HIPAA Notice of Privacy Practices

This notice is a summary of how mental health records and information about you may be used and disclosed and how you can get access to this information. Your rights are established pursuant to HIPAA, the Illinois Mental Health and Developmental Disabilities Confidentiality Act, state and federal alcohol and substance abuse privacy laws and the exceptions provided therein. Please review it carefully.

I. OUR RESPONSIBILITIES

By law we are required to insure that your PHI (Protected Health Information) is kept private. The PHI constitutes information created or noted by us that can be used to identify you. It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care. We are required to provide you with this Notice about our privacy procedures. This Notice must explain when, why, and how we would use and/ or disclose your PHI. Use of PHI means when we share, apply, utilize, examine, or analyze information within our practice; PHI is disclosed when we release, transfer, give, or otherwise reveal it to a third party outside our practice. With some exceptions, we may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, we are always legally required to follow the privacy practices described in this Notice. Please note that we reserve the right to change the terms of this Notice and our privacy policies at any time as permitted by law. Any changes will apply to PHI already on file with us. Before we make any important changes to our policies, we will immediately change this Notice and post a new copy of it in our office and on our website www.mansiocenter.com. You may also request a copy of this Notice from us, or you can view a copy of it in our office or on our website.

II. HOW WE WILL USE AND DISCLOSE YOUR PHI.

We will use and disclose your PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of our uses and disclosures, with some examples.

A. Uses and Disclosures of PHI that Do Not Require Your Prior Written Consent. In order to effectively provide client care, there are time when we will need to share confidential information with others beyond our agency. This includes:

1. For treatment. We can use your PHI within our practice to provide you with mental health treatment, including discussing or sharing your PHI with our trainees and interns. We may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care. Example: If a psychiatrist is treating you, we may disclose your PHI to her/him in order to coordinate your care.

2. For health care operations. We may disclose your PHI to facilitate the efficient and correct operation of our practice. This may include reviewing treatment care, training staff, accreditation surveys, consulting with attorneys or accountants to make sure we are in compliance with applicable laws.

3. To obtain payment for treatment. We may use and disclose your PHI to bill and collect payment for the treatment and services we provided you. This may include contacting the client’s guarantor, a third party collection agency, or health insurance company for prior approval of planned treatment, insurance verification, or for billing purposes.

4. To our business associates. We may contract with business associates to do work directly for us related to your treatment; this may include billing, consultation, legal, and related business practices. In such circumstances, the business associate will be subject to a Business Associate Agreement which obligates any such associates to maintain privacy consistent with the state and federal requirements outlined herein. Revised 6/2018 Page 1 of 3

5. Other disclosures. Under state and federal law, information about clients may be disclosed without client consent in the following circumstances:

• Emergencies. Sufficient information may be shared to address the immediate emergency you are facing. • Follow-up appointment/care. We may be contacting you to remind you of future appointments or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

• As required by law. This would include situation where we have a subpoena, court order, or are mandated to provide public health information, such as communicable diseases or suspected abuse, neglect, or domestic violence.

• Coroners. We are required to disclose information about the circumstances of a client’s death to a coroner who is investigating it.

• Governmental requirements. We may disclose information to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure. There are also might be a need to share information with the Food and Drug Administration related to adverse events or product defects. We are also required to share information, if requested, with the Department of Health and Human Services to determine our compliance with federal laws related to health care.

• Criminal activity or danger to others. If a crime is committed on our premises or against our personnel, we may share information with law enforcement to apprehend the criminal. We also have the right to involve law enforcement when we believe someone is in imminent danger.

• If disclosure is otherwise specifically required by law.

B. Certain Uses and Disclosures Require You to Have the Opportunity to Object.

1. Disclosures to family, friends, or others. We may provide your PHI to a family member, friend, or other individual who you indicate is involved in your care or responsible for the payment for your health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.

C. Other Uses and Disclosures Require Your Prior Written Authorization. In any other situation not described in Sections IIA or IIB above, we will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization, in writing, to stop any future uses and disclosures (assuming that we haven't taken any action subsequent to the original authorization) of your PHI by us.

III. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI

A. Copies of Records. In general, you have the right to see your PHI that is in our possession, or to get copies of it; however, you must request it in writing. If we do not have your PHI, but we know who does, we will advise you how you can get it. You will receive a response from us within 30 days of our receiving your written request. Under certain circumstances, we may feel we must deny your request, but if we do, we will give you, in writing, the reasons for the denial. We will also explain your right to have our denial reviewed. If you ask for copies of your PHI, we will charge you not more than $.25 per page. We may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.

B. Restriction on Record. You have the right to ask that we limit how we use and disclose your PHI. While we will consider your request, we are not legally bound to agree. If we do agree to your request, we will put those limits in writing and abide by them except in emergency situations. You do not have the right to limit the uses and disclosures that we are legally required or permitted to make.

C. Contacting Options. It is your right to ask that your PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via e-mail instead of by regular mail). We are obliged to agree to your request providing that we can give you the PHI, in the format you requested, without undue inconvenience. We may not require an explanation from you as to the basis of your request as a condition of providing communications on a confidential basis. You may also request at any time to be removed from mailing lists, including, but not limited to, newsletters, educational information, and donor requests, by emailing iarute@healingpathwayscc.com.

D. Accounting for Disclosures. You are entitled to a list of disclosures of your PHI that we have made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel. All disclosure records will be held for six years. We will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list we give you will include disclosures made in the previous six years unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. We will provide the list to you at no cost, unless you make more than one request in the same year, in which case we will charge you a reasonable sum based on a set fee for each additional request.

E. Amending Your PHI. If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that we correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of our receipt of your request. We may deny your request, in writing, if we find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of our records, or (d) written by someone other than your health care provider at the Mansio Center. Our denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and our denial be attached to any future disclosures of your PHI. If we approve your request, we will make the change(s) to your PHI. Additionally, we will tell you that the changes have been made, and we will advise all others who need to know about the change(s) to your PHI.

F. Notification of Breach. You have a right to be notified if there is a breach of your unsecured PHI. This would include information that could lead to identity theft. You will be notified if there is a breach or a violation of the HIPAA Privacy Rule and there is an assessment that the PHI may be compromised.

G. Filing Complaints. If, in your opinion, we may have violated your privacy rights, or if you object to a decision we made about access to your PHI, you are entitled to file a complaint with the person listed in Section IV below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about our privacy practices, we will take no retaliatory action against you.

IV. CONTACT PERSON FOR INFORMATION IN THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES

If you have any questions about this notice or any complaints about our privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact us at:

Healing Pathways Counseling & Consulting PLLC

499 Anthony Street, Glen Ellyn, IL 60137

630-866-7171

V. EFFECTIVE DATE OF THIS NOTICE

This notice went into effect on March 30, 2023.