Direct Preventive Care Effective Date: February 16, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice applies to Direct Preventive Care and all providers, employees, and staff who deliver care under our practice name. We are required by law to maintain the privacy of your protected health information (“PHI”), provide you with this Notice describing our legal duties and privacy practices, and abide by the terms currently in effect.
1. How We May Use and Disclose Your Health Information
Without your written authorization, we may use and disclose your PHI for:
- Treatment — to provide, coordinate, or manage your health care, including sharing information with other providers involved in your care (e.g., a lab, pharmacy, or referring/consulting physician).
- Payment — to bill and collect payment for services, including verifying coverage, submitting claims, and discussing charges with your insurer or payment processor.
- Health care operations — for quality assessment, staff training, compliance, and other internal administrative and business functions.
- Appointment reminders and treatment alternatives — to contact you about appointments or to tell you about treatment options or health-related benefits and services that may interest you.
- As required by law — including public health reporting, health oversight activities, judicial and administrative proceedings pursuant to valid legal process, law enforcement purposes narrowly defined by law, and to avert a serious threat to health or safety.
- Business associates — with vendors who perform services on our behalf (e.g., our scheduling/EHR platform, billing service, or IT support) under a signed Business Associate Agreement requiring them to protect your information consistent with HIPAA.
With your written authorization required. Most uses and disclosures of psychotherapy notes (if applicable), uses of your PHI for marketing purposes, and any sale of PHI require your specific written authorization. You may revoke a prior authorization in writing at any time, except to the extent we have already relied on it.
2. Special Protections: Substance Use Disorder Records (42 CFR Part 2)
If our practice creates, receives, or maintains substance use disorder (SUD) treatment records that are subject to 42 CFR Part 2, those records receive heightened confidentiality protections beyond standard HIPAA rules. Specifically:
- SUD treatment records generally may not be disclosed, even for treatment, payment, or health care operations, without your specific written consent, except in narrow circumstances (e.g., a bona fide medical emergency, or as otherwise permitted under Part 2).
- SUD treatment records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without a qualifying court order and, where required, your consent.
- Information you consent to share may be redisclosed only in accordance with Part 2’s requirements, and recipients are required to be notified of these restrictions.
If you have questions about whether this section applies to information in your chart, please ask our Privacy Officer.
3. Your Rights Regarding Your Health Information
You have the right to:
- Request restrictions on certain uses or disclosures of your PHI, including disclosures to family members involved in your care. We are not required to agree to all requests, but if you paid for a service in full out-of-pocket, you may request that we not disclose information about that service to your health plan, and we must honor that request.
- Request confidential communications — for example, that we contact you only at a specific phone number or address.
- Inspect and copy your medical and billing records, with limited exceptions, generally within 30 days of a written request (a reasonable, cost-based fee may apply for copies).
- Request an amendment to your records if you believe information is incorrect or incomplete. We may deny the request in certain circumstances, in which case you have the right to submit a statement of disagreement.
- Receive an accounting of certain disclosures of your PHI made for purposes other than treatment, payment, and health care operations, generally covering the six years prior to your request.
- Receive a paper copy of this Notice at any time upon request, even if you previously agreed to receive it electronically.
- Choose someone to act on your behalf — a personal representative — subject to our verification of that authority.
- Be notified of a breach of unsecured PHI affecting your information.
- File a complaint if you believe your privacy rights have been violated, without fear of retaliation (see Section 6).
4. Our Responsibilities
We are required to: – Maintain the privacy of your PHI as described in this Notice – Provide you with this Notice describing our legal duties and privacy practices – Notify you if a breach of your unsecured PHI occurs – Abide by the terms of this Notice currently in effect – Not use or share your information other than as described here, unless you provide written permission, which you may revoke at any time
5. Changes to This Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as any information we receive in the future. We will post the current Notice in our office and on our website (www.directpreventive.com), and will make copies available upon request.
6. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer, or with the Secretary of the U.S. Department of Health and Human Services:
U.S. Department of Health and Human Services, Office for Civil Rights www.hhs.gov/ocr/complaints 1-800-368-1019
You will not be retaliated against for filing a complaint.
7. Contact Information / Privacy Officer
Direct Preventive Care Privacy Officer: Dr. Manuel Omar Cruz Orlando, Florida Phone: (321) 844-3820 Email: support@directpreventive.com Website: www.directpreventive.com