HIPAA Notice of Privacy Practices

HALY, Inc. is required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice of our legal duties and privacy practices. We are required to abide by the terms of the notice currently in effect.

1. How We May Use and Disclose Your PHI

Treatment. We may use or disclose your PHI to facilitate treatment activities, such as sharing your intake information with a licensed provider, sending clinical summaries between providers involved in your care, or coordinating referrals.

Payment. We may use or disclose your PHI to obtain payment for services, including submitting claims to your insurance company, verifying coverage, and collecting cost-share amounts.

Healthcare Operations. We may use or disclose your PHI for our healthcare operations, including quality assessment, training, accreditation, and legal compliance activities.

Appointment Reminders. We may contact you to provide appointment reminders via phone, text, or email. You may opt out of non-essential communications at any time.

2. Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than treatment, payment, and operations, including:

• Marketing activities
• Sale of your PHI
• Most uses of psychotherapy notes
• Substance use disorder records protected under 42 CFR Part 2

You may revoke your authorization in writing at any time, except to the extent we have already relied on it.

3. Special Protections for Sensitive Information

Certain categories of PHI receive additional protections under federal and state law, including records related to mental health, substance use disorder, HIV/AIDS status, and reproductive health. We apply these special protections in accordance with applicable law.

4. Your Rights Regarding Your PHI

Right to access. You have the right to inspect and obtain a copy of your PHI maintained in our designated record set, with limited exceptions.

Right to amend. You may request that we amend PHI you believe is incorrect or incomplete. We may deny the request if the information was not created by us or is accurate and complete.

Right to an accounting of disclosures. You have the right to receive a list of certain disclosures we have made of your PHI in the six years prior to the date of your request.

Right to request restrictions. You may request restrictions on how we use or disclose your PHI. We are not required to agree to a requested restriction, except that we must agree not to disclose PHI to your health plan if you have paid in full out of pocket for a service.

Right to confidential communications. You may request that we communicate with you about PHI in a specific way or location (for example, by mail only). We will accommodate reasonable requests.

Right to a paper copy of this Notice. You have the right to request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

5. Minor Patients and Parental Access

Because HALY serves children and adolescents, parents and legal guardians generally have the right to access their minor child's PHI as personal representatives under HIPAA. However, this right is not absolute and may be limited in the following circumstances:

• The minor has consented to care and the applicable state law does not require parental notification (common for certain mental health, substance use, or reproductive health services for minors 12 and older in many states).
• A licensed provider determines that providing parental access would be reasonably likely to endanger the minor.
• The minor and the parent agree that the treating provider should maintain confidentiality.

Where state law grants the minor independent rights, we will apply those protections and inform the parent that access to certain records may be restricted. Contact our Privacy Officer at privacy@halychild.com with questions about your child's records.

6. Our Duties

We are required by law to:

• Maintain the privacy of your PHI
• Provide you with this notice of our duties and privacy practices
• Notify you following a breach of your unsecured PHI
• Abide by the terms of the notice currently in effect

6. Changes to This Notice

We reserve the right to change this Notice at any time. Changes will apply to PHI already on file with us. We will post the revised Notice on our website and provide a copy upon request.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

To file a complaint with HALY, contact our Privacy Officer at privacy@halychild.com.

8. Contact Information

For questions about this Notice or to exercise your rights, contact our Privacy Officer:

HALY, Inc. — Privacy Officer
340 Pine St, Suite 800
San Francisco, CA 94104
privacy@halychild.com