Notice of Privacy Policies and HIPAA Practices and Compliance Regarding Confidentiality of Client Records and Dissemination of Information

THIS NOTICE DESCRIBES HOW MENTAL HEALTH AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Individual and Relationship Therapy Center, PLLC (hereafter referred to as IRTC) is dedicated to maintaining the privacy of your individually identifiable health information (hereafter referred to as Protected Health Information, or PHI). IRTC and all of therapists at IRTC are required by law to maintain the confidentiality of health information that identifies you. According to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we are also required by law to provide you with this notice of our legal duties and the privacy practices concerning your PHI. We must follow the terms of the Notice of Privacy Practices that we have in effect at the time.

Group Practice of Individual and Relationship Therapy Center, PLLC

IRTC is a group of mental health therapists who strive to provide the best quality service to the clients we serve. If you have any concerns or questions about your treatment, please ask us. IRTC prohibits the release of any client information to anyone outside immediate staff, employees, interns, independent contract therapists or volunteers except in limited circumstances. Disclosure of protected health information (PHI) within the group practice is limited to the minimum necessary that is needed for the recipient of the information to perform their job and contact the client regarding scheduling and initial communication, follow up satisfaction questionnaires etc.

Please review this Notice of Privacy Policies and Practices and Compliance with HIPAA Regarding Confidentiality of Client Records and Dissemination of Information. It is the policy of IRTC to:

• fully comply with the requirements of the HIPAA General Administrative Requirements, the Privacy and Security Rules

• provide every patient who receives services with a copy of this Notice of Privacy Policies and Practices

• ask the patient to acknowledge receipt when given a copy of this Notice of Privacy Policies and Practices

Protected health information (PHI) refers to any information that is created or received by IRTC, and relates to:

• individual’s past, present or future physical or mental health conditions and related care services

• individual’s past, present, or future payment for the provision of health care to an individual

• any information that can identify the individual

• information where there is a reasonable basis to believe the information can be used to identify the individual

PHI includes any such information described above that IRTC transmits or maintains in any form, including Psychotherapy Notes. HIPAA and federal law regulate the use and disclosure of PHI when transmitted electronically.

Your Privacy Rights as Our Client:

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. Please review carefully and ask us any questions you have.

Get an electronic or paper copy of your medical record. You can ask to see or receive a copy of your medical record. We will provide a copy or a summary of your health information, within 30 days of your request. Hourly fees apply for writing a record summary, calculated in 15 minute increments. Expenses incurred to print and/or photocopy your files will be at your expense.

Ask us to correct your medical record. You can ask us to correct health information about you that you think is incorrect or incomplete. We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request confidential communications. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests. Please review the Consent for Communication of Protected Health Information By Non-Secure Means. You are required to ‘opt-in’ to receive electronic communications as outlined in the Consent for Communication of Protected Health Information by Non-Secure Means. If you chose not to opt-in to receive electronic communications, we will not communicate with you via electronic means.

Ask us to limit what we use or share. You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request if it would affect your care. If you pay for a health care service out-of-pocket in full, you can ask us not to share that information with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information. You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). Upon request, we will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for additional accountings within one 12-month window.

Get a copy of this privacy notice. You can ask for a paper copy of this notice at any time. We will provide you with a copy promptly.

Choose someone to act for you. If you have given someone medical power of attorney or if you have a legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your privacy rights are violated. You can complain if you feel we have violated your rights by contacting us. Our Privacy Officer is Laura Cross, LMFT and can be reached at 720-639-7724 or Laura@IndividualRelationshipCenter.com. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

Uses and Disclosures Not Requiring Consent:

Providing treatment services, collecting payment and conducting healthcare operations are necessary activities for quality care. State and federal laws allow us to use and disclose your health information for these purposes. In most cases, we are limited to disclosing the minimum information necessary to Notice of Privacy Policies and HIPAA Practices (Jan 21) Page 2 of 5 accomplish these purposes. To help clarify these terms, here are some examples:

• Treatment is when we use and disclose health information to provide, coordinate or manage your health care and other services related to your health care. If we decide to consult with another licensed health care provider about your condition, we would be permitted to use and disclose your personal health information, which is otherwise confidential, in order to assist me in the diagnosis or treatment of your mental health condition. Disclosures for treatment purposes are not limited to the minimum necessary standard, because physicians and other health care providers need access to the full record and/or full and complete information in order to provide quality care. The word “treatment” includes, among other things, the coordination and management of health care among health care providers or by a health care provider with a third party, consultations between health care providers, and referrals of a patient for health care from one health care provider to another.

• Payment is when we use and disclose health information to obtain reimbursement for your healthcare. Examples of payment are when we disclose your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.

• Health Care Operations refers to the use and disclosure of health information for activities that relate to the performance and operation of my practice. Examples of health care operations are review of treatment procedures or business operations, quality assessment and improvement activities, and staff training.

Uses and Disclosures Requiring Authorization

We may use or disclose PHI for purposes outside of treatment, payment, or health care operations when your appropriate authorization is obtained. In those instances when we are asked for information for purposes outside of treatment, payment or health care operations, we will obtain an authorization from you before releasing this information. We will also obtain an authorization from you before using or disclosing PHI in a way that is not described in this Notice. You may revoke all such authorizations at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) we have relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.

Uses and Disclosures with Neither Consent nor Authorization

• We may use or disclose PHI without your consent or authorization in certain circumstances, including, but not limited to:

• Child or At-Risk Adult Abuse: If we have reasonable cause to know or suspect that a child has been subjected to abuse or neglect or an at-risk adult has been mistreated, self-neglected, or financially exploited or is at imminent risk of mistreatment, self-neglect, or financial exploitation, then we must report this to the appropriate authorities.

• Health Oversight Activities: If the Colorado state licensing board or an authorized professional review committee is reviewing my services, we may disclose PHI to that board or committee.

• Judicial and Administrative Proceedings: If you are involved in a court proceeding where you are being evaluated for a third party or where the evaluation is court ordered, we may disclose PHI to the court. You will be informed in advance if this is the case.

• Serious Threat to Health or Safety: If you communicate to me a serious threat of imminent physical violence against a specific person or persons, including those identifiable by association with a specific place, we have a duty to notify any person or persons specifically threatened, as well as a duty to protect by taking other appropriate action. If we believe that you are at imminent risk of inflicting serious harm on yourself, we may disclose information necessary to protect you. In either case, we may disclose information in order to initiate hospitalization.

• Business Associates: We may enter into contracts with business associates to provide billing, legal, auditing, and practice management services that are outside entities. In those situations, protected health information will be provided to those contractors as is needed to perform their contracted tasks. Business associates are required to enter into an agreement maintaining the privacy of the protected health information released to them.

• In Compliance with Other State/Federal Laws and Regulations: PHI may be disclosed when the use and disclosure is allowed under other sections of Section 164.512 of the Privacy Rule and the state’s confidentiality law. This includes certain narrowly-defined disclosures to law enforcement agencies, to a health oversight agency (such as HHS), to a medical examiner, for public health purposes relating to disease or FDA-regulated products, or for specialized government functions (fitness for military duties, eligibility for VA benefits, etc.)

IRTC is required to promptly notify you of any breach that may occur that may have compromised the privacy or security of your information.

Special Authorizations - Certain categories of information have extra protections by law, and thus require special written authorizations for disclosures.

• HIV Information: Special legal protections apply to HIV/AIDS related information. I will obtain a special written authorization from you before releasing information related to HIV/AIDS.

• Alcohol and Drug Use Information: Special legal protections apply to information related to alcohol and drug use and treatment. I will obtain a special written authorization from you before releasing information related to alcohol and/or drug use/treatment. You may revoke all such authorizations (of PHI, Psychotherapy Notes, HIV information, and/or Alcohol and Drug Use Information) at any time, provided each revocation is in writing, signed by you, and signed by a witness. You may not revoke an authorization to the extent that (1) I have relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.

Your Choices - For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. We may request you sign a separate document if you authorize us to share certain PHI. You may revoke that authorization at anytime for future disclosure. In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care

• Share information in a disaster relief situation

• Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

Terms of Notice of Privacy Practices

The terms of this notice apply to all records containing your PHI that are created or retained by IRTC. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this notice will be effective for all of your records that IRTC has created or maintained in the past, and for any of your records created or maintained in the future. IRTC is required to abide by the terms of this Notice and any amended notice that may follow. IRTC reserves the right to change the terms of this notice and to make new Notice provisions for all PHI that it maintains. A current copy of this Notice can be found on our practice website. For more on HIPPA, please see: Official Notice of Privacy Practices for Protected Health Information.

This notice is effective January 1st, 2021.