I. Our Commitment to Your Privacy

Centrec Care ("we," "us," "our," or "the Practice") is committed to protecting the privacy and security of your protected health information ("PHI"). PHI includes information about your health condition, the health care services you receive from us, and payment for those services, when that information can be linked to you individually.

We are required by federal law, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the HITECH Act, the regulations under 45 C.F.R. Parts 160 and 164, the 2024 HIPAA Privacy Rule Final Rule, and the 2024 42 C.F.R. Part 2 Final Rule (as applicable), as well as by the laws of the State of Missouri, to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices regarding your PHI, and to abide by the terms of this Notice currently in effect.

Because we provide psychiatric and mental health services, your records may receive additional protections under both federal and Missouri law, as described in this Notice.

II. How We May Use and Disclose Your Protected Health Information

We may use or disclose your PHI for the following purposes without your written authorization:

A. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health care and related services. This includes consultations between health care providers regarding your care, referrals to other providers, and coordination with pharmacies for prescription management. For example, we may share your PHI with a primary care physician who is also treating you, or with a pharmacy to fulfill a prescription.

B. Payment

We may use and disclose your PHI to obtain payment for services we provide to you. This may include activities such as submitting claims to your health insurance plan, verifying insurance coverage, collecting copayments and deductibles, and conducting utilization review. For example, we may send your diagnosis and treatment information to your insurance company for reimbursement.

C. Health Care Operations

We may use and disclose your PHI for our health care operations, which include quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, conducting training programs, accreditation activities, compliance activities, business planning, and general administrative activities. For example, we may use your PHI to evaluate the quality of care you received or to train staff.

D. As Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law. This includes mandatory reporting obligations.

E. Public Health Activities

We may disclose your PHI for public health activities permitted or required by law, including reporting diseases, injuries, vital events, and conducting public health surveillance or investigations.

F. Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure proceedings.

G. Judicial and Administrative Proceedings

We may disclose your PHI in the course of any judicial or administrative proceeding, in response to a court order or administrative tribunal, or in response to a subpoena, discovery request, or other lawful process, subject to applicable conditions and limitations.

H. Law Enforcement Purposes

We may disclose your PHI for certain law enforcement purposes, including in response to a court order, warrant, subpoena, or summons issued by a judicial officer; to identify or locate a suspect, fugitive, material witness, or missing person; or when the information pertains to a victim of a crime under certain limited circumstances.

I. To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public or another person. Any disclosure will be made only to a person or persons reasonably able to prevent or lessen the threat.

J. Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to a coroner or medical examiner for the purposes of identifying a deceased person, determining a cause of death, or as otherwise authorized by law. We may also disclose PHI to funeral directors as necessary to carry out their duties.

K. Workers' Compensation

We may disclose your PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs.

L. Specialized Government Functions

We may disclose your PHI for military, national security, and intelligence activities, protective services for the President, and other specialized government functions as permitted by law.

M. Inmates and Individuals in Custody

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the institution or official under certain circumstances as required by law.

N. Appointment Reminders, Treatment Alternatives, and Health-Related Benefits

We may use and disclose your PHI to contact you with appointment reminders, to inform you about treatment alternatives, or to provide you with information about health-related benefits and services that may be of interest to you.

O. Contact Form Communications

If you submit information through a contact form on our website, that information may be used to respond to your inquiry, schedule appointments, or follow up on your request. Information submitted through online forms is not a secure communication method, and you should avoid including sensitive health information in contact form submissions. We will take reasonable steps to protect information received through these channels.

III. Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above (or as otherwise permitted or required by law). The following uses and disclosures require your written authorization:

• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization, except for face-to-face communications and promotional gifts of nominal value.
• Sale of PHI: We will not sell your PHI without your written authorization.
• Most uses and disclosures of psychotherapy notes (see Section IV below).
• Any other uses and disclosures not described in this Notice.

You may revoke any authorization you provide to us at any time by submitting a written revocation to our Privacy Officer. Your revocation will not affect any uses or disclosures we made in reliance on your authorization before we received your revocation.

IV. Special Protections for Psychotherapy Notes

"Psychotherapy notes" are notes recorded by a mental health professional documenting or analyzing the contents of a counseling or therapy session and that are separated from the rest of your medical record. Psychotherapy notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

We will not use or disclose your psychotherapy notes without your written authorization, except for the following limited purposes as permitted by law:

• Use by the originator of the psychotherapy notes for treatment purposes.
• Use or disclosure by the Practice for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
• Use or disclosure by the Practice to defend itself in a legal action or other proceeding brought by you.
• Use or disclosure required by the U.S. Department of Health and Human Services to investigate or determine our compliance with HIPAA.
• Use or disclosure required by law.
• Use or disclosure to a health oversight agency for oversight of the originator of the psychotherapy notes.
• Use or disclosure to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as required by law; or to avert a serious and imminent threat to health or safety.

V. Substance Use Disorder Records — 42 C.F.R. Part 2 Protections

Records relating to substance use disorder ("SUD") treatment that are received from programs subject to 42 C.F.R. Part 2 are afforded heightened confidentiality protections under federal law. The following restrictions apply to SUD records:

• Prohibited uses in legal proceedings: SUD records received from a Part 2 program, or testimony relaying the content of such records, may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding conducted by any federal, state, or local authority against the patient, unless based on the patient's prior written consent or a court order issued after notice and an opportunity to be heard. For example, these records cannot be introduced as evidence against you in a criminal prosecution or used in a custody dispute without your consent or a qualifying court order.
• Restrictions beyond HIPAA: Certain disclosures that may be permitted under HIPAA are not permitted for Part 2-protected SUD records. Where Part 2 is more restrictive than HIPAA, the Part 2 requirements apply. For example, while HIPAA may permit disclosures to law enforcement in some circumstances, Part 2 may prohibit such disclosures of SUD records absent consent or a court order.
• Redisclosure restrictions: PHI disclosed by this Practice may, in some circumstances, be redisclosed by the recipient and may no longer be protected by HIPAA. However, SUD records protected by Part 2 maintain their protections even when shared with other parties, and redisclosure is restricted.
• Consent requirements: You have the right to request restrictions on disclosures of SUD records made with your prior consent for purposes of treatment, payment, and health care operations.

We comply with all requirements of 42 C.F.R. Part 2 as amended by the 2024 Part 2 Final Rule, and our uses and disclosures of SUD records are governed by the more restrictive of HIPAA or Part 2.

VI. Reproductive Health Care Information

Pursuant to the HIPAA Privacy Rule as amended by the 2024 Final Rule, we will not use or disclose your PHI for the purpose of conducting a criminal, civil, or administrative investigation into, or imposing criminal, civil, or administrative liability on, any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care. This protection applies regardless of the state in which the reproductive health care was provided.

We may be required to obtain an attestation from persons requesting PHI potentially related to reproductive health care, certifying that the request is not for a prohibited purpose, before disclosing such information.

VII. Your Rights Regarding Your Protected Health Information

You have the following rights with respect to your PHI:

A. Right to Access and Inspect

You have the right to access and inspect your PHI that is maintained in a designated record set, with limited exceptions. You may request your records in a format that is convenient for you, including electronic format. We will provide your records in the requested format if readily producible, or in a mutually agreed-upon alternative format. We may charge a reasonable, cost-based fee for copies. To exercise this right, submit a written request to our Privacy Officer.

B. Right to Request Amendment

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances, but we will provide you with a written explanation if we do. To exercise this right, submit a written request to our Privacy Officer explaining why the amendment is needed.

C. Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI. This accounting will not include disclosures made for treatment, payment, or health care operations, disclosures you authorized, or certain other disclosures. The accounting will cover disclosures made in the six (6) years prior to your request (not including disclosures made before the effective date of this Notice). We will provide one accounting per 12-month period at no charge; we may charge a reasonable fee for additional requests. To exercise this right, submit a written request to our Privacy Officer.

D. Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except that we must comply with your request to restrict disclosure to a health plan for services you paid for entirely out of pocket. You also have the right to request restrictions on disclosures of SUD records made with your prior consent for purposes of treatment, payment, and health care operations. To exercise this right, submit a written request to our Privacy Officer.

E. Right to Request Confidential Communications

You have the right to request that we communicate with you about your health care in a certain way or at a certain location. For example, you may request that we contact you only at a specific phone number or by mail to a specific address. We will accommodate reasonable requests. To exercise this right, submit a written request to our Privacy Officer.

F. Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive the Notice electronically. To obtain a paper copy, contact our Privacy Officer.

G. Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI. We will notify you of any such breach as required by law.

H. Right to Revoke Authorization

If you have provided us with a written authorization for uses or disclosures of your PHI, you have the right to revoke that authorization at any time by providing written notice to our Privacy Officer. Revocation will not affect any actions we took in reliance on your authorization before we received your revocation.

VIII. Missouri State Privacy Protections

In addition to the federal protections described above, the State of Missouri provides additional privacy protections for mental health records that apply to our Practice:

A. Missouri Mental Health Confidentiality (RSMo § 630.140)

Under Missouri law, information and records compiled, obtained, prepared, or maintained by mental health facilities or programs in the course of providing services to patients are confidential. These records may not be disclosed except as specifically authorized under Missouri law, and any release of records must be documented, including the dates, nature, purposes, and recipients of any records disclosed.

B. Missouri Physician-Patient Privilege

Missouri law recognizes a physician-patient privilege that protects communications between patients and their treating physicians, including psychiatrists. This privilege generally prevents a physician from being compelled to disclose patient communications in legal proceedings without the patient's consent, subject to limited exceptions recognized under Missouri law.

C. Missouri Licensed Professional Counselors and Psychologists (RSMo § 337.636)

Missouri law provides additional confidentiality protections for communications between patients and licensed professional counselors, psychologists, and clinical social workers. These protections restrict the disclosure of patient information by these professionals.

D. Permitted Disclosures Under Missouri Law

Missouri law permits disclosure of mental health records without patient consent in limited circumstances, including disclosure to persons or agencies responsible for providing health care services to the patient, when ordered by a court, for purposes of audits or evaluations by authorized governmental agencies, to law enforcement when a patient presents an imminent danger, and as otherwise required by law.

E. Patient Rights Under Missouri Law

Under Missouri law, every consumer of mental health services has the right to confidentiality of information and records in accordance with federal and state law, the right to give or withhold written approval before information is released, and the right to access their own mental and medical records. These rights apply in addition to the federal rights described in Section VII of this Notice.

F. More Restrictive Standard

Where Missouri law provides greater privacy protections than HIPAA, we will comply with the more restrictive Missouri law. We apply the most protective standard available under applicable law to your mental health records.

IX. Our Duties

We are required by law to maintain the privacy of your PHI and to provide you with this Notice of our legal duties and privacy practices. We are required to abide by the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI that we maintain, including PHI we created or received before the change. If we make a material change to this Notice, we will make the revised Notice available on our website and at our office, and we will provide a copy to you upon request.

X. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. To file a complaint with us, contact our Privacy Officer using the information below. To file a complaint with the Office for Civil Rights, you may write to:

You may also file a complaint with the Missouri Department of Mental Health or the Missouri Attorney General's Office if you believe your rights under Missouri law have been violated.

You will not be retaliated against for filing a complaint.

XI. Contact Information

If you have any questions about this Notice or would like to exercise any of your rights, please contact our Privacy Officer at the address, phone number, or email listed above.

XII. Acknowledgment of Receipt

We may ask you to sign an acknowledgment confirming that you received a copy of this Notice of Privacy Practices. If you decline to sign, we will still provide you with health care services; your signature is not a condition of treatment. We will document our good-faith effort to obtain your written acknowledgment.