NOTICE OF PRIVACY PRACTICES

This notice explains how WWBH may use and disclose your health information and records that may identify you as having or having had a substance use disorder. It also describes:

• how WWBH may use and disclose your health information;

• your rights regarding your health information; and

• how to file a complaint about the privacy or security of your health information or about a violation of your rights.

You have a right to a paper or electronic copy of this notice and to discuss it with WWBH’s Privacy Officer by contacting (404) 480-0595 or privacy@wonderingwell.com if you have questions. Please read this notice carefully.

WWBH’S PRIVACY COMMITMENT

WWBH is committed to safeguarding your personal information. When possible, WWBH limits its collection, use, and disclosure of your information to only what is reasonably necessary for your care and safety, practice operations, payment and insurance processing, and to meet its legal obligations. 

INFORMATION PROTECTED BY THIS NOTICE

The Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d et seq., protects your individually identifiable health information, called protected health information (“PHI”), related to your physical or mental health, health care, or payment for care. HIPAA gives special protection to WWBH separately maintained psychotherapy notes, which document or analyze counseling conversations with you. 

42 C.F.R. Part 2 (“Part 2”) protects records that identify you as having or having had a substance use disorder and are created, received, or maintained by WWBH or another federally assisted substance use disorder program (“Part 2 Records”). Part 2 Records may also be PHI. When Part 2 applies, it may add additional protections to Part 2 Records or limit their use and disclosure in ways that HIPAA would otherwise permit.

YOUR RIGHTS

When it comes to your PHI and Part 2 Records, you have the right to:

Get a copy of your PHI in records that WWBH maintains about you.

You may ask to inspect or receive a copy of PHI in the records WWBH maintains about you, including Part 2 Records when Part 2 applies. Your request must be in writing. In most cases, WWBH must respond within thirty (30) days. If WWBH needs more time, it may take one extension of up to thirty (30) days and must notify you in writing of the reason for the delay and the date by which it will respond. WWBH may charge a reasonable, cost-based fee for copying and mailing any records provided to you. In limited circumstances, WWBH may also deny your request. If it does, WWBH will give you a written explanation, explain your right to request review of the denial, and tell you how to file a complaint with WWBH or the U.S. Department of Health and Human Services. 

Authorize or consent to WWBH’s use or disclosure of your information. 

When Part 2 applies, you may give a single written consent for future uses and disclosures of your Part 2 Records for treatment, payment, and health care operations, including sharing them with another treatment professional or submitting them to your insurance plan. You may also give a more limited written consent. WWBH will follow the scope of the consent you sign and applicable law to determine which Part 2 Records may be used or disclosed, if any.

If WWBH maintains substance use disorder (“SUD”) counseling notes about you separately from the rest of your Part 2 Records,  your separate, specific written consent will generally be required before WWBH uses or discloses those notes. WWBH will not condition your treatment on your consent to use or disclose SUD counseling notes. 

You may revoke a HIPAA authorization in writing, except to the extent WWBH has already acted in reliance on it. You may revoke a Part 2 consent in writing as provided by law. Revocation takes effect when WWBH receives your written revocation. It does not undo uses or disclosures of PHI or Part 2 Records already made in reliance on the authorization or consent. 

Ask WWBH to correct your medical record.

You may ask WWBH to amend PHI in the records it maintains about you, including Part 2 Records when Part 2 applies, if you believe information is inaccurate or incomplete. Your request must be in writing and include a reason supporting the request. WWBH will act on your request within sixty (60) days of receiving it and may take one extension of up to thirty (30) days when permitted by law. If WWBH denies your request, you will receive a written explanation and information about your right to submit a statement of disagreement.

Request confidential communications.

You can ask WWBH to contact you in a specific way (for example, by home, office, or cell phone) or send mail to a specific address. WWBH will accommodate all reasonable requests. 

Request limits on what information WWBH uses or shares.

You may ask WWBH to restrict certain uses or disclosures of your PHI, including Part 2 Records when Part 2 applies. WWBH is not generally required to agree to a restriction but will consider your request. When Part 2 applies, you may ask WWBH to restrict uses or disclosures of your Part 2 Records for its treatment, payment, or health care operations. WWBH generally does not have to agree, but must honor any agreed-upon restriction. WWBH may use or disclose restricted Part 2 Records to a health care provider for your emergency treatment. WWBH must ask that provider not to further use or disclose those Part 2 Records.  

If you have insurance and pay in full out of pocket for a service, you may ask WWBH not to disclose PHI related to your services or payment to your insurance plan, including Part 2 Records when Part 2 applies. WWBH will honor your request unless disclosure is required by law.

Get a copy of this privacy notice.

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically. Under Part 2, you may request a paper or electronic copy. WWBH will provide you with any copies promptly.

Get a list of certain disclosures of your information.

You may request an accounting of certain disclosures of your PHI made by WWBH during the six (6) years before your request. HIPAA excludes some disclosures from this accounting, including many disclosures for treatment, payment, and health care operations and disclosures you authorized. You may request one accounting in any twelve (12)-month period without charge. WWBH may charge a reasonable, cost-based fee for additional accountings during that period. If so, WWBH will tell you the fee and give you a chance to withdraw or change your request. 

When Part 2 applies, you may request an accounting of disclosures of your electronic Part 2 Records and other disclosures WWBH made with your written consent during the prior three (3) years. If your written consent allows an intermediary to disclose your Part 2 Records to a general group of health care providers, you may request from the intermediary a list of providers that received your Part 2 Records during the prior three (3) years.

Choose someone to act for you.

If someone has authority to act as your personal representative, such as under a power of attorney, advance directive, or court-ordered guardianship, that person can exercise your rights and make choices about your PHI and, when Part 2 applies, your Part 2 Records. WWBH will verify the person’s identity and authority to act for you before WWBH takes any action.

Discuss this notice with WWBH’s Privacy Officer.

You can ask questions or obtain more information about this notice and WWBH’s privacy practices by contacting WWBH’s Privacy Officer identified below. 

File a complaint if you believe your rights have been violated.

You may complain if you believe WWBH violated your privacy rights regarding your PHI or Part 2 Records by contacting WWBH’s Privacy Officer identified below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or by visiting www.hhs.gov/hipaa/filing-a-complaint/index.html. WWBH will not retaliate against you for filing a complaint.

Choose whether to receive fundraising communications.

WWBH does not currently engage in fundraising. If that practice changes, WWBH will provide any notice and opportunity to opt out required by law.

ROUTINE USES AND DISCLOSURES

How does WWBH typically use or disclose your information?

WWBH may use or disclose your PHI for the purposes described below, as permitted by HIPAA. If PHI is also a Part 2 Record, Part 2 creates additional limits on how WWBH may use or disclose the information.

• To treat you: HIPAA permits WWBH to use or disclose PHI to provide, coordinate, or manage your care without your authorization. When PHI is also a Part 2 Record, WWBH generally needs your written consent or another basis permitted by Part 2 to use or disclose that Part 2 Record for treatment.

• To run WWBH’s practice: HIPAA permits WWBH to use or disclose PHI for health care operations, such as quality assessment and improvement. HIPAA permits WWBH to disclose PHI to a business associate under a written contract that meets HIPAA requirements. If the PHI is also a Part 2 Record, WWBH generally needs your written consent or another basis permitted by Part 2 to use or disclose that Part 2 Record for health care operations.

• To bill for your services: HIPAA permits WWBH to use or disclose PHI to bill for your services and receive payment. If the PHI is also a Part 2 Record, WWBH generally needs your written consent or another basis permitted by Part 2 to use or disclose that record for payment. You may ask WWBH not to disclose PHI about a service you paid for in full to your insurance plan, unless disclosure is required by law.

When may WWBH use or disclose your information without your authorization or consent?

HIPAA permits WWBH to use or disclose your PHI without your written authorization in certain situations. For example, if you agree, WWBH may share with a family member, friend, or another person you identify only PHI directly related to that person’s involvement in your care or payment for care. After WWBH discloses PHI to that person, the person may share it with others. If the person is not subject to HIPAA, HIPAA may no longer protect that PHI. 

HIPAA’s permission does not by itself allow WWBH to disclose Part 2 Records. Part 2 generally requires your written consent before WWBH uses or discloses Part 2 Records, except in the situations described below. Part 2 also limits when WWBH may use or disclose records in legal proceedings against you.

HIPAA generally requires your written authorization for most uses or disclosures of separately maintained psychotherapy notes, for marketing, and for the sale of PHI. When Part 2 applies, WWBH generally needs your written consent before it uses or discloses Part 2 Records to a health plan or another provider for treatment, payment, or health care operations. Any use or disclosure of PHI not described in this notice requires your written HIPAA authorization. Any use or disclosure of Part 2 Records not described in this notice requires your written Part 2 consent, unless applicable law permits or requires the use or disclosure without that authorization or consent.

To work with business associates and qualified service organizations. HIPAA permits WWBH to disclose PHI to a business associate under a written contract that meets HIPAA requirements. Part 2 permits uses and disclosures of Part 2 Records within a Part 2 program or with an entity that has direct administrative control over that program. Part 2 also permits WWBH to disclose to a qualified service organization the Part 2 Records the organization needs to provide services to or on behalf of the program, under a written agreement. WWBH may disclose Part 2 Records for treatment, payment, or health care operations as permitted by your written consent.

For medical emergencies or serious threats. HIPAA permits WWBH to disclose PHI reasonably necessary to prevent or lessen a serious and imminent threat to health or safety. If the PHI is also a Part 2 Record, Part 2 permits WWBH to disclose only the Part 2 Records necessary to meet a bona fide medical emergency to medical personnel when prior written consent cannot be obtained. WWBH must immediately document the Part 2 emergency disclosure in your health record.

Public health and abuse reports. HIPAA permits certain disclosures of PHI to public health authorities. Part 2 permits disclosure of Part 2 Records to public health authorities only in de-identified form. Part 2 does not prohibit reports of suspected child abuse or neglect required by state law. A report does not permit other uses or disclosures of the Part 2 Records.

Research. WWBH does not use or disclose PHI or Part 2 Records for research.  

Required by law and compliance. HIPAA permits WWBH to disclose PHI when the disclosure is required by law. HIPAA also requires WWBH to disclose PHI to the U.S. Department of Health and Human Services for compliance investigations. WWBH may disclose Part 2 Records in these circumstances only when Part 2 permits it.

Audits and health oversight. HIPAA permits WWBH to disclose PHI for health oversight activities. Part 2 permits WWBH to disclose Part 2 Records for management audits, financial audits, and program evaluations only as provided in 42 C.F.R. § 2.53 or with your written consent.

Workers’ compensation, law enforcement, and government functions. HIPAA permits WWBH to disclose PHI in certain workers’ compensation, law enforcement, and specialized government situations. These HIPAA permissions do not by themselves authorize WWBH to disclose Part 2 Records. WWBH may use or disclose Part 2 Records for these purposes only as Part 2 permits.

Crimes on WWBH premises or against staff. HIPAA and Part 2 permit WWBH to disclose limited PHI and Part 2 records to law enforcement about a crime on WWBH’s premises or against WWBH personnel. The report may include only information about the circumstances of the incident, including the individual’s patient status, name, address, and last known whereabouts.

Legal proceedings. HIPAA permits WWBH to disclose PHI in response to a court order or other legal process when certain requirements are met. However, WWBH would not be permitted to use or disclose Part 2 Records, or testimony that would reveal the contents of Part 2 Records, in a proceeding against you without your specific written consent or a court order issued after WWBH has been given adequate notice and an opportunity to be heard. A court order authorizing use or disclosure of Part 2 Records must also be accompanied by a subpoena or similar legal mandate compelling WWBH to disclose them.

State Law confidentiality and privilege. Some Georgia and South Carolina laws protect certain mental health records more strictly than HIPAA and allow disclosure only in specified situations. WWBH will follow those stricter limits when they apply to your PHI or Part 2 Records, along with Part 2 and applicable privilege requirements.

Redisclosure After a General Consent

If you give a single written consent for WWBH to use or disclose your Part 2 Records for treatment, payment, and health care operations, any other Part 2 program, HIPAA covered entity, or business associate that receives those records may redisclose those Part 2 Records as HIPAA permits, without obtaining another Part 2 consent from you.

WWBH’S RESPONSIBILITIES

WWBH is required by law to protect the privacy and security of your PHI and Part 2 Records, provide this notice, follow its current terms, and notify you promptly if a breach of unsecured PHI or Part 2 Records may have compromised their privacy or security. For more information, visit hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

CHANGES TO THE TERMS OF THIS NOTICE

WWBH may change the terms of this notice and apply the revised terms to all PHI and Part 2 Records it maintains. WWBH will make the revised notice available on its website and upon request.

QUESTIONS, REQUESTS, AND COMPLAINTS

You may contact the WWBH Privacy Officer to exercise a right or file a complaint. WWBH will not retaliate against you for filing a complaint.

Privacy Officer: Joann E. Johnston, LCSW | Wondering Well Behavioral Health, LLC | Phone: (404) 480-0595 | Email: privacy@wonderingwell.com

EFFECTIVE DATE

This notice is effective as of 10/13/26.