SUNSHINE COUNSELING INCORPORATED NOTICE OF PRIVACY PRACTICES

I. OUR COMMITMENT TO YOUR PRIVACY

Sunshine Counseling Incorporated is dedicated to maintaining the privacy and confidentiality of your Protected Health Information (PHI). PHI includes individually identifiable health and mental health information created, received, or maintained by our practice, whether in oral, paper, or electronic formats. We are required by federal law (Health Insurance Portability and Accountability Act - HIPAA) and Kentucky state law to provide you with this Notice of Privacy Practices, which outlines our legal duties, privacy practices, and your individual rights concerning your health information. II. USES & DISCLOSURES OF PROTECTED

II. USES & DISCLOSURES OF PROTECTED HEALTH INFORMATION

We may use and disclose your Protected Health Information (PHI) for routine treatment, payment, and healthcare operations without obtaining explicit written authorization: • Treatment: Consulting with other healthcare professionals or clinical supervisors to provide high-quality mental health care. For example, discussing clinical strategies or coordinating care with your primary care provider with your consent. • Payment: Submitting claims to your health insurance company, processing copayments, verifying coverage, or collecting outstanding balances. For example, providing diagnostic codes (DSM-5-TR) to your insurer to process reimbursement. • Healthcare Operations: Conducting internal quality assurance reviews, audit compliance, accreditation, administrative business planning, and updating clinical technology systems.

III. PERMITTED USES & DISCLOSURES REQUIRING NO AUTHORIZATION

Under federal and Kentucky state laws, we may disclose your PHI without your consent under specific, limited circumstances: 1. Child/Vulnerable Adult Abuse Reporting: If we have reasonable cause to suspect that a child, elderly adult, or vulnerable adult is subjected to abuse, neglect, or exploitation, we are legally mandated to report this to Kentucky protective services. 2. Imminent Harm / Safety Threats: If you communicate an explicit, imminent threat of serious physical harm to yourself or an identified victim, we have a legal duty to take protective action, which may include contacting law enforcement, emergency services, or the intended victim. 3. Judicial & Administrative Proceedings: Disclosures required by a court order issued by a judge of competent jurisdiction. 4. Health Oversight Activities: To state health oversight agencies or licensing boards conducting official audits, investigations, or disciplinary reviews. 5. Law Enforcement & Public Health: To law enforcement officials in response to a court order, warrant, or statutory mandatory reporting requirements.

IV. DISCLOSURES REQUIRING YOUR EXPLICIT WRITTEN AUTHORIZATION

For any purpose not described above, we will obtain your explicit written authorization before using or disclosing your PHI. Specifically: • Psychotherapy Notes: Notes recorded by your psychotherapist documenting private session discussions are kept separate from your general medical record and require a specific, separate authorization for release. • Marketing & Sale of PHI: We will never use or sell your PHI for marketing, commercial purposes, or fundraising without your express written permission. You have the r

V. YOUR INDIVIDUAL PRIVACY RIGHTS UNDER HIPAA

As a client of Sunshine Counseling Incorporated, you possess the following rights regarding your health information: 1. Right to Inspect and Copy: You have the right to inspect and obtain a copy of your clinical record and billing history, subject to limited statutory exceptions. Sunshine Counseling Inc. | Notice of Privacy Practices Page 2 2. Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. While we will consider all requests, we are not required to agree, except when you pay out-of-pocket in full for a service and request that we not disclose details to your health plan. 3. Right to Confidential Communications: You may request that we communicate with you via specific methods (e.g., specific phone number, secure email) or at an alternative address. 4. Right to Request Amendments: If you believe information in your record is incorrect or incomplete, you may submit a written request for an amendment. 5. Right to Accounting of Disclosures: You have the right to receive a list of non-routine disclosures of your PHI made by our practice. 6. Right to a Paper Copy: You have the right to request and receive a paper copy of this Notice of Privacy Practices at any time.

VI. BREACH NOTIFICATION & PRACTICE DUTIES

We are required by law to maintain the privacy of your PHI, abide by the terms of this Notice currently in effect, and notify affected individuals promptly following any breach of unsecured Protected Health Information.

VII. QUESTIONS & COMPLAINTS

If you believe your privacy rights have been violated, or if you have questions regarding this Notice, please contact our Privacy Officer directly @ leigh@thesunshinecollaborative.com.

You may also file a formal written complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. We strictly prohibit any retaliation against individuals who file a complaint