NOTICE OF PRIVACY PRACTICES

This notice explains how medical information about you may be used and disclosed, how substance use disorder records receive additional protection, and how you may exercise your privacy rights. Please review it carefully.

WONDERING WELL’S PRIVACY COMMITMENT

Confidentiality is central to the therapeutic relationship. Wondering Well Behavioral Health, LLC (“Wondering Well”) limits collection, use, and disclosure of your information to what is reasonably necessary for your care, payment, practice operations, safety, and legal obligations. A use or disclosure permitted by law is not automatically required. Unless disclosure is required by law or necessary to address a serious, foreseeable, and imminent risk of harm, Wondering Well will use professional judgment, seek your involvement when feasible, disclose only information directly relevant to the purpose, and choose the least intrusive lawful option.

INFORMATION PROTECTED BY THIS NOTICE

Protected health information (“PHI”) includes information that identifies you and relates to your physical, mental, or behavioral health; diagnosis; demographic information; treatment; payment; or health care services. It may include clinical notes, diagnoses, treatment plans, appointment information, billing records, communications, and telehealth information.

Psychotherapy notes are notes kept separately from the medical record that document or analyze the contents of counseling conversations. The Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d et seq., gives psychotherapy notes special protection. Most uses or disclosures of psychotherapy notes require your specific written authorization.

If your records are protected under 42 C.F.R. Part 2 (“Part 2”), certain uses and disclosures permitted by HIPAA for treatment, payment, and health care operations are materially limited by the stricter standards of those regulations. Part 2 records are records that identify you as having or having had a substance use disorder and are created, received, or maintained by a federally assisted substance use disorder program subject to 42 CFR Part 2. Part 2 provisions in this notice apply whenever WWBH creates, maintains, or receives records protected by Part 2.

YOUR HEALTH INFORMATION RIGHTS

When it comes to your protected health information, you have certain rights. This section explains your rights and some of Wondering Well’s responsibilities to help you. You have the right to:

• Consent to most uses and disclosures of your health information;

• Ask Wondering Well to limit the information it shares;

• Get a copy of this privacy notice;

• Discuss this notice with Wondering Well’s privacy officer;

• Get a list of those with whom Wondering Well has shared your electronic records;

• Get a list of health care providers who have received your information through certain third parties;

• Choose in advance whether to receive fundraising communications; and

• File a complaint if you believe your privacy rights have been violated

Provide consent when WWBH uses or shares your information for most purposes

When Part 2 applies, you may provide a single written consent for future uses and disclosures for treatment, payment, and health care operations, or a more limited written consent. You may revoke a written consent at any time, except to the extent Wondering Well or another lawful holder has already acted in reliance on it. Wondering Well will explain how to revoke consent. A decision not to authorize a disclosure may affect insurance payment or care coordination when the requested disclosure is necessary for that purpose, but WWBH will not condition treatment on consent to use or disclose substnce use disorder counseling notes.

Get an electronic or paper copy of your medical record

You may ask to inspect or receive an electronic or paper copy of PHI in medical records maintained about you. Your request must be in writing. Wondering Well will respond within the time required by law, usually within 30 days, and may charge a reasonable, cost-based fee for copying and mailing. In limited circumstances, Wondering Well may deny your request. In this case, WWBH will give you, in writing, the reasons for the denial and explain your right to have the denial reviewed. 

Ask Wondering Well to correct your medical record

If you believe PHI that Wondering Well maintains about you is inaccurate or incomplete, you may ask Wondering Well to amend it. Your request must be in writing and include a reason supporting the request. Wondering Well may deny the request in certain limited circumstances. If Wondering Well denies the request, it will explain the denial in writing within 60 days, and you may submit a statement of disagreement. 

Request confidential communications

You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address. Wondering Well will accommodate all reasonable requests. Please tell Wondering Well which methods are safe, whether messages may be left, and how payment communications should be handled.

Request limits on what Wondering Well uses or shares

You may ask Wondering Well not to use or share certain health information for treatment, payment, or health care operations. Wondering Well is not generally required to agree, but will consider the request and ordinarily honor it when reasonably feasible. If Part 2 applies, you may request restrictions on disclosures previously authorized by a general treatment, payment, and health care operations consent. Any agreed restriction may be limited when information is needed for emergency treatment or disclosure is required by law.

If you pay for a service or health care item out-of-pocket in full, you can ask Wondering Well not to share that information for the purpose of payment or health care operations with your health insurer. Wondering Well will honor this request unless a law requires WWBH to share that information.

Get a list of those with whom Wondering Well has shared information

You may request an accounting of certain disclosures of your PHI during the six years before your request. HIPAA excludes certain disclosures from that accounting, including many disclosures for treatment, payment, and health care operations and disclosures you authorized. When Part 2 applies, you may also request an accounting of disclosures of electronic Part 2 records for the preceding three years and an accounting of other disclosures made with consent as required by law. Wondering Well will provide the first accounting in a 12-month period without charge and may charge a reasonable, cost-based fee for an additional accounting after notifying you in advance.

Get a copy of this privacy notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. Wondering Well will provide you with a paper copy promptly.

Discuss this notice with Wondering Well’s privacy officer

You can ask questions or obtain more information about this notice and Wondering Well’s privacy practices by calling or emailing the Wondering Well privacy officer identified below. 

Choose someone to act for you

If someone has authority to act as your personal representative, such as if someone has your medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. Wondering Well will verify the person’s identity and authority to act for you before Wondering Well takes any action.

File a complaint if you feel your rights are violated

You can complain if you feel Wondering Well has violated your rights by contacting the privacy officer identified below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or by visiting www.hhs.gov/hipaa/filing-a-complaint/index.html. Neither Wondering Well nor its clinician will retaliate against you for filing a complaint.

Choose whether to receive fundraising communications

Wondering Well does not currently use PHI or Part 2 records for fundraising. If that practice changes, Wondering Well will provide any notice and opportunity to opt out required by law.

YOUR CHOICES

When written consent is required, Wondering Well may use or disclose information only within the scope of that consent. Depending on the information and governing law, consent may authorize Wondering Well to:

• Coordinate your treatment with another provider; 

• COnduct specified payment or health care operations activities;

• Bill for services or communication with your health insurance plan; 

• Fulfill your requests to share information with your consent;

• Prevent multiple program enrollments;

• Provide a narrowly limited report about court-referred treatment when specifically authorized; and

• Report prescribed medications to a prescription drug monitoring program when authorized or required by applicable law.

For certain health information, you can tell us your choices about what Wondering Well shares. If you have a clear preference for how Wondering Well shares your information in the situations described below, tell your clinician what you want Wondering Well to do, and Wondering Well will follow your instructions. In these cases, you have both the right and choice to tell Wondering Well to:

• Authorize disclosure of information with your family, close friends, or others involved in your care or payment for your care; and

• Authorize or permit limited disclosure in a disaster-relief situation when applicable.

Wondering Well does not routinely disclose information to family, friends, or other persons involved in your care without your permission. If you are unable to state a preference, Wondering Well will disclose information only when permitted by law and when disclosure is reasonably necessary for your care or safety. Wondering Well will use professional judgment, consider less intrusive alternatives, and limit any disclosure to information directly relevant to the purpose. Part 2 records will not be disclosed on a best-interest basis unless Part 2 independently permits the disclosure.

Except where a narrow legal exception applies, WWBH will obtain your written authorization or consent before using or disclosing information for:

• Marketing purposes;

• Fundraising, if WWBH ever elects to conduct it using PHI or Part 2 records;

• Sale of your information; and

• Most sharing of psychotherapy notes.

ROUTINE USES AND DISCLOSURES

How does Wondering Well typically use or share your health information?

Wondering Well typically uses or shares your protected health information in the following ways:

• To treat you: Wondering Well may use your information to provide treatment. Wondering Well does not routinely disclose psychotherapy information to outside providers without your permission. When coordination is clinically important, Wondering Well will ordinarily discuss it with you and obtain permission when feasible. HIPAA may permit treatment disclosures without authorization, but Part 2, state confidentiality law, privilege, and Wondering Well’s more protective privacy practices may require or favor written permission.

• To run Wondering Well’s practice: Wondering Well may use the minimum information reasonably necessary for scheduling, quality improvement, credentialing, compliance, security, and other health care operations. Wondering Well may disclose information to vendors that are contractually required to safeguard it, but will not disclose clinical details when administrative information will serve the purpose.

• To bill for your services: Wondering Well may use and disclose the minimum information reasonably necessary to obtain payment. Wondering Well will explain foreseeable insurance-related disclosures and will honor an applicable request to restrict disclosure to a health plan for services paid in full out of pocket.

With your consent, Wondering Well may also use and share your information in the following ways:

• To whomever you name in a consent to share your information;

• To prevent multiple enrollments in withdrawal management or maintenance treatment programs;

• To report participation in treatment required by the criminal justice system; and

• To report prescribed substance use disorder treatment medications to a state prescription drug monitoring program when required by law

How else can Wondering Well use or share your health information?

Law may permit or require other uses or disclosures. Permission under law is not, by itself, Wondering Well’s reason to disclose. Wondering Well will verify the requester’s authority, consider privilege and Part 2 restrictions, use the least intrusive lawful response, and disclose only the information required or directly relevant to the purpose. The categories below describe possibilities; they are not statements that Wondering Well routinely makes these disclosures.

In all cases, including those listed below, if Wondering Well has substance use disorder client records about you, subject to 42 CFR part 2, Wondering Well cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena

To operate the practice and work with contractors. Wondering Well may use information internally and disclose the minimum necessary information to contractors that help operate the practice and are subject to applicable confidentiality obligations and agreements. Wondering Well is a solo practice and does not disclose information to an outside organization merely because that organization performs an administrative role.

For medical emergencies. Wondering Well may disclose information to medical personnel to the extent necessary to meet a bona fide medical emergency. When Part 2 applies, Wondering Well will document the disclosure as required. Wondering Well may also make a disclosure to the Food and Drug Administration when applicable law specifically permits it for an FDA-related health or safety purpose.

Public health and safety. Wondering Well may make a narrowly tailored disclosure only when permitted or required by governing law and after considering whether a less intrusive lawful response is available, including for:

• Preventing disease;

• Helping with product recalls;

• Reporting adverse reactions to medications;

• Making a report of suspected abuse or neglect when legally required or when you authorize it; and

• Preventing or reducing a serious and imminent threat to health or safety, after considering feasible less intrusive protective steps

Research. Wondering Well does not routinely use or disclose identifiable client information for research. Any research use or disclosure would require your written authorization or another lawful basis, applicable ethics or privacy review, and compliance with Part 2 when applicable. Wondering Well will prefer de-identified information when it can serve the purpose.

Comply with the law. Wondering Well will disclose information when a valid law specifically requires disclosure, including to the U.S. Department of Health and Human Services for a lawful compliance investigation. Before disclosing, Wondering Well will verify the demand, consider privilege and Part 2 protections, and limit the response to what the law requires.

Audits, evaluations, credentialing, and oversight. WWBH may use or disclose the minimum information necessary for a legally authorized audit, evaluation, credentialing activity, or oversight activity. When Part 2 applies, Wondering Well will use applicable agreements and safeguards, including restrictions on redisclosure and use against you, and return or destruction requirements where required.

Cause-of-death inquiries. Wondering Well may disclose only the information required by a valid law concerning cause of death, subject to Part 2 and other confidentiality protections.

Workers’ compensation, law enforcement, oversight, and government requests. Wondering Well will not disclose information merely because a government or law enforcement official requests it. Wondering Well will verify legal authority, consider privilege and Part 2, and provide only the minimum information required by a valid legal mandate or specifically authorized by you. This may include narrowly limited disclosures:

• For workers’ compensation claims;

• To law enforcement only when specifically required or permitted by governing law and consistent with applicable privilege and Part 2 protections;

• With health oversight agencies for activities authorized by law; and

• For a legally authorized special government function, when applicable.

Report suspected child abuse and neglect. Wondering Well will only report the information required by law.

Crimes on Wondering Well premises or against staff. When Part 2 applies, Wondering Well may report a crime committed on Wondering Well’s premises or against Wondering Well staff, or a threat to commit such a crime. Any report will be limited to the circumstances of the incident, including the client’s name and address and last known whereabouts, and will not include unrelated treatment information. Wondering Well will consider safety, professional ethics, privilege, and less intrusive lawful alternatives before making a discretionary report

Lawsuits, investigations, and legal proceedings. Wondering Well will not disclose records or provide testimony merely in response to an informal request, attorney request, or facially deficient subpoena. Wondering Well will verify the legal demand; consider therapist-client privilege, state confidentiality law, HIPAA, and Part 2; seek your written authorization when appropriate; assert available protections; and disclose only what a valid legal mandate requires.

Part 2 records, and testimony conveying their contents, may not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless based on your specific written consent or a Part 2 court order. When required by law, an order may be issued only after notice and an opportunity to be heard is provided to you or the record holder. A court order authorizing use or disclosure must be accompanied by a subpoena or similar legal mandate compelling disclosure before the records are used or disclosed. Different rules may apply when Wondering Well must defend itself in a proceeding brought by you, but Wondering Well will limit any disclosure to what governing law permits and the defense reasonably requires.

WONDERING WELL’S RESPONSIBILITIES

Wondering Well is required by law to maintain the privacy and security of your health information, provide this notice, and notify affected individuals following a breach of unsecured PHI or Part 2 records as required by law. HIPAA does not require consent for every treatment, payment, or health care operations use or disclosure; however, Part 2, state law, privilege, and Wondering Well’s more protective commitments may require or favor written permission.

Wondering Well must follow the duties and privacy practices described in the notice currently in effect and give you a copy. Wondering Well will make uses and disclosures not described in this notice only with your written authorization or consent unless law requires otherwise. You may revoke an authorization or consent in writing, except to the extent action has already been taken in reliance on it.

For more information: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part 2

If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2. This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with client consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as: 

• Medical Emergencies: to the extent necessary to treat you; 

• Reporting a crime on Wondering Well’s premises or against Wondering Well personnel, or a threat to commit such a crime, using only the limited information Part 2 permits;

• Child-abuse or neglect reporting: making an initial report as required by state law, while recognizing that Part 2 restrictions continue to apply to the underlying records in later proceedings;

• Certain audits, evaluations, research activities, court-ordered disclosures, and other narrowly defined uses or disclosures expressly permitted by Part 2.

• Fundraising: Wondering Well will provide you with an opportunity to decline to receive any fundraising communications prior to making such communications. You may revoke this consent at any time.

Redisclosure After a General Consent

If you give written consent for future uses and disclosures of Part 2 records for treatment, payment, and health care operations, a Part 2 program, HIPAA covered entity, or business associate that receives the records under that consent may redisclose them without obtaining another Part 2 consent to the extent HIPAA permits. The consent must explain this potential redisclosure. Part 2 records still may not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless based on your specific written consent for that proceeding or a Part 2 court order accompanied by a subpoena or similar legal mandate.

CHANGES TO THE TERMS OF THIS NOTICE

Wondering Well can change the terms of this notice, and the changes will apply to all information Wondering Well has about you. The new notice will be available upon request, in Wondering Well’s office, and on Wondering Well’s website.

QUESTIONS, REQUESTS, AND COMPLAINTS

Contact Wondering Well’s Privacy Officer to exercise a right, request a form, ask a question, or submit a complaint. You will not be retaliated against or denied services for raising a privacy concern.

Privacy Officer:

Joann E. Johnston, LCSW

Wondering Well Behavioral Health, LLC

PO Box 17621, Atlanta, Georgia 30316

Phone: (404) 480-0595

Fax: (404) 937-6160

Email: privacy@wonderingwell.com

EFFECTIVE DATE

This notice is effective as of September 19, 2026.