HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice of Privacy Practices ("Notice") explains how Form Psychiatry PLLC (the "Practice," "we," "us," or "our") may use and disclose your protected health information ("PHI"), your rights regarding your PHI, and our legal duties to protect your PHI. This Notice applies to PHI created or received by the Practice in connection with your care, including through telehealth, the patient portal, secure messaging, billing, and other administrative services. This Notice is followed by our workforce, including clinicians, employees, trainees, and contractors working on our behalf.

Key points: We are required by law to maintain the privacy and security of your PHI and to provide you with this Notice. We may use and disclose PHI without your written authorization for treatment, payment, and health care operations. Certain uses and disclosures (such as most disclosures of psychotherapy notes, marketing, and any sale of PHI) require your written authorization. You have important rights, including the right to access and obtain copies of your records (with limited exceptions), request corrections, request confidential communications, and receive an accounting of certain disclosures. We will notify you if a breach occurs that may have compromised the privacy or security of your PHI.

I. Our pledge regarding health information

We understand that information about you and your health care is personal. We are committed to protecting your PHI. We create and maintain records of the care and services you receive from the Practice. We need these records to provide you with quality care and to comply with certain legal requirements. We are required by law to: maintain the privacy and security of your PHI to the extent required by federal and applicable state law; provide you with this Notice of our legal duties and privacy practices with respect to your PHI; follow the terms of the Notice that is currently in effect; and notify you following a breach of unsecured PHI as required by law. We may change the terms of this Notice at any time. Any changes will apply to all PHI we maintain about you. The current Notice will be available upon request, on our website, and/or through our patient portal.

II. How we may use and disclose your PHI without your written authorization

The categories below describe the different ways we may use and disclose PHI. Not every use or disclosure is listed, but all of the ways we are permitted to use and disclose PHI will fall within one of these categories.

A. For treatment. We may use and disclose your PHI to provide, coordinate, or manage your health care treatment and related services. For example, we may share information with other health care providers involved in your care (such as a primary care clinician, therapist, hospital, pharmacy, or laboratory) and we may consult with other clinicians about your care.

B. For payment. We may use and disclose your PHI to bill and collect payment for services we provide to you. For example, we may submit claims to your health plan, verify eligibility, obtain prior authorization, determine coverage, and respond to questions from your health plan. If you pay for an item or service in full out of pocket and request that we not disclose to your health plan the PHI solely relating to that item or service, we will follow that request as required by law (see Section VI.D).

C. For health care operations. We may use and disclose your PHI for health care operations, which are activities necessary to run our practice and ensure quality care. Examples include quality assessment and improvement, peer review, supervision and training, licensing and credentialing activities, business planning and development, legal services, accounting, audits, and general administrative activities.

D. Business associates and vendors. We may share PHI with trusted third parties (called "business associates") that perform services for us, such as electronic health record and practice management systems (for example, Healthie), telehealth platforms, secure messaging, billing and claims processing, payment processing, IT support, cloud storage, shredding, and professional services. When required by law, we enter into agreements that require these business associates to safeguard your PHI.

E. Telehealth, patient portal, and electronic communications. We may use and disclose PHI electronically in connection with providing you care via telehealth (live two-way audio/video) and through our patient portal and secure messaging tools. While we use safeguards designed to protect your information, no method of electronic communication is 100% secure. Telehealth privacy considerations: We use HIPAA-compliant platforms and privacy safeguards for telehealth sessions. We do not record sessions unless we tell you in advance and obtain your consent (and any recording will be stored and protected as part of your record). We encourage you to participate from a private location, use a personal device when possible, and avoid public or shared Wi-Fi networks. If video technology fails, we may continue the visit by phone when clinically appropriate. If you choose to communicate with us by email, text message, or voicemail, you acknowledge there are additional privacy risks. You may request that we communicate with you in a certain way or at a certain location (see Section VI.E). We encourage you to use the patient portal or other secure communication methods when available.

F. Appointment reminders and health-related benefits or services. We may use and disclose your PHI to contact you about appointment reminders, scheduling changes, and other matters related to your care. We may also contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.

G. Individuals involved in your care. With your agreement or as permitted by law, we may share relevant PHI with a family member, friend, or other person you identify as involved in your care or the payment for your care. In an emergency, we may share information if we believe it is in your best interest and you are unable to agree or object at that time.

H. Lawsuits and disputes. If you are involved in a lawsuit or dispute, we may disclose PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process, but only if applicable legal requirements are satisfied (such as receiving satisfactory assurances that you have been notified or that a protective order has been sought).

I. De-identified information. We may use and disclose information that has been de-identified (meaning it cannot reasonably be used to identify you) for purposes such as quality improvement, business planning, and analytics.

III. Uses and disclosures that require your written authorization

Except as described in this Notice, we will use or disclose your PHI only with your written authorization. Common examples include disclosures to employers, schools, attorneys, disability carriers, life insurance companies, and certain other third parties. You may revoke an authorization at any time in writing, except to the extent that we have already relied on it.

A. Psychotherapy notes. Some clinicians may create "psychotherapy notes," as defined by HIPAA (45 C.F.R. § 164.501). Psychotherapy notes are given special protection. They are kept separate from the rest of your medical record and generally include personal notes about the content of counseling sessions. Psychotherapy notes do not include information such as medication prescriptions, monitoring, counseling session start/stop times, modalities and frequencies of treatment, clinical test results, diagnoses, functional status, treatment plans, symptoms, prognosis, or progress to date. We will not use or disclose psychotherapy notes without your written authorization, except as permitted by law, such as: for our own use in treating you; for training or supervision of mental health practitioners; to defend ourselves in a legal action or other proceeding brought by you; for oversight by the U.S. Department of Health and Human Services to investigate or determine our compliance with HIPAA; as required by law or for certain health oversight activities related to the originator of the notes; to a coroner or medical examiner as authorized by law; and to help avert a serious and imminent threat to the health or safety of you or others, consistent with applicable law.

B. Marketing. We will not use or disclose your PHI for marketing purposes without your written authorization, except as permitted by law (for example, face-to-face communications about treatment alternatives).

C. Sale of PHI. We will not sell your PHI without your written authorization.

D. Other uses and disclosures. Any other use or disclosure of your PHI not described in this Notice will be made only with your written authorization.

IV. Other uses and disclosures permitted or required without your authorization

Subject to certain limitations in the law, we may use and disclose your PHI without your authorization for the following purposes: when required by federal, state, or local law, and the use or disclosure complies with and is limited to the relevant requirements of such law; public health activities (such as reporting certain communicable diseases) and public health investigations; reporting suspected abuse, neglect, or domestic violence, as required or permitted by law (including suspected child, elder, or dependent adult abuse); health oversight activities, such as audits, investigations, inspections, and licensure actions; judicial and administrative proceedings, such as responding to a court order or certain subpoenas; law enforcement purposes, such as responding to certain legal processes or reporting certain crimes on our premises, as permitted by law; coroners, medical examiners, and funeral directors, as authorized by law; organ and tissue donation, as permitted by law; research, under certain circumstances and subject to safeguards required by law; to avert a serious threat to health or safety, consistent with applicable law and ethical standards; specialized government functions (such as military, national security, and protective services); correctional institutions or law enforcement officials, if you are an inmate and disclosure is necessary for your health and safety or the health and safety of others, as permitted by law; and workers' compensation or similar programs that provide benefits for work-related injuries or illness, as authorized by law. Disaster relief: to assist in disaster relief efforts, as permitted by law. We will generally apply the HIPAA "minimum necessary" standard to uses, disclosures, and requests for PHI, meaning we limit PHI to what is needed to accomplish the purpose. This standard does not apply to disclosures for treatment, disclosures to you, disclosures made pursuant to your authorization, or certain other disclosures required by law.

V. Uses and disclosures where you have the opportunity to agree or object

In some situations, we may share PHI with family, friends, or others involved in your care or payment for your care. We will ask for your agreement when possible. You may object to such disclosures in whole or in part. In an emergency or if you are unable to agree or object, we may share information if we believe it is in your best interest and consistent with applicable law.

VI. Your rights regarding your PHI

You have the following rights with respect to your PHI (subject to certain exceptions):

A. Right to get an electronic or paper copy of your medical record. You may request to inspect or obtain an electronic or paper copy of your medical record and other PHI we have about you, except for psychotherapy notes and certain other information exempted by law. We will provide a copy or a summary (if you agree) within 30 days of your written request, or we will notify you if we need an extension as permitted by law. We may charge a reasonable, cost-based fee as allowed by law. You may also request that we transmit a copy of your PHI directly to another person or entity you designate, when feasible. In certain limited circumstances, we may deny your request for access as permitted by law. If we deny your request, we will provide a written explanation and, when applicable, information about your right to have the denial reviewed.

B. Right to request an amendment. If you believe your PHI is incorrect or incomplete, you may ask us to amend it. Your request must be in writing and provide a reason supporting the amendment. We may deny your request in certain circumstances (for example, if we did not create the information or if it is accurate and complete). We will respond in writing within 60 days, or notify you if we need an extension as permitted by law.

C. Right to an accounting of disclosures. You may request a list (an "accounting") of certain disclosures we have made of your PHI during the six years prior to your request. This accounting does not include disclosures made for treatment, payment, or health care operations, disclosures made to you, or disclosures made with your authorization. We will provide the accounting within 60 days of your written request, or notify you if we need an extension as permitted by law. The first accounting in a 12-month period is free; we may charge a reasonable, cost-based fee for additional requests.

D. Right to request restrictions. You may request that we restrict how we use or disclose certain PHI for treatment, payment, or health care operations. We are not required to agree to most requests, and we may say "no" if it would affect your care. However, if you pay out of pocket in full for a specific item or service and request that we not disclose PHI related solely to that item or service to your health plan for payment or health care operations, we must honor that request unless a law requires disclosure.

E. Right to request confidential communications. You may request that we communicate with you about your care in a specific way (for example, only at a certain phone number or address). We will accommodate reasonable requests. Your request must be in writing and specify how or where you wish to be contacted.

F. Right to receive a copy of this Notice. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

G. Right to choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify the person's authority before taking any action.

H. Right to receive notice of a breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

I. Right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with the Practice and/or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

VII. Special privacy protections (mental health, minors, and sensitive information)

Because we provide mental health services, certain types of information may be subject to additional protections under federal and/or state law. When state law provides greater privacy protections than HIPAA, we will follow the stricter law. Mental health records: Some states require your written consent for certain disclosures of mental health treatment records, except in specific situations such as emergencies or as required by law. Substance use disorder records: If records are subject to 42 C.F.R. Part 2, additional restrictions may apply to the use and disclosure of substance use disorder diagnosis, treatment, or referral information. HIV/STD and other specially protected information: Some states provide enhanced confidentiality protections for HIV testing or treatment and certain other conditions. Minors: Laws about minor consent and parent/guardian access vary by state and by the type of service. We will follow applicable law and will discuss confidentiality and access rules with you when relevant.

VIII. Changes to this Notice

We reserve the right to change this Notice and our privacy practices. Any changes will apply to all PHI we maintain, including PHI created before the change. The updated Notice will be made available upon request and through our website and/or patient portal.

IX. Questions and complaints

If you have questions about this Notice, want to exercise your rights, or want to file a complaint, please contact our Founder: Yates Brown, Form Psychiatry PLLC, 186 Lincoln Street, Ste. 112, Boston, Massachusetts, 02111, (617) 657-2947, email: contact@formpsych.com. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). OCR complaint information is available at hhs.gov/hipaa/filing-a-complaint or through the OCR Complaint Portal. We will not retaliate against you for filing a complaint.

By signing, you acknowledge that you have received a copy of Form Psychiatry PLLC's Notice of Privacy Practices. Your signature confirms receipt; it does not indicate that you agree or disagree with the contents of the Notice.

Effective: 2026-07-13