Notice of Privacy Practices

Spark Pediatrics PPEC
Effective Date: August 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOUR CHILD MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Spark Pediatrics PPEC is a Prescribed Pediatric Extended Care center serving medically complex children in Florida. We are required by law to maintain the privacy of your child's protected health information ("PHI"), to provide you with notice of our legal duties and privacy practices, and to notify you if there is a breach of unsecured PHI. This Notice describes how we may use and disclose your child's health information and explains your rights as a parent or legal guardian.

This Notice applies to all Spark Pediatrics PPEC locations and to all workforce members, contractors, and volunteers acting on our behalf.

1. How We May Use and Disclose Your Child's Health Information

1.1 Uses and Disclosures for Treatment, Payment, and Health Care Operations

We may use and disclose your child's PHI without your written authorization for the following purposes:

Treatment. We use your child's health information to provide, coordinate, and manage care. This includes sharing information with physicians who ordered care, therapists, nurses, specialists, hospitals, and other providers involved in your child's treatment. For example, we may send clinical notes to your child's pulmonologist, or coordinate with a hospital following an emergency.

Payment. We use and disclose PHI to bill and receive payment for services. This includes submitting claims to Medicaid, private insurers, and other payers; verifying eligibility; obtaining prior authorizations; and responding to billing disputes. For example, we may disclose diagnosis and treatment information to Medicaid when billing for daily PPEC services.

Health Care Operations. We use PHI for our internal operations, including quality assessment and improvement (QAPI), peer review, staff training and competency evaluation, compliance activities, and audits. For example, nursing supervisors may review your child's chart to evaluate care quality.

1.2 Other Uses and Disclosures Permitted Without Authorization

Required by Law. We will disclose PHI when required by federal or state law. State law requires us to report certain communicable diseases, conditions affecting public health, and specific adverse events.

Child Abuse and Neglect Reporting. We are mandatory reporters under state law. If we have reasonable cause to suspect that a child has been abused, neglected, or abandoned, we are required to report that to the Department of Children and Families (DCF) or other state designated agency, regardless of your wishes.

Health Oversight Activities. We may disclose PHI to government agencies authorized to conduct health oversight activities, including Medicaid audits, state licensing surveys, investigations, and inspections by responsible state agencies.

Public Health Activities. We may disclose PHI to public health authorities for activities such as reporting disease or injuries, reporting adverse reactions to medications, or notifying persons at risk for disease.

Judicial and Administrative Proceedings. We may disclose PHI in response to a court or administrative order, or in response to a valid subpoena, discovery request, or other lawful process with appropriate notice to you.

Law Enforcement. We may disclose PHI to law enforcement in limited circumstances, such as to identify or locate a suspect, or to report a crime on our premises, as permitted by federal and state law.

Coroners and Medical Examiners. We may disclose PHI to a coroner or medical examiner as necessary to identify a deceased person or determine cause of death.

Serious Threats to Health or Safety. We may disclose PHI if we, in good faith, believe it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person or persons reasonably able to prevent or lessen the threat.

Business Associates. We may share PHI with companies and individuals that perform services on our behalf (called "business associates"), such as billing companies, information technology vendors, and our electronic health record provider, PointClickCare. Our business associates are required by contract and by law to protect PHI.

Emergencies and Disaster Relief. We may use or disclose PHI in an emergency or for the purposes of disaster relief.

Workers' Compensation. We may disclose PHI to comply with workers' compensation laws or similar programs for work-related injuries or illness.

1.3 Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures require your written authorization. You may revoke an authorization at any time in writing, except to the extent we have already acted on it.

• Marketing communications — except for face-to-face communications we make with you and promotional gifts of nominal value
• Sale of your child's PHI
• Most uses and disclosures of psychotherapy notes
• Any use or disclosure not described in this Notice

2. Your Rights as a Parent or Legal Guardian

As the parent or legal guardian of a minor patient, you have the following rights regarding your child's health information. To exercise any of these rights, please contact your center director or our Privacy Officer using the information in Section 4 below.

2.1 Right to Inspect and Copy

You have the right to inspect and receive a copy of PHI about your child that is maintained in a designated record set, which includes the medical and billing records we use to make decisions about care. We will respond to your request within 30 days. We may charge a reasonable cost-based fee for copies. We may deny access in limited circumstances; if we deny a request, we will tell you the reason in writing and explain how you may request a review.

2.2 Right to Request Amendment

You have the right to request that we amend PHI about your child if you believe it is incorrect or incomplete. Submit your request in writing, explaining why the amendment should be made. We may deny your request if the information was not created by us, is not part of our records, or is accurate and complete. If we deny the request, we will tell you why and explain your right to submit a statement of disagreement.

2.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your child's PHI during the six years prior to the date of your request. The list does not include disclosures for treatment, payment, health care operations, or disclosures you authorized in writing.

2.4 Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your child's PHI. We are not required to agree to a restriction, except in one situation: if you pay out-of-pocket in full for a service and ask us not to share information about that service with a health plan for payment or operations purposes, we must honor that request. If we agree to a restriction, we will honor it except in an emergency.

2.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about your child's health matters in a specific way or at a specific location. For example, you may ask that we call your cell phone not your home phone, or that we do not leave a voicemail. We will honor reasonable requests that do not endanger or disrupt care. Any accommodations granted would be applied on a going forward basis, not to retroactive communications.

2.6 Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you agreed to receive it electronically. Contact your center Director of Nursing or Privacy Officer to request one.

2.7 Right to Be Notified of a Breach

If there is a breach of your child's unsecured PHI, we will notify you without unreasonable delay and no later than 60 calendar days after we discover the breach. The notification will describe what happened, what information was involved, what steps you should take to protect yourself, and what we are doing to investigate, mitigate, and prevent future breaches.

3. Our Duties

Spark Pediatrics PPEC is required by law to:

• Maintain the privacy of your child's PHI;
• Provide you with this Notice of our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect; and
• Notify you if there has been a breach of your child's unsecured PHI.

We reserve the right to change the terms of this Notice at any time. Any revised Notice will apply to PHI we already have as well as PHI we create or receive in the future. We will post the current Notice in our centers and soon to be on our website. You may request a copy of the current Notice at any time.

4. How to Contact Us / File a Complaint

Contact Our Privacy Officer

If you have questions about this Notice or about how we handle your child's health information, please contact:

Privacy Officer: Krystal Roberts, Director of Quality and Compliance
Organization: Spark Pediatrics PPEC
Email: KRoberts@sparkpediatrics.com

How to File a Complaint

If you believe your child's privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR):

OCR Online: https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf
OCR Mail: Office for Civil Rights, Hubert H. Humphrey Building, 200 Independence Ave SW, Room 509F, Washington, DC 20201
OCR Phone: 1-800-368-1019 (voice) | 1-800-537-7697 (TDD)

We will not retaliate against you for filing a complaint. Complaints filed with us should be submitted in writing to the Privacy Officer at the address above. We will acknowledge receipt and respond within 30 days.

5. Special Topics

5.1 Minor Patients and Personal Representatives

All of our patients are minors. Under state law and HIPAA, a parent or legal guardian generally has the right to access their child's PHI and to act as the child's "personal representative" for privacy purposes. The rights described in Section 2 belong to the personal representative on behalf of the child.

State law provides limited exceptions in which a minor's information is confidential from a parent. If an exception applies, we will inform you that we cannot fulfill a request and refer you to appropriate resources.

5.2 Immunization Records

We may disclose proof of immunization to a school where the law requires the school to have that information before admitting the child. We will obtain your agreement — which may be oral — before making this disclosure.

5.3 Electronic Health Records

Spark Pediatrics uses PointClickCare as its electronic health record system. PHI stored in PointClickCare is subject to the same privacy protections described in this Notice. Access to PointClickCare is controlled by individual user credentials, role-based permissions, and technical security safeguards.

5.4 State-Specific Protections

State law may provide additional protections for certain health information, including HIV/AIDS-related information, mental health records, and substance use records. Where state law is more protective than HIPAA, we will comply with the more protective standard.

6. Acknowledgment of Receipt

Please sign below to confirm that you have received and reviewed this Notice of Privacy Practices. You are not required to sign; however, we are required to document our good-faith effort to provide you with this Notice.

Your signature does not authorize any use or disclosure beyond what is described in this Notice.

Signature of Parent / Legal Guardian ____________________ Printed Name ____________________

Relationship to Child ____________________ Date ____________________

Child's Full Name (print) ____________________

Staff Member Signature ____________________ Date Provided / Attempted ____________________

If the parent or guardian declined to sign, document the reason here:

Document Control
Version 1.0 | Effective August 1, 2026 | Policy Owner: Krystal Roberts, Director of Quality and Compliance | Approved by: Melissa Lacy, CNO/COO
Review Cycle: Annually and upon material change | Regulatory Basis: 45 CFR 164.520 | Applies to all Spark Pediatrics PPEC locations and workforce members