Privacy Policy & HIPAA Notice

Our Legal Duty

Serenelle Living, LLC (“we,” “our,” or “us”) is a home health care services organization operating in the State of Florida, subject to HIPAA (45 CFR Parts 160 and 164), the Florida Medical Records Act (Fla. Stat. §456.057), and AHCA licensing regulations. We are required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice of our legal duties and privacy practices with respect to PHI.

We are required to abide by the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new Notice effective for all PHI that we maintain.

How We Use & Disclose Your PHI

The following uses and disclosures are permitted without your written authorization:

• Treatment: We share PHI among care coordinators, field staff, and treating clinicians to coordinate and provide care services.
• Payment: We may use and disclose PHI to bill and collect payment from you, your insurer, Medicaid, or other responsible parties.
• Healthcare Operations: We use PHI for quality assessment, compliance, training, and business management activities.
• Required by Law: We disclose PHI when required by federal, Florida state, or local law (including mandatory abuse, neglect, and exploitation reporting under Fla. Stat. §39.201 and §415.1034).
• Public Health & Safety: We may report to the Florida Department of Health (FDOH) or AHCA as required.
• Abuse & Neglect Reporting: As required by Florida law, we report suspected abuse, neglect, or exploitation of clients to the Florida DCF Abuse Hotline (1-800-962-2873).
• Business Associates: We share PHI with vendors (including our software platform) under signed Business Associate Agreements (BAAs).

Your Rights Regarding Your PHI

You have the following rights regarding your health information:

• Right to Access: You may request access to and copies of your medical records within 30 days (or 60 days if offsite). Florida law (Fla. Stat. §456.057) may provide additional access rights.
• Right to Amend: You may request correction of inaccurate or incomplete PHI.
• Right to an Accounting of Disclosures: You may request a list of disclosures of your PHI made in the last 6 years.
• Right to Request Restrictions: You may request that we limit how we use or disclose your PHI (we are not required to agree except for self-pay restrictions).
• Right to Confidential Communications: You may request that we communicate with you at a specific address or in a specific way.
• Right to a Paper Copy of this Notice: You may request a paper copy of this Notice at any time.
• Right to Revoke Authorization: You may revoke any written authorization you have given us, except to the extent we have already acted on it.

Breach Notification

In the event of a breach of unsecured PHI, we will notify affected individuals within 60 days of discovery as required by the HIPAA Breach Notification Rule (45 CFR §§164.400–414) and the Florida Information Protection Act (Fla. Stat. §501.171). If the breach affects 500 or more Florida residents, we will also notify the Florida Attorney General and HHS.

Security Safeguards

• Role-based access controls — staff access only what is necessary for their role (minimum necessary standard)
• Automatic session timeout after 15 minutes of inactivity in the staff portal
• All PHI access and modifications are logged with timestamps and user identification
• Encrypted data transmission (TLS/HTTPS) for all data in transit
• Business Associate Agreement (BAA) in place with our technology platform provider
• Annual HIPAA Security Risk Assessments conducted
• Staff HIPAA training completed prior to PHI access

Complaints & Contact

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health & Human Services (HHS). We will not retaliate against you for filing a complaint.