Notice ofPrivacy Practices

Who This Notice Covers

This Notice is provided by INSIGHT NP IN PSYCHIATRY PLLC, doing business as Mindara NP in Psychiatry (“Mindara,” “we,” “us,” or “our”). We are a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

It applies to the protected health information (“PHI”) we create, receive, or maintain about you — information that identifies you and relates to your past, present, or future physical or mental health condition, the care we provide you, or payment for that care. It covers PHI in every form: electronic, paper, and verbal.

This Notice is separate from, and in addition to, our website Privacy Policy, which describes how we handle information collected through this website.

Our Commitment

We are required by law to maintain the privacy of your PHI, to provide you with this Notice describing our legal duties and privacy practices regarding your PHI, to notify you following a breach of unsecured PHI, and to abide by the terms of the Notice currently in effect. Because we practice psychiatry and mental health care, we recognize that the information we hold is especially sensitive, and we treat it accordingly.

1. How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure is listed, but every use or disclosure we make falls within one of these categories or is otherwise permitted or required by law.

For Treatment

We may use your PHI to provide, coordinate, or manage your psychiatric care and related services. For example, we may review your treatment history and current medications to determine an appropriate prescription; consult with another clinician involved in your care; or share relevant information with your primary care provider or therapist so your care is coordinated.

For Payment

We may use and disclose your PHI to obtain payment for the services we provide. For example, we may send a claim to your health plan containing your diagnosis and the services rendered; verify your insurance eligibility and benefits before your appointment; or provide information needed for prior authorization of a medication or service.

For Health Care Operations

We may use and disclose your PHI for our own operations — the activities necessary to run our practice and ensure quality care. For example, we may review records to evaluate and improve the quality of our services; conduct training, licensing, or credentialing activities; or use information in the course of business planning, audits, and compliance reviews.

Appointment and Care Reminders

We may contact you to remind you of an appointment, to follow up after a visit, or to tell you about treatment alternatives or health-related benefits and services that may interest you. You may ask us to communicate with you in a specific way or at a specific location — see “Right to Request Confidential Communications” below.

To Business Associates

We may disclose your PHI to third parties who perform services on our behalf — for example, scheduling, billing, or technology vendors. Each such party is a Business Associate and is required by a written Business Associate Agreement to safeguard your PHI in the same manner we do, and to use it only for the purposes we have authorized.

2. Uses and Disclosures Permitted or Required Without Your Authorization

Federal and state law permit or require us to use or disclose your PHI without your authorization in certain circumstances, including:

• When required by law — including disclosures to the Secretary of the U.S. Department of Health and Human Services to investigate our compliance with HIPAA
• Public health activities — such as reporting disease, injury, vital events, or adverse reactions to medications
• Victims of abuse, neglect, or domestic violence — reports to authorities authorized by law to receive them
• Health oversight activities — audits, investigations, inspections, and licensure actions by oversight agencies
• Judicial and administrative proceedings — in response to a court order, subpoena, or other lawful process
• Law enforcement purposes — as permitted by law, such as responding to a court order or identifying a suspect or missing person
• To avert a serious threat to health or safety — including our duty to warn or protect where an individual poses a serious and imminent threat to themselves or others
• Coroners, medical examiners, and funeral directors — as necessary to carry out their duties
• Organ, eye, or tissue donation — to organizations that handle procurement or transplantation
• Research — where an institutional review board has approved the research and established protocols to protect your privacy
• Workers’ compensation — as authorized by workers’ compensation laws
• Specialized government functions — including military and veteran activities, national security, and protective services
• Inmates — to a correctional institution or law enforcement official having lawful custody

3. Uses and Disclosures That Require Your Written Authorization

Some uses and disclosures may be made only with your written authorization. These categories are particularly important in a mental health practice:

• Psychotherapy notes. Most uses and disclosures of psychotherapy notes require your written authorization. These are notes recorded by a mental health professional documenting or analyzing a counseling session, kept separate from the rest of your medical record.
• Marketing. Most uses and disclosures of your PHI for marketing purposes require your written authorization.
• Sale of PHI. Any disclosure that constitutes a sale of your PHI requires your written authorization. We do not sell your PHI.
• Other uses not described in this Notice will be made only with your written authorization.

If you give us written authorization, you may revoke it in writing at any time. Your revocation will stop any further use or disclosure for the purposes covered by the authorization, except to the extent we have already acted in reliance on it.

4. Your Rights Regarding Your Health Information

You have the following rights with respect to the PHI we maintain about you. To exercise any of them, contact our Privacy Officer using the information at the end of this Notice. We may ask you to make your request in writing.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI we use to make decisions about your care, including medical and billing records. If you request an electronic copy of information we maintain electronically, we will provide it in the form and format you request if readily producible. We may charge a reasonable, cost-based fee. In limited circumstances we may deny your request, and you may have the right to have that denial reviewed. Psychotherapy notes are excluded from this right of access.

Right to Amend

If you believe the PHI we hold about you is incorrect or incomplete, you may ask us to amend it. We may deny your request if the information was not created by us, is not part of the records we maintain, is not information you would be permitted to inspect and copy, or is accurate and complete. If we deny your request, you may submit a written statement of disagreement that will be included with your records.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI. This accounting does not include disclosures made for treatment, payment, or health care operations, disclosures made to you, or disclosures you authorized. Your request may cover a period of up to six years. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests.

Right to Request Restrictions

You have the right to request a restriction on the PHI we use or disclose for treatment, payment, or health care operations, or to someone involved in your care. We are not required to agree to most requested restrictions. However, we must agree to your request to restrict disclosure of PHI to your health plan if the disclosure is for payment or health care operations and the information pertains solely to a service you have paid for out of pocket in full.

Right to Request Confidential Communications

You have the right to ask that we communicate with you about medical matters in a certain way or at a certain location — for example, only by email, or only at a particular phone number. We will accommodate reasonable requests and will not ask you to explain the reason for your request.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you agreed to receive it electronically. Ask us and we will provide one promptly.

Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI.

Right to Choose Someone to Act for You

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify that the person has this authority before we act.

5. Our Legal Duties

We are required by law to maintain the privacy and security of your PHI, to provide you with this Notice of our legal duties and privacy practices, to notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI, and to follow the terms of the Notice currently in effect.

We maintain administrative, physical, and technical safeguards designed to protect your PHI against unauthorized access, use, or disclosure, and we limit access to the minimum necessary for the task at hand. Members of our workforce receive HIPAA training and are bound by written confidentiality obligations that continue after their employment or role ends.

6. Changes to This Notice

We reserve the right to change this Notice at any time and to make the revised Notice effective for all PHI we already maintain as well as any we receive in the future. Whenever we make a material change, we will post the revised Notice on this page with a new effective date and make paper copies available on request. The effective date appears at the top of this page.

7. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us, with the U.S. Department of Health and Human Services, or both.

With us: Contact our Privacy Officer using the information below. All complaints must be submitted in writing. We will review every complaint we receive.

With the federal government: You may file a complaint with the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201; by calling 1-877-696-6775; or online at hhs.gov/ocr/privacy/hipaa/complaints.

You will not be penalized, retaliated against, or denied services in any way for filing a complaint.