HIPAA Notice of Privacy Practices

You have the following rights regarding your Protected Health Information (PHI):

• Right to inspect and copy your medical and billing records, with limited exceptions. We will respond to your request within 30 days.
• Right to request amendment of your record if you believe it is incorrect or incomplete.
• Right to an accounting of certain disclosures we've made of your PHI for purposes other than treatment, payment, or operations.
• Right to request restrictions on uses and disclosures of your PHI. We are required to honor restrictions only in specific cases (e.g., when you pay out-of-pocket and ask us not to share with insurance).
• Right to confidential communications at alternative locations or by alternative means.
• Right to a paper copy of this notice, even if you receive it electronically.
• Right to file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

For treatment. We may use your PHI to provide therapy and coordinate with other providers involved in your care, with your authorization where required.

For payment. We may share your PHI with your insurance company to obtain reimbursement — typically diagnosis, dates of service, and CPT codes. We do not share session content with insurers.

For health care operations. We may use your PHI for clinical supervision, quality assurance, training, and business management — always with the minimum necessary information and proper safeguards.

Other uses requiring your written authorization. Most uses and disclosures of psychotherapy notes, marketing communications about our services, and any sale of PHI require your specific written authorization, which you may revoke at any time in writing.

The law permits us to use or disclose your PHI without your authorization in these situations:

• Required by law — court orders, subpoenas, government audits.
• Public health activities — reporting communicable diseases, adverse events.
• Abuse, neglect, or domestic violence — mandatory reporting under Georgia law.
• Health oversight — audits, investigations, licensing reviews.
• Judicial and administrative proceedings — when properly subpoenaed.
• Law enforcement purposes — limited circumstances per HIPAA.
• To avert serious threat to your safety or that of others.
• Workers' compensation, military, national security — narrow specific cases.
• Coroners and funeral directors — in case of death.

For uses and disclosures that don't fall under the above categories, we will request your written authorization. You may revoke an authorization in writing at any time, except to the extent we've already acted on it.

Psychotherapy notes (notes recording the contents of conversations during therapy sessions, kept separate from the rest of the medical record) receive heightened protection under HIPAA. Most disclosures of psychotherapy notes require your specific written authorization.

We use administrative, technical, and physical safeguards: encrypted transmission and storage, access controls, audit logs, staff training, signed Business Associate Agreements with our HIPAA-compliant vendors (EHR, video platform, email), and annual security risk assessments. If a breach affecting your information occurs, we will notify you in accordance with HIPAA Breach Notification Rule timelines.

We may revise this notice. The revised notice will apply to all PHI we maintain, including PHI created or received before the revision. The current notice will be available on our website and at our practice. The effective date at the top reflects the most recent revision.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

To file a complaint with us:

• Email: support@chctherapy.com
• Phone: (404) 832-0102
• Mail: 1317 Preakness Dr, Alpharetta, GA 30022

To file a complaint with HHS:

• Online: hhs.gov/ocr/privacy/hipaa/complaints
• Mail: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201

You will be asked to sign an acknowledgement that you have received a copy of this notice when you become a client. Signing the acknowledgement does not waive any of your privacy rights — it is required by HIPAA solely to confirm that we provided the notice to you.