Your Information. Your Rights. Our Responsibilities.
This page explains patient privacy rights and permitted uses of health information. For the practice notice currently in effect and its effective date, contact Ernest Caruso at (561) 447-2228. The historical notice linked below is provided for reference.
The following explanation is based on the U.S. Department of Health and Human Services healthcare provider model notice, revised February 2026. The practice’s own procedures and any additional legal protections govern how these requirements apply to your records.
Your Rights
- Obtain records: Ask to inspect or receive an electronic or paper copy of medical records and other health information maintained about you. A copy or summary is generally provided within 30 days, subject to legally permitted extensions. A reasonable, cost-based fee may apply where permitted.
- Request corrections: Ask to amend information you believe is incorrect or incomplete. A request may be denied; the reason must be given in writing, generally within 60 days, subject to a permitted extension. You may submit a statement of disagreement.
- Request confidential communications: Ask for contact in a specific way or at a different location. Reasonable requests will be accommodated.
- Request restrictions: Ask to limit uses or disclosures for treatment, payment, or healthcare operations. The practice generally need not agree, except where the law requires it. An agreed restriction can have an emergency-treatment exception.
- Out-of-pocket payments: If you pay for an item or service out of pocket in full and request it, the practice must not disclose information solely about that item or service to your health plan for payment or healthcare operations unless disclosure is required by law.
- Obtain an accounting: Request a list of applicable disclosures during the six years before your request. Certain disclosures, including most treatment, payment, operations, and authorized disclosures, are excluded. One accounting in a 12-month period is free; a reasonable cost-based fee may apply to additional requests.
- Receive a paper copy: You may request a paper copy of the applicable notice promptly and at any time, even if you previously agreed to receive it electronically.
- Choose a representative: A legally authorized personal representative may exercise your rights. The practice must verify that person’s authority, subject to applicable legal exceptions.
- File a complaint: Contact the practice or the U.S. Department of Health and Human Services if you believe your privacy rights were violated. The practice may not retaliate against you for filing a complaint.
Your Choices
You may tell the practice whether to share information relevant to care or payment with family, close friends, caregivers, or others involved in your care, and in disaster-relief situations. Where permitted, you may agree or object. If you cannot express a preference, information may be shared in your best interest using professional judgment, or to reduce a serious and imminent threat, subject to applicable law.
For uses that require written authorization, you decide whether to authorize disclosure. You may revoke an authorization in writing, except to the extent action has already been taken in reliance on it or another legal exception applies.
If fundraising communications are undertaken, you may opt out of further fundraising contacts. For any records subject to 42 CFR Part 2, clear and conspicuous advance notice and a choice about receiving fundraising communications using those records are required.
How Health Information May Be Used and Disclosed
The following describes legally permitted or required purposes, not a statement that the practice performs every listed activity. Each disclosure must satisfy applicable conditions, including any stronger protections for particular records.
- Treatment: Use information to provide your care and share it with other professionals treating you; for example, consulting another clinician about an injury.
- Payment: Use and disclose information to bill and obtain payment from health plans or other responsible parties, subject to applicable restrictions.
- Healthcare operations: Manage practice activities, evaluate care, improve services, and perform permitted administrative functions.
- Appointment reminders and treatment-related communications: Contact you about appointments, care, treatment alternatives, or related services as permitted and consistent with reasonable confidential-communication requests.
- Public health and safety: Required or permitted reporting of disease, product problems, adverse reactions, abuse, neglect, or domestic violence, and prevention of serious threats, subject to legal conditions.
- Health oversight: Disclosures to agencies conducting authorized audits, inspections, investigations, or other oversight.
- Workers’ compensation: Disclosures authorized by and necessary to comply with workers’ compensation or similar laws.
- Legal proceedings and law enforcement: Responses to qualifying court or administrative orders, subpoenas, or other legally permitted requests, with required safeguards. Additional Part 2 restrictions described below apply.
- Medical examiners and other authorized purposes: Permitted disclosures to coroners, medical examiners, funeral directors, organ procurement organizations, and for authorized military, national security, or other special governmental functions.
- Research: Uses or disclosures only when applicable legal requirements, such as authorization or an approved waiver, are satisfied.
- Required by law: Disclosures required by applicable law, including to HHS to review compliance, subject to any additional protections that apply.
Uses Requiring Written Authorization
Written authorization is generally required for marketing uses and disclosures, sale of protected health information, and most uses or disclosures of psychotherapy notes, subject to the specific exceptions in law. This does not state that the practice sells information, conducts marketing with patient records, or maintains psychotherapy notes.
Other uses or disclosures not described in the applicable notice or otherwise permitted or required by law require your written authorization. You can revoke that authorization in writing as described above.
Specially Protected Records
If the practice receives or maintains substance use disorder patient records subject to 42 CFR Part 2, those records receive additional federal protection. This does not mean the practice operates a Part 2 substance use disorder treatment program.
Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a qualifying court order and a subpoena, as required by Part 2. An ordinary request or subpoena alone does not remove these protections. This restriction also applies to the otherwise permitted purposes listed above.
The February 16, 2026 Part 2-related notice requirements include the above protection against use in proceedings against you and advance notice and choice before fundraising using Part 2 records. Any handling or redisclosure of such records must meet the applicable consent and other Part 2 requirements.
Additional Legal Protections
Florida or federal law may impose additional confidentiality protections for certain information, including HIV-related information, mental health information, genetic information, and substance use disorder records. Where a law provides stronger protection or requires a separate consent, authorization, or procedure, the applicable additional protection must be followed. Contact the privacy contact about how those requirements apply to your records.
Practice Responsibilities
Applicable law requires the practice to maintain the privacy and security of protected health information, provide a notice of its legal duties and privacy practices, and follow the notice currently in effect.
The practice must provide legally required notification following a breach of unsecured protected health information. The timing and recipients of notice depend on the applicable law.
Uses and disclosures must remain within what the law permits or your valid authorization allows. You may ask the privacy contact about the practice’s notice, your rights, and request procedures.
Business Associates
Service providers performing functions involving protected health information on the practice’s behalf must be subject to business associate agreements where required by law. Such arrangements do not permit unrestricted use or disclosure of patient information.
Electronic Communications
Ordinary website inquiry forms and unsecured email are not appropriate for medical histories, diagnoses, insurance identifiers, or other sensitive health information. Call the office to ask about an appropriate communication method and any request for confidential communications. Do not use the website for emergencies; call 911.
Changes to the Notice
The practice may revise its notice as permitted by law, including making changes applicable to information already held. The revised notice must identify its effective date and be made available through the practice and on its website as required. Ask the office for the notice currently in effect.
Privacy Contact
Ernest Caruso, Privacy Contact, Boca Health & Wellness Center, 3350 NW 2nd Ave Ste A24, Boca Raton, FL 33431. Phone: (561) 447-2228.
Filing a Federal Privacy Complaint
You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its complaint website, by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775. The practice may not retaliate for a complaint.
Availability of the Notice
This information is available online. Ask the office for a printed copy of the notice currently in effect and confirmation of its effective date. The downloadable August 8, 2013 notice is historical reference material, not confirmation of current adoption.