THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. Purpose of Notice Under the federal health care privacy regulations pertaining to Health Insurance Portability and Accountability Act of 1996 set forth at 45 CFR 160.101 et seq. (the “Privacy Regulations”), Flatirons Cognitive Therapy (“the Practice”) is required to protect the privacy of your individually identifiable health information, which includes information about your health history, symptoms, test results, diagnoses, treatment, claims and payment history. We are also required to provide you with this Notice of Protected Health Information Practices regarding our legal duties, policies and procedures to protect and maintain the privacy or your health information (‘the Notice”). We will not use or disclose your health information except as provided for in the Notice. However, we reserve the right to change the terms of this Notice and make new notice provisions for all your health information that we maintain. Permitted Uses and Disclosures of Your Health Information 1. Uses and Disclosures with Patient Consent: Under the Privacy Regulations, after having made good faith efforts to obtain your acknowledgement of receipt of this Notice, we are permitted to use and disclose your health information for the following purposes: a. Treatment. We are permitted to use your health information in the provision and coordination of your health care. We may disclose information contained in your medical record to your primary health care provider, consulting providers, and to other health care personnel who have a need for such information for your care and treatment. For example, your cognitive therapist may disclose your health information when consulting with a physician regarding your medical condition. b. Payment. We are permitted to use your health information for the purposes of determining coverage, billing, claims management, medical data processing and reimbursement. This information may be released to an insurance company, third party payer or other authorized entities involved in the payment of your medical bill and may include copies or portions of your medical record which are necessary for payment of your account. For example, a bill sent to your insurance company may include information Notice of Privacy Practices Page 1 of 5 that identifies you, your diagnosis, and the procedures and supplies used in your treatment. c. Health Care Operations. We are permitted to use and disclose your health information during the Practice’s routine health care operations, including but not limited to, quality assurance, utilization reviews, medical reviews, auditing, accreditation, certification, licensing or credentialing activities and for education purposes. 2. Uses and Disclosures with Patient Authorization. Under the Privacy Regulations, we can use and disclose your health information for purposes other than treatment, payment or health care operations with your written authorization. For example, with your authorization we can provide your name and medical condition to companies who might be able to provide you useful items or services. Under the Privacy Regulations, you may revoke your authorization; however such revocation will not have any effect on uses or disclosures of your health information prior to our receipt of the revocation. 3. Uses and Disclosures With Patient Opportunity to Verbally Agree or Object. Under the Privacy Regulations, we are permitted to disclose your health information without your written consent or authorization to a family Flatirons Cognitive Therapy, 11001 W 120th Ave, Suite 400, Broomfield, CO, 80021 720-953-9323 member, a close personal friend or any other person identified by you, if the information is directly relevant to that person’s involvement in your care or treatment. You must be notified in advance of the use or disclosure and have the opportunity to verbally agree or object. 4. Uses and Disclosures Without an Acknowledgement, Authorization or Opportunity to Verbally Agree or Object. Under the Privacy Regulations, we are permitted to use or disclose your health information without your consent, authorization or the opportunity to verbally agree or object with regard to the following: a. Uses and Disclosures Required by Law. We will disclose your health information when required to do so by law. b. Public Health Activities. We may disclose your health information for public health reporting, reporting of communicable diseases and vital statistics and similar other circumstances. c. Abuse and Neglect. We may disclose your health information if we have a reasonable belief of abuse, neglect or domestic violence. d. Regulatory Agencies. We may disclose your health information to a health care oversight agency for activities authorized by law, including, but not limited to, licensure, certification, audits, investigations and inspections. These activities are necessary for the government and certain private health oversight agencies to monitor the health care system, government programs and compliance with civil rights. e. Judicial and Administrative Proceedings. We may disclose health information in judicial and administrative proceedings, as well as in response to an order of a court, administrative tribunal, or in response to subpoena, summons, warrant, discovery request or similar legal request. f. Law Enforcement Purposes. We may disclose your health information to law enforcement officials when required to do so by law. g. Coroners, Medical Examiners, Funeral Directors. We may disclose your health information to a coroner or medical examiner. This may be necessary, for example, to determine a cause of death. We may also disclose your health information to funeral directors, as necessary, to carry out their duties. h. Research. Under certain circumstances, we may disclose your health information to researchers when their clinical research study has been approved by institutional review board that has reviewed the research proposal and provided that certain safeguards are in place to ensure the privacy and protection Notice of Privacy Practices Page 2 of 5 of your health information. i. Threats to Health and Safety. We may use or disclose your health information if we believe, in good faith, the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. j. Military/Veterans. If you are a member of the armed forces, we may disclose your health information as required by military command authorities. k. Workers’ Compensation. We may disclose your health information to the extent necessary to comply with laws relating to workers’ compensation or other similar programs. l. Marketing. We may use or disclose your health information to make a marketing communication to you, if such communication is conducted face-to-face, concerns products or service or nominal value, or identifies us as the communicating party and that we will receive remuneration for making the communication and, where required by the Privacy Regulations, instructions describing how you may verbally object to receiving future communications. m. Appointment Reminders. We may use and disclose your health information to remind you of an appointment for treatment and medical care at our practice. n. Other Uses and Disclosures. In addition to the reasons outlined above, we may disclose your health Flatirons Cognitive Therapy, 11001 W 120th Ave, Suite 400, Broomfield, CO, 80021 720-953-9323 information for other purposes permitted by the Privacy Regulations. 5. Uses and Disclosures to Business Associates. Within an acknowledgement or a proper authorization, we are permitted to disclose your health information to Business Associates and to allow Business Associates to receive your health information on our behalf. A Business Associate is defined under the Privacy regulations as an individual or entity under contract with us to perform or assist us in a function or activity which requires the use of your health information. Examples of business associates include, but are not limited to, consultants, accountants, lawyers, medical transcriptionists and third party billing companies. We require all Business Associates to protect the confidentiality of your health information. Patient Rights Although your medical record is our property, you have the following rights concerning your medical record and health information: 1. Right to Request Restrictions on the Use and Disclosure of Your Health Information. You have the right to request restrictions on the use and disclosure of your health information for treatment, payment and health care operations. However, we are not required to agree with such a request. If, however, we agree to the requested restriction, it is binding on us. 2. Right to Inspect and Copy Your Health Information. You have the right to inspect and copy your own health information upon request. However, we are not required to provide you access to all the health information that we maintain. For example, this right does not extend to psychotherapy notes, information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative proceeding, or subject to or exempt from Clinical Laboratory Improvements Amendments of 1988. Access may also be denied if disclosure would reasonably endanger you or another person. 3. Right to Verbally Object. You have the right to verbally object to certain disclosures that are routinely made for treatment, payment or healthcare operations or for other purposes without an Authorization. For example, we are required to give you an opportunity to object to the sharing of your health information with a person or family member accompanying you for treatment. Notice of Privacy Practices Page 3 of 5 4. Right to Seek an Amendment of Your Health Information. You have the right to request an amendment of your health information. If we disagree with the requested amendment, we will permit you to include a statement in the record. Moreover, we will provide you with a written explanation of the reasons for the denial and the procedures for filing appropriate complaints and appeals. 5. Right to an Accounting of Disclosure of Your Health information. You have the right to receive an accounting of disclosures made by us of your health information within six (6) years prior to the date of your request; provided, however that we need not provide an accounting for any information disclosed prior to April 14, 2003. The accounting will not include disclosures related to treatment, payment or health care operations, disclosures made to you, disclosures made pursuant to a validly executed authorization, disclosures permitted by the Privacy Regulations, disclosures to persons involved in your care, or disclosures that occurred prior to the April 14, 2003 compliance deadline under the Privacy Regulations. The accounting of disclosures shall include the date of each disclosure, name and address of the person or organization who received your health information, a brief description of the information disclosed, and the purpose for the disclosure. 6. Right to Confidential Communications. You have the right to receive confidential communications of your health information by alternative means or alternative locations. For example, you may request that we only contact you at work or by mail. 7. Right to Revoke Your Authorization. You have the right to revoke a validly executed authorization for the use or disclosure of your health information. However, such revocation will not have any effect on uses or disclosures prior to the receipt of the revocation. 8. Right to Receive a Copy of this Notice. You have the right to receive a copy of this Notice. Flatirons Cognitive Therapy, 11001 W 120th Ave, Suite 400, Broomfield, CO, 80021 720-953-9323 Contact Information and How to Report a Privacy Rights Violation You may file a complaint with us and with the Secretary of DHHS if you believe that your privacy rights have been violated. You may submit your complaint in writing by mail to our privacy officer, Ramya Shyam at Flatirons Cognitive Therapy, LLC, 11001 W 120th Ave, Suite 400, Broomfield, CO 80021. A complaint must name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of HIPAA or this Privacy Policy. A complaint must be received by us or filed with the Secretary of DHHS within 180 days of when you knew or should have known that the act or omission complained of occurred. You will not be retaliated against for filing any complaint. Amendments to this Privacy Policy We reserve the right to revise or amend the Privacy Policy at any time. These revisions or amendments may be made effective for all personal health information we maintain even if created or received prior to the effective date of the revision or amendment. We will provide you with notice of any revisions or amendments to this Privacy Policy or changes in the law affecting this Privacy Notice, by mail or electronically within 60 days of the effective date of such revision, amendment or change. On-going Access to Privacy Policy We will provide you with a copy of the most recent version of this Privacy Policy at any time upon your written request sent to Flatirons Cognitive Therapy, LLC, 11001 W 120th Ave, Suite 400, Broomfield, CO 80021. For any other requests or for further information regarding the privacy of your personal health information, and for information regarding the filing of a complaint with us, please contact our privacy officer Ramya Shyam, at the address, telephone number listed above. Acknowledgement of Receipt of Privacy Notice Purpose of this Acknowledgement Notice of Privacy Practices Page 4 of 5 This Acknowledgement, which allows the practice to use and/or disclosure personally identifiable home information for treatment, payment or healthcare operations, is made pursuant to the requirements of 45 CFR 164.520 ©(2)(ii), part of the federal privacy regulations for the Health Insurance Privacy and Accountability Act of 1996 (the “Privacy Regulations”). Please read the following information carefully: 1. I understand and acknowledge that I am consenting to the use and/or disclosure of personally identifiable health information about me by Flatirons Cognitive Therapy (the “Practice”) for the purpose of treating me, and as necessary in order to carry out any healthcare operations that are permitted in the Privacy Regulations. 2. I am aware that the Practice maintains a Privacy Notice which sets forth the types of uses and disclosures that the Practice is permitted to make under the Privacy Regulations and sets forth in detail the way in which the Practice will make such use or disclosure. By signing this Acknowledgement, I understand and acknowledge that I have received a copy of the Privacy notice. 3. I understand and acknowledge that I have the right to request that the Practice restrict how my information is used or disclosed to carry out treatment, payment or healthcare operations. I understand and acknowledge that the Practice is not required to agree to restrictions requested by me, but if the Practice agrees to such a requested restriction it will be bound by that restriction until I notify it otherwise in writing. Flatirons Cognitive Therapy, 11001 W 120th Ave, Suite 400, Broomfield, CO, 80021 720-953-9323