HIPAA Notice of Privacy Practices

✓ Enhanced Privacy Through Private Pay:

When you choose private pay (not using insurance), your therapy information remains exclusively between you and your therapist. We do not share your information with insurance companies, employers, or any third parties unless you specifically authorize us to do so or we are legally required to disclose it.

• Information about your past, present, or future physical or mental health condition
• Information about the provision of health care services to you
• Information about past, present, or future payment for your health care
• Demographic information (name, address, phone number, email, date of birth, etc.)
• Treatment records, diagnosis information, and clinical notes

A. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health care and related services. This includes consultation with other health care providers regarding your treatment and referral to other providers for services.

Example: If we refer you to a psychiatrist for medication evaluation, we may share relevant treatment information to coordinate your care (with your authorization).

B. Payment

We may use and disclose your PHI to obtain payment for services provided. This applies primarily when you choose to use your out-of-network insurance benefits through Thrizer or submit claims yourself.

Example: If you use out-of-network benefits, we will provide necessary billing information (including diagnosis codes) to process your insurance claim.

C. Health Care Operations

We may use and disclose your PHI for our own health care operations, including quality assessment, training, and other operational activities.

Example: We may use your information in an aggregated, de-identified format to improve our services or for clinical supervision (with all identifying information removed).

D. Business Associates

We may disclose your PHI to business associates who perform services on our behalf (such as electronic health record systems, billing platforms, or secure video conferencing services). These business associates are required by law to protect your information and may only use it as specified in our contracts with them.

Example: Our HIPAA-compliant telehealth platform and electronic health record system have signed Business Associate Agreements to protect your privacy.

• Psychotherapy notes: If we maintain separate psychotherapy notes (process notes), we will not disclose these without your authorization, except in very limited circumstances
• Marketing purposes: We will not use your information for marketing without your permission
• Sale of PHI: We will never sell your information
• Third-party disclosures: Sharing information with family members, employers, attorneys, or others requires your written consent
• Most other purposes: Any use or disclosure not described in this notice will require your written authorization

You have the right to revoke any authorization at any time by submitting a written revocation to our practice. The revocation will not affect any uses or disclosures already made based on your authorization.

A. To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent a serious and imminent threat to your health or safety, or the health or safety of others. Disclosures will be made only to someone able to help prevent the threat.

B. Required by Law

We may disclose your PHI when required by federal, state, or local law, including:

• Mandatory reporting: Child abuse, elder abuse, or dependent adult abuse
• Court orders and subpoenas: When legally compelled by a court or administrative order
• Law enforcement: As required by law or in response to valid legal process
• Workers' compensation: When necessary to comply with workers' compensation laws

C. Health Oversight Activities

We may disclose PHI to health oversight agencies (such as the California Board of Behavioral Sciences) for activities authorized by law, such as audits, investigations, or licensure actions.

D. Coroners and Medical Examiners

We may disclose PHI to coroners or medical examiners as authorized by law.

Enhanced Privacy for Process Notes:

These notes belong to the therapist and receive additional privacy protections. They cannot be disclosed—even to insurance companies—without your specific written authorization. Psychotherapy notes do not include: session dates and times, diagnoses, treatment plans, medications, or test results, which are part of your standard medical record.

A. Right to Inspect and Copy

You have the right to inspect and receive a copy of your medical record and billing records. To request copies, submit a written request to our office. We may charge a reasonable fee for copying and mailing costs. Note: Psychotherapy notes are not included in your right to access.

B. Right to Request Amendment

If you believe your health information is incorrect or incomplete, you may request that we amend it. We may deny your request in certain circumstances, but will provide you with a written explanation.

C. Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your health information. This does not include disclosures for treatment, payment, health care operations, or disclosures you authorized.

D. Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your information. We are not required to agree to your request, but if we do, we will comply with the restriction unless the information is needed for emergency treatment.

E. Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information by alternative means or at alternative locations. For example, you may request that we contact you only via a specific phone number or email address.

F. Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. Contact our office to request a paper copy.

• Maintain the privacy and security of your protected health information
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information
• Follow the duties and privacy practices described in this notice
• Not use or disclose your information other than as described in this notice, unless you give us written permission
• Make available a current copy of this notice upon request

• Secure electronic health records: HIPAA-compliant encrypted systems
• Encrypted communications: All electronic communications are secured
• Secure video platform: HIPAA-compliant telehealth technology
• Access controls: Limited access to your information on a need-to-know basis
• Business Associate Agreements: All third-party vendors sign agreements to protect your data
• Physical security: Secure storage of any physical records
• Staff training: Regular HIPAA compliance training for all staff

We take data security seriously and employ multiple layers of protection to prevent unauthorized access to your information. To date, we have had no breaches of protected health information.

If we make changes to this notice, we will:

• Post the revised notice on our website at cerevity.com
• Make copies available upon request
• Update the effective date at the top of this notice

To File a Complaint with CEREVITY:

Contact us at:

Phone: (562) 295-6650

Address: 3217 East Carson Street, Suite 319, Lakewood, CA 90712

To File a Complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights

U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Phone: 1-877-696-6775

Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

You will not be penalized or retaliated against in any way for filing a complaint.

CEREVITY, Licensed Clinical Social Worker, P.C.

Privacy Officer: Elijah Fernandez

Phone: (562) 295-6650

Address: 3217 East Carson Street, Suite 319, Lakewood, CA 90712

Website: cerevity.com

CEREVITY's Commitment:

• HIPAA Compliant – Rigorous privacy and security protections
• Encrypted Systems – All communications and records are secured
• Private Pay Option – Maximum confidentiality without insurance involvement
• Professional Discretion – Trusted by executives, attorneys, and physicians

Or visit: cerevity.com

Join California's high-achieving professionals who trust CEREVITY for confidential, expert mental health care.

✓ Complete Privacy • ✓ Secure Technology • ✓ California Licensed