Early Steps Therapy, Inc.
Patient/Parent Notice of Privacy Practices & PHI Policy
Effective Date: 01/13/2026
This Notice is effective as of the date listed above and remains in effect until replaced by a revised Notice.
Welcome & Purpose (Parent-Friendly Summary)
At Early Steps Therapy, Inc., we provide speech, occupational, and physical therapy services at Prescribed Pediatric Extended Care (PPEC) centers. To care for your child, we need to collect and use health information. This document explains:
Your rights as a parent/caregiver regarding your child’s health information.
How we may use and share that information.
What we will not do without your written permission.
The steps we take to keep information safe.
We encourage you to read this carefully and ask questions. You will be asked to sign an acknowledgment that you received this notice. If you refuse to sign the acknowledgment, we may still provide treatment to your child, but we will document your refusal as required by HIPAA.
Our Duties
We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. If we make material changes, we will provide you with a revised Notice. The current Notice is always available on our website on this page and at our office locations.
We are required by law to:
Maintain the privacy of your child’s protected health information (PHI).
Provide you with this Notice.
Follow the terms of this Notice.
Notify you without unreasonable delay and no later than 60 days after discovery if a breach of unsecured PHI occurs that compromises the privacy or security of your child's PHI, as required by the HITECH Act and HIPAA Breach Notification Rule.
What Counts as Protected Health Information (PHI)
PHI is any information that identifies your child and relates to their health or care. This includes:
Name, date of birth, and Medicaid/insurance number.
Medical diagnoses and therapy treatment plans.
Progress notes, session records, and evaluations.
Billing records.
PHI may be written, spoken, or stored electronically.
Permitted Uses and Disclosures (No Extra Permission Needed)
We may use or share PHI for:
Treatment – to coordinate therapy with PPEC staff, your child’s doctor, or other therapists.
Payment – to bill Medicaid, insurance, or other payors.
Healthcare Operations – to run our practice, improve services, and for quality checks.
Required by Law – if requested by Medicaid, CMS, or other regulators.
Public Health & Safety – for child abuse reporting, communicable disease reporting, or serious safety concerns.
Minimum Necessary Standard – We will make reasonable efforts to use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose, except when the disclosure is for treatment purposes or as otherwise permitted or required by law.
Uses and Disclosures Requiring Authorization
We will not use or share your child’s PHI for these purposes unless you sign a separate authorization:
Marketing or fundraising.
Research purposes.
Posting or sharing photos/videos of your child.
Selling PHI.
You may revoke your authorization at any time in writing.
Your Rights Regarding PHI
You, as parent or caregiver, have the right to:
Access – Request and receive access to your child’s therapy records within 30 calendar days of the request (one 30-day extension allowed if we provide written notice of the delay and reason). We may charge a reasonable, cost-based fee for copies limited to: (a) labor for copying PHI; (b) supplies for creating paper or electronic media; (c) postage when mailed; and (d) preparation of a summary if agreed to in advance. We will provide records in the electronic format requested if readily producible, or in a readable alternative format if not. Under Florida law, the fee may not exceed $1.00 per page for the first 25 pages and $0.25 per page thereafter, plus actual postage and handling costs not to exceed $5.00.
Amend – Request corrections if you believe the record is inaccurate or incomplete. We must respond within 60 days (one 30-day extension allowed with written notice). If we deny your request, we will provide a written explanation and inform you of your right to submit a statement of disagreement, which will be included with your child's records.
Accounting – Request an accounting of certain disclosures of PHI made in the last six years (or a shorter period if you specify). This does not include disclosures for treatment, payment, healthcare operations, disclosures made to you or pursuant to your authorization, disclosures for national security purposes, or disclosures to correctional institutions or law enforcement. We will provide the first accounting in a 12-month period free of charge; subsequent requests may incur a reasonable, cost-based fee.
Restrictions – Request limits on how we use or disclose PHI. We are not required to agree to most restrictions, but we will consider your request. However, we must agree to restrict disclosures to health plans for payment or healthcare operations purposes if: (1) the disclosure is not otherwise required by law; and (2) the PHI pertains solely to healthcare items or services for which you have paid us in full out-of-pocket.
Confidential Communications – Ask us to contact you in a specific way (different address, phone, email).
Complaints – File a complaint with our Privacy Officer or with the U.S. Department of Health & Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints/. Complaints must be filed within 180 days of when you knew or should have known of the issue. We will not retaliate against you for filing a complaint.
Paper Copy – Obtain a paper copy of this Notice even if you receive it electronically.
Safeguards & Record Retention
Electronic PHI – stored in HIPAA-compliant systems with encryption at rest and in transit.
Paper PHI – kept securely locked when not in use.
Retention – Under Florida law, medical records for minors must be maintained for at least 7 years from the last patient contact or until the patient reaches age 25, whichever is longer. HIPAA documentation (policies, procedures, breach notifications) must be retained for 6 years from creation or last effective date. Florida Medicaid service records must be retained for at least 5 years from the date of service or from the date of audit resolution, whichever is later.
Breach Notification – If a breach of unsecured PHI occurs, we will notify you without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notification will include: (1) a description of the breach; (2) the types of information involved; (3) steps you should take to protect yourself; (4) what we are doing to investigate and mitigate harm; and (5) contact information for questions. Business Associates must notify us within 60 calendar days of discovering any breach. If a breach affects 500 or more individuals, we will also notify the U.S. Department of Health & Human Services and prominent media outlets as required by law.
Special Note About PPEC Settings
Because therapy occurs inside a PPEC:
We may share PHI with PPEC staff for care coordination.
Early Steps Therapy remains fully responsible for safeguarding PHI.
Parents remain the primary rights-holders of their child’s PHI.
Florida Medicaid requires that all service entries be signed or electronically authenticated by the rendering provider within two business days of service delivery, as required by the Florida Medicaid Provider General Handbook and applicable therapy coverage policies.
PPEC rules require child medical records to include plans of treatment, physician orders, therapy notes, case notes, and discharge summaries.
Assistants & Scope of Practice
If therapy assistants (Physical Therapist Assistants, Occupational Therapy Assistants, or Speech-Language Pathology Assistants) are involved in your child’s care, their role is limited by Florida law and the applicable practice acts. All assistant services must be supervised by appropriately licensed therapists in accordance with Florida Board rules. Assistants may not perform evaluations, re-evaluations, or make independent clinical decisions. Supervision requirements and scope of practice limitations are specified in our contracts and comply with Florida Medicaid policy and professional licensing standards.
NPI Numbers & Insurance Regions
Our practice and individual providers use National Provider Identifier (NPI) numbers as required by HIPAA for all electronic healthcare transactions. Organizational and individual provider NPIs are registered with the National Plan and Provider Enumeration System (NPPES). If we expand services to new regions or add providers, we will ensure all NPIs are properly registered and disclosed to payors as required by federal law and payor contracts.
Security & Breach Notification
We conduct regular risk analysis and apply administrative, physical, and technical safeguards. We encrypt PHI and require Business Associate Agreements with vendors. All staff members receive regular training on HIPAA privacy practices and our internal privacy policies to ensure proper handling of PHI. In case of a breach, we will notify parents within 60 days.
Staff Sanctions Policy. All workforce members are required to comply with our privacy and security policies. Any staff member who fails to comply with privacy practices will be subject to appropriate disciplinary action, which may include verbal or written warnings, mandatory retraining, suspension, termination of employment, or other sanctions as determined by the severity and frequency of the violation. Violations will be documented and investigated in accordance with our internal compliance procedures.
Information Blocking Rule
As a healthcare provider, we comply with the 21st Century Cures Act Information Blocking provisions and the ONC Information Blocking Rule (45 C.F.R. Part 171). We will not engage in practices that are likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI), except as permitted by law. Requests for electronic health information will be honored promptly unless a permitted exception applies (such as privacy, security, infeasibility, health IT performance, content and manner, or fees exceptions). You may request your child's EHI in electronic format. Reasonable, cost-based fees may be charged for labor costs in responding to requests for EHI, as permitted under 45 C.F.R. § 171.302(d), but no fees will be charged for a single copy for personal use in electronic format.
Our Right to Change This Notice
We reserve the right to change this Notice at any time, and to make the revised or changed Notice effective for protected health information (PHI) we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our PPEC service locations and on our website. The Notice will contain the effective date on the first page. In addition, upon request, we will provide you with a copy of the current Notice, even if you have previously received a copy.
Questions or Complaints
Privacy Officer Contact:
Omar Fagundo
manager@earlystepsslp.com
You may also file a complaint directly with the:
U.S. Department of Health & Human Services – Office for Civil Rights
200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, D.C. 20201
We will not retaliate against you for filing a complaint or exercising any of your rights under this Notice or applicable law. Filing a complaint will not affect your care or your child's care in any way.
Acknowledgment of Receipt of Notice of Privacy Practices
I acknowledge that I have received a copy of Early Steps Therapy, Inc.’s Notice of Privacy Practices. I understand that this Notice describes how medical information about my child may be used and disclosed and how I can access this information. I understand that Early Steps Therapy, Inc. reserves the right to change the terms of this Notice and that I may contact the Privacy Officer to obtain a current copy at any time.