Contents

1. 1. Notice of Privacy Practices for HIPAA Covered Health Care Provider

2. 2. Your Rights

3. 3. Your Choices

4. 4. Our Uses and Disclosures

5. 5. Our Responsibilities

6. 6. Part 2 Patient Notice for Applicable Substance Use Disorder Records

7. 7. Website, Telehealth, SMS/Text Messaging, and Crisis Addendum

8. 8. Acknowledgment of Receipt

1. Notice of Privacy Practices for HIPAA Covered Health Care Provider

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical/mental health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice applies to protected health information maintained by Stock Health LLC DBA Stock Health for Mental Balance, including outpatient mental health and telehealth services. To the extent that Stock Health maintains substance use disorder patient records subject to 42 CFR Part 2, additional confidentiality protections may apply and are described in the Part 2 Patient Notice section of this document.

Quick Summary

2. Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

· You can ask to see or get an electronic or paper copy of your medical record and other health information we maintain about you. Ask us how to do this.

· We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee when allowed by law.

Ask us to correct your medical record

· You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.

· We may say no to your request, but we will tell you why in writing within 60 days.

Request confidential communications

· You can ask us to contact you in a specific way, such as by phone, patient portal, mail, or another reasonable method, or to send mail to a different address.

· We will say yes to all reasonable requests. Please tell us if a communication method is unsafe or not private for you.

Ask us to limit what we use or share

· You can ask us not to use or share certain health information for treatment, payment, or health care operations. We are not required to agree to your request, and we may say no if it could affect your care.

· If we agree to your request, we may still share information if you need emergency treatment.

· If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information with your health insurer for payment or health care operations. We will say yes unless a law requires us to share that information.

Get a list of those with whom we have shared information

· You can ask for a list, called an accounting, of certain disclosures of your health information for six years prior to the date you ask, including who we shared it with and why.

· We will include all disclosures except those about treatment, payment, health care operations, and certain other disclosures such as those you asked us to make. We will provide one accounting per year for free and may charge a reasonable, cost-based fee for another request within 12 months.

Get a copy of this privacy notice

· You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will provide a paper copy promptly.

Choose someone to act for you

· If someone has legal authority to act as your personal representative, such as a medical power of attorney or legal guardian, that person may exercise your rights and make choices about your health information.

· We will confirm the person has this authority before taking action.

File a complaint if you believe your privacy rights have been violated

· You can complain if you believe we have violated your privacy rights by contacting our Privacy Contact listed in this notice.

· You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

· We will not retaliate against you for filing a complaint.

3. Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations below, tell us what you want us to do and we will follow your instructions when required by law and when reasonably possible.

In these cases, you have both the right and choice to tell us to:

· Share information with your family, close friends, or others involved in your care or payment for your care.

· Share information in a disaster relief situation when applicable.

· Use certain methods of communication such as phone, portal, email, text messaging, or mail, subject to safety, privacy, and operational limitations.

If you are not able to tell us your preference, for example if you are unconscious or otherwise unable to communicate, we may share information if we believe it is in your best interest. We may also share information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we never share your information unless you give us written permission:

· Marketing purposes, except as permitted by law.

· Sale of your information. Stock Health does not sell patient information.

· Most sharing of psychotherapy notes, when psychotherapy notes exist and are maintained separately as defined by HIPAA.

Fundraising

Stock Health does not currently use protected health information for fundraising. If this changes, we will follow applicable law and provide a clear way for you to opt out of future fundraising communications. If Part 2 information is involved, we will provide clear and obvious notice in advance and a choice about whether to receive fundraising communications that use Part 2 information.

Hospital Directory

Stock Health is an outpatient practice and does not maintain a hospital directory.

4. Our Uses and Disclosures

We typically use or share your health information in the following ways.

Treat you

We can use your health information and share it with other professionals who are treating you. Example: We may share information with another provider involved in your care to support safe treatment planning, medication coordination, or continuity of care.

Run our organization

We can use and share your health information to run our practice, improve your care, coordinate services, maintain records, conduct quality improvement, and contact you when necessary. Example: We use health information to manage appointments, document care, support billing workflows, and improve our services.

Bill for your services

We can use and share your health information to bill and get payment from health plans or other entities. Example: We may give information to your health insurance plan so it will pay for your services.

Communicate with you about care

We may contact you about scheduling, appointment reminders, intake forms, portal messages, billing questions, refill processes, and other practice-related matters. SMS/text messaging is only used according to our SMS terms and consent process when applicable.

How else can we use or share your health information?

We are allowed or required to share your information in other ways, usually in ways that contribute to the public good, such as public health, safety, oversight, and legal compliance. We must meet conditions in the law before we can share information for these purposes. If we have substance use disorder patient records subject to 42 CFR Part 2, we cannot use or share information from those records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order and subpoena or similar legal requirement.

Help with public health and safety issues

· Preventing disease.

· Reporting adverse reactions to medications.

· Reporting suspected abuse, neglect, or domestic violence as required or permitted by law.

· Preventing or reducing a serious threat to anyone’s health or safety.

· Assisting with product recalls or medication safety concerns when applicable.

Do research

· Stock Health does not currently conduct research using patient information. If research activities occur in the future, we will follow applicable legal requirements.

Comply with the law

· We will share information about you if state or federal law requires it, including with the Department of Health and Human Services if it wants to confirm that we are complying with federal privacy law.

Work with a medical examiner or funeral director

· We can share health information with a coroner, medical examiner, or funeral director when an individual dies, when permitted or required by law.

Address law enforcement, health oversight, and other government requests

· We can share information for law enforcement purposes or with law enforcement officials when permitted or required by law.

· We can share information with health oversight agencies for activities authorized by law.

· We can share information for special government functions such as military, national security, and protective services when applicable and legally permitted.

Respond to lawsuits and legal actions

· We can share health information about you in response to a court or administrative order or in response to a subpoena, when permitted or required by law. Additional protections may apply to mental health records, psychotherapy notes, and Part 2 records.

Follow state law when it is more protective

· To the extent Kansas, New Mexico, or another applicable state law provides greater privacy protection or greater limits on disclosure than federal law, we will follow the more protective law.

5. Our Responsibilities

· We are required by law to maintain the privacy and security of your protected health information.

· We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

· We must follow the duties and privacy practices described in this notice and give you a copy of it.

· We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you give us written permission, you may change your mind at any time by telling us in writing.

· We will use reasonable safeguards to protect communications, including telehealth, portal, email, text/SMS, and phone communications, consistent with applicable law and the limitations of each communication method.

Changes to the Terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on our website.

Questions or Complaints

For questions about this notice or our privacy practices, contact:

6. Part 2 Patient Notice for Applicable Substance Use Disorder Records

Your Information. Your Rights. Our Responsibilities.

This Part 2 Patient Notice applies only to substance use disorder diagnosis, treatment, or referral records maintained by Stock Health that are subject to 42 CFR Part 2. It does not necessarily apply to every record maintained by Stock Health. If you have questions about whether Part 2 applies to your records, contact the Privacy Contact listed in this notice.

In this Part 2 Notice, “your health information” means your substance use disorder patient record, to the extent it is protected by 42 CFR Part 2.

Your Rights Under Part 2

· Consent to most uses and disclosures of your substance use disorder patient records.

· Ask us to limit the information we share.

· Get a copy of this privacy notice in paper or electronic form.

· Discuss this notice with someone in our program.

· Get a list of those with whom we have shared certain electronic records, when required by law.

· Get a list of health care providers who have received your information through certain third parties, when applicable.

· Choose in advance whether to receive fundraising communications, if any.

· File a complaint if you believe your privacy rights have been violated.

Uses and Disclosures With Your Consent

With your consent, we may use and share your Part 2 information as we:

· Treat you and coordinate your care.

· Run our organization and improve our services.

· Bill for our services.

· Fulfill your requests to share information with a person, provider, program, health plan, or other entity you identify.

· Prevent multiple program enrollments when applicable.

· Report about court-referred treatment when applicable and permitted by law.

· Report prescribed substance use disorder treatment medications to a state prescription drug monitoring program when required by law.

Uses and Disclosures Without Your Consent

We may use or share Part 2 information without your consent in limited circumstances, and we must protect your information and limit how we use and share it. Examples include:

· Communications within our program and with qualified service organizations or contractors who help us run the program.

· Bona fide medical emergencies with personnel and health care providers responding to the emergency.

· Public health activities when information does not identify you, or when otherwise permitted by law.

· Scientific research when legal requirements are met and researchers do not include patient-identifying information in reports.

· Audits, evaluations, and health oversight activities as permitted by law.

· Cause of death inquiries as required or allowed by law.

· Reports of suspected child abuse or neglect, limited to the information required by law.

· Reports to law enforcement when a patient commits or threatens to commit a crime on program premises, against program staff, or as otherwise permitted by law.

· Responses to court orders when Part 2 requirements are met.

Consent for Treatment, Payment, and Health Care Operations

You may provide a single consent for future uses and disclosures for treatment, payment, and health care operations purposes. You may also request more limited disclosures, but limiting disclosures may affect our ability to coordinate care, bill services, or provide certain services.

Redisclosure According to HIPAA

When you consent to uses and disclosures for treatment, payment, and health care operations, we may share your Part 2 information with other substance use disorder treatment programs, health care providers, health plans, and health care businesses for those activities. If the person or entity receiving the information is subject to HIPAA, they may be permitted to use and share your information again for purposes allowed by HIPAA. However, your Part 2 information still cannot be used in legal proceedings against you unless you consent or a Part 2 court order and subpoena or similar legal requirement applies.

Legal Proceedings and Court Orders

· We will not use or share your Part 2 information or provide testimony about your Part 2 information in any civil, administrative, criminal, or legislative proceeding against you without your written consent or a court order that meets Part 2 requirements.

· We will only respond to a court order to use or share your Part 2 information if it is accompanied by a subpoena or other similar legal requirement when required.

· We will follow required procedures before using or sharing Part 2 information for investigations or legal proceedings.

Our Responsibilities Under Part 2

· We are required to obtain your consent for most uses and sharing of your Part 2 information.

· We are required by law to maintain the privacy and security of your information.

· We must let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

· We must follow the duties and privacy practices described in this notice and give you a copy of it.

· We will not use or share your information other than as described in this notice unless you tell us we can in writing. You may change your mind in writing at any time.

Complaints

You can complain if you believe we have violated your privacy rights by contacting the Privacy Contact listed in this notice. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. We will not retaliate against you for filing a complaint.

Changes to this Part 2 Notice

We are required to follow the terms of this notice that are currently in effect. We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on our website.

7. Website, Telehealth, SMS/Text Messaging, and Crisis Addendum

This addendum summarizes additional privacy and safety practices related to Stock Health’s website, telehealth services, and electronic communications. This addendum should be read together with the Notice of Privacy Practices, Terms of Service, SMS Terms, Telehealth Consent, and any patient portal policies.

Website and Contact Forms

· Website forms should be used for general inquiries, scheduling requests, and non-urgent administrative communication only.

· Website forms, email, voicemail, and text messages should not be used for emergencies, crisis situations, medication emergencies, or detailed clinical concerns.

· Patients should use the patient portal or another approved clinical communication method for protected health information or clinical questions when instructed by the practice.

Telehealth Disclaimer

Stock Health provides outpatient mental health services, including telehealth care, for appropriate clients. Telehealth allows services to be provided through secure virtual communication; however, it may not be appropriate for every individual, condition, or situation. Telehealth services are not a substitute for emergency care, crisis intervention, inpatient treatment, or immediate safety support.

Crisis and Emergency Disclaimer

Stock Health is not a crisis center, emergency service, or 24-hour mental health response provider. If you are experiencing a psychiatric emergency, suicidal thoughts, thoughts of harming yourself or others, severe emotional distress, medication emergency, substance-related emergency, or any immediate safety concern, call or text 988, call 911, or go to the nearest emergency room. Messages, voicemails, emails, website forms, text messages, and portal requests are not monitored for emergency or crisis situations.

SMS/Text Messaging Privacy

If you consent to receive text messages from Stock Health, we may use your phone number to send conversational messages, customer care messages, appointment reminders, scheduling updates, intake form reminders, and other practice-related communications. Message frequency may vary. Message and data rates may apply.

· You may opt out at any time by replying STOP.

· For assistance, reply HELP or contact Stock Health directly.

· Consent to receive text messages is not a condition of receiving health care services.

· No mobile opt-in information, phone numbers, or text message consent will be shared with third parties or affiliates for marketing or promotional purposes.

· Text messaging is not appropriate for emergencies, crisis situations, medication emergencies, or detailed clinical concerns.