Access and copy your records. You may ask to inspect or receive an electronic or paper copy of the medical and billing records we maintain about you in a designated record set. We generally respond within 30 days, or sooner when state law applies. We may charge only a reasonable, cost-based fee. If we deny access as permitted by law, we will explain why and tell you whether the decision may be reviewed.

Ask us to correct or amend your records. You may ask us in writing to correct information you believe is inaccurate or incomplete. We may deny the request for reasons permitted by law, such as when the record was not created by us or is accurate and complete. If denied, you may submit a statement of disagreement, and we will explain your other rights.

Request confidential communications. You may ask us to contact you in a particular way or at a different address, telephone number, email address, or patient portal. We will accommodate reasonable requests. Tell us if a particular method is unsafe or unavailable for you.

Ask us to limit what we use or disclose. You may request a restriction on uses or disclosures for treatment, payment, or health care operations, or on disclosures to persons involved in your care. We are not generally required to agree. We must agree not to disclose information to a health plan for payment or operations when the information relates only to an item or service that you, or someone for you, paid for in full, unless the disclosure is required by law.

Receive an accounting of disclosures. You may ask for a list of certain disclosures made during the six years before your request. The list generally does not include disclosures for treatment, payment, or health care operations; disclosures to you; disclosures you authorized; and certain other disclosures excluded by law. One accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional accountings after notifying you in advance.

Receive a paper or electronic copy of this notice. You may ask for a copy at any time, even if you agreed to receive it electronically. The current notice is also available at our locations and on our website.

Choose someone to act for you. A personal representative with legal authority, such as a health care agent, parent, or legal guardian, may exercise your rights. We will verify that authority. State law may limit a representative's access to certain minor-consented services or information when access could cause harm.

Receive breach notification. We will notify you as required by federal or state law if a breach or unauthorized access, use, or disclosure may have compromised the privacy or security of your information.

Revoke an authorization. You may revoke a written authorization at any time by submitting a written request. Revocation will not affect actions already taken in reliance on the authorization or disclosures otherwise permitted or required by law.

For the situations below, tell us your preference. If you are unable to tell us, we may act in your best interest and as permitted by law. You may change your preference by contacting your Case Manager or the Privacy Officer.

Family, friends, and others involved in your care. Unless you object, we may share information directly relevant to a family member, relative, close friend, caregiver, or another person you identify who is involved in your care or payment for your care. We may also notify someone of your location, general condition, or death.

Facility directory. If we maintain a directory, we may include your name, location, general condition, and religious affiliation. Except for religious affiliation, this information may be given to people who ask for you by name; religious affiliation may be given to clergy. You may restrict or opt out of the directory. When a separate California directory-choice form is required, we will provide it.

Disaster relief. We may share limited information with a disaster relief organization to help notify family or others about your condition and location, unless you object when you are able to do so.

Psychotherapy notes. Most uses and disclosures of psychotherapy notes require your written authorization. Limited exceptions include certain uses by the author for treatment, our training programs, and our defense in a legal action you bring, as permitted by law.

Marketing and sale. We will obtain your written authorization for marketing uses or disclosures that require authorization and before selling PHI. We do not sell PHI. Communications about your treatment, care coordination, treatment alternatives, or health-related services may be permitted without authorization.

Fundraising. We may contact you about fundraising if permitted by law, but each communication will explain how to opt out. If a communication would use records protected by 42 CFR Part 2, we will give you clear advance notice and a choice before using those records for fundraising.

We may use or disclose PHI without your written authorization for the purposes below when federal and state law permit or require it. We will apply any more protective law and, where required, limit information to the minimum necessary.

Treatment, Payment, and Health Care Operations

Treatment. We may use and share information with physicians, therapists, nurses, counselors, pharmacies, laboratories, hospitals, post-acute providers, and others involved in diagnosing, treating, coordinating, or transitioning your care. For example, we may send records to a provider who will care for you after discharge.

Payment. We may use and share information to bill you, a health plan, or another payer; verify coverage; obtain prior authorization; determine medical necessity; and collect payment. A bill may identify you, your diagnosis, services, and supplies.

Health care operations. We may use and share information to operate our organization, improve quality and patient safety, train staff and students, credential clinicians, conduct compliance and risk activities, manage business and legal matters, coordinate care, and evaluate services.

For safe facility operations, we may use limited identifiers such as your name, photograph, room or treatment schedule to identify you, match you with medications, food, equipment, clothing, appointments, activities, and care plans, and track your location when clinically necessary. Limited identifiers may appear on schedules, labels, logs, or announcements. We use reasonable safeguards and limit incidental disclosures.

We may communicate with a referral source or prior or subsequent provider when needed for treatment, care transitions, patient safety, or permitted health care operations. We will not use your information to promote our services to a referral source unless the communication is permitted by law or you authorize it.

Other Permitted or Required Uses and Disclosures

Business associates and electronic health information exchange. We may share information with vendors and contractors that perform services for us, such as billing, records copying, technology, analytics, diagnostic testing, or secure health information exchange. Written agreements require them to safeguard PHI and use it only as allowed.

Appointment reminders and health-related services. We may contact you about appointments, follow-up care, treatment alternatives, case management, care coordination, providers, settings of care, and benefits or services that may interest you.

Public health and safety. We may report or share information for disease prevention and control, adverse events, product safety and recalls, public health investigations, suspected abuse or neglect, domestic violence, and to prevent or lessen a serious and imminent threat, when legal conditions are met.

Research. We may use or share information for research approved by an institutional review board or privacy board, under a valid waiver or authorization, for certain preparatory or decedent research, or as a limited data set subject to a data use agreement.

Compliance with law and health oversight. We may disclose information when required by federal, state, or local law and to authorized oversight agencies for audits, inspections, licensure, accreditation, investigations, disciplinary matters, government benefit programs, and health care system oversight.

Legal proceedings and law enforcement. We may disclose information in response to qualifying court orders, warrants, subpoenas, administrative demands, or other lawful process, and for limited law-enforcement purposes permitted by law. We verify the requester's authority and do not disclose information merely because an official asks. California and Part 2 restrictions described below may provide greater protection.

Organ donation, coroners, medical examiners, and funeral directors. We may disclose information to facilitate organ, eye, or tissue donation and transplantation, to identify a deceased person or determine cause of death, and to allow funeral directors to perform their duties.

Workers' compensation and specialized government functions. We may disclose information as authorized for workers' compensation, military and veterans activities, national security and protective services, medical suitability determinations, correctional institutions, and lawful custodial situations.

De-identified information and limited data sets. We may create and use information that does not identify you. We may also use or disclose a limited data set for research, public health, or health care operations under a data use agreement.

More protective records. Information about mental health, developmental disabilities, substance use disorder treatment, HIV/AIDS and certain communicable diseases, genetic testing, reproductive or sexual health, gender-affirming care, and services to which a minor may legally consent may receive additional protection. We will obtain a specific authorization or follow other special procedures when a more protective law requires it.

Substance use disorder records under 42 CFR Part 2. To the extent we are a Part 2 program or create, receive, or maintain patient records protected by Part 2, additional rules apply. A Part 2 program generally obtains consent for most uses and disclosures except as Part 2 permits. Part 2 records, or testimony describing them, will not be used or disclosed in any civil, criminal, administrative, or legislative investigation or proceeding against you unless you provide written consent or a qualifying court order is issued and accompanied by a subpoena or similar legal requirement. Recipients subject to HIPAA may redisclose records received under a valid consent as HIPAA permits, but the restriction on use in proceedings against you continues.

Ambient clinical documentation and artificial intelligence. We may offer technology that listens during an encounter and creates a draft clinical note or assists with other clinical or administrative tasks. A clinician remains responsible for reviewing and completing the record. Before any confidential audio recording, we will give required notice and obtain any consent required by law. You may decline ambient audio recording without losing access to care. Technology vendors that receive PHI must protect it under applicable agreements and law; recordings and generated data are retained or deleted under our approved retention practices.

Electronic communications. Email, text messages, portals, telehealth platforms, and health information networks can carry privacy risks. We use reasonable safeguards and honor reasonable requests for alternative communications. Do not send sensitive information through an unsecured channel unless you accept the risk or we have instructed you to do so.

This section applies when California law governs. The California Confidentiality of Medical Information Act (CMIA) generally prohibits disclosure of medical information without a valid authorization unless a specific exception permits or requires the disclosure. When California law is more protective than HIPAA, we follow California law.

Access, copies, and fees. Subject to lawful exceptions, California patients may inspect records during business hours within five working days after a request and may receive copies within 15 days. Fees will be reasonable and cost-based and will not exceed $0.25 per page for paper copies or $0.50 per page for copies from microfilm, plus other costs permitted by law. Records will not be withheld because of an unpaid bill. California law may provide one free copy of relevant records for certain public-benefit or immigration-related claims.

Patient addendum. After inspecting a record, you may submit a written addendum of up to 250 words for each item you believe is incomplete or incorrect. We will attach the addendum to the record and include it when we disclose the disputed portion.

Unauthorized access, use, or disclosure. If we are a California-licensed clinic, health facility, home health agency, or hospice subject to Health and Safety Code section 1280.15, we will notify the California Department of Public Health and the affected patient or representative no later than 15 business days after detecting unlawful or unauthorized access, use, or disclosure, subject to a legally permitted law-enforcement delay.

Law enforcement, court orders, and out-of-state requests. We will disclose medical information only under legal process recognized by California law, such as a valid California or federal court order or a judicial warrant, or another specific statutory exception. We do not disclose medical information merely because law enforcement requests it. As California law requires, we will not assist out-of-state investigations or proceedings seeking information about abortion, abortion-related services, contraception, or gender-affirming care that is lawful in California, and we will apply special limits to electronic sharing of such information.

Immigration-related information. If we know or collect a patient's place of birth or current or prior immigration status in connection with care, California law treats that information as medical information. We will not disclose medical information for immigration enforcement except as expressly authorized by the patient or as otherwise permitted or required by applicable California or federal law.

Confidential recordings and AI. California generally requires the consent of all parties before a confidential communication is recorded. We will obtain required consent before using an ambient tool that records a confidential encounter. Declining the recording will not affect the availability or quality of your care.

California consumer privacy laws. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, exempts medical information governed by CMIA, PHI governed by HIPAA, and certain other health information maintained under the conditions stated in that law. A separate California consumer privacy notice may apply to personal information that is not exempt, such as certain website or employment information.

This section applies when Texas law governs. The Texas Medical Records Privacy Act and other Texas medical privacy laws may protect health information more broadly than HIPAA. When Texas law is more protective than HIPAA, we follow Texas law.

Notice that PHI is subject to electronic disclosure. We create or receive PHI that is subject to electronic disclosure. Except as Texas or federal law permits or requires, Texas law generally prohibits us from electronically disclosing your PHI to another person without a separate authorization for each disclosure. A separate authorization is not required for electronic disclosure to another covered entity for treatment, payment, or health care operations; for certain insurance or health maintenance organization functions; or as otherwise authorized or required by state or federal law.

Electronic health record access. If we maintain an electronic health record system capable of fulfilling your written request, we will provide the requested electronic health record no later than the 15th business day after receiving the request, subject to lawful exceptions. We may charge reasonable copying and mailing costs but will not charge a retrieval fee.

Marketing. Texas law generally requires prior written authorization before PHI is used or disclosed for marketing communications such as sales calls or advertising, subject to exceptions. A mailed marketing communication that uses PHI will identify the sender, provide a toll-free number, and explain how to be removed from the mailing list, when required.

Sensitive records and breach notice. Texas law may impose additional restrictions on mental health records and communications, HIV or communicable-disease information, genetic information, substance use disorder records, and certain minor records. We will give breach notice as required by Texas and federal law.

Artificial intelligence disclosure. When Texas law requires disclosure that an artificial intelligence system is used in relation to health care services or treatment, we will provide a clear notice no later than the date the service is first provided, or as soon as reasonably possible in an emergency. Any audio recording remains subject to applicable consent requirements.

Other consumer information. This notice addresses PHI and medical records. A separate consumer privacy notice may apply to information outside HIPAA and Texas medical privacy laws, such as certain website or employment information.

• We are required by law to maintain the privacy and security of your PHI and other protected medical information.

• We will notify you promptly, and within any shorter state-law deadline that applies, if a breach or unauthorized access, use, or disclosure may have compromised your information.

• We must follow the duties and privacy practices described in the notice currently in effect and provide a copy upon request.

• We will not use or disclose your information in a way not described in this notice unless you authorize it in writing or the law otherwise permits or requires it.

• We train our workforce, apply reasonable administrative, technical, and physical safeguards, and impose sanctions for violations of privacy policies.

• We will not retaliate against you, deny care, or otherwise penalize you for exercising a privacy right or filing a complaint.

We may change this notice and make the revised terms effective for all information we maintain, including information created or received before the change. The current notice will be posted at our facilities and on www.neuroskills.com and will be available upon request. The effective date appears on the first page.

Contact our Privacy Officer to ask a question, exercise a right, request another copy, or file a complaint. Please do not include sensitive medical information in an ordinary email unless we instruct you to use a secure method.

Copies of this notice are available at each listed location and at www.neuroskills.com. Unless a location provides different instructions, send privacy questions and requests to the central Privacy Officer listed above.