NOTICE OF PRIVACY PRACTICES

Effective Date: June 1, 2026

This notice describes how protected health information ("PHI") may be used and disclosed and how you can get access to this information. Please review it carefully.

I. What Is Protected Health Information?

Protected Health Information ("PHI") is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health condition, treatment, or payment for health care services. PHI includes both your medical records and personal information such as your name, Social Security number, address, and phone number — as well as any other records of care generated by this practice.

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") is a federal law that requires that all medical records and other individually identifiable health information used or disclosed by us — in any form, whether electronically, on paper, or orally — be kept properly confidential. This Act gives you, the patient, the right to understand and control how your PHI is used. HIPAA provides penalties for covered entities that misuse personal health information.

II. Our Pledge Regarding Health Information

We understand that your health information is personal, and we are committed to protecting it. We create a record of the care and services you receive from us in order to provide quality care and to comply with certain legal requirements.

Under federal law, we are required to:

• Protect the privacy of your PHI. All employees and clinicians are required to maintain the confidentiality of PHI and receive appropriate privacy training.
• Provide you with this Notice of Privacy Practices explaining our duties and practices.
• Follow the practices and procedures set forth in this Notice.

We reserve the right to change the terms of this Notice, and such changes will apply to all PHI we maintain about you. The updated Notice will be available upon request, at our office, and on our website.

III. How We May Use and Disclose Your Health Information

The following categories describe the ways in which we use and disclose your PHI. Not every use or disclosure within a category will be listed, but all permitted uses and disclosures will fall within one of the categories below.

Treatment

Treatment means providing, coordinating, or managing health care and related services by one or more health care providers. For example, if your clinician consults with another licensed health care provider about your condition, we are permitted to use and disclose your PHI — otherwise confidential — to assist in your diagnosis and treatment. Disclosures for treatment purposes are not limited to the minimum necessary standard because providers need access to full records to provide quality care. Treatment includes coordination and management of care with third parties, consultations between providers, and referrals.

Payment

Payment means activities such as obtaining reimbursement for services, confirming coverage, billing or collections activities, and utilization review. For example, we may send your insurance company a bill for your visit or verify coverage prior to a procedure.

Health Care Operations

Health care operations include the business aspects of running our practice, such as conducting quality assessments, auditing functions, cost management analysis, and customer service. For example, sending new patient survey forms or conducting internal quality reviews.

Appointment Reminders and Health-Related Communications

We may contact you, by phone or in writing, to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also send other communications, including fundraising communications. You have the right to opt out of fundraising communications from us.

Disclosures to Family, Friends, or Others

We may provide your PHI to a family member, friend, or other person you indicate is involved in your care or payment for your care, unless you object in whole or in part. In emergency situations, the opportunity to object may be obtained retroactively.

De-Identified Information

We may create and distribute de-identified health information by removing all references to individually identifiable information, in accordance with HIPAA standards.

IV. Uses and Disclosures That Do Not Require Your Authorization

Subject to certain limitations in the law, we may use and disclose your PHI without your authorization for the following reasons:

• Legal requirements: When disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of such law.
• Public health activities: Including reporting suspected child, elder, or dependent adult abuse, or preventing or reducing a serious threat to anyone's health or safety.
• Health oversight activities: Including audits and investigations.
• Judicial and administrative proceedings: Including responding to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process, provided that efforts have been made to notify you or to obtain a protective order. Our preference is to obtain your authorization before doing so.
• Law enforcement purposes: Including reporting crimes occurring on our premises.
• Coroners or medical examiners: When performing duties authorized by law.
• Research purposes: Including studying and comparing mental health outcomes across treatment approaches, subject to applicable safeguards.
• Specialized government functions: Including ensuring the proper execution of military missions, protecting the President of the United States, conducting intelligence or counterintelligence operations, or helping ensure the safety of individuals within correctional institutions.
• Workers' compensation: We may provide your PHI to comply with workers' compensation laws, although our preference is to obtain your authorization before doing so.

V. Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures of PHI will only be made with your prior written authorization:

• Psychotherapy notes: Any use or disclosure of psychotherapy notes (as defined in 45 C.F.R. § 164.501) requires your authorization, unless the use or disclosure is:
  • For our use in treating you;
  • For training or supervising mental health practitioners to help improve their skills in group, joint, family, or individual counseling or therapy;
  • For use in defending ourselves in legal proceedings instituted by you;
  • For use by the Secretary of Health and Human Services to investigate our compliance with HIPAA;
  • Required by law and limited to the requirements of such law;
  • Required for certain health oversight activities pertaining to the originator of the notes;
  • Required by a coroner performing duties authorized by law; or
  • Required to help avert a serious threat to the health and safety of others.
• Marketing purposes: As a mental health practice, we will not use or disclose your PHI for marketing purposes.
• Sale of PHI: As a mental health practice, we will not sell your PHI in the regular course of our business.
• Other uses and disclosures not described in this Notice.

You may revoke a written authorization at any time. We are required to honor your written revocation, except to the extent that we have already taken action in reliance on your prior authorization.

VI. Your Rights Regarding Your Protected Health Information

Right to Request Restrictions on Uses and Disclosures

You have the right to ask us not to use or disclose certain PHI for treatment, payment, or health care operations purposes, or to limit disclosures to family members, relatives, close personal friends, or any other person you identify. We are not required to agree to your request and may decline if we believe it would affect your care. If we do agree, we must abide by the restriction unless you agree in writing to remove it.

Right to Request Restrictions for Out-of-Pocket Expenses

If you have paid for services out-of-pocket, in full, you have the right to request that we not disclose PHI related solely to those services to a health plan for payment or health care operations purposes. We will accommodate your request except where required by law to disclose.

Right to Request Confidential Communications

You have the right to ask us to contact you in a specific way (for example, by home or office phone) or to send mail to a different address, and we will agree to all reasonable requests.

Right to Inspect and Copy Your PHI

You have the right to get an electronic or paper copy of your medical record and other information we have about you — other than psychotherapy notes. We will provide a copy of your record, or a summary if you agree to receive one, within 30 days of your written request. We may charge a reasonable, cost-based fee as permitted by state law.

Right to Amend Your PHI

If you believe there is a mistake in your PHI or that important information is missing, you have the right to request a correction or addition. We may decline your request, but we will explain why in writing within 60 days of receiving your request.

Right to an Accounting of Disclosures

You have the right to request a list of instances in which we have disclosed your PHI for purposes other than treatment, payment, or health care operations, or for which you provided authorization. We will respond within 60 days of receiving your request. The list will cover disclosures made in the last six years unless you request a shorter period. The first request each year is provided at no charge; additional requests within the same year may incur a reasonable, cost-based fee.

Right to a Copy of This Notice

You have the right to receive a paper or electronic copy of this Notice at any time, even if you have previously agreed to receive it electronically.

Right to Be Advised of a Breach

You have the right to be notified if your unsecured PHI is intentionally or unintentionally disclosed in a manner not permitted under HIPAA.

VII. Complaints

If you believe your privacy rights have been violated, you have the right to file a formal written complaint with our office and with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint. Please feel free to contact your clinician for more information, in person or in writing.

VIII. Practice Contact Information

IX. Changes to this Notice

We reserve the right to revise or change provisions on this Notice. We will implement the new Notice provisions effective for all services provided and confidential information we maintain. The most current version of this notice will be available on our website at https://www.emilywoodmdphd.com/policies. The Notice will contain the effective date on the top of the first page.

X. Acknowledgment of Receipt

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By signing below, you acknowledge that you have received, read, and understood this Notice of Privacy Practices.

Patient (or Legal Guardian if patient is a minor)

Signature: ___________________________________________

Date: ___________________________________________

Printed Name: ___________________________________________

Relationship (if signing on patient's behalf): ___________________________________________