities if you are a member of that foreign military service.
• Workers’ Compensation: We may disclose PHI to workers’ compensation and other programs providing benefits for work-related injuries or illnesses.
• Organ and Tissue Donation: We may disclose PHI to organizations involved in organ, eye, or tissue procurement, banking, or transplantation.
• Public Health and Safety: We may disclose your health information to appropriate government authorities for public health activities. These activities generally include the following:
  • When necessary to prevent a serious threat to your health and safety or the health and safety of others; 
  • To prevent or control disease, injury, or disability;
  • To report births and deaths;
  • To report child abuse or neglect;
  • To report reactions to medications or problems with products;
  • To entities regulated by the Food and Drug Administration, if necessary, to report adverse events, product defects, or to participate in product recalls;
  • To notify people of recalls of products they may be using;
  • To certain registries (such as the Cancer Registry) as required by law if your condition meets applicable definitions;
  • To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or
  • To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence, as required or authorized by law.
• Health Oversight Activities: We may disclose PHI to a government health oversight agency for activities authorized by law such as audits, investigations, inspections, and licensure. Government oversight agencies include government benefit programs, government regulatory programs, and civil rights laws, etc.
• Legal Proceedings: If you engage in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order. We may also disclose your medical information in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement: We may disclose PHI if required to do so by a law enforcement official for law enforcement purposes:
  • In response to a court order, subpoena, warrant, summons, or similar process;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • Pertaining to a victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • About a death we believe may be the result of criminal conduct;
  • About criminal conduct at the hospital or any of our health care companies; or
  • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.
• Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose your medical information to a funeral director, as authorized by law, in order for the director to carry out assigned duties.
• Inmates or Persons in Custody: If you are an inmate or in custody, we may disclose PHI to the correctional institution or law enforcement official for your health care, your safety, the health and safety of others, or the security of the correctional institution.
• Electronic mail (Email) and Text Messages: We may communicate with you electronically if you request an electronic method of communication or initiate electronic communications with SMHCS. By providing an email address or mobile phone number for electronic transmission of PHI, you are consenting to those with access to that information having access to the PHI that will be contained in such electronic messages.
• Substance use disorder (SUD) treatment:  Federal law protects the confidentiality of SUD patient records. 
  • SUD treatment records, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a patient unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the patient. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed. 
  • SUD treatment records may be used about a patient for fundraising purposes that benefit SMHCS only if the patient is first provided with clear opportunity to elect not to receive fundraising communications. 
  • A single consent will be used for all future uses or disclosures of SUD treatment records for treatment, payment, and health care operations purposes.

YOUR RIGHTS REGARDING YOUR PHI

• Right to Access, Inspect, and Copy: You may inspect and obtain a copy of your PHI that is used to make decisions about your care. This includes medical and billing records, health plan enrollment, payments, adjudicated claims, and case or medical management record systems, but may not include psychotherapy notes or other information that is subject to laws that prohibit access.
  
  If we maintain your records electronically, and you request electronic access, we will provide the information in the form and format you request, if readily producible, or in a readable electronic format to which you agree.
  
  We may deny your request to access and copy in certain limited circumstances. Written notice of denial will be provided; this may include electronic communication if appropriate. If you are denied access to your medical information, you may request that the denial be reviewed, subject to the laws regarding whether a denial is reviewable. Another licensed health care professional chosen by the hospital or one of our related health care companies will review your request and the denial. This health care professional will not be the person who denied your initial request, and we will comply with the outcome of that review.
  
  To access and request a copy of your medical information, please visit our website for hospital medical or radiology records at https://www.smh.com/Home/Patients-Visitors/Release-of-Information. For all other records, please contact the appropriate department by calling the telephone number listed on the last page of this Notice. A fee may be charged for making copies. We will respond to your request within 30 days or will let you know within 30 days that we need additional time to respond to the request (if the information you request is not maintained or accessible on-site.)
  
  Note: The right to access belongs primarily to the individual who is the subject of the PHI, but a person who is legally authorized to act on behalf of the individual regarding health care matters is granted the same right of access. An individual’s legal authority to act on behalf of an individual with regard to health care matters is determined by state law. Any person who requests PHI, as well as the person’s authority to have access to the information, will be verified in accordance with SMHCS policies and procedures. You may also ask us, in a written request signed by you, to send a copy of your PHI to another person who you designate.
   
• Right to Amend: If you think that your PHI is incorrect or incomplete, you may ask us to amend or correct the information. You have the right to request an amendment for as long as the information is kept by, or for, our hospital or one of our related healthcare companies. To request an amendment, please contact the Privacy Officer, the hospital’s Health Information Management Department, or appropriate office below by calling the telephone number listed on the last page of this Notice. Reasonable efforts will be taken to communicate the amendment to others in the network within a reasonable period.
  
  You will be required to provide a reason that supports your request. Please note that we may deny your request if you ask us to amend information that:
  • Was not created by us, unless the author or entity that created the information is no longer available to make the amendment;
  • Is not part of the medical information kept by or for our hospital or our related health care companies;
  • Is not part of the information which you would be permitted to review and copy; or
  • We believe the information is accurate and complete.


• If your request is denied, but you continue to dispute the accuracy of the information, you will be provided with an opportunity to file a statement of disagreement. This statement of disagreement will be provided with any subsequent disclosure of disputed PHI. Please contact the Privacy Officer by calling the telephone number listed on the last page of this Notice.
  
  Note: Changes to non-clinical information such as changes of address, insurance information, date of birth, etc. are not amendments and may be routinely processed.
   
• Right to Request Restrictions: You have the right to restrict or request a limit on the use and disclosure of your PHI for treatment, payment and health care operations and to certain individuals involved in your care. We are not required to agree to your request if it could affect your care. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment, or until the agreement is terminated by either you or SMHCS. Termination of the agreement to restrict will not apply to information that SMHCS is required to restrict.
  
  To request a restriction or limitation, please contact the Privacy Officer, the hospital’s Health Information Management Department, or appropriate office below by calling one of the telephone numbers on the last page of this Notice. Your request must specify:
  • The information you want to limit;
  • Whether you want to limit our use, disclosure, or both; and
  • To whom you want the limits to apply, for example to your spouse.


• We are required to agree to your request to restrict disclosure of your PHI to a health plan or other third party payor if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and, the information pertains solely to a health care service or item that you, or a third party other than the health plan or other third party payor, have paid for in full.
   
• Right to Request Confidential Communications (Alternative Ways): You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we only contact you at work or by U.S. mail. To request confidential communications, please contact the Privacy Officer, the hospital’s Health Information Management Department, or appropriate office below by calling one of the telephone numbers listed on the last page of this Notice to make your request in writing. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests.
   
• Right to an Accounting of Disclosures: You may request an accounting of certain disclosures of your PHI made in the six years prior to your request. The list does not include disclosures made:
  • For treatment, payment, and health care operations;
  • To you, or pursuant to your authorization;
  • As a result of an incidental disclosure;
  • Through our hospital directory, or to people involved in your care;
  • For national security or intelligence purposes; or
  • To correctional institutions or law enforcement officials.
• 
  To request an accounting of disclosures, please contact the Privacy Officer, the hospital’s Health Information Management Department, or appropriate office below by calling one of the telephone numbers listed on the last page of this Notice to make your request in writing. Your request must state:
  • A time period for which you want the accounting.
  • In what form you wish to receive the accounting (for example, paper or electronically).


• The first accounting you request within a twelve-month period will be free. For additional accountings, a fee may be charged for providing the list. We will notify you of the fee and you may choose to withdraw or modify your request at that time.
   
• Right to a Paper Copy of This Notice: You may obtain a paper copy of this Notice at any time. The Notice is also available to download on our corporate website (www.smh.com) and listed department/facility webpages.

OTHER USES OF YOUR MEDICAL INFORMATION
Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written authorization. We will ask your written permission before we use or disclose your PHI, for example for the following purposes:

• Psychotherapy notes made by your individual mental health provider during a counseling session, except for certain limited purposes related to treatment, payment and health care operations, or other limited exceptions, including government oversight and safety.
• Certain marketing activities, including whether we are paid by a third party for marketing statements as described in your executed authorization.
• Sale of your health information except for certain purposes permitted under the regulations.

If you give us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. We are unable to take back any disclosures that we have already made, and, we are required by law to retain our records of the care that we provide to you. PHI that the law permits or requires us to disclose may be further shared by recipients and is no longer protected by law or the safeguards and restrictions in place when it is in our possession.

SMHCS’s website (www.smh.com) and subsidiary websites (including but not limited to www.firstphysiciansgroup & www.smhurgentcare.com) use cookies to enhance the user experience, to support site functionality, and analyze site usage. Uses include, but are not limited to, navigation improvements, content use, and accessibility. Please visit www.smh.com or SMHCS’s subsidiary websites to manage your cookie preferences.

FLORIDA LAW
In the event that Florida Law requires us to give more protection to your health information than stated in this Notice or required by Federal law, we will give that additional protection to your health information. Additional  confidentiality protections may apply to health care services such as treatment for mental health, substance use disorder, or sexually transmitted disease, or for genetic testing/DNA analysis. If a minor may lawfully consent to certain services such as outpatient mental health services, SUD treatment, sexually transmitted disease evaluation and treatment, and certain pregnancy-related care, the minor generally controls the confidentiality of information related to that care, and the minor’s authorization is typically required before disclosing that information to a parent or guardian, unless an applicable statutory or regulatory exception applies. 

COMPLAINTS
If you believe your privacy rights have been violated, you may contact SMHCS’s Privacy Officer at (941) 917-9000 or write to: Sarasota Memorial Hospital, 1700 South Tamiami Trail, Sarasota, FL 34239, Attn: Privacy Officer. You also have the right to file a written complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights.  Your care will not be affected, and you will not be penalized for filing a complaint.

CHANGES TO THIS NOTICE
We may change our privacy practices and this Notice. Changes apply to PHI we already maintain and to new  medical information. We will post the current Notice, including the effective date, at each of our health care locations and on our corporate website (www.smh.com). We will offer you a copy of the latest Notice each time you register at one of our facilities.

ACKNOWLEDGEMENT
We will ask you to sign an acknowledgement of your receipt of this Notice.

TELEPHONE CONTACT LIST

* To request copies of your medical information from First Physicians Group, call the physician’s office directly.