SMILE-FX ORTHODONTIC & CLEAR ALIGNER STUDIO
NOTICE OF PRIVACY PRACTICES
Effective September 1 2025 (supersedes all prior versions)
Why You Are Receiving This Notice
We create and store a record of the care and services you receive. That record contains protected health information (PHI)—identifiable details about your past, present, or future physical or mental health and related services or payment. Examples of PHI include your name, contact details, appointment history, treatment plans, X-rays, billing and insurance information, photographs, and any other identifiers linked to your health.
Federal law (HIPAA), Florida law—including the Florida Digital Bill of Rights—and other regulations require us to give you this Notice, follow it, and tell you if we change it.
We protect your information under the minimum-necessary standard, encrypt data in transit and at rest, and require every vendor that handles PHI—including cloud storage, AI tools, EHR, CRM, billing, scheduling, marketing, and tele-orthodontic platforms—to sign a Business Associate Agreement (BAA) and pass a security risk assessment.
1. Your Rights
You have the right to:
- Receive a copy of this Notice in paper or electronic form (English, Spanish, large-print, Braille, or other accessible formats upon request).
This means we will give you this notice whenever you ask—at the front desk, by mail, email, or download link.
- Access your PHI—including an electronic copy—or direct us to transmit it to a person, service, or app of your choice; reasonable cost-based fees may apply.
This means you can review or download your entire record and have us send it securely to another provider, caregiver, or health app.
- Request confidential communications (e.g., alternate address, email, or text).
This means you can tell us to reach you at a different address or phone number or by another method and we will honor reasonable requests.
- Understand and accept the risks of digital messaging (SMS, email) and give or withdraw consent at any time.
This means unencrypted email or text may be intercepted; you decide whether we may use these channels and can change your mind later
- Ask us to limit what we share, including withholding information from your health plan when you pay out-of-pocket in full for a service.
This means you can request restrictions on certain uses or disclosures. We must agree when you have paid for a service yourself and ask us not to bill your plan.
- Request an amendment if you believe your record is incorrect or incomplete.
This means you may ask us to add missing information or correct errors. If we deny your request, we will explain why in writing.
- Obtain one free list every 12 months of certain disclosures we have made.
This means you can receive a report of when, why, and to whom we shared your PHI outside our practice, except for routine care, payment, and operations.
- Receive written notice of a breach of unsecured PHI without unreasonable delay and no later than 60 days. If 500 or more Floridians are affected, we will also notify the Florida Attorney General.
This means we will alert you promptly if your information is compromised, describing what happened, what was involved, and how to protect yourself.
- Authorize any other use or disclosure of your PHI that is not covered in this Notice, and revoke that authorization at any time in writing except to the extent we have already relied on it.
This means marketing, sale of PHI, or sharing psychotherapy notes requires your signed permission, which you can later withdraw.
- File a complaint with our Privacy Officer or with the U.S. Department of Health & Human Services Office for Civil Rights (OCR) without retaliation.
This means you may voice concerns if you think your privacy rights were violated, and we cannot penalize you for doing so.
2. How We May Use & Disclose Information
We typically use or share your PHI in these ways without additional authorization:
- Treatment – with dentists, physicians, pharmacies, labs, and other providers involved in your care (including secure health-information exchanges).
- Payment – to obtain prior authorization, verify coverage, bill, and collect payment.
- Healthcare Operations – quality improvement, audits, legal services, training, business planning, and patient-safety activities.
- Appointment Reminders and Treatment Alternatives – via phone, mail, portal, email, or text unless you opt out.
- Fund-Raising – we may contact you; each message will explain how to opt out by calling 954-824-9707 or emailing [email protected]. Opt-out requests are honored within 10 business days.
- Business Associates – vendors such as billing services, cloud hosting, and AI analytics or AI simulation services who are bound by BAAs.
- Health Information Organizations and Patient Portals – secure electronic exchange to support care; you may opt out by written request.
- Parents & Minors – parents or guardians generally access a minor’s PHI except where Florida law allows the minor to consent to their own care.
- Reproductive-Health PHI – we will not disclose PHI for identifying, investigating, or prosecuting lawful reproductive-health care without your signed attestation.
- Genetic Information – we do not use or disclose genetic data for underwriting or discriminatory purposes.
- Sale/Marketing and Online Tracking – we do not sell your PHI and do not allow ad-tracking technologies on PHI-collecting pages unless the vendor has a BAA or you have authorized it.
- Other Required or Permitted Disclosures – public-health reporting, abuse/neglect, FDA, research (with safeguards), law enforcement, legal proceedings, workers’ compensation, military/national security, correctional institutions, and as otherwise required by federal or Florida law.
3. Your Choices
You may tell us “no” if we intend to:
- Include your information in a hospital or clinic directory.
- Disclose information to family, friends, or others involved in your care.
- Contact you for fund-raising.
- Share PHI for marketing or with non-BAA third-party tracking tools.
4. Our Responsibilities
- Maintain the privacy and security of PHI under HIPAA, Florida law, and this Notice.
- Limit PHI access to authorized workforce members who have a job-related need and ensure all staff receive annual HIPAA and data-privacy training.
- Promptly notify you of any reportable breach. Certain incidents—such as unintentional access by a workforce member or disclosures with a low probability of compromise, as assessed under HIPAA’s four-factor standard—may not constitute a reportable breach.
- Follow the duties and privacy practices described here and update the Notice at least annually.
- Not use or share your information for reasons other than those described here unless you give written permission, which you may revoke at any time.
5. Digital Communications & Portals
By signing our Digital Communication Consent, you authorize SMILE-FX to communicate via e-mail, SMS/text, or other electronic means you select. We use secure platforms, but unencrypted channels may carry a risk of unauthorized access. You may change or withdraw your consent at any time.
6. Security Statement
SMILE-FX uses encryption, multi-factor authentication, role-based access, annual workforce training, and continuous security-risk assessments to safeguard electronic PHI. We align with the HIPAA Security Rule, NIST SP 800-53 controls, and Florida Information Protection Act (FIPA) requirements.
7. Changes to the Terms of This Notice
We may change this Notice, and the new terms will apply to all PHI we hold. We will post the updated Notice at our office, on our website, and offer you a copy on request. The revision history and effective date appear at the top of each version. For information on how we collect and use data on our website—including cookies and analytics—please see our Website Privacy Policy at www.smile-fx.com/privacy.
8. Contact & Complaints
Privacy Officer
SMILE-FX Orthodontic & Clear Aligner Studio
11225 Miramar Pkwy, Suite 285
Miramar, FL 33025
Tel: 954-824-9707
Email: [email protected]
You may also contact the U.S. Department of Health & Human Services Office for Civil Rights,
200 Independence Ave SW, Washington DC 20201, 1-800-368-1019, or visit
hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate for filing a complaint