Notice of Privacy Practices

Kassy Home Health ("Kassy," "we," "us") is a for-profit Medicare-certified home health agency. We are required by federal and Florida law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice of our legal duties and privacy practices regarding your PHI, to notify you following a breach of unsecured PHI, and to abide by the terms of the Notice currently in effect. If you have questions about this Notice, please contact our Privacy Officer using the information at the end.

Our Promise to You

Your health information belongs to you. We treat it with the same care we bring to every visit — kindness, respect, and discretion. Federal law (the HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164) and Florida law (including Fla. Stat. §§ 400.494 and 456.057) require us to keep PHI confidential. We will use and disclose your PHI only as described in this Notice, or as you authorize in writing.

How We May Use and Disclose Your Health Information Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

For treatment. We share PHI with our nurses, therapists, aides, and the physicians, hospitals, and other providers involved in your care so they can coordinate and deliver services. Example: A Kassy nurse will share your wound-care progress with your treating physician to update your plan of care.

For payment. We use PHI to bill and collect payment from Medicare, Medicaid, your health plan, or you. Example: We submit claims with your diagnosis and the services we provide so Medicare can pay for your home health benefit.

For health care operations. We use PHI to run our agency — quality improvement, staff training, accreditation, licensure surveys, audits, and care management. Example: Our quality team may review your record to assess outcomes and improve the care we deliver.

For appointment reminders, treatment alternatives, and health-related benefits. We may contact you about scheduled visits, alternative treatments, and services or benefits that may be of interest to you.

To business associates. We may disclose PHI to vendors that perform services on our behalf — billing, IT, software hosting, accreditation support — under written Business Associate Agreements that require them to safeguard your PHI.

To people involved in your care. Unless you object, we may share with a family member, caregiver, or other person you have identified the PHI directly relevant to that person's involvement in your care or payment for your care.

Where the law requires or permits. We may use or disclose PHI for: public health activities (including reporting communicable diseases to the Florida Department of Health, reporting suspected abuse or neglect of a child to the Department of Children and Families, or of a vulnerable adult to the Adult Protective Services hotline); health oversight by AHCA, HHS, or other regulators; judicial and administrative proceedings (subject to Florida's heightened subpoena-notice requirements at Fla. Stat. § 456.057); law enforcement; coroners, medical examiners, and funeral directors; organ and tissue donation; research approved by an institutional review board; serious threats to health or safety; specialized government functions; workers' compensation; and disclosures otherwise required by law.

Special Protections Under Florida Law

Some categories of information receive stronger protection under Florida law than under HIPAA, and we will follow the stricter rule. These include:

• Mental health records — Florida Mental Health (Baker) Act, Fla. Stat. § 394.4615
• Substance use disorder records — Fla. Stat. § 397.501 and 42 CFR Part 2 (see below)
• HIV/AIDS information — Fla. Stat. § 381.004
• Sexually transmitted disease information — Fla. Stat. § 384.29
• Tuberculosis records — Fla. Stat. § 392.65
• Genetic information — Fla. Stat. § 760.40

For these categories, we will obtain your specific written authorization before disclosure unless an exception in the relevant statute applies.

Substance Use Disorder Treatment Records (42 CFR Part 2)

If we receive or maintain substance use disorder treatment records originating from a program subject to 42 CFR Part 2, we will protect those records under Part 2 in addition to HIPAA. Substance use disorder treatment records received from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent or a court order entered after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in 42 CFR Part 2.

Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures will be made only with your written authorization, which you may revoke in writing at any time (revocation does not affect actions already taken in reliance on the authorization):

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes
• Sales of PHI
• Other uses and disclosures not described in this Notice

Your Rights Regarding Your Health Information

Right to access and obtain a copy. You have the right to inspect and obtain a copy of your PHI, including in an electronic form and format if readily producible. We will respond within 30 days of your written request. We may charge a reasonable, cost-based fee.

Right to amend. You have the right to ask us to amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain limited circumstances; if we do, you may file a written statement of disagreement, which we will include in your record.

Right to an accounting of disclosures. You have the right to request a list of certain disclosures we have made of your PHI in the prior six years (excluding disclosures for treatment, payment, healthcare operations, and certain others permitted by law).

Right to request restrictions. You have the right to ask us to restrict how we use or disclose your PHI for treatment, payment, or healthcare operations, or to family members involved in your care. We are not required to agree, except that we must agree to a restriction on disclosure of PHI to your health plan if the disclosure is for payment or healthcare operations and you have paid for the service in full out of pocket.

Right to confidential communications. You have the right to ask us to communicate with you about your PHI in a particular way or at a particular location (for example, by mail to a specified address, or by phone at work only).

Right to a paper copy of this Notice. You have the right to receive a paper copy of this Notice on request, even if you previously agreed to receive it electronically.

Right to be notified of a breach. You have the right to be notified following a breach of your unsecured PHI, consistent with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–.414) and Fla. Stat. § 501.171.

To exercise any of these rights, please contact our Privacy Officer using the information below. Most requests must be in writing on a form we will provide.

Our Duties

Kassy is required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, to notify you following a breach of unsecured PHI, and to abide by the terms of this Notice currently in effect. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as for PHI we receive in the future. The new Notice will be available at our office, posted on kassyhealth.com, and provided on request.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Contact Our Privacy Officer