Notice of Privacy Practices

This Notice describes how your health information may be used and disclosed and how you can access this information. Please review it carefully.

Contact: Jonathan Impellizzeri, Chief Clinical Officer (CCO), Cognitive Behavior Institute, 125 Emeryville Drive, Suite 230, Cranberry Twp, PA 16066. Phone: 724-609-5002.

Our Legal Duty

We are required by law to maintain the privacy of your protected health information (PHI), provide you with this Notice of our legal duties and privacy practices, and notify you in the event of a breach of unsecured PHI. We are committed to protecting your information in accordance with federal and Pennsylvania law. We are required to follow the terms of this Notice currently in effect.

Your Protected Health Information

PHI includes any information about your past, present, or future physical or mental health or condition, the care you receive, and payment for that care. PHI may be in paper, electronic, or oral form.

Information disclosed to another party may be subject to redisclosure by that recipient and may no longer be protected under the HIPAA Privacy Rule; however, other applicable federal or state laws may continue to protect such information.

How We May Use and Disclose Your PHI Without Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment — To provide, coordinate, or manage your health care and related services, including psychotherapy, psychological testing, psychiatric services, and consultations with other health care providers.

Payment — To bill and collect payment for services provided to you, verify insurance coverage, and process claims.

Health Care Operations — To conduct activities necessary to run our practice, including quality assessment, staff training, licensing, accreditation, and compliance.

Appointment Reminders and Health-Related Benefits — To contact you with appointment reminders or information about treatment alternatives or other health-related services.

Individuals Involved in Your Care or Payment — Unless you object, we may share information with family members, close friends, or others you identify if the information is relevant to their involvement in your care or payment.

As Required by Law — We may disclose your PHI when required by federal, state, or local law, including:

• Mandatory reporting of abuse or neglect
• Court orders or subpoenas
• Law enforcement requests
• Health oversight activities
• Coroners, medical examiners, and funeral directors
• Substance use disorder records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide written authorization or a valid court order is issued.

To Prevent Serious Threats to Health or Safety — If we believe there is a serious and imminent threat of harm to yourself or others, we may disclose information to prevent or lessen that threat.

Additional Protections for Mental Health Records

Certain types of health information may be subject to additional protections under federal or state law, including substance use disorder records, mental health records, HIV-related information, and genetic information, and we will comply with all applicable legal requirements. Pennsylvania law provides special protections for mental health records. In most cases, we will not disclose your mental health information without your written consent except when:

• Required by a valid court order
• Necessary to prevent a serious and imminent threat to health or safety
• Required by law, including mandatory reporting obligations
• Needed for limited payment purposes (unless you request restrictions as described below)
• Certain health information related to substance use disorder diagnosis, treatment, or referral ("SUD records") is subject to additional federal confidentiality protections under 42 C.F.R. Part 2.

We will comply with these additional protections where applicable. We may use and disclose SUD records for treatment, payment, and healthcare operations as permitted by law, unless additional restrictions apply. In many cases, your written authorization is required before we may disclose SUD records.

Special Rules for Minors

Pennsylvania law provides additional privacy protections for minors. Minors aged 14 and older may consent to their own outpatient mental health treatment. If a minor provides this consent, they generally control the release of their treatment records. A parent or guardian cannot override this consent or access treatment records without the minor's authorization, except in limited circumstances permitted by law. If a parent or guardian provides consent for treatment, that parent or guardian generally controls the release of treatment records. We will comply with all applicable laws regarding minor consent and confidentiality.

Communication and Telehealth Services

We use secure electronic methods to provide behavioral health services, including therapy, psychological assessment, and psychiatric services. These services may include video sessions, telephone calls, and secure messaging.

Use of Electronic Communication

If you choose to communicate by email or text message, please understand these methods may not be secure. You have the right to decline or limit electronic communications.

Your Rights

• You may request that we communicate with you only in certain ways (for example, by phone, secure messaging, or postal mail).
• You may request restrictions on the information we share through different communication channels.
• You can withdraw consent to telehealth services at any time.
• You have the right to request restrictions on certain uses and disclosures of your substance use disorder records.
• You have the right to request confidential communications regarding your substance use disorder information.
• You have the right to inspect and obtain a copy of your records, including substance use disorder records, as permitted by law.
• You have the right to receive an accounting of certain disclosures of your substance use disorder records.
• Additional protections may apply to substance use disorder records beyond standard HIPAA rights.

Please contact our office if you have questions about telehealth services or wish to request confidential communication preferences.

Uses and Disclosures Requiring Your Authorization

Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke your authorization in writing at any time, except where we have already relied on it.

Examples requiring your authorization include:

• Most uses and disclosures of psychotherapy notes
• Marketing communications
• Sale of your health information

Your Rights Regarding Your PHI

Right to Access — You have the right to inspect and receive a copy of your PHI in a designated record set, including electronic copies if available. We will provide access within 30 days of your request (with one 30-day extension if necessary).

Right to Request Amendment — If you believe your PHI is incorrect or incomplete, you may request an amendment in writing. We may deny your request in certain circumstances.

Right to an Accounting of Disclosures — You may request a list (accounting) of disclosures we have made of your PHI in the six years prior to your request, excluding those for treatment, payment, and health care operations.

Right to Request Restrictions — You may ask us to restrict certain uses or disclosures of your PHI. While we are not required to agree to most restrictions, we must agree to your request not to disclose information about services you paid for in full out of pocket to your health plan, unless disclosure is otherwise required by law.

Right to Request Confidential Communications — You have the right to request that we communicate with you in a specific way or at a specific location. We will accommodate reasonable requests.

Right to a Paper or Electronic Copy of This Notice — You can request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Psychotherapy Notes

Psychotherapy notes are kept separately from your medical record and have special protections. We will not use or disclose psychotherapy notes without your written authorization except in limited situations, such as:

• For our own treatment purposes
• To defend ourselves in legal actions brought by you
• To comply with law or prevent serious harm
• As otherwise permitted by HIPAA

Marketing, Sale, and Fundraising Communications

We will not use or disclose your PHI for marketing purposes or sell your information without your express written authorization. If we contact you for fundraising, you have the right to opt out of receiving such communications, and you will be provided with a clear opportunity to opt out of future fundraising communications with each contact.

Breach Notification

If a breach occurs that may have compromised the privacy or security of your PHI, we will notify you in writing as soon as reasonably possible, and no later than 60 days after discovery.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

To file a complaint or ask questions:

Contact: Jonathan Impellizzeri, Chief Clinical Officer (CCO), Cognitive Behavior Institute, 125 Emeryville Drive, Suite 230, Cranberry Twp, PA 16066. Phone: 724-609-5002.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints.

Changes to This Notice

We reserve the right to change our privacy practices and this Notice at any time. The new Notice will apply to all PHI we maintain and will be available upon request and posted in our office and on our website, if applicable.