Notice of Privacy Practices

1. What Is Protected Health Information?

"Protected Health Information" (PHI) includes any information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for that healthcare — and that can be used to identify you. This includes your name, address, dates of service, diagnoses, treatment notes, billing records, and any other identifying health-related information.

As your therapist, we create and maintain records of the care and services provided to you. These records are used to provide quality care and comply with legal requirements.

2. How We Use & Disclose Your PHI

The following categories describe the different ways we may use and disclose your protected health information. For each category, we explain what we mean and give some examples.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health treatment. For example, we may share information with other healthcare providers involved in your care, such as your primary care physician, psychiatrist, or other mental health professionals, when clinically appropriate and with your consent.

Payment

We may use and disclose your PHI for payment activities, including billing your insurance company (Blue Cross Blue Shield), processing claims, and verifying coverage. For example, we may send billing records to your insurer to obtain reimbursement for services provided.

Healthcare Operations

We may use and disclose your PHI for our internal practice operations, such as quality assessment, training, licensing, and administrative functions necessary to run the practice. These activities help us improve the quality of care we provide.

3. Permitted Uses Without Your Authorization

In certain situations, we are permitted or required by law to use or disclose your PHI without your written authorization:

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law.

Mandatory Reporting — Abuse & Neglect

As a licensed mental health professional in Montana, we are a mandated reporter. We are required by law to report suspected or known abuse, neglect, or exploitation of a child or vulnerable adult to the appropriate authorities, even without your consent.

Duty to Warn / Serious Threat

If we believe, in good faith, that you pose a serious and imminent threat of harm to yourself or to an identifiable third party, we may be permitted or required to disclose relevant information to law enforcement, emergency services, or the potential victim to prevent or lessen that threat.

Public Health Activities

We may disclose your PHI for public health activities as authorized or required by law, including reporting communicable diseases to public health authorities.

Health Oversight Activities

We may disclose your PHI to health oversight agencies (such as state licensing boards) for activities authorized by law, including audits, investigations, and inspections.

Judicial & Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, or other lawful process, subject to applicable legal protections.

Law Enforcement

We may disclose your PHI to law enforcement under specific, limited circumstances required or permitted by law, such as to identify or locate a suspect, or to report crimes on our premises.

Coroners, Medical Examiners & Funeral Directors

We may disclose PHI to a coroner, medical examiner, or funeral director as necessary to carry out their duties.

Workers' Compensation

We may disclose your PHI for workers' compensation claims or similar programs as authorized by law.

4. Uses Requiring Your Written Authorization

For uses and disclosures not described in this Notice, we will ask for your written authorization before sharing your PHI. This includes, but is not limited to:

• Disclosures to family members, friends, or other individuals (except in emergencies)
• Disclosure to your employer
• Use of your PHI for marketing purposes (we do not engage in this)
• Sale of your PHI (we do not sell PHI)
• Most disclosures of psychotherapy notes (see Section 7)
• Disclosures to attorneys or for legal proceedings not covered above

You may revoke your authorization at any time in writing. The revocation will apply to future uses and disclosures, but not to disclosures we have already made based on the authorization.

5. Your Rights Regarding Your PHI

You have the following rights regarding the PHI we maintain about you. To exercise these rights, please submit a written request to us using the contact information in Section 12.

Right to Access Your Records

You have the right to inspect and obtain a copy of your PHI that we use to make decisions about your care, including your treatment records and billing records. We will provide access within 30 days of your request. We may charge a reasonable cost-based fee for copies. In limited circumstances, we may deny access; if so, we will explain why and provide information on how to appeal.

Right to Request Amendments

If you believe information in your records is incorrect or incomplete, you may request an amendment. We will respond within 60 days. We may deny the request if the information is accurate and complete, was not created by us, or is not part of the records you are entitled to access. If denied, you have the right to submit a statement of disagreement.

Right to an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made by us during the past six years. This right applies to disclosures made for purposes other than treatment, payment, and healthcare operations, and does not include disclosures made with your authorization. We will provide the first accounting in any 12-month period free of charge; subsequent requests may incur a reasonable fee.

Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to all restrictions, but if we do agree, we will comply with the restriction (except in emergencies). Exception: If you have paid for a service entirely out-of-pocket (not through insurance), you have the right to request that we not share information about that service with your health plan, and we must honor that request.

Right to Request Confidential Communications

You may request that we communicate with you about health matters in a certain way or at a certain location. For example, you may request that we only contact you via email or only at a specific phone number. We will accommodate reasonable requests without requiring an explanation.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time. Please contact us and we will provide one promptly.

Right to Be Notified of a Breach

You have the right to be notified if there is a breach of your unsecured PHI, in accordance with HIPAA's Breach Notification Rule (see Section 9).

6. Our Duties

We are required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if there is a breach of your unsecured protected health information

We will not use or disclose your PHI in ways that are inconsistent with this Notice without your written authorization, except as required or permitted by law.

7. Special Protections: Mental Health & Psychotherapy Notes

Because we are a mental health practice, certain additional protections apply to your information under Montana law and HIPAA.

Psychotherapy Notes

Psychotherapy notes (sometimes called "process notes") are notes recorded by your therapist that document the contents of a counseling session and are kept separate from your general medical and billing records. These notes receive heightened protection under HIPAA and Montana law.

In most cases, we will not disclose psychotherapy notes without your specific written authorization, except:

• For training or supervision purposes within the practice
• To defend against a legal action brought by you
• To the Secretary of Health and Human Services for HIPAA compliance investigations
• As required by law (e.g., mandatory reporting, court order)
• To prevent or lessen a serious and imminent threat to health or safety

Substance Use Disorder Records

If any treatment provided involves substance use disorder services, those records may be subject to additional federal confidentiality protections under 42 CFR Part 2. We will inform you if those protections apply to your records.

Montana State Law

Montana law may provide additional privacy protections beyond those required by HIPAA. Where Montana law is more protective of your privacy, we will follow Montana law. This includes additional protections for mental health records under the Montana Mental Health Code.

8. Minor Clients

When we provide services to clients under 18, privacy rights and parental access to records are governed by a combination of federal law (HIPAA), Montana state law, and clinical ethics.

• In general, parents or legal guardians have the right to access the health records of their minor children.
• However, in certain circumstances permitted by Montana law, we may treat a minor's communications as confidential when the minor has consented to care independently (e.g., for certain mental health services).
• We will discuss our approach to confidentiality with both the minor and their parent/guardian at the outset of treatment, and document any agreements in our treatment records.
• Mandatory reporting requirements apply regardless of the client's age.

9. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). Notification will be provided:

• Without unreasonable delay, and
• Within 60 days of discovering the breach

The notice will include a description of what happened, what types of information were involved, what you can do to protect yourself, what we are doing in response, and contact information for questions.

If a breach affects 500 or more individuals in Montana, we will also notify prominent media outlets and the Secretary of Health and Human Services, as required by law.

10. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us directly or with the federal government. We will not retaliate against you for filing a complaint.

11. Changes to This Notice

We reserve the right to change this Notice at any time. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future.

We will post a copy of the current Notice on our website and make it available in our client portal. The effective date of the Notice appears at the top of this page. You may request a copy of the current Notice at any time.

12. Contact Information

For questions about this Notice or to exercise any of your rights described above, please contact: