Notice of Privacy Practices

Effective date: September 23, 2026

---

Overview

Coastal Primary Care and Wellness, LLC (“Coastal,” “we,” “us”) is required by law to protect the privacy of your protected health information, to give you this notice describing our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

Protected health information, or PHI, means information that identifies you and relates to your health, your care, or payment for your care. This notice applies to all PHI we create or receive, including records held in our electronic health record system.

Treatment, payment & operations

We may use and share your information without your written authorization for the following purposes:

• Treatment — to provide, coordinate, or manage your care. For example, we may share your results with a laboratory, send a prescription to a pharmacy, or discuss your care with a specialist you have been referred to.
• Payment — to bill and collect for the care you receive, including membership billing and processing payments.
• Health care operations — to run our practice, review the quality of care we provide, train staff, and carry out administrative activities.

Appointments & reminders

We may contact you by phone, text message, email, or through the patient portal to remind you of an appointment, to follow up on your care, or to tell you about treatment options or health services that may interest you. If you would prefer we contact you a different way, or not at all for these purposes, tell us and we will accommodate reasonable requests.

We do not use your protected health information for fundraising.

Uses requiring your authorization

Some uses and disclosures require your written authorization. These include most uses of psychotherapy notes, most marketing communications, and any sale of your protected health information.

You may revoke an authorization at any time in writing, except to the extent we have already acted on it. Any use or disclosure not described in this notice will be made only with your written authorization.

Other permitted disclosures

Federal law permits or requires us to share your information in certain other circumstances, and we will do so only as the law allows:

• Public health and safety — to prevent disease, report reactions to medications or problems with products, or help with product recalls.
• Abuse or neglect — to report suspected abuse, neglect, or domestic violence.
• Serious threats — to prevent a serious and imminent threat to your health and safety or that of others.
• Health oversight — for audits, investigations, inspections, and licensure activities by agencies that oversee the health care system.
• Required by law — where federal, state, or local law requires the disclosure.
• Judicial and administrative proceedings — in response to a court or administrative order, subpoena, or other lawful process.
• Law enforcement — for limited law enforcement purposes permitted by law.
• Coroners, medical examiners, and funeral directors — so they may carry out their duties.
• Organ and tissue donation — to organizations that handle procurement or transplantation.
• Research — where an institutional review board has approved the research and applicable privacy protections are in place.
• Workers’ compensation — for claims that fall under workers’ compensation laws.
• Military, veterans, and national security — for activities authorized by law, including for members of the armed forces.
• Correctional institutions — if you are an inmate, to the institution or a law enforcement official as permitted by law.

State law

We care for patients in Florida, Georgia, and North Carolina. Where state law gives your information greater protection than federal law, or gives you broader rights, we follow the state law. Some categories of information — for example, mental health, substance use treatment, HIV status, and genetic information — may carry additional protections.

Your rights

You have the following rights regarding your protected health information. To exercise any of them, contact our Privacy Officer using the details at the end of this notice.

• Get a copy of your health and billing records. We will usually respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct records you believe are incorrect or incomplete. We may deny your request, and if we do we will tell you why in writing within 60 days.
• Request confidential communications — for example, asking us to contact you at a specific phone number or address. We will say yes to all reasonable requests.
• Ask us to limit what we use or share. We are not required to agree in every case. However, if you pay for a service in full out of pocket, you may ask us not to share that information with a health plan, and we will agree unless a law requires the disclosure.
• Get a list of disclosures we have made of your information for the six years before the date you ask. This list will not include disclosures for treatment, payment, and health care operations, or certain other disclosures. We will provide one list free of charge in any 12-month period.
• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you — a legal guardian or someone with medical power of attorney may exercise these rights on your behalf once we have confirmed their authority.
• Be notified if a breach occurs that may have compromised the privacy or security of your information.

Our responsibilities

We are required by law to maintain the privacy and security of your protected health information, to notify you promptly if a breach occurs that may have compromised it, and to follow the duties and privacy practices described in this notice and give you a copy of it.

We will not use or share your information other than as described in this notice unless you tell us in writing that we may.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the details below. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Online: OCR Complaint Portal
• By mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, D.C. 20201
• By phone: 1-800-368-1019 (TDD 1-800-537-7697)
• By email: OCRComplaint@hhs.gov  |  By fax: 202-619-3818

Complaints should be filed within 180 days of when you knew or should have known that the act or omission occurred.

We will not retaliate against you for filing a complaint.

Changes to this notice

We reserve the right to change the terms of this notice at any time, and to make the new terms effective for all protected health information we maintain, including information created or received before the change. The revised notice will be available at our office and on this page, with the new effective date shown at the top.

Privacy Officer

Coastal Primary Care and Wellness, LLC has designated a Privacy Officer who is responsible for this notice and for handling privacy requests and complaints. To exercise any of the rights described above, or to ask a question about this notice, contact:

Coastal Primary Care and Wellness, LLC
Attn: Privacy Officer
Phone: 813-678-6063
Email: info@coastalprimarycare.com
Fax: 813-742-4942

Please do not include protected health information in an email or web form. If you are an established patient, use the patient portal for anything involving your health information.