NOTICE OF
PRIVACY
PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL AND MENTAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH DATA. PLEASE REVIEW IT CAREFULLY.

Hear and Now Psychology, A Professional Corporation, is required by federal law (HIPAA and the HITECH Act), the California Confidentiality of Medical Information Act (CMIA), and North Carolina law to maintain the privacy and security of your Protected Health Information (PHI), to provide you with this Notice of Privacy Practices explaining our legal duties and privacy practices, and to notify you promptly following a breach of unsecured PHI. PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health condition and related health care services. We are legally bound to follow the terms of the notice currently in effect.

Which Laws Apply: Hear and Now Psychology is subject to federal law and to the laws of California and North Carolina. Where this notice describes a rule that comes from one state's law, it names that state (for example, “Under California law”). When both states' laws apply and they differ, we follow the law that gives your information greater protection, unless a law requires us to do otherwise.

SECTION 1: USES AND DISCLOSURES OF PHI WITHOUT YOUR AUTHORIZATION

We may use or disclose your PHI for treatment, payment, and health care operations without obtaining your prior written authorization:

·Treatment: We may use and disclose your PHI to provide, coordinate, or manage your psychological care. This includes sharing relevant information with clinicians, supervisors, trainees, and administrative staff within our practice who are involved in your care.

·Payment: We may use and disclose your PHI to bill and collect payment for your services from you, an insurance company, or another third-party payer. Because we are primarily a private-pay practice that is out of network with insurance plans, this usually happens only if you request a superbill or otherwise authorize the disclosure in writing. If your sessions are paid for by Lyra Health or another employer-sponsored benefits program, we will share with that program the information it needs to process payment, along with any other information it requires (which, for some programs, includes claims submitted to your own health plan), only with your written consent, which we obtain before your first session. Lyra Health has its own Notice of Privacy Practices, which governs how Lyra itself uses and shares your information.

·Health Care Operations: We may use and disclose your PHI for our internal operations, such as quality assessment, clinical supervision, peer review, financial audits, and legal compliance. Vendors that handle PHI for these purposes, such as our electronic health record (EHR) platform, are bound by Business Associate Agreements (BAAs) or other written confidentiality agreements, as required by N.C. Gen. Stat. § 122C-55(f). We do not enter your identifiable information into artificial intelligence (AI) tools, and we do not record or transcribe your sessions. Any AI tool we use with information about clients receives only de-identified information, is covered by a BAA, and is used only as described in our separate Privacy-First Consent for AI Use. We may also use your PHI to send you appointment reminders or to tell you about treatment alternatives or other services we offer. Our practice creates, stores, and transmits PHI electronically and protects it with physical, technical, and administrative safeguards, as required by the HIPAA Security Rule.

·Required by Law, Mandated Reporting, & Safety Threats: We will disclose PHI when required by federal, California, or North Carolina law. This includes the following safety disclosures:

o   Abuse Reporting: We follow the mandatory reporting laws of California and North Carolina, depending on the circumstances, including where the person at risk is located.

§  Under California law: If we have a reasonable suspicion that a child has been a victim of abuse or neglect, we must report it immediately, or as soon as practicably possible,
to Child Protective Services or local law enforcement (Child Abuse and Neglect Reporting Act, Cal. Penal Code § 11164 et seq.). If we observe, have knowledge of, or
reasonably suspect that an elder (65 or older) or a dependent adult (18–64 with physical or mental limitations) has been a victim of abuse, financial abuse, abandonment,
isolation, or neglect, we must report it to Adult Protective Services or local law enforcement (Cal. Welf. & Inst. Code § 15630).

§  Under North Carolina law: If we have cause to suspect that a juvenile (any person under 18) has been abused, neglected, or is dependent, we must report it to the county
Department of Social Services (N.C. Gen. Stat. § 7B-301). If we have reasonable cause to believe that a disabled adult (an adult who is physically or mentally incapacitated,
including an older adult) needs protective services because of abuse, neglect, or exploitation, we must report it to the county Department of Social Services (N.C. Gen. Stat. §
108A-102).

o   Danger to Self (Suicide Risk & Emergency Evaluation): If we determine that you present an imminent risk of serious harm or death to yourself, we may disclose information without your consent to help keep you safe. This may include contacting family, emergency contacts, emergency medical personnel, a mobile crisis team, or law enforcement, or initiating an emergency evaluation (Cal. Civ. Code § 56.10 and Cal. Evid. Code § 1024; N.C. Gen. Stat. § 122C-55(d); see also § 122C-54(a1)).

o   Gravely Disabled Status (Inability to Meet Basic Needs): If a mental health condition leaves you unable to provide for your own basic needs (food, clothing, or shelter) in a way that makes serious harm likely, we may disclose limited information to medical personnel, crisis services, family members, or legal representatives to arrange an emergency evaluation, protective placement, or stabilization, under California's Lanterman-Petris-Short (LPS) Act or North Carolina's involuntary commitment law (N.C. Gen. Stat. Chapter 122C, Article 5).

o   Danger to Others & Serious Threats:

§  Under California law (Tarasoff “duty to protect”): If you communicate to us a serious threat of physical violence against a reasonably identifiable victim or victims, we
have a legal duty to protect them (Cal. Civ. Code § 43.92). This requires prompt protective action, including reasonable efforts to communicate the threat to the potential
victim(s) and to law enforcement, and may also include seeking emergency psychiatric hospitalization. California law also requires us to report the identity of a person who
communicates such a threat to local law enforcement within 24 hours, which results in a five-year prohibition on possessing or purchasing firearms (Cal. Welf. & Inst. Code §§
8100(b), 8105(c)). These California requirements apply to services we provide under a California psychology license.

§  Under North Carolina law: If we believe there is an imminent danger to the health or safety of another person, or a likelihood that you will commit a felony or violent
misdemeanor, we may disclose the information necessary to protect against it (N.C. Gen. Stat. § 122C-55(d)). This may include warning the intended victim, notifying law
enforcement, or seeking emergency hospitalization.

o   Workers' Compensation: Although we prefer to obtain your authorization, if you file a workers' compensation claim, we may disclose PHI related to your work injury or illness as required or permitted by workers' compensation law.

§  Under California law: A psychologist who treats an injured worker must file a report on the injury and treatment with the employer's insurer (or the employer) and the
Division of Workers' Compensation within five days of the initial examination (Cal. Labor Code §§ 3209.3, 6409). We will disclose other PHI only to the extent authorized by and
necessary to comply with California workers' compensation law.

§  Under North Carolina law: We may disclose your PHI to your employer, its insurance carrier, or the N.C. Industrial Commission only as permitted by N.C. Gen. Stat. § 97-
25.6 or by an order of the Industrial Commission or a court. The law limits disclosure to information reasonably related to the injury or illness and gives you certain rights to
notice and to copies of the records released.

o   Deceased Individuals: Under HIPAA, privacy protections for your health information continue for 50 years after your death, and your records remain confidential after your death under California and North Carolina law. We will not release your records to family members or others after your death unless your legally appointed personal representative (for example, the executor or administrator of your estate), who holds your privilege after death (Cal. Evid. Code § 1013), authorizes it in writing. We may, however, disclose PHI without authorization to coroners, medical examiners, or funeral directors as needed to identify a deceased person or determine a cause of death, to the extent permitted or required by law.

o   Health Oversight Activities: We may disclose PHI to a health oversight agency for activities required or authorized by law, such as audits, investigations, and licensure actions. These agencies include the California Board of Psychology, the North Carolina Psychology Board, the U.S. Department of Health and Human Services, and, for clients whose benefits come through a California-licensed health plan or EAP (including some Lyra Health programs), the California Department of Managed Health Care. If a complaint is filed against a therapist or our practice with either Board, we will disclose records relevant to the complaint as required by law, such as in response to a lawful subpoena or order.

o   Specialized Government Functions & National Security: We may disclose PHI of military personnel and veterans under certain circumstances, or in the interest of national security, such as protecting public officials or conducting lawful intelligence operations, and only when required by law.

o   Public Health & Research: HIPAA permits certain disclosures for public health activities (such as reporting to prevent or control disease) and for approved research. Our practice will make these disclosures only when required by law or with your written authorization.

o   Judicial Proceedings & Law Enforcement: We may disclose your PHI in judicial and administrative proceedings, or to law enforcement officials, when required by federal or state law, including in response to a valid court order or a lawfully issued search warrant. Communications with a psychologist are privileged under California law (Cal. Evid. Code § 1014) and North Carolina law (N.C. Gen. Stat. § 8-53.3), so a subpoena or discovery request alone is not enough for us to release your records. We will assert these protections on your behalf unless you authorize the release in writing or a court orders otherwise.

SECTION 2: SPECIFIC LIMITS & SPECIAL CONDITIONS ON THE USE OF PHI

·Disclosures to Family, Friends, or Others: We may share limited PHI with a family member, friend, or other person you identify who is involved in your care or in paying for it, but only with your written consent (or your oral consent given in the presence of a witness you choose, which we will document in your record). Your consent applies for the period you specify, and you may revoke it at any time. In an emergency involving imminent danger, we may share limited information as described in Section 1.

·Psychotherapy Notes: Psychotherapy notes (private notes kept separate from the rest of your clinical record) require your written authorization for any use or disclosure, except in the limited situations HIPAA permits without it (for example, use by the clinician who wrote them to treat you, supervised training programs, defending ourselves in a legal action you bring, oversight of the clinician who wrote them, or when required by law or needed to prevent a serious and imminent threat to health or safety). Health insurance plans may not condition payment, enrollment, or eligibility on your authorization to release psychotherapy notes.

·Marketing and Sale of PHI: We will never sell your PHI, or use or disclose it for marketing purposes, without your written authorization.

·Other Uses and Disclosures: Any use or disclosure of your PHI not described in this notice requires your written authorization under HIPAA, the California Confidentiality of Medical Information Act (CMIA), and North Carolina law. You may revoke an authorization at any time, as described in Section 3.

·Fundraising Disclosures: Our practice does not engage in fundraising activities and will not use your PHI to contact you for fundraising purposes. However, should we ever use or disclose records protected under 42 C.F.R. Part 2 for fundraising purposes in the future, we will give you a clear and conspicuous opportunity to opt out before any such use or disclosure occurs.

·Substance Use Disorder Treatment Records: Our practice is not a federally assisted substance use disorder treatment program. However, if we receive records from such a program that are protected by 42 C.F.R. Part 2, we will protect them as federal law requires. Under federal law, Part 2 records we receive may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you without your specific written consent or a court order that meets federal requirements. If records we receive include “SUD counseling notes” (notes recorded by a substance use disorder program clinician documenting the contents of a counseling session), any use or disclosure of those notes requires your separate written authorization, which cannot be combined with consent for other types of records. You may revoke that consent at any time, except to the extent we have already acted on it. We provide this information because federal regulations require it.

·California Protections for Reproductive and Gender-Affirming Care Information: For services we provide under a California psychology license, California law restricts the release of medical information related to abortion and gender-affirming care. We will not release that information in response to a subpoena or request based on another state's law that interferes with rights protected in California, and we will not cooperate with an out-of-state inquiry or investigation seeking to identify a person who sought or obtained care that is lawful in California, except as California law allows. California law also limits sharing abortion-related information out of state through electronic health records (Cal. Civ. Code §§ 56.108, 56.109, 56.110). Any such request will receive legal review before we respond.

·De-Identified Data: We may remove all personal identifiers (such as name, birthdate, and address) from your PHI in accordance with HIPAA de-identification standards. De-identified data may be used for internal statistics, practice analytics, or research without your further consent.

SECTION 3: YOUR RIGHTS

Under HIPAA, the HITECH Act, California law (Cal. Health & Safety Code § 123100 et seq.), and North Carolina law (including N.C. Gen. Stat. Chapter 122C), you have the following rights:

·Right to Inspect and Copy: You have the right to inspect and obtain copies of your clinical and billing records, including an electronic copy if we keep your records electronically, and to direct us in writing to send a copy to a person or entity you choose. Under HIPAA, this right does not include psychotherapy notes; however, California law may allow you to request access to them as well. We may deny access only in limited circumstances permitted by HIPAA, such as when a licensed professional determines that access is reasonably likely to endanger your life or physical safety or that of another person. If we deny access, we will explain why in writing, and you may ask to have the denial reviewed by another licensed health care professional who was not involved in the decision, or ask that the information be sent to a licensed mental health professional of your choice. We may charge a reasonable, cost-based fee for copying or preparing records, as permitted by federal and state law (no more than 25 cents per page for paper copies, and one free copy of the relevant records if you need them to support a claim or appeal for public benefits or certain immigration petitions for survivors of crime or abuse, Cal. Health & Safety Code § 123110). If you request psychotherapy notes, we may decline to provide them only if there is a substantial risk of significant adverse or detrimental consequences to you in seeing them; if we decline, we will note the reasons in your record and, at your request, allow a licensed physician, psychologist, or other licensed mental health professional you designate to inspect or receive copies of them (Cal. Health & Safety Code § 123115(b)).

o   Timing: We will allow you to inspect your records within 5 working days of your written request and will send copies within 15 days of your request (Cal. Health & Safety Code
§ 123110). These timelines are faster than the 30 days federal law allows.

·Right to a Treatment Summary: Our practice may provide you with a written summary of your treatment instead of your full clinical record if you request access and agree in advance to receive a summary and to any fee for preparing it (45 C.F.R. § 164.524). We will provide the summary within 10 working days of your request, or within 30 days if your record is unusually long and we notify you of the delay (Cal. Health & Safety Code § 123130).

·Right to Request Restrictions: You may ask us to limit how we use or disclose your PHI for treatment, payment, or operations. We are not required to agree to your request, except as noted below.

·Right to Restrict Out-of-Pocket Disclosures: If you pay for a service in full out of pocket and ask us not to disclose information about that service to your health plan, we must agree.

·Right to Opt Out of Health Information Exchanges (HIE): You have the right to opt out of having your electronic mental health data shared through a statewide health information exchange, including North Carolina's exchange (NC HealthConnex). Our practice does not currently share your information through any health information exchange. If that ever changes, we will notify you in advance of your right to opt out.

·Right to Confidential Communications: You can request that we communicate with you in a specific way or at a specific location (for example, at a specific phone number, through the secure client portal, or at a different mailing address). We will accommodate all reasonable requests and will not ask you to explain why.

·Right to Amend: If you believe the information in your record is incorrect or incomplete, you may request an amendment in writing. We may deny this request if the record is accurate and complete, but we will tell you why in writing within 60 days of receiving your request. You may also submit a written addendum of up to 250 words for each item you believe is incomplete or incorrect; we will attach it to your record and include it whenever we disclose that part of your record (Cal. Health & Safety Code § 123111).

·Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI for purposes other than treatment, payment, or operations. The list will cover up to six years before the date of your request. The first list in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests within that period.

·Right to a Paper Copy: You have the right to receive a paper copy of this notice at any time, even if you agreed to receive it electronically.

·Right to Revoke Authorization: If you provide written authorization for any use or disclosure of your PHI not described in this notice, you have the right to revoke that authorization in writing at any time. Your revocation will stop future disclosures but will not affect any actions taken before the revocation was received.

·Right to File a Complaint Without Fear of Retaliation: If you believe your privacy rights have been violated, you can file a complaint with our Privacy Official, the Secretary of the U.S. Department of Health and Human Services (Office for Civil Rights: www.hhs.gov/hipaa/filing-a-complaint, 1-800-368-1019), the California Board of Psychology, or the North Carolina Psychology Board. Federal law prohibits our practice from retaliating against you, treating you differently, or terminating your care for filing a complaint.

o   California Board of Psychology: 1625 North Market Blvd., Suite N-215, Sacramento, CA 95834; (916) 574-7720 or toll-free (866) 503-3221; bopmail@dca.ca.gov;
‍ ‍www.psychology.ca.gov.

o   North Carolina Psychology Board: 895 State Farm Road, Suite 101, Boone, NC 28607; (828) 262-2258; www.ncpsychologyboard.org.

SECTION 4: CHANGES TO THIS NOTICE, CONTACT INFORMATION & EFFECTIVE DATE

·Changes to the Terms of This Notice: We reserve the right to change the terms of this Notice at any time. Any new Notice will be effective for all PHI that we maintain at that time. If we make material changes, we will provide a revised copy to current clients and post it on our website.

·Data Breach Notification: If a breach of your unsecured PHI occurs, we will notify you by first-class mail (or by email, if you have agreed to electronic notice) without unreasonable delay and no later than 60 days after discovering the breach, or sooner if state law requires (California generally requires notice within 30 calendar days). These obligations come from federal law (HIPAA and the HITECH Act) and applicable state law, including Cal. Civ. Code § 1798.82 and N.C. Gen. Stat. Chapter 75, Article 2A.

For questions, requests regarding your records, or to file a privacy or clinical complaint, please contact our practice:

Phone / Email: (213) 789-7862
info@hearandnowpsychology.com
Effective Date of This Notice: 09/30/26