HIPAA Notice of Privacy Practices

Who This Notice Applies To

This Notice applies to Youth Lab 360 and members of its workforce who are authorized to create, receive, maintain, use, or disclose protected health information.

It may also apply to participating healthcare professionals, contractors, and service locations that have agreed to follow this Notice when providing or supporting care through Youth Lab 360.

Protected Health Information

Protected health information, commonly called PHI, includes individually identifiable information concerning your past, present, or future physical or mental health, healthcare services, or payment for healthcare.

PHI may exist in written, spoken, photographic, or electronic form. Examples may include medical histories, consultation records, laboratory information, prescriptions, treatment plans, billing information, appointment details, and communications concerning your care.

Information you submit through a general website inquiry does not automatically become PHI. Its legal status depends on the recipient, the purpose for which it is received, and whether it is maintained in connection with covered healthcare services.

Your Health Information Rights

When Youth Lab 360 maintains PHI about you under HIPAA, you have certain rights concerning that information.

Restrictions for Self-Paid Services

When you pay in full out of pocket for a healthcare item or service, you may request that we not disclose information about that item or service to your health plan for payment or healthcare-operations purposes.

We will honor a qualifying request unless disclosure is otherwise required by law.

Personal Representatives

A person who has lawful authority to act on your behalf, such as a healthcare power of attorney, legal guardian, or another authorized personal representative, may exercise your privacy rights.

We may request documentation and verify that the person has authority to act for you before releasing information or processing a request.

Your Choices

For certain uses and disclosures, you may tell us your preferences or provide written authorization.

Family members and others involved in your care

We may share information relevant to your care or payment with a family member, friend, caregiver, or another person involved in your care when you agree, do not object, or when professional judgment permits the disclosure.

Disaster-relief situations

We may disclose limited information to organizations assisting with disaster relief so that family members or other responsible persons can be informed of your location, condition, or safety.

Marketing and sale of information

We will obtain written authorization before using or disclosing PHI for marketing when authorization is required by HIPAA. We will also obtain authorization before selling PHI when required by law.

Psychotherapy notes

Most uses and disclosures of separately maintained psychotherapy notes require written authorization, except in limited circumstances permitted by law.

Fundraising

If we contact you concerning fundraising activities, you will be given a clear method to opt out of future fundraising communications.

Revoking authorization

You may revoke a written authorization at any time by submitting a written request. A revocation will not affect actions already taken in reliance on the authorization.

Treatment, Payment, and Healthcare Operations

HIPAA allows us to use and disclose PHI for treatment, payment, and healthcare operations without obtaining a separate authorization in many circumstances.

Business Associates

We may engage vendors and service providers that perform functions involving PHI, such as hosting, secure communications, scheduling, billing, record management, information technology, analytics, or administrative support.

When required by HIPAA, these business associates must enter into written agreements requiring them to protect PHI and use it only as permitted by the agreement and applicable law.

Other Permitted or Required Disclosures

We may use or disclose PHI without your written authorization when a disclosure is permitted or required by law and all applicable conditions have been met.

• To comply with federal, state, or local law.
• For public-health activities, including disease prevention, product safety, and reporting adverse events.
• To report suspected abuse, neglect, or domestic violence when permitted or required.
• For authorized health-oversight activities, audits, inspections, licensing, and investigations.
• For workers’ compensation and similar programs.
• To respond to qualifying court orders, subpoenas, administrative proceedings, or other lawful process.
• For certain law-enforcement purposes subject to HIPAA limitations.
• To avert a serious and imminent threat to health or safety when permitted by law.
• For approved research when applicable privacy requirements have been satisfied.
• To coroners, medical examiners, and funeral directors as legally permitted.
• To organ, eye, or tissue donation and transplantation organizations.
• For specialized government activities, military functions, national security, or protective services when authorized.
• To the U.S. Department of Health and Human Services for HIPAA compliance and enforcement.

Reproductive Healthcare Information

We will protect reproductive-health information in accordance with applicable federal and state privacy requirements.

Where prohibited by law, we will not use or disclose PHI to investigate or impose liability on a person merely for seeking, obtaining, providing, or facilitating lawful reproductive healthcare.

For certain requests involving health oversight, litigation, law enforcement, coroners, or medical examiners, we may require a signed attestation confirming that the requested information will not be used for a prohibited purpose.

Substance Use Disorder Records

When Youth Lab 360 receives or maintains substance-use- disorder treatment records protected by 42 CFR Part 2, those records may receive privacy protections in addition to HIPAA.

Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide the required written consent or a qualifying court order and other applicable legal requirements have been satisfied.

Any consent covering treatment, payment, and healthcare operations will be handled according to applicable Part 2 and HIPAA requirements. Further disclosure of these records remains subject to the protections required by law.

Minimum Necessary Standard

When applicable, we make reasonable efforts to limit the PHI used, requested, or disclosed to the minimum information reasonably necessary to accomplish the intended purpose.

The minimum-necessary standard does not apply in every situation, including certain disclosures to healthcare providers for treatment and disclosures made directly to you.

Our Legal Duties

Youth Lab 360 is required to:

• Maintain the privacy and security of PHI as required by applicable law.
• Provide you with this Notice describing our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify affected individuals following a reportable breach of unsecured PHI.
• Use or disclose PHI only as described in this Notice, permitted by your authorization, or otherwise allowed or required by law.
• Provide reasonable assistance when you exercise an applicable privacy right.

We maintain administrative, technical, and physical safeguards designed to protect PHI from unauthorized access, use, loss, alteration, and disclosure.

No electronic transmission or storage system can be guaranteed to be completely secure. Please use approved communication channels when sending sensitive health information.

Changes to This Notice

We may change the terms of this Notice and make the revised terms effective for all PHI that we maintain, including information received or created before the revision.

When a material change is made, the updated Notice will be made available on our website, upon request, and through other methods required by law.

The effective date displayed at the top of the Notice identifies when the current version became effective.

Questions and Complaints

Contact our Privacy Officer if you have questions about this Notice, wish to exercise a privacy right, or believe your privacy rights may have been violated.