Effective date: September 14, 2026

Foundations Pediatrics Assessment and Treatment Center, LLC
495 Prosperity Lake Drive, Suite 101, Saint Augustine, FL 32092
245 Land Grant Street, Suite 3, Saint Augustine, FL 32092

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. Our Pledge Regarding Health Information

We understand that health information about you and your health care is personal. We are committed to protecting it. We create a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements.

This notice applies to all of the records of your care generated by this practice. It tells you about the ways in which we may use and disclose health information about you, describes your rights to the health information we keep about you, and describes certain obligations we have regarding its use and disclosure.

We are required by law to:

  • Make sure that protected health information (“PHI”) that identifies you is kept private.
  • Give you this notice of our legal duties and privacy practices with respect to health information.
  • Follow the terms of the notice that is currently in effect.
  • Notify you if a breach of your unsecured protected health information occurs.

We are also required by law to provide you with adequate notice of your rights and our legal duties if we create or maintain records protected by 42 C.F.R. Part 2.

We can change the terms of this notice, and such changes will apply to all information we have about you. The new notice will be available upon request, in our offices, and on our website at foundationspediatrics.com/notice-of-privacy-practices.

II. How We May Use and Disclose Health Information About You

The following categories describe different ways that we use and disclose health information. For each category we explain what we mean and give some examples. Not every use or disclosure is listed, but all of the ways we are permitted to use and disclose information fall within one of these categories.

For Treatment, Payment, or Health Care Operations

Federal privacy rules allow health care providers who have a direct treatment relationship with a client to use or disclose that client’s personal health information without written authorization, in order to carry out treatment, payment, or health care operations. We may also disclose your protected health information for the treatment activities of any health care provider. For example, if a clinician were to consult with another licensed health care provider about your condition, we would be permitted to use and disclose your personal health information in order to assist in diagnosis and treatment.

In this practice, treatment includes coordinating care among clinicians, clinical supervision of registered interns and other supervised clinicians, and consultation with other parties with your permission. Payment includes billing your insurance and verifying coverage. Operations include scheduling, quality review, and training.

Disclosures for treatment purposes are not limited to the minimum necessary standard, because clinicians need access to the full record in order to provide quality care. The word “treatment” includes, among other things, coordination and management of care with a third party, consultations between health care providers, and referrals from one provider to another.

If your records are protected under 42 C.F.R. Part 2, certain uses and disclosures permitted by HIPAA for treatment, payment, and health care operations are materially limited by the stricter standards of those regulations. Information disclosed under those rules may be subject to redisclosure by the recipient and may no longer be protected by federal privacy standards.

Lawsuits and Disputes

If you are involved in a lawsuit, we may disclose health information in response to a court or administrative order. We may also disclose health information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested. For records protected by 42 C.F.R. Part 2, such records or testimony relaying their content will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide specific written consent or a court order is issued in accordance with those regulations.

III. Certain Uses and Disclosures Require Your Authorization

Psychotherapy Notes

We may keep “psychotherapy notes” as that term is defined in 45 C.F.R. § 164.501, and any use or disclosure of such notes requires your authorization unless the use or disclosure is:

  • For our use in treating you.
  • For our use in training or supervising mental health practitioners to help them improve their skills in group, joint, family, or individual counseling or therapy.
  • For our use in defending ourselves in legal proceedings instituted by you.
  • For use by the Secretary of Health and Human Services to investigate our compliance with HIPAA.
  • Required by law, and the use or disclosure is limited to the requirements of such law.
  • Required by law for certain health oversight activities pertaining to the originator of the psychotherapy notes.
  • Required by a coroner who is performing duties authorized by law.
  • Required to help avert a serious threat to the health and safety of others.

Marketing

We will not use or disclose your PHI for marketing purposes.

Sale of PHI

We will not sell your PHI in the regular course of our business.

Revoking an Authorization

If you provide us with a written authorization, you may revoke it in writing at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written permission. We are unable to take back any disclosures we have already made with your permission. You may not revoke an authorization to the extent that we have already relied on it, or if the authorization was obtained as a condition of obtaining insurance coverage and the law gives the insurer the right to contest the claim under the policy.

IV. Certain Uses and Disclosures Do Not Require Your Authorization

Subject to certain limitations in the law, we can use and disclose your PHI without your authorization for the following reasons:

  • When disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of that law.
  • For public health activities, including reporting suspected child, elder, or dependent adult abuse, or preventing or reducing a serious threat to anyone’s health or safety.
  • For health oversight activities, including audits and investigations.
  • For judicial and administrative proceedings, including responding to a court or administrative order, although our preference is to obtain an authorization from you first.
  • For law enforcement purposes, including reporting crimes occurring on our premises.
  • To coroners or medical examiners, when such individuals are performing duties authorized by law.
  • For research purposes, including studying and comparing the mental health of clients who received one form of therapy versus another for the same condition.
  • For specialized government functions, including ensuring the proper execution of military missions, protecting the President of the United States, conducting intelligence or counter-intelligence operations, or helping to ensure the safety of those working within or housed in correctional institutions.
  • For workers’ compensation purposes. Although our preference is to obtain an authorization from you, we may provide your PHI in order to comply with workers’ compensation laws.
  • For appointment reminders and health-related benefits or services. We may use and disclose your PHI to remind you of an appointment, or to tell you about treatment alternatives or other services we offer.

What this means in practice

The situations below are the ones that arise most often in a mental health practice in Florida. They are examples of the categories above, not additions to them.

  • Child abuse. Child abuse or neglect, including domestic violence in the presence of a child, child-on-child sexual acting out or abuse, and physical abuse. If you reveal information about child abuse or neglect, your clinician is required by law to report it to the appropriate authority.
  • Vulnerable adult abuse. If information is revealed about vulnerable adult or elder abuse or neglect, your clinician is required by law to report it.
  • Self-harm. Threats, plans, or attempts to harm oneself. Your clinician is permitted to take steps to protect the client’s safety, which may include disclosure of confidential information.
  • Harm to others. If there is a threat of bodily harm or death to another person, your clinician is required by law to report it to the appropriate authority.
  • Subpoenas. If we receive a subpoena for records, your clinician will contact you directly so you may take whatever steps you consider necessary to prevent the release of your confidential information. Your clinician will attempt to reach you twice by phone; if that is unsuccessful, written correspondence will be sent.
  • Court orders. If a court issues a legitimate court order, we are required by law to provide the information specifically described in the order.
  • Court-ordered therapy. If therapy is court ordered, the court may request records or documentation of participation. Your clinician will discuss the information with you in session before sending it to the court.
  • Health oversight in Florida. If a complaint is filed against the practice with the Florida Department of Health, the Department has the authority to subpoena confidential mental health information relevant to that complaint.
  • Insurance. Insurance companies and other third-party payers are given information they request regarding services, which may include types of services, dates and times of services, diagnoses, treatment plans, evaluations, and progress of therapy.
  • Fee disputes. In the case of a credit card dispute, we reserve the right to provide your bank or credit card company with the documentation necessary to respond, such as your signature on the agreement covering the cancellation policy.
  • Releases to third parties. Clients must sign a release of information form before any information is sent to a third party. A summary of visits will usually be provided in place of psychotherapy or process notes. If sessions involve more than one person, each person over the age of 18 must sign the release before information is released.
  • Sessions outside the office. From time to time clients prefer to meet in an alternate location, such as a school or a public place. We may be able to accommodate this, but it can put your confidentiality at risk.
  • Social media. We do not accept friend or contact requests from current or former clients on any personal social networking account. If you comment on our professional pages or posts, you do so at your own risk and may reveal that you are a client. We cannot be held liable if someone identifies you as a client.
  • Electronic communication. Do not use email for emergencies. In an emergency, call 988 to reach the Suicide & Crisis Lifeline, call 911, or go to the nearest emergency room. Email is not a substitute for sessions; if you need to be seen, please call to book an appointment.

V. Certain Uses and Disclosures Require You to Have the Opportunity to Object

Disclosures to family, friends, or others

We may provide your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.

VI. Your Rights With Respect to Your PHI

  1. The right to request limits on uses and disclosures of your PHI. You have the right to ask us not to use or disclose certain PHI for treatment, payment, or health care operations purposes. We are not required to agree, and may say no if we believe it would affect your health care.
  2. The right to request restrictions for out-of-pocket expenses paid in full. You have the right to request restrictions on disclosures of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or service that you have paid for out of pocket in full. We must agree to this request.
  3. The right to choose how we send PHI to you. You have the right to ask us to contact you in a specific way, for example at a home or office phone, or to send mail to a different address. We will agree to all reasonable requests.
  4. The right to see and get copies of your PHI. Other than psychotherapy notes, you have the right to get an electronic or paper copy of your record and other information we have about you. We will provide a copy of your record, or a summary if you agree to receive one, within 30 days of receiving your written request, and may charge a reasonable, cost-based fee.
  5. The right to get a list of the disclosures we have made. You have the right to request a list of instances in which we disclosed your PHI for purposes other than treatment, payment, or health care operations, or for which you provided us with an authorization. We will respond within 60 days. The list will include disclosures made in the last six years unless you request a shorter period. We provide the list at no charge, but if you make more than one request in the same year, we may charge a reasonable, cost-based fee for each additional request.
  6. The right to correct or update your PHI. If you believe there is a mistake in your PHI, or that important information is missing, you have the right to request that we correct or add to it. We may say no, but we will tell you why in writing within 60 days.
  7. The right to get a paper or electronic copy of this notice. You have the right to a paper copy of this notice and to receive it by email. Even if you have agreed to receive it by email, you may still request a paper copy.
  8. The right to be notified of a breach. You have the right to be notified if a breach of your unsecured protected health information occurs. See Section VIII.

VII. Complaints

If you have a concern, please tell us first

Contact Dr. Jill Driest, Privacy Officer, Foundations Pediatrics Assessment and Treatment Center, LLC, 495 Prosperity Lake Drive, Suite 101, Saint Augustine, FL 32092, or email us at info@foundationspediatrics.com with any privacy questions or complaints.

You may also complain to the federal government

You may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. The complaint must be filed within 180 days of when you knew or should have known about the issue.

File online at ocrportal.hhs.gov/ocr/smartscreen/main.jsf, or mail a written complaint to: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F, HHH Building, Washington, D.C. 20201.

We will not retaliate

Foundations Pediatrics Assessment and Treatment Center, LLC will not retaliate against you, change your treatment, or deny you services because you filed a complaint.

VIII. Our Duty to Notify You of a Privacy Breach

We are required by federal and state law to maintain the privacy and security of your protected health information. If an unauthorized person accesses, acquires, uses, or discloses your unsecured PHI, we will conduct a risk assessment.

If we determine that a breach has occurred, we will notify you in writing without unreasonable delay, and in no case later than sixty calendar days after we discover the incident.

Our notification will include:

  • What happened. A brief, plain-language description of the incident, including the date it occurred and the date it was discovered.
  • Information involved. A description of the specific types of health information involved, such as your name, intake forms, diagnosis, treatment plans, or billing details.
  • Steps you can take. Recommendations on how to protect yourself from potential harm, such as monitoring your credit report or health insurance statements.
  • Our corrective action. A summary of what we are doing to investigate, mitigate the damage, and protect against future incidents.
  • How to contact us. Direct contact information so you can call or email us with questions.

IX. Record Keeping and Retention

We maintain records in a way that preserves their confidentiality. Paper records are stored in locked cabinets or other containers housed in locked offices or storage rooms. Electronic records are safeguarded through security procedures including passwords, firewalls, data encryption, and authentication.

We retain clinical records for seven years from the date of last contact with the client. Where the client is a minor, records are retained at least until the client reaches the age of eighteen, and for a minimum of seven years after that date.

Email correspondence that becomes part of a client’s record is retained on the same schedule. Correspondence that does not form part of a clinical record is addressed in the Privacy Policy on our website.

Acknowledgement of Receipt

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information.

You have a right to request a paper copy of this notice. You may request a physical copy during any visit or at either of our office locations.

Clients acknowledge receipt through the intake paperwork.