Notice of Privacy Practices

Effective Date: 18/08/2026

Your Information. Your Rights. Our Responsibilities.

This Notice of Privacy Practices describes how medical information about you may be used and disclosed and how you can obtain access to that information.

Please review this notice carefully.

At Nestor de la Cruz-Munoz, MD, FACS we understand that information about your health is personal. We are committed to protecting the privacy and security of your protected health information (“PHI”) and to complying with applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

This notice applies to the healthcare services provided by our practice and describes our privacy practices concerning your PHI.

YOUR RIGHTS

When it comes to your health information, you have certain rights.

1. Get a Copy of Your Medical Record

You have the right to inspect and obtain a copy of your medical record and other health information maintained by our practice, subject to applicable legal limitations.

You may request your records in paper or electronic form when available.

We will generally provide a copy or summary of your health information within the timeframe required by applicable law.

We may charge a reasonable, cost-based fee where permitted by law.

2. Ask Us to Correct Your Medical Record

If you believe that information in your medical record is incorrect or incomplete, you may request that we correct or amend the information.

We may deny a request when permitted by law. If we deny your request, we will provide you with a written explanation.

3. Request Confidential Communications

You may ask us to contact you in a specific way or at a particular location.

For example, you may request that we:

Contact you at a particular telephone number.
Contact you by email.
Send correspondence to a specific mailing address.
Avoid contacting you at a particular location.

We will consider reasonable requests as required by applicable law.

4. Ask Us to Limit What We Use or Share

You may request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations.

We are not required to agree to every restriction request.

However, if you pay for a healthcare service or item completely out of pocket and request that information concerning that service or item not be disclosed to your health plan for payment or healthcare operations, we will generally honor that request unless disclosure is otherwise required by law.

5. Get a List of Certain Disclosures

You have the right to request an accounting of certain disclosures of your PHI made by us during the applicable period specified by HIPAA.

The accounting does not include certain disclosures, including disclosures made for treatment, payment, or healthcare operations and certain other disclosures excluded by law.

6. Get a Copy of This Notice

You have the right to receive a paper copy of this notice at any time.

You may also access the current notice through our website.

7. Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices regarding your health information to the extent permitted by law.

We will verify the person’s authority before taking action.

8. File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with our practice or with the U.S. Department of Health and Human Services Office for Civil Rights.

You will not be retaliated against for filing a complaint.

OUR RESPONSIBILITIES

We are required by law to:

Maintain the privacy and security of your PHI.
Provide you with this notice describing our legal duties and privacy practices.
Follow the terms of the notice currently in effect.
Notify you as required by law if a breach occurs that compromises the privacy or security of your unsecured PHI.
Not use or disclose your PHI except as permitted or required by law or as described in this notice.
Obtain your written authorization when required before using or disclosing your PHI.

We reserve the right to change our privacy practices and this notice.

If we make a material change to our privacy practices, we will update this notice and make the revised notice available as required by law.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following sections describe some of the circumstances in which we may use or disclose your PHI without obtaining your written authorization.

Treatment

We may use or disclose your PHI to provide, coordinate, or manage your healthcare and related services.

For example, we may share relevant information with physicians, surgeons, nurses, specialists, hospitals, laboratories, pharmacies, or other healthcare professionals involved in your care.

Payment

We may use or disclose your PHI to obtain payment for healthcare services we provide.

This may include communicating with your health insurance company or other payer regarding eligibility, coverage, claims, billing, or payment.

Healthcare Operations

We may use or disclose your PHI as necessary to conduct our healthcare operations.

Healthcare operations may include activities such as:

Quality assessment and improvement.
Reviewing the performance of healthcare professionals.
Training and education.
Credentialing.
Auditing.
Compliance activities.
Business planning.
Patient safety activities.
Case management.
Other activities permitted under HIPAA.

Appointment Reminders and Health-Related Communications

We may use or disclose your PHI to contact you regarding appointments, treatment-related matters, healthcare services, or other communications permitted by HIPAA.

Communications may occur by telephone, voicemail, text message, email, mail, or other communication methods you have provided, subject to applicable law and our practices.

Individuals Involved in Your Care

We may disclose relevant PHI to a family member, close personal friend, or another person identified by you when that person is involved in your healthcare or payment for your healthcare, unless you object or another legal restriction applies.

We may also make certain disclosures to individuals involved in your care when permitted by HIPAA.

Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities

We may disclose PHI for public health activities permitted or required by law, including activities involving:

Preventing or controlling disease.
Reporting certain diseases or conditions.
Reporting adverse events or product problems.
Public health investigations.
Food and drug safety.
Other activities authorized by law.

Abuse, Neglect, or Domestic Violence

We may disclose PHI to appropriate government authorities when permitted or required by law to report suspected abuse, neglect, or domestic violence.

Health Oversight

We may disclose PHI to appropriate government agencies for activities authorized by law involving oversight of the healthcare system, government programs, and compliance with applicable laws.

Legal Proceedings

We may disclose PHI in response to a court order, administrative proceeding, subpoena, discovery request, or other lawful process when the requirements of applicable law are satisfied.

Law Enforcement

We may disclose PHI to law enforcement officials when permitted or required by applicable law and under the circumstances established by HIPAA.

Coroners and Medical Examiners

We may disclose PHI to a coroner or medical examiner when necessary to perform legally authorized duties.

Funeral Directors

We may disclose PHI to funeral directors as permitted by law to assist them in carrying out their duties.

Organ and Tissue Donation

We may use or disclose PHI for organ, eye, or tissue donation and transplantation purposes when permitted by law.

Workers’ Compensation

We may disclose PHI as necessary to comply with workers’ compensation laws and other similar programs established by law.

Serious Threats to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, when permitted by law.

Specialized Government Functions

We may disclose PHI for certain specialized government functions, including authorized military, national security, intelligence, protective services, and correctional institution activities when permitted by law.

Research

We may use or disclose PHI for research purposes when permitted by applicable law and appropriate privacy protections are in place.

USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION

Certain uses and disclosures of PHI generally require your written authorization.

These may include:

Most uses and disclosures of psychotherapy notes when applicable.
Uses and disclosures for marketing when an authorization is required.
Sale of PHI when an authorization is required.
Other uses and disclosures for purposes not otherwise described in this notice when authorization is required by law.

If you provide written authorization, you may generally revoke that authorization in writing at any time to the extent permitted by law.

Revocation does not affect actions already taken in reliance on your authorization.

MARKETING AND SALE OF HEALTH INFORMATION

We will obtain your written authorization when required by HIPAA before using or disclosing your PHI for marketing purposes.

We will also obtain authorization when required before selling your PHI.

Certain communications about treatment, health-related products, or services may not constitute marketing under HIPAA and may be permitted without authorization.

FUNDRAISING

If we conduct fundraising activities using PHI, we will comply with applicable HIPAA requirements concerning fundraising communications and your right to opt out where applicable.

YOUR CHOICES

In certain situations, you may have choices about how we communicate with you or disclose your PHI.

For example, you may:

Ask us to communicate with you using a particular method.
Ask us to communicate with you at an alternative location.
Tell us whether you object to certain disclosures to people involved in your care.
Request restrictions on certain disclosures as described above.

SUBSTANCE USE DISORDER RECORDS

Certain substance use disorder patient records may receive additional privacy protections under federal law, including 42 U.S.C. § 290dd-2 and 42 CFR Part 2, when applicable.

Where these protections apply, we will handle such records in accordance with applicable federal requirements.

If our practice maintains records subject to Part 2, additional requirements may apply to the use and disclosure of those records.

OUR PRIVACY AND SECURITY PRACTICES

We maintain administrative, physical, and technical safeguards designed to protect PHI from unauthorized access, use, disclosure, alteration, or destruction.

We limit access to PHI to individuals who require access to perform their authorized duties.

We also require appropriate protections from applicable service providers and business associates that create, receive, maintain, or transmit PHI on our behalf.

No security system can guarantee absolute security. We nevertheless maintain safeguards designed to protect the confidentiality, integrity, and availability of your PHI.

BREACH NOTIFICATION

If we discover a breach of unsecured PHI that requires notification under applicable law, we will provide notice as required by HIPAA and other applicable laws.

Notifications may include information about what happened, the information involved, steps you can take to protect yourself, and measures we are taking to investigate and address the incident.

COMPLAINTS

If you believe that your privacy rights have been violated, you may submit a complaint to us.

Privacy Contact:
Name: Nestor de la Cruz-Munoz, MD, FACS
Address: 3683 S Miami Ave Suite 500 Miami, Fl 33133
Phone: 305-285-5092
Email: Maria.Matuk@HCAhealthcare.com

You may also file a complaint with the:

U.S. Department of Health and Human Services
Office for Civil Rights

You can obtain information about filing a complaint through the HHS Office for Civil Rights.

We will not retaliate against you for filing a complaint.

CHANGES TO THIS NOTICE

We reserve the right to change the terms of this Notice of Privacy Practices.

Any revised notice will apply to PHI that we already maintain as well as information we receive in the future, to the extent permitted by law.

The current version of this notice will be available on our website and upon request at our practice.

QUESTIONS ABOUT THIS NOTICE

If you have questions about this Notice of Privacy Practices or our privacy practices, please contact:

Nestor de la Cruz-Munoz, MD, FACS
Address: 3683 S Miami Ave Suite 500 Miami, Fl 33133
Phone: 305-285-5092
Email: Maria.Matuk@HCAhealthcare.com