HIPAA

I. MY PLEDGE REGARDING HEALTH INFORMATION

I understand that health information about you and your care is personal. I am committed to protecting your protected health information (“PHI”). I create a record of the care and services you receive from me. I need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all records of your care generated by this practice. It describes the ways in which I may use and disclose your PHI, your rights regarding your PHI, and my obligations under federal and state law. I am required by law to:

• Maintain the privacy of your protected health information
• Provide you with this Notice of my legal duties and privacy practices;
• Follow the terms of the Notice currently in effect; and
• Notify you following a breach of unsecured protected health information.

I reserve the right to change the terms of this Notice. Any changes will apply to all PHI I maintain. The revised Notice will be available upon request, in my office, and on my website (if applicable). The effective date will appear at the top of the Notice. In accordance with Ohio Administrative Code 4757-5-09, Soma and Soul Mental Health & Trauma Therapy maintains your records for seven years. If your therapist leaves Soma and Soul Mental Health & Trauma Therapy, the record of your treatment history prior to the therapist leaving remains with the practice.

II. HOW I MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following categories describe ways I may use and disclose PHI. Not every possible use or disclosure is listed, but all permitted uses and disclosures fall within one of these categories. All uses and disclosures described below are subject to federal limitations regarding reproductive health care and substance use disorder information.

A. For Treatment, Payment, or Health Care Operations

Federal privacy regulations permit health care providers with a direct treatment relationship to use or disclose PHI without written authorization for treatment, payment, and health care operations.

Treatment I may use or disclose PHI to provide, coordinate, or manage your health care. This includes consultations, referrals, and coordination with other providers. Disclosures for treatment purposes are not limited to the “minimum necessary” standard.

Payment I may use and disclose PHI to obtain payment for services provided to you.

Health Care Operations I may use and disclose PHI for practice operations, including quality assessment, supervision, training, licensing, and compliance activities.

B. Lawsuits, Legal Proceedings, and Law Enforcement

I may disclose PHI in response to a court or administrative order. I may also disclose PHI in response to a subpoena, discovery request, or other lawful process if legal requirements are met. However, I am prohibited from using or disclosing PHI for the purpose of investigating or prosecuting any person in connection with lawful reproductive health care. If a request involves reproductive health care information and falls within a category requiring additional safeguards (including law enforcement, health oversight activities, judicial or administrative proceedings, or disclosures to coroners or medical examiners), I will obtain a signed attestation confirming the request is not for a prohibited purpose before making the disclosure.

III. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION

Except as described in this Notice, I will not use or disclose your PHI without your written Authorization. Uses and disclosures requiring Authorization include:

• Use or disclosure of psychotherapy notes (with limited exceptions described below);
• Use or disclosure of PHI for marketing purposes;
• Sale of PHI;
• Uses or disclosures not otherwise permitted by HIPAA;
• Certain uses and disclosures involving reproductive health care information not otherwise permitted by law.

You may revoke your Authorization at any time in writing, except to the extent that I have already relied on it.

Psychotherapy Notes

I maintain psychotherapy notes as defined in 45 CFR § 164.501. Any use or disclosure of psychotherapy notes requires your Authorization except:

• For my use in treating you;
• For training or supervising mental health practitioners;
• To defend myself in legal proceedings brought by you;
• For investigation by the Secretary of Health and Human Services;
• As required by law;
• For certain health oversight activities;
• To a coroner performing lawful duties;
• To avert a serious threat to health or safety.

Marketing

I will not use or disclose your PHI for marketing purposes without your written Authorization. If I receive financial remuneration in exchange for making a communication about a product or service, your written Authorization is required.

Fundraising Communications

If I ever use PHI to send you fundraising communications, you will be given a clear and conspicuous opportunity to opt-out of receiving such communications.

Sale of PHI

I will not sell your PHI. Any disclosure that constitutes a sale of PHI under federal law requires your written Authorization.

IV. USES AND DISCLOSURES THAT DO NOT REQUIRE AUTHORIZATION

Subject to legal limitations, I may use or disclose PHI without your Authorization:

• When required by federal or state law;
• For public health activities;
• To report suspected abuse or neglect;
• For health oversight activities;
• For judicial and administrative proceedings;
• For law enforcement purposes;
• To coroners or medical examiners;
• For research (under appropriate safeguards);
• For specialized government functions;
• For workers’ compensation purposes;
• For appointment reminders;
• To inform you of treatment alternatives or health-related benefits or services.

V. DISCLOSURES WHERE YOU HAVE THE OPPORTUNITY TO OBJECT

I may disclose PHI to a family member, friend, or other person involved in your care or payment for care, unless you object. In emergency circumstances, consent may be obtained retroactively.

VI. YOUR RIGHTS REGARDING YOUR PHI

You have the following rights:

Right to Request Restrictions You may request restrictions on certain uses and disclosures. I am not required to agree, except where required by law.

Right to Restrict Disclosures to Health Plans If you pay out-of-pocket in full for a service, you may request that I not disclose information about that service to your health plan. I must agree to this request unless disclosure is otherwise required by law.

Right to Confidential Communications You may request that I communicate with you in a specific way or at a specific location. I will accommodate reasonable requests.

Right to Access and Copies You may obtain an electronic or paper copy of your PHI (excluding psychotherapy notes). I will respond within 30 days and may charge a reasonable cost-based fee. Requests should be submitted in writing to: Soma and Soul Mental Health & Trauma Therapy 6545 Market Ave. North, Ste. 100 North Canton, OH 44721

Right to an Accounting of Disclosures You may request a list of certain disclosures made in the past six years (excluding treatment, payment, and operations). I will respond within 60 days.

Right to Amend You may request correction of your PHI. I may deny the request but will respond in writing within 60 days.

Right to a Copy of This Notice You may receive a paper or electronic copy of this Notice at any time.

Right to Be Notified of a Breach You have the right to be notified if there is a breach of your unsecured protected health information.

VII. Special Protections for Reproductive Health Care Information

Federal law provides additional protections for PHI related to reproductive health care. I am prohibited from using or disclosing PHI for the purpose of conducting a criminal, civil, or administrative investigation or proceeding against any person for seeking, obtaining, providing, or facilitating lawful reproductive health care. When required by federal law, I will obtain a signed attestation from a requesting party confirming that the requested PHI is not for a prohibited purpose before making certain disclosures involving reproductive health care information.

VIII. Substance Use Disorder Records (42 C.F.R. Part 2)

I create and/or maintain records related to the diagnosis, treatment, or referral for treatment of substance use disorders, certain records are protected by a federal law known as 42 C.F.R. Part 2 (“Part 2”). These records receive heightened confidentiality protections beyond standard HIPAA protections. SUD treatment records received from programs subject to 42 CFR part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.

Your Rights Concerning SUD Records With respect to SUD records protected under Part 2, you have the following rights:

• Your SUD records may not be used or disclosed without your written consent unless specifically permitted by Part 2.
• SUD records may not be disclosed for use in civil, criminal, administrative, or legislative proceedings against you unless:
• You provide written consent; or
• A court issues an order after providing you and/or the record holder notice and an opportunity to be heard, consistent with Part 2 requirements
• You have the right to receive an accounting of certain disclosures of your SUD records.
• You have the right to revoke a written consent for disclosure at any time, except to the extent that action has already been taken in reliance on that consent.

2. How SUD Records May Be Used or Disclosed

A. With Your Written Consent Your SUD records may be used or disclosed if you sign a valid written consent that meets federal requirements. Your consent must specify:

• The name of the person or entity permitted to make the disclosure;
• The name of the person or entity to whom disclosure may be made;
• The purpose of the disclosure;
• What information will be disclosed; and
• An expiration date or event.

You may revoke your consent at any time in writing, except to the extent that I have already acted in reliance on it.

B. Pursuant to a Court Order SUD records may be disclosed pursuant to a court order that complies with 42 C.F.R. Part 2. Such an order may be issued only after:

• Notice is provided to you and/or the record holder; and
• You and/or the record holder are given an opportunity to be heard by the court. Absent a valid consent or qualifying court order, SUD records will not be disclosed for investigative or prosecutorial purposes.

C. Limited Exceptions Without Consent Part 2 permits limited disclosures without consent in specific circumstances, including:

• Medical emergencies;
• Certain research activities;
• Audits and program evaluations;
• Reporting of child abuse or neglect, as required by law. Even in these situations, disclosures are limited to the minimum necessary information required by law.

IX. REDISCLOSURE NOTICE

Information that is disclosed pursuant to the Privacy Rule may be subject to redisclosure by the recipient and may no longer be protected by HIPAA or other federal privacy laws. You should always inquire about the privacy practices of any entity to which your PHI is disclosed.

X. COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with: U.S. Department of Health and Human Services Office for Civil Rights Centralized Case Management Operations 200 Independence Avenue, S.W. Room 509F HHH Bldg. Washington, D.C. 20201 You may file electronically through the OCR Complaint Portal or by mail. You may also file a complaint with the Ohio Board of Counselors, Social Workers, and Marriage & Family Therapists online at https://elicense.ohio.gov/OH_HomePage or by mail at: 77 S High St, 24th Floor, Room 2468, Columbus, OH 43215 You will not be retaliated against for filing a complaint. Acknowledgement of Receipt of Privacy Notice Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By signing below, you are acknowledging that you have received a copy of HIPAA Notice of Privacy Practices. BY SIGNING BELOW I AM AGREEING THAT I HAVE READ, UNDERSTOOD, AND AGREE TO THE ITEMS CONTAINED IN THIS DOCUMENT.