Notice of Privacy Practices

Access Alliance Tele-Psychiatry Licensed in New York, New Jersey, and Oregon Effective Date: January 1, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

---

1. Our Commitment to Your Privacy

Access Alliance Tele-Psychiatry (“Access Alliance,” “we,” “us,” or “our”) is committed to protecting the privacy of your health information. We comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, as well as the applicable mental health privacy laws of New York, New Jersey, and Oregon — whichever standard provides the greatest protection to you.

We are required by law to:

• Maintain the privacy of your protected health information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Abide by the terms of this Notice currently in effect
• Notify you in the event of a breach of your unsecured PHI

This Notice applies to all records of care and services you receive at Access Alliance Tele-Psychiatry, whether provided in person or via telehealth platform.

---

2. How We May Use and Disclose Your Health Information

We may use and disclose your protected health information for the following purposes. Because we are a psychiatric practice operating in New York, New Jersey, and Oregon, we apply stricter state-law standards where applicable — which in many cases means we require your written consent even where federal HIPAA would not.

Treatment

We may use and share your health information to provide, coordinate, or manage your psychiatric care. Disclosures to providers outside Access Alliance — including therapists, specialists, or prescribing pharmacists — will be made only with your written authorization unless an emergency requires otherwise, consistent with NY Mental Hygiene Law, NJ Mental Health Procedures Act, and Oregon ORS 179.505.

Payment

We may use and disclose your health information to bill and collect payment for services rendered, including submitting claims to your insurance carrier. We disclose only the minimum necessary information required for payment purposes.

Healthcare Operations

We may use your health information for internal quality improvement, staff training, compliance activities, and practice management. Such uses are limited to the minimum necessary and are never used for marketing purposes without your explicit written authorization.

As Required by Law

We will disclose your health information when required to do so by federal, state, or local law, including mandatory reporting obligations and responses to lawful court orders or subpoenas.

Public Health Activities

We may disclose your information to public health authorities for legally required reporting activities, including communicable disease reporting and FDA-required adverse event reporting.

Serious Threats to Health or Safety

We may use or disclose your health information when necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of another person or the public. This includes our obligations under applicable duty-to-warn laws in New York, New Jersey, and Oregon.

Abuse, Neglect, or Domestic Violence

We may disclose your health information to appropriate authorities if we have reasonable cause to believe you are a victim of abuse, neglect, or domestic violence, to the extent required or permitted by applicable state and federal law.

Judicial and Administrative Proceedings

We may disclose your health information in response to a court order, subpoena, or other lawful legal process, subject to the heightened protections applicable to mental health records under state law.

Law Enforcement

We may disclose health information for certain law enforcement purposes as required by law, subject to applicable state-law restrictions on mental health record disclosures.

Coroners, Medical Examiners, and Funeral Directors

We may disclose health information to a coroner, medical examiner, or funeral director as required by applicable law.

Workers’ Compensation

We may release health information as necessary to comply with workers’ compensation laws or similar programs providing benefits for work-related injuries or illness.

---

3. Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures will only be made with your prior written authorization. This list is broader than what federal HIPAA requires alone, reflecting the stronger protections of New York, New Jersey, and Oregon law:

• Psychotherapy notes — in all circumstances, consistent with state law
• Disclosure to family members, friends, or third parties — including for coordination of care, except as required by law or in a life-threatening emergency
• Disclosure to employers or schools
• Marketing purposes of any kind
• Sale of your health information
• HIV/AIDS-related information — governed by NY Public Health Law §2780, NJ N.J.S.A. 26:5C, and Oregon ORS 433.045, each of which requires separate written authorization
• Substance use disorder treatment records — governed by 42 CFR Part 2 and applicable state law, requiring separate written consent
• Genetic information
• Any disclosure not otherwise permitted by law

You have the right to revoke any authorization in writing at any time. Revocation will not apply to actions already taken in reliance on your authorization.

---

4. Special Protections: Mental Health Records

As a psychiatric practice, we recognize that mental health records carry the highest level of sensitivity and are entitled to heightened legal protection. We apply the following state-specific protections in addition to federal HIPAA requirements:

New York

Under the New York Mental Hygiene Law and related regulations, mental health records maintained by Access Alliance may not be disclosed without your written consent except in narrowly defined circumstances. Records will not be released to third parties — including family members — without your authorization, except as required by law or in a documented emergency.

Minor Patients (New York): Patients aged 16 and older in New York have the independent right to consent to outpatient mental health treatment and to control the confidentiality of their own records. Parental or guardian access to such records requires the minor patient’s consent, except in limited circumstances defined by law.

New Jersey

Under the New Jersey Mental Health Procedures Act (N.J.S.A. 30:4-24.3) and related statutes, mental health treatment records are confidential and shall not be disclosed without written consent except as required by law.

Minor Patients (New Jersey): Patients aged 16 and older in New Jersey may independently consent to outpatient psychiatric treatment. Their records are afforded independent confidentiality protections consistent with their consent rights.

Oregon

Oregon law (ORS 179.505) provides some of the strongest mental health record confidentiality protections in the United States. Records of mental health treatment may not be disclosed without written authorization except in specific circumstances defined by statute. We apply Oregon’s standard wherever it is more protective than federal HIPAA or the standards of other states in which we are licensed.

---

5. Telehealth-Specific Disclosures

Access Alliance Tele-Psychiatry delivers care through secure, HIPAA-compliant telehealth platforms. The following applies to all telehealth services:

• All video sessions are conducted through encrypted, HIPAA-compliant technology
• Session recordings are not made or retained without your explicit written consent
• Electronic communications (including messages sent through our patient portal) are transmitted through secured, encrypted systems
• You have the right to request an alternative method of communication if you have privacy concerns about telehealth delivery
• Telehealth services are subject to the privacy laws of the state in which you are located at the time of the session, as well as the state in which your provider is licensed

---

6. Your Rights Regarding Your Health Information

Right to Access Your Records

You have the right to inspect and obtain a copy of your health information. Requests must be submitted in writing. We will respond within 30 days (or sooner as required by state law). We may charge a reasonable cost-based fee for copies.

Right to Request an Amendment

If you believe your health information is inaccurate or incomplete, you may request an amendment in writing. We will notify you of our decision. If we deny your request, you have the right to submit a written statement of disagreement to be included in your record.

Right to an Accounting of Disclosures

You may request a list of certain disclosures we have made of your health information within the past six years. This does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization.

Right to Request Restrictions

You may request that we limit how we use or disclose your health information. We are not required to agree to all restrictions, but if we do agree, we are bound by that agreement. You have the right to restrict disclosures to your health plan for services you have paid for in full out of pocket.

Right to Request Confidential Communications

You may request that we contact you in a specific way or at a specific location — for example, by a particular phone number or email address only. We will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Right to Be Notified of a Breach

You have the right to be notified if your unsecured PHI is breached. We will notify you in accordance with HIPAA’s Breach Notification Rule, the New York SHIELD Act, the New Jersey Identity Theft Prevention Act, and Oregon’s breach notification statutes — whichever requires the most timely and comprehensive notification.

---

7. Breach Notification: Multi-State Standards

In the event of a breach of your unsecured protected health information, we will notify you in accordance with the following:

• Federal HIPAA: Written notification within 60 days of discovery
• New York SHIELD Act: Notification in the most expedient time possible without unreasonable delay
• New Jersey Identity Theft Prevention Act: Notification in the most expedient time possible
• Oregon ORS 646A.604: Notification within 45 days of discovery

We will apply whichever standard requires the earliest and most comprehensive notification to you.

---

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the applicable regulatory authority. You will not be penalized or retaliated against for filing a complaint.

Access Alliance Tele-Psychiatry — Privacy Officer [Practice Address] [Phone Number] [Email Address]

U.S. Department of Health & Human Services — Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 Toll-Free: 1-877-696-6775 | www.hhs.gov/ocr/privacy

New York State Office of Mental Health 44 Holland Avenue, Albany, NY 12229 Tel: 1-800-597-8481 | www.omh.ny.gov

New Jersey Division of Mental Health and Addiction Services P.O. Box 362, Trenton, NJ 08625 Tel: (609) 438-6000 | www.state.nj.us/humanservices/dmhas

Oregon Health Authority — Behavioral Health Division 500 Summer Street NE, Salem, OR 97301 Tel: (503) 945-5763 | www.oregon.gov/oha

---

9. Changes to This Notice

We reserve the right to change the terms of this Notice at any time. Any revised Notice will be effective for all health information we maintain. The most current version will always be available on our website and upon request at our office.

---

10. Contact Us

For questions about this Notice or our privacy practices, please contact us via support@aatpsych.org

---

This Notice of Privacy Practices is effective as of January 1, 2025. It supersedes all prior versions. Access Alliance Tele-Psychiatry is licensed to practice in New York, New Jersey, and Oregon and applies the most protective privacy standard applicable in each jurisdiction.