Sleepspan private practice

Sleepspan home

Sleepspan, PLLC

Notice of Privacy Practices

Launch version 1.1, effective November 9, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your Information. Your Rights. Our Responsibilities.

This notice tells you how we protect your health information, what rights you have, and what we must do. "We" means Sleepspan, PLLC and David Benavides, M.D., only. The companies that help us run the practice are described under "Business associates" below. We provide sleep medicine care by secure video telehealth to adults who are physically in Florida, Massachusetts or Michigan. We keep your records electronically.

Questions or requests about this notice? Contact our Privacy Officer:

David Benavides, M.D., Privacy Officer
Sleepspan, PLLC
Mailing address: 7901 4th St N, Ste 300, St. Petersburg, FL 33702 (mailing address) (we do not see patients in person at this address)
Phone: (305) 330-2807
Email: hello@sleepspanhealth.com
Website: sleepspanhealth.com

Your Rights

You have certain rights about your health information. This section explains them and how we can help.

Get a copy of your medical record

  • You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how, using the contact information above. You can make your request in writing or by portal message.
  • We will give you a copy or a summary, usually within 30 days of your request. If we need more time, we may take one extra 30 days. We will tell you in writing why and when you can expect it.
  • There is no charge for a copy sent through the patient portal or for any other electronic copy. For a paper copy, we charge $1.00 per page for the first 25 pages and $0.25 per page after that, or the cost-based amount HIPAA allows, whichever is lower. Federal law limits what we may charge you for your own records to the cost of labor for copying, supplies, and postage (45 CFR 164.524(c)(4)). Florida law separately caps copy charges at our actual cost, including reasonable time spent, or the Florida Board of Medicine's rule amount (Fla. Stat. 456.057(17); Rule 64B8-10.003). We charge whichever is lowest.
  • We will not hold back your records because you owe us money for care. (Fla. Stat. 456.057(6))
  • You can ask us in writing to send a copy of your electronic record to another person you name.

Ask us to correct your medical record

  • You can ask us to correct health information about you that you think is wrong or incomplete. Ask us how, using the contact information above. Please make your request in writing.
  • We may say "no" to your request. If we do, we will tell you why in writing within 60 days. You may then send us a statement of disagreement, which we will add to your record.

Ask for private ways to be contacted (confidential communications)

  • You can ask us to contact you in a certain way (for example, only by phone or only through the patient portal) or at a certain place (for example, a different mailing address).
  • We will say "yes" to all reasonable requests. We will not ask you why.

Ask us to limit what we use or share

  • You can ask us not to use or share certain health information for treatment, payment, or our operations. We do not have to agree, and we may say "no" if it would affect your care.
  • If you pay for a service in full out of your own pocket, you can ask us not to share that information with your health insurer for payment or our operations. We will say "yes" unless a law requires us to share it.

Get a list of those with whom we have shared your information

  • You can ask for a list (called an "accounting") of the times we shared your health information in the six years before your request, who we shared it with, and why.
  • The list will include all disclosures except those for treatment, payment, and health care operations, and certain others (such as ones you asked us to make). You get one list free every 12 months. We may charge a reasonable, cost-based fee for another list within 12 months.
  • Florida law also requires us to keep a record of the times we give your medical record information to a third party. (Fla. Stat. 456.057(11))

Get a copy of this notice

  • You can ask for a paper copy of this notice at any time, even if you agreed to get it electronically. We will give you a paper copy promptly. This notice is also on our website at sleepspanhealth.com.

Choose someone to act for you

  • If you have given someone medical power of attorney, or if someone is your legal guardian or health care surrogate, that person can use your rights and make choices about your health information.
  • We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights have been violated

  • With us: Tell our Privacy Officer using the information above, by portal message, phone, email, or mail. A team member will confirm that we received your complaint, and you will receive a written answer.
  • With the federal government: You can file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR):
    • Letter: 200 Independence Avenue, S.W., Washington, D.C. 20201
    • Phone: 1-877-696-6775
    • Web: www.hhs.gov/ocr/privacy/hipaa/complaints/
    • OCR generally asks that you file within 180 days of when you learned of the problem.
  • With the State of Florida: See "Florida Law and Your Privacy" below for how to complain to the Florida Department of Health.
  • With Massachusetts or Michigan: If you are in Massachusetts or Michigan, see "If You Are in Massachusetts or Michigan" below for how to complain to your state.
  • We will not punish you or retaliate against you in any way for filing a complaint.

Language help. Dr. Benavides provides care in English, Spanish and Italian. If you need another language or sign-language support, tell us before scheduling and we will arrange it at no charge to you.

Concerns or complaints: tell us by portal message, phone, email, or mail. A team member will confirm that we received it, and you will receive a written answer.

Your Choices

For some kinds of information, you can tell us what you want us to share. Florida law is stricter than federal law here. Before we discuss your care with family members, friends, or anyone else who is not treating you, we need your written permission (Fla. Stat. 456.057(7)(a)). We will give you a short form (Form 5), or you can tell us in a signed portal message, naming the people we may talk with and what we may share. You can change or cancel this at any time in writing.

See "Florida Law and Your Privacy" below for more about who may talk with others about your care.

In these cases we never share your information unless you give us written permission:

  • Marketing. We never use or share your information for marketing without your written permission.
  • Sale of your information. We never sell your information. Doing so would require your written permission.
  • Most sharing of psychotherapy notes. If we ever keep psychotherapy notes (separate notes of a mental health professional's counseling sessions), we will share them only with your written permission, except where the law allows or requires otherwise.

Fundraising: We do not use your information for fundraising.

Other uses and disclosures. We will make other uses and disclosures that are not described in this notice only with your written permission (called an "authorization"). If you give us permission, you can change your mind at any time. Tell us in writing. This will stop any further use or sharing for the purposes covered by your permission, but it will not undo what we already did while your permission was in effect.

Our Uses and Disclosures

How do we usually use or share your health information? We usually use or share your health information in these ways.

Treat you

We can use your health information and share it with other professionals who are treating you.
Example: If you say yes on Form 2, we send a summary of your sleep consultation to your primary care doctor so your doctors work from the same information.

Run our practice

We can use and share your health information to run our practice, improve your care, and contact you when necessary.
Example: We review records to check the quality of our care, keep our computer systems secure, and manage the practice. We may also use your information to remind you of appointments.

Bill for your services

We can use and share your health information to bill and get payment from you or from other payers.
Example: We use your name and the amount due to charge your credit or debit card through a payment service. Our sleep medicine visits are self-pay. For this practice, Sleepspan does not submit claims, prepare superbills, or provide receipts for insurance submission. On request we will give you an itemized receipt for your own records; it states "not for insurance submission."

How else can we use or share your health information?

We are allowed or required to share your information in other ways, usually ways that serve the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these reasons. Where Florida law is stricter than federal law, we follow Florida law (see "Florida Law and Your Privacy" below). For more information about the federal rules, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html

Help with public health and safety issues. We can share health information about you to:

  • Prevent or control disease
  • Help with product recalls
  • Report bad reactions to medicines
  • Report suspected abuse, neglect, or domestic violence, as the law requires or permits
  • Prevent or lessen a serious threat to anyone's health or safety

Do research. We can use or share your information for health research, as the law allows. Under Florida law, we may share information for research only if your identity is protected, or if you give written permission. (Fla. Stat. 456.057(7)(a)4.)

Comply with the law. We will share information about you if state or federal law requires it. This includes sharing with the U.S. Department of Health and Human Services if it wants to see that we are following federal privacy law.

Respond to organ and tissue donation requests. We can share health information about you with organ procurement organizations.

Work with a medical examiner or funeral director. We can share health information with a coroner, medical examiner, or funeral director when a person dies.

Address workers' compensation, law enforcement, and other government requests. We can use or share health information about you:

  • For workers' compensation claims
  • For law enforcement purposes or with a law enforcement official
  • With health oversight agencies for activities the law allows (for example, audits or a licensing investigation)
  • For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions. We can share health information about you in response to a court or administrative order, or in response to a subpoena. Under Florida law, a subpoena for your records must come with proper notice to you. (Fla. Stat. 456.057(7)(a)3.)

Business associates

We use outside companies to help us run the practice, such as our electronic medical record system, our video visit platform, our email tools, and our billing company. These companies are called "business associates." They may see your information only to do their work for us. Each one must sign a written contract promising to protect your information as HIPAA requires.

Minimum necessary

When we use or share your information, or ask others for it, we try to use or share only the least amount needed for the purpose. This "minimum necessary" rule does not apply when we share your information with other health care providers for your treatment, when you ask for your own records, when you give us written permission that says otherwise, or when the law requires the disclosure.

De-identified information

We may remove your name and other details that could identify you, so that the information can no longer reasonably be linked to you. We may use or share this "de-identified" information for quality work, teaching, or research. De-identified information is not covered by this notice. We will not sell it.

Information can be shared again

When we share your information as this notice allows, the person or group that gets it may share it again, and it may no longer be protected by federal privacy law. Florida law also limits what a third party may do with medical records we give them. (Fla. Stat. 456.057(11))

Our Responsibilities

  • We are required by law to keep the privacy and security of your protected health information.
  • We will let you know promptly if a breach happens that may have put the privacy or security of your information at risk.
  • We must follow the duties and privacy practices in this notice and give you a copy of it.
  • We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

If a breach happens

If your unsecured health information is accessed or shared in a way the law does not allow, we will notify you. We will notify you without unreasonable delay and no later than 30 days after we determine that a breach occurred. This is shorter than the 60-day outer limit in federal law (HIPAA), and it meets both Florida law and HIPAA. See "Florida Law and Your Privacy" below.

How long we keep records

We keep your medical record for 7 years from your last contact with us. We also keep for 7 years the intake records of people we did not accept as patients. We keep our HIPAA documents, such as signed acknowledgments of this notice, Good Faith Estimates, and logs, for 6 years.

Changes to the Terms of This Notice

We can change the terms of this notice, and the changes will apply to all information we have about you, including information we created before the change. The new notice will be available on request and on our website at sleepspanhealth.com. It will show the new effective date. If we make a major change, we will post the new notice on our website and send the new notice to current patients through the patient portal or email.

Florida Law and Your Privacy

Florida has its own privacy laws for medical information. When Florida law gives you more protection than federal law, we follow Florida law. This section describes those extra protections.

Your medical records are confidential

Under Florida law, a doctor's records about you may not be given to anyone, and your medical condition may not be discussed with anyone, other than you, your legal representative, or other health care providers who are involved in your care or treatment, unless you give written permission. (Fla. Stat. 456.057(7)(a))

Florida law allows a few exceptions, where we may release records without your written permission. These include:

  • To a person or company that arranged or provided your care, with your consent
  • In a lawsuit or criminal case, when a court issues a subpoena and you or your representative get proper notice from the person asking for the records
  • For statistical or scientific research, if your identity is protected or you give written permission
  • To a regional poison control center for treating a poisoning
  • To the Florida Department of Children and Families for investigating or helping with cases of abuse, neglect, or exploitation of a child or a vulnerable adult
  • When a court orders a compulsory physical examination in a lawsuit (copies go to both sides), and when the Florida Department of Health obtains records by subpoena in a licensing investigation.

What you tell your doctor during your care is confidential. Your doctor may share it only with other providers involved in your care, with your written permission, or when a subpoena is issued with proper notice. (Fla. Stat. 456.057(7)(c))

Florida law also says your information may not be used for solicitation or marketing the sale of goods or services without a specific written release from you. (Fla. Stat. 456.057(7)(b))

If we ever stop practicing, retire, or move, Florida law requires us to tell patients and give them a chance to get a copy of their records. (Fla. Stat. 456.057(12))

Extra protection for HIV test results, mental health information, and substance use records

Some kinds of information have extra protection under Florida and federal law. For these, a general permission form ("release of medical information") is not enough. We will ask for a separate, specific written permission before we share them, unless the law requires or allows us to share them without it.

  • HIV test results. Florida law makes HIV test results and the identity of the person tested confidential. Results may be disclosed only to the people and in the situations the law lists, or as you allow in a legally effective written release. A general release of medical information is not sufficient to release HIV test results. (Fla. Stat. 381.004(2)(e)-(f))
  • Mental health information. Florida law gives extra protection to mental health information, including the privilege that protects some communications with mental health professionals (Fla. Stat. 90.503, which covers a physician who diagnoses or treats a mental or emotional condition; see Fla. Stat. 456.057(8)(b)), and confidentiality rules for clinical records of people treated in facilities covered by Florida's mental health act (Fla. Stat. 394.4615). Federal law also gives special protection to "psychotherapy notes." As part of your sleep care, we may ask screening questions about mood or safety, such as questions about depression or thoughts of harming yourself. We keep your answers in your medical record and protect them under the laws described in this notice.
  • Substance use treatment records. Records of substance use treatment from programs covered by Florida's substance abuse services law and by the federal rule 42 CFR Part 2 may not be disclosed without your written consent, except in limited situations the law lists. (Fla. Stat. 397.501(7); 42 CFR Part 2) See also "Substance use disorder records" below.

Florida breach notice law

Florida's Information Protection Act protects "personal information," which includes your name together with information about your medical history, mental or physical condition, or treatment or diagnosis, or your health insurance policy number. (Fla. Stat. 501.171) We must take reasonable steps to protect this information when it is held in electronic form. If a breach of security happens:

  • We will notify you as soon as we reasonably can, and no later than 30 days after we determine that a breach occurred (or have reason to believe it occurred), unless law enforcement asks us to wait, or unless, after an investigation and after consulting with law enforcement, we determine in writing that the breach is not likely to cause you identity theft or other financial harm.
  • If a breach affects 500 or more people in Florida, we must also notify the Florida Department of Legal Affairs (the Attorney General's office), generally within 30 days.
  • Companies that store or process your information for us must tell us about a breach within 10 days after they find it.

How to complain to the State of Florida

You may also file a complaint about a physician with the Florida Department of Health. Complaints about licensed practitioners must be in writing and signed; they cannot be made by phone.

  • Online: https://complaint-portal.mqa.flhealthsource.gov/
  • Email: MQA.ConsumerServices@FLhealth.gov
  • Mail: Florida Department of Health, Board of Medicine, 4052 Bald Cypress Way, Bin C-03, Tallahassee, FL 32399-3253
  • Phone (Customer Contact Center, for questions only): (850) 488-0595

If You Are in Massachusetts or Michigan

The Florida section above applies to Florida patients. If you are physically in Massachusetts or Michigan during your care, the following also applies to you.

Massachusetts Law and Your Privacy

  • Your medical records are confidential under Massachusetts law.
  • Massachusetts patients: you may inspect your record and receive a copy. Electronic copies through the portal are free. For paper copies Sleepspan charges no more than Massachusetts law allows (currently a base fee of up to $15 per request plus up to $0.50 per page for the first 100 pages and $0.25 per page after that, plus postage) or the HIPAA cost-based amount if that is lower. There is no charge, and we respond within 30 days, when the records support a Social Security or other needs-based benefit claim or appeal and you tell us so when you ask. We never require payment of your bill before releasing records. Your record is kept for at least 7 years after your last visit.
  • Massachusetts residents: Sleepspan keeps a written information security program under 201 CMR 17.00. If a security breach involves your name together with your Social Security number, driver's license or state ID number, or a financial account or card number, Sleepspan will notify you, the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay, will tell you how to obtain a police report and place a free security freeze, and will offer at least 18 months of free credit monitoring if your Social Security number was involved.
  • Massachusetts patients may also complain about a physician to the Board of Registration in Medicine, 178 Albion Street, Suite 330, Wakefield, MA 01880, telephone (781) 876-8200, fax (781) 876-8383, or online through the Board's complaint system at mass.gov/orgs/board-of-registration-in-medicine (Submit a Complaint). Questions about the complaint process: borim.consumercomplaints@mass.gov.

Michigan

  • If you are in Michigan, you may ask for your records with a written request that you sign and date (dated within the last 60 days). We respond within 30 days (60 days if the record is stored off-site); if we need more time we will tell you in writing why, once, for up to 30 more days. We will not ask why you want your records.
  • There is no initial fee when you ask for a copy of your own record. Your record is electronic, and we give you an electronic copy through the portal at no charge. If you ask for paper copies, we charge no more than Michigan law allows under the Medical Records Access Act (for 2026: $1.60 per page for pages 1 to 20, $0.80 per page for pages 21 to 50, $0.32 per page after page 50, plus actual postage; MCL 333.26269). All fees are waived if you are medically indigent.
  • If a breach of security involves your unencrypted personal information, we will notify you without unreasonable delay. The notice will describe what happened in general terms, the type of information involved, what we have done to protect you, a telephone number you can call, and a reminder to watch for fraud and identity theft (MCL 445.72). Our HIPAA breach procedure meets this Michigan requirement.
  • If you are in Michigan, you may also file a complaint about a physician with the Michigan Department of Licensing and Regulatory Affairs (LARA), Bureau of Professional Licensing, Complaint Intake Section, P.O. Box 30670, Lansing, MI 48909-8170; phone (517) 241-0205; email BPL-Complaints@michigan.gov; or online through MiPLUS at michigan.gov/lara.

Telehealth: Video Visits and Your Privacy

  • Where you must be. Sleepspan sees patients only while they are physically in Florida, Massachusetts or Michigan. Tell us at every visit which state you are in. We care for adults (18 and older). We may ask you to confirm where you are at the start of each visit.
  • Private place. Please join from a private place. People near you may overhear or see the visit. If you choose to have someone join you, tell us at the start.
  • Sleepspan does not record video or audio of visits and asks you not to record them. With your permission, Dr. Benavides may use an AI note-taking tool (a scribe) that listens during the visit to draft the visit note. The audio is not kept after the note is drafted, the tool's vendor works under a business associate agreement, and you may decline it at any time.
  • Video platform. The company that provides our video visit platform is one of our "business associates" (see "Business associates" above) and is bound by a written business associate agreement (BAA) to protect your information as HIPAA requires.
  • Records. We write notes about your telehealth visits in your record the same way we do for any visit. Florida law treats records of telehealth visits, including any video, audio or electronic records, as confidential medical records (Fla. Stat. 456.47(3)). We do not create video or audio recordings of visits.
  • Technology risks. No internet connection or device is perfectly secure. Use a device and network that you trust. Do not use public Wi-Fi if you can avoid it.

Email and Other Electronic Communication

We use the secure patient portal for messages about your health. We use email only to schedule visits and send reminders, and we use text messages only if you agree to them on Form 2. We send appointment reminders by email only. We do not send text message reminders. Please understand these risks:

  • Regular email and text messages are usually not encrypted. They can be read by others, delivered to the wrong person, saved on your device or by your phone company, or intercepted.
  • Anyone who can use your phone, email account, or devices may see the messages.
  • Messages are not for emergencies or urgent medical problems. We do not watch email or the portal all the time. Portal messages and voicemail are read on business days only (Monday to Friday, except federal holidays). Replies are not immediate. In an emergency, call 911.
  • When you first contact us at hello@sleepspanhealth.com, please send only your name and how to reach you, with no health details. We will invite you to the secure patient portal for everything else.
  • We will keep the details in the messages we send to the minimum needed. Reminder emails give the practice name and the date and time of your visit, and they do not include health details. We encourage you to use the secure patient portal for anything about your health.
  • You choose whether to use email. You can tell us at any time to stop, or to use only the portal or phone calls. Your care will not depend on it.

By giving us your email address and agreeing to be contacted that way (including by choosing email on Form 2), you tell us you understand these risks.

Our Website

We do not use advertising pixels, session-replay tools, or social media trackers on our website. Our website host, Squarespace, sets its own cookies and basic visitor analytics; no health information is collected on the website.

Substance Use Disorder (SUD) Records

Federal law (42 CFR Part 2) protects records from certain substance use disorder treatment programs. We do not run a substance use disorder treatment program. If we get records from a program covered by that law, we will protect them as the law requires, which may be more strict than the rules in this notice.

Records we receive from a Part 2 program, or testimony that describes what is in them, may not be used or shared in a civil, criminal, administrative, or legislative case against you unless you give written consent, or a court orders it after you (or the holder of the record) have notice and a chance to be heard. A court order must come with a subpoena or other legal demand before we may release the record.

Effective Date

This notice is effective on November 9, 2026. Launch version 1.1.