Notice of Privacy Practices

1.1 For Treatment

We use and disclose your PHI to provide, coordinate, and manage your care. Examples: your psychiatrist reviews your therapist’s progress notes before adjusting a medication; your treatment team discusses your progress in a clinical staffing meeting; we send records to your primary care physician or outside therapist so your care is coordinated; we share information with a pharmacy to fill a prescription; we provide information to a hospital if you require a higher level of care.

1.2 For Payment

We use and disclose your PHI to obtain payment for the services we provide. Examples: verifying your insurance benefits before admission; obtaining prior authorization for PHP or IOP; submitting claims that include your diagnosis, dates of service, and the level of care provided; responding to a payer’s request for medical necessity documentation; collecting an unpaid balance.

1.3 For Health Care Operations

We use and disclose your PHI to run our clinic and maintain quality of care. Examples: quality assessment and improvement activities; reviewing the competence and qualifications of our clinicians; conducting training programs; business planning; auditing, including compliance and legal review; and arranging for accounting or legal services.

1.4 Appointment Reminders and Health-Related Communications

We may contact you to remind you of appointments, to tell you about treatment alternatives, or to describe other health-related benefits and services that may be of interest to you. You may ask us to communicate with you only in a certain way or at a certain location, as described in Section 4.

1.5 Individuals Involved in Your Care

Unless you object, we may disclose PHI to a family member, relative, close personal friend, or another person you identify, to the extent that information is directly relevant to that person’s involvement in your care or payment for your care. We may also use or disclose PHI to notify someone of your location or general condition. If you are not present or are unable to agree or object because of incapacity or an emergency, we will use professional judgment to determine whether the disclosure is in your best interest.

1.6 Other Permitted or Required Uses and Disclosures

We may use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limits in federal and Texas law:

• As required by law: when a federal, state, or local law requires the use or disclosure.
• Public health activities: to prevent or control disease, report reactions to medications or product problems, or report births and deaths.
• Victims of abuse, neglect, or domestic violence: to a government authority authorized to receive such reports. Texas law requires us to report suspected abuse or neglect of a child, an elderly person, or a person with a disability.
• Health oversight activities: to agencies conducting audits, investigations, inspections, licensure actions, and civil, administrative, or criminal proceedings.
• Judicial and administrative proceedings: in response to a court order, or in response to a subpoena, discovery request, or other lawful process where satisfactory assurances of notice to you or a protective order have been provided. Mental health records receive additional protection under Texas Health and Safety Code Chapter 611, described in Section 3.
• Law enforcement: to comply with a court order, warrant, subpoena, or summons; to identify or locate a suspect, fugitive, material witness, or missing person; about a victim of a crime under limited circumstances; about a death we believe may have resulted from criminal conduct; and about criminal conduct on our premises.
• To avert a serious threat to health or safety: when we believe in good faith that use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, and the disclosure is to someone able to prevent or lessen the threat. This includes duties recognized under Texas law.
• Coroners, medical examiners, and funeral directors: to identify a deceased person or determine cause of death.
• Organ and tissue donation: to organizations that handle procurement, banking, or transplantation.
• Research: when an institutional review board or privacy board has approved a waiver of authorization, or under other limited circumstances permitted by law.
• Workers’ compensation: as authorized by and to the extent necessary to comply with Texas workers’ compensation laws.
• Military, national security, and correctional institutions: as required by law for armed forces personnel, national security and intelligence activities, protective services for the President, and individuals in custody.
• Business associates: to vendors that perform functions on our behalf, such as billing, electronic health records, telehealth, and secure messaging. Each business associate signs a written agreement requiring it to protect your PHI.

The following uses and disclosures will be made only with your written authorization:

• Psychotherapy notes. Most uses and disclosures of psychotherapy notes require your written authorization. Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a counseling session, kept separate from the rest of your medical record. Limited exceptions apply, including use by the originating clinician for treatment, our own training programs, defending ourselves in a legal action you bring, and certain uses required by law.
• Marketing. Uses and disclosures of PHI for marketing purposes require your written authorization, including any communication for which we receive payment from a third party. This includes use of your name, image, story, or testimonial in advertising, on our website, or on social media.
• Sale of PHI. We will not sell your PHI. Any disclosure that constitutes a sale of PHI requires your written authorization and must state that we will receive payment.
• Substance use disorder (Part 2) records. See Section 5.
• Most electronic disclosures under Texas law. See Section 3.

You may revoke an authorization in writing at any time. Revocation does not affect disclosures we already made in reliance on it.

Where Texas law is more protective than HIPAA, we follow Texas law.

3.1 Mental Health Records: Texas Health and Safety Code Chapter 611

Communications between you and a mental health professional, and records of your identity, diagnosis, evaluation, and treatment, are confidential under Chapter 611 of the Texas Health and Safety Code. We disclose these records only with your written consent or under a specific statutory exception. Chapter 611 places narrower limits on disclosure in judicial proceedings than HIPAA does, and we apply those limits.

Under Chapter 611, we may deny you access to portions of your mental health record if we determine that release would be harmful to your physical, mental, or emotional health. If we deny access, we will tell you in writing, note the denial in your record, and allow you to designate another mental health professional to review the decision.

3.2 Required Notice: Electronic Disclosure of PHI, Texas Health and Safety Code Section 181.154

3.3 Access to Electronic Health Records: Texas Health and Safety Code Section 181.102

If we use an electronic health record system capable of fulfilling your request, we will provide your electronic health record in electronic form no later than the 15th business day after we receive your written request, unless you agree to receive it in another form. This deadline is shorter than the deadline HIPAA sets. We may still deny access to information that is excepted from access under 45 C.F.R. 164.524.

Right to inspect and copy

You may inspect and obtain a copy of your PHI in a designated record set, including in electronic form where we maintain it electronically. Submit your request in writing to our Privacy Officer. We may charge a reasonable, cost-based fee. We will respond within 30 days, or within 15 business days for electronic health records under Texas law. We may deny access in limited circumstances, including where a licensed health care professional determines access is reasonably likely to endanger you or another person. If we deny access, you may request a review of the denial.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it and state the reason. We may deny the request if the information was not created by us, is not part of the designated record set, is not available for inspection, or is accurate and complete. If we deny it, you may submit a statement of disagreement that we will include with the record.

Right to an accounting of disclosures

You may request a list of disclosures we made of your PHI, other than disclosures for treatment, payment, health care operations, disclosures made to you or with your authorization, and certain other exceptions. The request may cover up to six years before the date of the request. The first accounting in any 12-month period is free.

Right to request restrictions

You may ask us to restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to a person involved in your care. We are not required to agree to most restrictions. However, we must agree to your request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations, is not otherwise required by law, and the item or service has been paid for by you or someone on your behalf in full and out of pocket.

Right to request confidential communications

You may ask us to communicate with you about health matters in a certain way or at a certain location, for example only by mobile phone, only at a work address, or in a plain envelope. We will accommodate reasonable requests and will not ask you to explain the reason.

Right to a paper copy of this Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. A copy is posted at our clinic and at saltwoodmentalhealth.com.

Right to be notified of a breach

You have the right to be notified if a breach of your unsecured PHI occurs, as required by federal law and Section 521.053 of the Texas Business and Commerce Code.

Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legally authorized representative or court-appointed guardian, that person can exercise your rights and make choices about your PHI. We will verify the person’s authority before taking action.

Some information in your record may be protected by federal regulations governing the confidentiality of substance use disorder patient records at 42 C.F.R. Part 2. Where we receive or maintain Part 2 records, we handle them as follows:

• We may use and disclose Part 2 records for treatment, payment, and health care operations based on a single prior written consent from you, until you revoke that consent.
• You may revoke your consent at any time, in writing or electronically, except to the extent we have already acted in reliance on it.
• Part 2 records, and any testimony relaying information contained in them, may not be used against you in a criminal investigation or proceeding, or in most civil, administrative, or legislative proceedings, without your written consent or an order from a court of competent jurisdiction that meets the requirements of Part 2.
• We will not use or disclose Part 2 records in a proceeding against you without that consent or court order.
• You may request a list of disclosures of Part 2 records made with your consent in the three years before the request.
• You may file a complaint about a violation of Part 2 with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
• Any disclosure we make of Part 2 records will carry a notice stating that the information may not be redisclosed without consent, unless permitted by Part 2.

• We are required by law to maintain the privacy and security of your PHI.
• We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or disclose your information other than as described here unless you tell us we may in writing. If you tell us we may and then change your mind, you may revoke that permission in writing at any time.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as information we receive in the future. We will post the current Notice at our clinic and at saltwoodmentalhealth.com, with the effective date shown. You may request a copy at any time.

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal government. All complaints must be in writing.

You may also contact the Texas Health and Human Services Commission or the licensing board of the clinician involved.

We will not retaliate against you for filing a complaint.