NOTICE OF PRIVACY PRACTICES
Effective Date: July 1, 2026 | Version 2.0 | Reviewed Annually
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Vital Mobility Foot & Ankle Care, PLLC ("Vital Mobility," "we," or "our") is an independent direct-pay podiatric practice. We do not take, bill, or work with commercial insurance, Medicare, or Medicaid. We are committed to protecting your health information and fully following the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and all other state and federal laws that apply.
This Notice applies to all health information we create, receive, keep, or send in any form — paper, electronic, or spoken. We give you a copy of this Notice at your first visit, post it in our office, and post it at www.vital-mobility.com. You can ask for a printed copy at any time at no charge.
YOUR RIGHTS AS A FLORIDA PATIENT
Florida Patient's Bill of Rights and Responsibilities
As a patient receiving care in Florida, you have the right to be treated with courtesy and respect, with appreciation for your individual dignity, and with protection of your privacy. You can get a full copy of the Florida Patient's Bill of Rights and Responsibilities by asking us, and it's posted in our office. Key rights include:
• The right to receive care regardless of race, national origin, religion, disability, sex, sexual orientation, or source of payment
• The right to know the name, credentials, and role of every person involved in your care
• The right to receive a clear explanation of your diagnosis, treatment options, and expected outcomes in plain language
• The right to make decisions about your care, including the right to refuse treatment, to the extent permitted by law
• The right to an itemized bill and, upon request, an explanation of any charge
• The right to file a complaint without fear of retaliation or interference with your care
• The right to have your health information kept private and secure, as described in this Notice
HOW WE PROTECT YOUR HEALTH INFORMATION
We maintain administrative, physical, and technical safeguards to protect your health information consistent with HIPAA's Privacy and Security Rules:
Administrative Safeguards: Every staff member gets HIPAA privacy and security training every year before they can access patient information. Access to health records is based on each person's role, and only staff who need the information for their job can see it. We do a Security Risk Assessment (SRA) at least once a year, or whenever our technology or operations change significantly.
Physical Safeguards: We keep patient records — paper and electronic — in locked cabinets or password-protected systems. Computer screens in clinical areas face away from public view. Our sign-in sheets do not show patient diagnoses or other sensitive information. We shred paper records with PHI instead of putting them in regular trash or recycling.
Technical Safeguards: We protect electronic health information with access controls, encryption (both while it's sent and while it's stored, where applicable), automatic logoff, and activity logs. We check any software or cloud platform that stores or handles patient information for HIPAA compliance, and we sign a Business Associate Agreement (BAA) before using it.
Incidental Disclosures: Even with these precautions, some accidental exposure can happen in a clinical setting — for example, a staff member may say your name out loud when calling you back to an exam room. HIPAA allows this kind of incidental disclosure as long as we use reasonable safeguards, which we do.
De-Identified Information: Information that has had all 18 HIPAA patient identifiers removed is no longer considered protected health information, and this Notice does not apply to it.
PERMITTED USES AND DISCLOSURES OF YOUR HEALTH INFORMATION
We can use or share your health information without your written permission for the reasons below.
Treatment: We use and share your health information to provide, coordinate, and manage your podiatric care and related services. This includes sharing information with other treating providers, specialists, physical therapists, labs, imaging centers, hospitals (including AdventHealth Tampa, where Dr. Dwarampudi holds active surgical and wound care privileges), and pharmacies involved in your care. Staff can only see what they need for their role.
Payment: Because this is a direct-pay practice, we use your health information only to collect payment directly from you for services. We do not bill insurance companies, Medicare, or Medicaid for you. We may share payment information with our payment processor and practice management system as needed to process your payment.
Health Care Operations: We use and share health information to improve quality of care and document your visits. To give you focused, attentive visits, this practice uses a secure AI documentation tool built into our HIPAA-compliant medical record system, Hint Health. This tool helps write your visit notes — so Dr. Dwarampudi can focus on you instead of typing during your visit. Dr. Dwarampudi reviews and approves every note before it becomes part of your chart. The AI only helps with notes — Dr. Dwarampudi makes all medical decisions. We obtain your written consent before this tool is used in your care, as Florida law requires.
Appointment Reminders & Care Follow-Up: We may contact you by phone, text, voicemail, email, or mail to remind you of appointments, share test results, or follow up on your care. You can tell us your preferred contact method at any time. Text messages are subject to your phone carrier's normal rates.
Emergencies: In a medical emergency, we may share your health information with emergency responders, treating providers, or a family member or emergency contact, about your location, condition, or death. When we can, we'll ask you first. If you can't respond, we use our best professional judgment and only share what's directly needed for your immediate care.
Required by Law: We will share your health information when a valid federal or Florida law requires it — including court orders, subpoenas, and other official legal process where you were properly notified.
Public Health & Safety: In accordance with applicable law, we may disclose health information for public health purposes, including:
• Reporting communicable diseases to the Florida Department of Health
• FDA product recall and adverse event reporting
• Mandatory reporting of suspected child abuse or neglect
• Mandatory reporting of abuse of elderly or vulnerable adults
• Preventing or reducing a serious and imminent threat to health or safety
Sensitive Health Information: The categories below get extra protection and need additional permission, or must strictly follow specific laws, before we can share them:
• HIV/AIDS test results and related records — protected by applicable federal and Florida law
• Mental health records — protected by applicable federal and Florida mental health law
• Substance use disorder treatment records — protected by applicable federal and Florida law
• Genetic information — protected by applicable federal and Florida law
• Psychotherapy notes — require separate written authorization for most uses and disclosures
Research: We do not use or share your identifiable health information for research without your written permission, or approval from an Institutional Review Board (IRB) or Privacy Board, except in the limited cases HIPAA allows.
Clinical Photography & Images: Photos, videos, or clinical images taken as part of your care (like wound photos) are part of your chart and treated as protected health information. We never use them for marketing, social media, or teaching without your separate, clear written permission.
Social Media: We never post, share, or mention any patient information, photos, or identifying details on social media or public platforms — with or without your name — unless you give us clear written permission.
Workers' Compensation: We may disclose your health information as required or permitted by Florida workers' compensation laws and similar programs.
Law Enforcement & Government Requests: We may share health information with law enforcement and health oversight agencies when the law requires or allows it, and for authorized government functions like military, national security, and public safety.
Business Associates: Vendors and services that work on our behalf — like billing, IT, cloud storage, our EHR, and lab connections — are our "Business Associates." Each one must sign a HIPAA Business Associate Agreement (BAA) and is contractually required to protect your health information.
Deceased Patients: HIPAA privacy protections apply to a deceased patient's health information for 50 years after death. Sharing records with a personal representative or next-of-kin follows Florida law and HIPAA requirements.
Practice Closure or Transfer: If this practice closes, is sold, or changes ownership, patient records will be transferred or disposed of in a way that follows the law. We will notify you and give you the chance to get copies of your records.
USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION
Any use or sharing not described in this Notice needs your written permission first. We will never sell your health information. We will never use your health information for marketing, fundraising, or advertising without your separate written permission. You can cancel any permission you've given, at any time, in writing. Canceling does not undo anything we already did while relying on your earlier permission. Keep in mind that information shared under your written permission could be shared again by whoever receives it — and once that happens, it may no longer be protected by this Notice or by HIPAA.
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
Right to Access Your Records: You have the right to look at and get a copy of your protected health information that we keep, within legal limits. Send your written request to our Privacy Officer. Under HIPAA, we will generally respond within 30 calendar days of receiving your request; in limited cases, the law allows us up to 30 more days. Florida law requires us, as the record owner, to provide copies of medical records promptly and without unreasonable delay. We may charge a reasonable, cost-based fee for copies, as the law allows. We verify your identity before releasing any records.
Electronic Access to Health Information: If we keep your protected health information electronically, you can request access to, or a copy of, your electronic health information under federal law. This practice supports appropriate access, sharing, and use of electronic health information and does not engage in prohibited information blocking. We may rely on the exceptions allowed under federal information-blocking rules.
Right to Request Amendment: You can ask us to correct health information that is wrong or incomplete. Your request must be in writing and explain why. We will respond within 60 days (we're allowed one 30-day extension). We may say no if the information is accurate and complete, wasn't created by us, or another legal exception applies. Approved corrections are added as notes; we cannot delete the original entry.
Right to an Accounting of Disclosures: You can ask for a list of the times we shared your health information over the past six years, not counting sharing for treatment, payment, or operations. We provide one list per year for free; a cost-based fee may apply if you ask again within 12 months.
Right to Request Restrictions: You can ask us to limit certain uses or sharing of your information. We must agree to restrict sharing with a health plan for payment or operations if you paid in full out of pocket and no law requires the report. We put all agreed restrictions in writing.
Right to Confidential Communications: You can ask us to contact you only in a certain way or at a certain place — for example, cell phone only, or a work address. Send written requests to our Privacy Officer — you don't need to give a reason. We will accommodate all reasonable requests.
Right to Receive a Notice: You have the right to a copy of this Notice at your first visit and whenever we make an important change. This Notice is also posted in our office and at www.vital-mobility.com.
Acknowledgment of Receipt: At your first visit, we'll ask you to sign to confirm you received this Notice. If you don't want to sign, we will document that we made a good-faith effort to get your acknowledgment, as HIPAA requires.
Personal Representatives & Minors: We honor the rights of authorized personal representatives — health care surrogates or court-appointed guardians — once we verify their authority. For minors, parents and legal guardians generally have access to records. However, Florida law lets certain minors consent on their own to some services — including STI testing, certain mental health services, and contraceptive care — and records from those visits may need the minor's own permission before we release them to a parent.
Breach Notification: If we discover a breach of your unsecured health information, we will notify you within 30 days as Florida's FIPA law requires, and within 60 days as HIPAA requires. We'll send notice by first-class mail, or electronically if you've agreed to that. Large breaches (500 or more people) are also reported to HHS/OCR and, when required, to Florida authorities.
Language Access: If you need this Notice or other materials in Spanish or another language, let our office know. We will make a reasonable effort to provide translation help or translated materials.
MEDICAL RECORD RETENTION
Our practice keeps medical records according to federal law, Florida law, and the rules for Florida-licensed health care providers.
Unless a different rule applies, we keep records for at least five (5) years after your last appointment.
Medical records include notes written by the physician or staff, information you provide, diagnostic records like X-rays, reports, and related billing documents.
We may keep records longer because of professional standards, legal requirements, malpractice insurance recommendations, or our own internal policies.
We may keep records for minor patients longer, based on practice policy and legal requirements.
We keep records of deceased patients for the same period described above, counted from their last appointment, or for at least two (2) years after death — whichever is longer.
After the required retention period ends, we destroy records by secure shredding or certified electronic destruction that prevents anyone from reconstructing them, protecting your privacy.
ELECTRONIC COMMUNICATIONS
Unsecured channels — like standard email or text messages — carry risks, including interception, being sent to the wrong person, access from a shared device, or storage on an unsecured platform. We recommend using our secure patient messaging portal for anything containing health information. If you choose to contact us through an unsecured channel, you're accepting these risks. You can withdraw your consent to unsecured communication at any time by telling our Privacy Officer in writing.
PRIVACY OFFICER AND ANNUAL REVIEW
Dr. Aparna Dwarampudi, DPM is the sole provider and Privacy Officer of Vital Mobility Foot & Ankle Care, PLLC. As Privacy Officer, she reviews our HIPAA privacy and security policies every year, keeps us in compliance with federal and Florida law, and makes sure any vendor or business associate with access to protected health information has a signed Business Associate Agreement. We review and update this Notice at least once a year.
QUESTIONS, COMPLAINTS, AND REGULATORY CONTACTS
If you believe we violated your privacy rights, or you disagree with a decision we made about your health information, you can file a written complaint with our Privacy Officer. You can also file a complaint with:
• U.S. Department of Health & Human Services, Office for Civil Rights (OCR)
200 Independence Ave SW, Washington, DC 20201 | hhs.gov/ocr | 1-800-368-1019
• Florida Department of Health
4052 Bald Cypress Way, Tallahassee, FL 32399 | floridahealth.gov | (850) 245-4444
• Florida Agency for Health Care Administration (AHCA)
2727 Mahan Dr, Tallahassee, FL 32308 | ahca.myflorida.com | (888) 419-3456
We will not retaliate against you in any way for filing a complaint with us or with any regulatory authority. All complaints are handled confidentially.
CHANGES TO THIS NOTICE
We can revise this Privacy Notice at any time. Any revised Notice applies to all health information we keep, even information created before the revision. We will post the updated Notice in our office and at www.vital-mobility.com with a new effective date. You can request a printed copy.
PRIVACY OFFICER CONTACT INFORMATION
Dr. Aparna Dwarampudi, DPM — Privacy Officer
Vital Mobility Foot & Ankle Care, PLLC
17929 Hunting Bow Circle, Suite 101, Lutz, FL 33558
Phone: (813) 725-9226
Email: info@vital-mobility.com
© 2026 Vital Mobility Foot & Ankle Care, PLLC. All rights reserved.