Notice of Privacy Practices

Our Commitment to Your Privacy

BehavioTech is required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and to abide by the terms of this Notice. We are required to notify you following a breach of your unsecured PHI.

Who Will Follow This Notice

This Notice describes the practices of:

• All BehavioTech employees, contractors, and volunteers who have access to your health information.
• All Board Certified Behavior Analysts (BCBAs), Registered Behavior Technicians (RBTs), and other clinical staff.
• All departments and units of BehavioTech.
• All business associates with whom we share your PHI, who are also bound by these privacy practices through Business Associate Agreements.

How We May Use and Disclose Your Health Information

The following describes the ways we may use and disclose your health information. For each category, we provide an explanation and an example specific to ABA therapy services.

For Treatment

We may use and disclose your PHI to provide, coordinate, and manage your child's ABA therapy. This includes sharing information among members of your child's treatment team.

Example: Your child's BCBA may share session data and behavior plans with the assigned RBT to ensure consistent implementation of treatment goals. We may also share relevant information with your child's pediatrician or school team with your authorization.

For Payment

We may use and disclose your PHI to bill and collect payment for the ABA therapy services we provide. This may include contacting your insurance company to verify coverage, obtain prior authorizations, or submit claims.

Example: We may send your insurance company a claim that includes your child's diagnosis code, the type of ABA service provided, and the dates of service so that we can be reimbursed for the care provided.

For Healthcare Operations

We may use and disclose your PHI for our healthcare operations, which include quality improvement activities, staff training, compliance programs, and business management.

Example: We may review treatment records to assess the quality of care provided by our clinical team, or use de-identified data to evaluate the effectiveness of our ABA programs.

Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization for the following purposes:

• As required by law: We will disclose PHI when required to do so by federal, state, or local law.
• Public health activities: For disease prevention, reporting vital statistics, or FDA-related activities.
• Victims of abuse, neglect, or domestic violence: As required by California mandatory reporting laws, including suspected child abuse or neglect.
• Health oversight activities: For audits, investigations, and inspections by government agencies.
• Judicial and administrative proceedings: In response to a court order or subpoena.
• Law enforcement: For specific law enforcement purposes as permitted by HIPAA.
• To avert a serious threat: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Workers' compensation: As authorized by workers' compensation laws.

Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above. Specifically, we will obtain your authorization for:

• Marketing purposes.
• Sale of your PHI.
• Most uses of psychotherapy notes (if applicable).
• Sharing information with your child's school, other providers, or family members not listed as authorized contacts.
• Any other purpose not described in this Notice.

You may revoke your authorization at any time by submitting a written request to our Privacy Officer. Revocation will not affect any actions we took before receiving your revocation.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI:

Our Duties

• We are required by law to maintain the privacy and security of your PHI.
• We are required to provide you with this Notice of our legal duties and privacy practices.
• We are required to abide by the terms of this Notice currently in effect.
• We are required to notify you if a breach of your unsecured PHI occurs.
• We will not use or disclose your PHI without your authorization, except as described in this Notice.

Changes to This Notice

We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will post the revised Notice on our website and make it available at our office.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

You will not be penalized or retaliated against in any way for filing a complaint.

Acknowledgment of Receipt

We will ask you to sign an acknowledgment that you have received this Notice of Privacy Practices. If you decline to sign, we will still provide you with services — your signature is not a condition of treatment. We will document our good-faith effort to obtain your acknowledgment.