NOTICE OF PRIVACY PRACTICES

H-240 NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

To Our Patient: The physicians and staff of Baptist Health are committed to the protection of your health information. The Health Insurance Portability and Accountability Act, requires that we provide notice to each of our patients of how this information is used. We safeguard information about your health and your person (Protected Health Information, PHI). We collect information from you and keep it in a designated record set that contains your health and billing information.

This Notice of Privacy Practices describes the privacy practices of the health care organizations that are a part of Baptist Health that have collectively formed an Affiliated Covered Entity or “ACE” under the HIPAA regulations for purposes of HIPAA compliance (the “Baptist Health ACE”). The Baptist Health ACE includes hospitals, clinics and other health care providers that the organizations operate. Our rules to protect your privacy will be followed by all workforce members of the site where you are being treated, as well as physicians and other health care practitioners with permission to provide services at our sites.

This Notice of Privacy Practices also describes the privacy practices of the physicians and other health care professionals on our medical staffs (“Practitioners”), and other health care providers that provide health care services in our hospitals, clinics and other sites. Legally this is called an “organized health care arrangement” or “OHCA” between the Baptist Health ACE and eligible providers on its Medical Staff. Because the Baptist Health ACE is a clinically-integrated care setting, our patients receive care from Baptist Health ACE staff and from independent practitioners on the Medical Staff. The Baptist Health ACE and its Medical Staff must be able to share your health information freely for treatment, payment and health care operations as described in this Notice. Because of this, the Baptist Health ACE and all eligible providers on the Baptist Health ACE’s Medical Staff have entered into the OHCA under which the Baptist Health ACE and the eligible providers will: 

• Use this Notice as a joint notice of privacy practices for all inpatient and outpatient visits and follow all information practices described in this notice 
• Obtain a single signed acknowledgment of receipt 
• Share health information between healthcare settings with eligible providers so that they can help the Baptist Health ACE with its health care operations 

Accordingly, this Notice will be followed by (1) our workforce members and (2) the independent physicians and other Practitioners who are not employees, agents, servants, partners or joint venturers of Baptist Health or its Affiliates. All Practitioners are solely responsible for their judgment and conduct in treating or providing professional services to patients and for their compliance with state and federal laws. Nothing in this Notice is meant to imply or create an employment relationship between any independent physician or other Practitioner and us. We use a joint Notice of Privacy Practices and a joint Acknowledgement Form with independent physicians and other practitioners to reduce paperwork and make it easier to share information to improve your care. This Notice does not change or limit any consents for treatment or procedures the patient may sign during the time the patient receives care from any of us. The OHCA does not cover the information practices of practitioners in their private offices or at other practice locations.

1. ACCESS/USE/DISCLOSURE AND YOUR PROTECTED HEALTH INFORMATION 

Treatment: We will use and disclose your PHI to provide you with health care treatment or services. This includes sharing PHI among health care providers involved in your care, both inside and outside of Baptist Health. Sharing PHI among providers promotes a collective, comprehensive approach to care. This communication may be accomplished by using a secure electronic method. 

• Your health care provider may share information about your condition with pharmacists to discuss appropriate medications, or with radiologists or other consultants to make a diagnosis. 
• Different departments may share your PHI to coordinate such things as prescriptions, dietary needs, physical therapy, social work, psychiatric support, lab work and diagnostic imaging, etc.

 Your care may involve the use of telemedicine equipment. Security measures (such as encryption and/or the use of nonpublic networks) are used to help minimize the risks associated with telemedicine. 

Payment: Your protected health information will be used, and disclosed as necessary, to obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for your services such as determining eligibility and coverage and utilization review. For example, 

• Obtaining approval from your insurance company for your admission and continued stay 

Healthcare Operations: We will use or disclose your PHI in order to support the business activities of Baptist Health. These activities include, but are not limited to, quality assessment and improvement activities, recruitment and training of medical personnel, licensing, risk management, legal services, compliance and audit functions, etc. Baptist Health participates in a number of online public social media sites. If you or others choose to share your health information on our online social media sites, this information is considered to be public and not protected by privacy laws, and may be re-posted or shared by Baptist Health or others. If you do not want your health information to be public, you should not share it on online public social media sites. You may be contacted by Baptist Health regarding fund-raising activities. Any communication will include an option to opt-out of receiving further communications. We will share your protected health information with third party “business associates” which perform various functions for Baptist Health. Whenever an arrangement such as this involves the access/use or disclosure of your protected health information, we will have a written contract that contains terms that will protect your privacy. For example, 

• A contract exists between Baptist Health and certain entities that help improve patient care and operational efficiency. 
• A contract exists between Baptist Health and the revenue cycle vendors who work patient accounts. 

The workforce and business associates of the medical staff and other healthcare providers may also require access to your protected health information to perform their job functions. To protect your privacy, Baptist Health requires written authorization from the provider before access is granted. This access may be accomplished by using a secure electronic method. 

We may participate in certain health information exchanges (HIEs) whereby we may disclose your health information, as permitted by law, to other health care providers or entities for treatment, payment, or health care operations purposes. 

Artificial Intelligence (AI) Technologies. Your medical information may be used with AI technologies to support various functions, such as treatment, payment and health care operations. These AI tools may assist in analyzing health data, streamlining administrative workflows and supporting clinical decisions. 

For example: We may use AI solutions to assist with tasks such as medical transcription and summary services to improve the quality of care our patients receive or to provide your doctor with evidence-based insights to support treatment decisions. 

2. OTHER USES AND DISCLOSURES BASED UPON YOUR WRITTEN AUTHORIZATION 

Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law. For example, 

• Use and disclosure of psychotherapy records 
• Use and disclosure of PHI for marketing 
• Disclosures that constitute the sale of PHI 

You may revoke your authorization at any time in writing. There may be cases where Baptist Health has already released your protected health information prior to the revocation of the authorization. 

3. DISCLOSURES TO WHICH YOU HAVE THE OPPORTUNITY TO OBJECT 

Facility Directory: Unless you object, we will place your name and location in our facility directory. This information will be disclosed to people who ask for you by name. Unless you object, we will maintain your religious affiliation for use by clergy of the same religious affiliation.

Others Involved in your Healthcare: Unless you object, we may discuss your protected health information with family members or close friends. The information disclosed will only be that related directly to this person’s involvement in your care. If you are unable to agree or disagree, we may disclose this information if we determine that it is in your best interest based on our professional judgment. For example, 

• We may notify your family of your admission to the hospital. 
• We may discuss your discharge plan with the individuals participating in your care. 

Emergencies: We may use or disclose your protected health information in an emergency treatment situation.

Communication Barriers: We may use and disclose your protected health information if we are unable to obtain consent from you but feel in our professional judgment that you intend to consent. 

4. USES AND DISCLOSURES THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION OR OPPORTUNITY TO OBJECT 

We may use or disclose your protected health information in the following situations without your consent or authorization. These situations include, but are not limited to: 

- Required by Law: We will disclose your protected health information when required to do so by federal, state, or local law

 - Public Health Reporting: We may disclose your protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive information. 

- Communicable Diseases: We may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition. 

- Health Oversight: We may disclose your information to health oversight agencies for activities authorized by law such as audits, investigations, and inspections. - Abuse and/or Neglect: We may disclose your protected health information to a governmental entity or agency authorized by law to receive reports of suspected abuse/neglect. 

- Food and Drug Administration: We may disclose your protected health information to a person or company required by the FDA to report adverse events, product defects, biologic product deviations, etc. 

- Legal Proceedings: If you are involved in a lawsuit, we may disclose your protected health information in response to a court order. We may also disclose your protected health information in response to a subpoena, discovery request, or other lawful process from someone else involved in the lawsuit, but only if efforts have been made to tell you about the request or to obtain an order from the court. For patients receiving substance use disorder services, we will not disclose Part 2 Records in any legal proceeding against you without your specific written consent or a specialized court order. More information in regards to part 2 Records is available in Appendix A below.

- Law Enforcement: We may disclose protected health information, so long as applicable requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death or injury has occurred as a result of criminal conduct, (5) in the event that a crime occurs on property owned or operated by Baptist Health, and (6) in the event of a medical emergency. 

- Coroners, Funeral Directors, and Organ Donation: We may disclose your protected health information to a coroner or medical examiner for identification purposes, determining cause of death, or for them to perform other duties as required by law. Your protected health information may also be disclosed to a funeral director, as authorized by law, in order for the director to carry out their duties. We may disclose such information in the reasonable anticipation of death. Protected health information may be used and disclosed for cadaver organ, eye, or tissue donation purposes. 

- Research: Your protected health information may be used for the purpose of research in the form of concurrent or retrospective chart review. This would occur with your permission or after we’ve received approval from a special board whose members review and approve the research project. We may also disclose protected health information to the Baptist Health Center for Clinical Research to determine if you could benefit from participating in a clinical trial. If so, you may be contacted to see if you are interested. 

- Criminal Activity: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual. 

- Military Activity and National Security: When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel, (1) for activities deemed necessary by appropriate military command authorities, (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military services. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities. 

- Worker’s Compensation: Your protected health information may be disclosed by us as authorized to comply with worker’s compensation laws and other similar legally-established programs. - Inmates: We may use or disclose your protected health information if you are an inmate of a correctional facility and your physician created or received your protected health information in the course of providing care to you.

- Other Required Uses and Disclosures: Under the law, we must make disclosures when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 et.seq. 

5. YOUR RIGHTS 

You have the right to inspect and obtain a copy of your protected health information. This means that you may inspect and obtain a copy of protected health information about you that is contained in a designated record set for as long as we maintain your protected health information. A designated record set contains medical and billing records and any other records that we use in making decisions about you. You may request the records be provided in paper or electronic format. You may be charged a fee for the cost of copying, mailing, or supplies associated with your request. Patients are also encouraged to use the Baptist Health portal to access their protected health information. Enrollment information can be found at www.baptist-health.com. Use of the portal is free. Under federal and state law, however, you may be denied access to inspect or obtain a copy. Depending on the circumstances, the decision to deny access may be reviewable.

Please contact the medical records department at 501-202-1914 if you have any questions about access to your medical record. 

You have the right to request a restriction of your protected health information. This means that you may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment, or healthcare operations. You may request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care. Your request must state the specific restriction requested and to whom this restriction applies. You may also request restriction of PHI to a health plan with respect to health care for which you have paid for in full out of pocket. The request and payment must occur in writing in advance of the services being provided. The hospital/physician is not required to agree to the restriction that you request, except in the case of a requested restriction of PHI to a health plan for purposes of payment or healthcare operations with respect to health care for which you have paid for in full out of pocket. If the hospital/physician believes that it is in your best interest to permit use and disclosure of your protected health information, it will not be restricted. With this in mind, please discuss any restriction you wish to request with your physician. 

You have the right to request to receive confidential communication from us by alternative means or at an alternative location. We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of any alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please make this request in writing to the privacy contact listed below. 

You have the right to request an amendment to your protected health information. This means that you may request an amendment of protected health information about you in a designated record set for as long a maintain the information. In certain cases, we may deny your request for an amendment. If we deny your request, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy. Please contact the appropriate medical record department if you have questions about amending your medical record. 

You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information. This right applies to disclosures made for purposes outside those for treatment, payment, and healthcare operations. You have the right to receive specific information regarding non routine disclosures that occurred after April 14, 2003. We must respond within sixty (60) days. You may request a shorter timeframe. You are entitled to receive one (1) free accounting each year. There will be a fee for any additional accounting requests during the year. The right to receive this information is subject to certain exceptions, restrictions, and limitations. 

You have the right to obtain a copy of this notice from us. Upon request, you may receive an additional paper or electronic copy of this notice from us. You have the right to receive a notice following a breach of your unsecured PHI. 

6. COMPLAINTS

If you believe your privacy rights have been violated by Baptist Health, you may file a complaint with us by contacting the Baptist Health Privacy Officer at 501-202-1323. You may also file a complaint with the Secretary of Health and Human Services. We will not retaliate against you for filing a complaint. We will not require you to waive the right to file a complaint with HHS as a condition to receive treatment from us. 

7. ADDITIONAL INFORMATION

Notice of Redisclosure. Medical information that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Federal or state law applicable to the recipient may limit their ability to use or disclose the medical information received, such as if they are another health care provider subject to HIPAA or a program or entity subject to Part 2. 

This notice was updated, published and became effective on February 1, 2026. Baptist Health has a duty as your healthcare provider to maintain your privacy, abide by the terms of this privacy notice, and provide you with a revised copy of this notice if revisions are made. 

We reserve the right to change this notice. We reserve the right to make the revised notice effective for protected health information we already have as well as any information we create or receive in the future.

APPENDIX A PART 2 PROGRAM ADDENDUM TO THE NOTICE OF PRIVACY PRACTICES

 (For Substance Use Disorder Treatment Records) 

If you receive services from a Part 2 Program (an identified unit within the Facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment ("SUD services") or medical personnel whose primary function is the provision of SUD services and who is identified as a SUD provider), the federal Confidentiality of Substance Use Disorder Patient Records law (42 U.S.C. 290dd-2) and regulations (42 C.F.R. Part 2) (collectively, "Part 2") protect your substance use disorder treatment records, including the fact that you are enrolled in a Part 2 Program and any other information that would identify you as having or having had a substance use disorder (collectively, "Part 2 Records") 

The Part 2 Program ("we" or "our") complies with Part 2 and will abide by the Part 2 Program Addendum ("Addendum") currently in effect with respect to your Part 2 Records. We also follow the Notice of Privacy Practices ("Notice") to the extent it is more restrictive or provides you with more rights than this Addendum. To the extent other applicable law is more protective than Part 2, we comply with that law.

THE NOTICE AND THIS ADDENDUM DESCRIBE: 

HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED 

YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION 

HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION 

YOU HAVE A RIGHT TO A COPY OF THE NOTICE AND THIS ADDENDUM (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE FACILITY PRIVACY OFFICE AT PRIVACY@BAPTISTHEALTH.ORG OR at 501-202-1323 IF YOU HAVE ANY QUESTIONS. 

HOW THE PART 2 PROGRAM MAY Use and Disclose Part 2 Records Without Your WRITTEN Consent: 

We may use and disclose your Part 2 Records without your written consent under the following circumstances:

Medical Emergencies: We may disclose your Part 2 Records to medical personnel to the extent necessary to meet a bona fide medical emergency and (i) your prior written consent cannot be obtained; or (ii) we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. We will obtain your consent prior to disclosing your information for non-emergency treatment. We may also disclose your Part 2 Records to medical personnel of the Food and Drug Administration (FDA) who assert (i) a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction; and (ii) that your Part 2 Records will be used for the exclusive purpose of notifying you or your physicians of potential danger. 

Scientific Research: Under certain circumstances, we may use and disclose your Part 2 Records without your consent for scientific research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your Part 2 Records for research purposes without your consent to the extent permitted by HIPAA, the FDA and HHS regulations regarding the protection of human subjects. 

Audits and Program Evaluations: Under certain circumstances we may use or disclose your Part 2 Records in connection with a management or financial audit or a program evaluation. For example, in certain situations, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 Program or is authorized by law to regulate the activities of the Part 2 Program. We may also disclose your identifying information to a third-party payer or health plan covering the services provided to you, a quality improvement organization (QIO) performing QIO review of the Part 2 Program or an entity with direct administrative control over the Part 2 Program. 

Public Health: We may disclose Part 2 Records to a public health authority for public health purposes. However, the contents of the information from the Part 2 Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you. 

Qualified Service Organizations (QSOs): We may share Part 2 Records with contractors who provide certain services to us or on our behalf. These contractors are called qualified service organizations or QSOs. Our QSOs are required to agree in writing to protect Part 2 Records. 

Crimes: We may disclose limited information to law enforcement to report a crime or threatened crime on our premises or against our personnel. 

Suspected Child Abuse and Neglect Reports: We may disclose information to the appropriate authorities to report suspected child abuse and neglect as required by state law. 

Adult Patients Who Lack Capacity and Deceased Patients: If an adult patient is adjudicated as lacking capacity or dies, we may disclose the patient's Part 2 Records with the consent of the patient's personal representative. 

Substantial Threat to Life or Well Being: We may disclose facts relevant to reducing a substantial threat to the life or physical well-being of a minor patient or any person to the personal representative of the minor patient if certain conditions are met. 

Vital Statistics: We may disclose patient identifying information relating to a patient's cause of death or death investigation under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death. 

U.S. Department of Health and Human Services (HHS): We must disclose Part 2 Records to the Secretary of HHS if required for an investigation or to determine compliance with Part 2. 

Court Order with Legal Mandate: We may disclose Part 2 Records, or testimony relaying the content of such Part 2 Records, pursuant to a specific court order. Part 2 Records may only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you (the patient) and/or us (the record holder), if required by Part 2. The court order must also be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Record is used or disclosed. 

Fundraising: We may use or disclose your Part 2 Records to fundraise for the benefit of the Part 2 Program, but you have the right to opt-out of receiving fundraising communications from us, as noted in the Notice of Privacy Practices. 

Other Permissible Purposes: We may use or disclose Part 2 Records without your consent as otherwise permitted by Part 2. 

We will only use or disclose your Part 2 Records without your written consent as described in this Addendum. To the extent other applicable law is more protective than Part 2, we comply with that law. 

HOW THE PART 2 PROGRAM May Use and DisclosE Part 2 Records with Your WRITTEN Consent: 

The Part 2 Program may use and disclose your Part 2 Records with written consent that satisfies the requirements of Part 2 as follows: 

Treatment, Payment, and Healthcare Operations (TPO): We may use and disclose your Part 2 Records for TPO purposes, as described in the Notice of Privacy Practices, with your written consent. You may provide a single consent for all future TPO uses or disclosures. For example, you may give us permission to share your Part 2 Records with your treating providers and/or health plans for TPO purposes. Part 2 Records disclosed for TPO purposes to another Part 2 program or an individual/entity subject to the Health Insurance Portability and H-240 NOTICE OF PRIVACY PRACTICES 

Accountability Act (HIPAA) pursuant to your consent may be further disclosed by that Part 2 program or individual/entity subject to HIPAA to the extent permitted by HIPAA, or if the Part 2 Program is not subject to HIPAA, to the extent permitted by your consent. However, your Part 2 Records cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order, as noted below. 

Central Registry or Withdrawal Management Program: We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program with your written consent. For example, if you consent to participating in a drug treatment program, we can disclose your information to the program to coordinate care or to a central registry to avoid duplicate enrollment. 

Criminal Justice System: We may disclose information from your Part 2 Records to persons within the criminal justice system who made your participation in the Part 2 Program a condition of the disposition of any criminal proceeding against you with your written consent. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which your consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which written permission was given. For example, if you consent, we can inform a court-appointed officer, prosecutor or law enforcement about your treatment status as part of a legal agreement or sentencing conditions. 

Prescription Drug Monitoring Program: We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program (PDMP) if required by applicable state law. However, we will obtain your consent prior to reporting such information. 

Legal Proceeding Against a Patient: We will not use or disclose Part 2 Records, or testimony relaying the content of Part 2 Records, in any civil, administrative, criminal, or legislative proceeding against you unless such use or disclosure is pursuant to your specific written consent (separate from consent for any other use or disclosure) or a court order, as described above. 

Designated Person or Entities: We may use and disclose your Part 2 Records in accordance with your written consent to any other person or category of persons identified or generally designated in your consent. For example, if you consent to a disclosure of your Part 2 Records to your spouse or a healthcare provider, we will share your health information with them as outlined in your consent. If you want to revoke (take back) your written consent to use or disclose your Part 2 Records, please send a written request to the Facility Privacy Office listed at the end of this Addendum. 

If you would like an alternative revocation process, please contact the Facility Privacy Office by phone. Your revocation will not apply to the extent we already used or disclosed your Part 2 Records based on your consent. 

PATIENT RIGHTS: 

In addition to the patient rights listed in the Notice of Privacy Practices, you have: 

the right to request restrictions on disclosures of your Part 2 Records for purposes of treatment, payment, and health care operations made with your prior written consent (see our Notice of Privacy Practices for when we are required to agree to your request); the right to request a list of Part 2 Record disclosures by an intermediary for the prior 3 years, including information about who received your records, the date of the disclosure, and a brief description of the information that was disclosed; and the right to discuss the Notice of Privacy Practices or this Part 2 Program Addendum with the Facility Privacy Office. To exercise these rights, please submit a written request to the Facility Privacy Office listed at the end of this Addendum.