HIPAA NOTICE OF PRIVACY PRACTICES

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY. IF YOU HAVE ANY QUESTIONS OR WOULD LIKE TO GO OVER IT, PLEASE ASK YOUR THERAPIST. PROTECTING YOUR INFORMATION AND CREATING A SAFE PLACE IS IMPORTANT TO US.

IT IS OUR LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI). By law, we are required to ensure that your PHI is kept private and provide you with this Notice about our privacy procedures and explain when, why, and how we might use and/or disclose your PHI. PHI contains data about your health or condition, the health care services offered to you, or the payment for care. Use of PHI means when we share, utilize, or review information within our practice; disclosure is when we release, transfer, or otherwise reveal it outside our practice - such as another therapist or insurance. With few exceptions, we may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made. We are legally required to follow the privacy practices described in this Notice.

HOW I WILL USE AND DISCLOSE YOUR PHI.

Uses and Disclosures Require Your Prior Written Authorization. Other than the situation described below, we will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke, in writing, any authorization to disclose your PHI stopping future use and disclosure by us.

Disclosures Which Do Not Require Your Consent:

a) To avoid harm to you and others. If we believe you are a danger to yourself or you tell us of a serious/imminent threat of physical violence by you against another person(s), we may be compelled to report.

b) If we have a reasonable suspicion of child abuse and/or neglect; elder or dependent adult abuse and/or neglect, we are required by law to report. (Texas Child Abuse and Neglect Reporting & Texas Elder/Dependent Adult Abuse Reporting law).

c) If disclosure is compelled by a court of law pursuant to subpoena. (e.g., a judge issued subpoena).

d) As required by federal, state, or local law; judicial, board, or administrative proceedings; or, law enforcement.

e) Appointment reminders (you have the option to opt-out)

We may use and disclose your PHI without your consent for the following reasons:

a) Consultation: At times we may discuss our therapeutic work with other licensed mental health practitioners in order to guide and better aid in treatment. These individuals are under the same legal obligations regarding HIPAA and confidentiality. We focus on treatment and limit the amount of PHI that we share to the absolute minimum needed to consult.

b) Payment: To obtain payment for treatment and services we provided you. Example: to submit a claim for reimbursement to your insurance company or health plan.

c) Care Coordination. We may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care.

d) Emergency Situations. Your consent isn't required if you need emergency treatment provided that we attempt to get your consent after treatment is rendered. In the event that we try to get your consent but you are unable to communicate with us (for example, if you are unconscious or in severe pain) but think that you would consent to such treatment.

e) After Death. We may disclose deceased individuals' PHI to family members and/or non-family members who were involved in the care or payment for healthcare of the decedent prior to death; however, this disclosure is limited to PHI relevant to such care or payment and cannot be inconsistent with any prior expressed preference of the deceased individual.

WHAT RIGHTS YOU HAVE REGARDING YOUR PHI

The Right to See and Get Copies of Your PHI. In general, you have the right to see or get copies of your records in our possession. This must be requested in writing. You will receive a response within 15 days of receiving your written request. Under certain circumstances, we have the right to deny your request and will provide a written explanation of the reasons for the denial. This is rare. You also have the right to have our denial reviewed.

If you ask for copies of your PHI, we will not charge you more than $.25 per page. We may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.

The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask that we limit how to use and disclose your PHI. Will consider your request though are not legally bound to agree nor can we go against legal or board record requirements. If we agree to your request, we will put those limits in writing and abide by them except in emergency situations. **You do not have the right to limit the uses and disclosures that we are legally required or permitted to make.**

The Right to Choose How You Receive Your PHI to You. It is your right to ask that your PHI be sent to you at an alternate address (e.g. sending information to your work address rather than your home address) or by an alternate method (e.g., via email instead of by regular mail). We are obliged to agree to your request providing that we can give you the PHI, in the format you requested, without undue inconvenience. We do not require an explanation as to the basis of your request as a condition to provide your records. We will discuss any confidentiality concerns with you.

The Right to Get a List of the Disclosures Which Are Made. You are entitled to a list of disclosures of your PHI that we have made. The list will not include uses or disclosures to which you have already consented, e.g., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel, disclosure records will be held for 6 years.

We will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list we give you will include disclosures made in the previous 6 years unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. We will provide the list to you at no cost, unless you make more than one request in the same year, in which case we will charge you a reasonable sum based on a set fee for each additional request.

The Right to Amend Your PHI. If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that we correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of our receipt of your request. We may deny your request, in writing, if we find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of our records, or (d) written by someone other than me. Our denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and our denial be attached to any future disclosures of your PHI. If we approve your request, we will make the change(s) to your PHI. Additionally, we will tell you that the changes have been made, and we will advise all others who need to know about the change(s) to your PHI.

The Right to Get This Notice by Email. You have the right to get this notice by email. You have the right to request a paper copy of it, as well.

HOW TO COMPLAIN ABOUT THESE PRIVACY PRACTICES If, in your opinion, we may have violated your privacy rights, or if you object to a decision we made about access to your PHI, you are entitled to file a complaint with the person listed below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about our privacy practices, we will take no retaliatory action against you.

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES If you have any questions about this notice or any complaints about these privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact: Sarah Osmer, 2525 Wallingwood Dr., Building 12, Austin, TX 78746 // hello@CarlisleCollective.co

NOTIFICATIONS OF BREACHES In the case of a breach, even if such a breach was caused by a business associate, we are required to notify each affected individual whose unsecured PHI has been compromised. If the breach involves more than 500 persons, OCR must be notified in accordance with instructions posted on its website. Resilience Counseling, PLLC bears the ultimate burden of proof to demonstrate that all notifications were given or that the impermissible use or disclosure of PHI did not constitute a breach and must maintain supporting documentation, including documentation pertaining to the risk assessment.

Individuals' Right to Restrict Disclosures; Right of Access To implement the 2013 HITECH Act, the Privacy Rule is amended Carlisle Collective, PLLC is required to restrict the disclosure of PHI about you to a health plan, upon request, if the disclosure is for the purpose of carrying out payment or healthcare operations and is not otherwise required by law. The PHI must pertain solely to a healthcare item or service for which you have paid the covered entity in full. (OCR clarifies that the adopted provisions do not require that covered healthcare providers create separate medical records or otherwise segregate PHI subject to a restrict healthcare item or service; rather, providers need to employ a method to flag or note restrictions of PHI to ensure that such PHI is not inadvertently sent or made accessible to a health plan.)

The 2013 Amendments also adopt the proposal in the interim rule requiring Resilience Austin, PLLC, to provide you, (the client) a copy of PHI to any individual client requesting it in electronic form. The electronic format must be provided to you if it is readily producible. OCR clarifies that we must provide you only with an electronic copy of your PHI, not direct access to their electronic health record systems. The 2013 Amendments also give you the right to direct us to transmit an electronic copy of PHI to an entity or person designated by you. Furthermore, the amendments restrict the fees that we may charge you for handling and reproduction of PHI, which must be reasonable, cost-based, and identify separately the labor for copying PHI (if any). Finally, the 2013 Amendments modify the timeliness requirement for right of access, from up to 90 days currently permitted to 15 days, with a one-time extension of 30 additional days.

We reserve the right to change the terms of this Notice and our privacy policies at any time as permitted by law. Any changes will apply to PHI already on file with us. Before we make any important changes to our policies, we will immediately change this Notice and post a new copy of it in my office and on our website (if applicable). You may also request a copy of this Notice from us, or you can view a copy of it in our office or on our website, which is located at https://www.CarlisleCollective.co.

EFFECTIVE DATE OF THIS NOTICE This notice went into effect on March 31, 2022