Notice of Privacy Practices

1. Our pledge regarding your information

Pasadena Clinical Group ("PCG") is committed to protecting the privacy of your Protected Health Information ("PHI"). PHI is health information that identifies you and that we create, receive, or maintain in the course of providing services. This Notice describes how we may use and disclose PHI to carry out treatment, payment, and health care operations, and for other purposes permitted or required by law. It also describes your rights regarding PHI under both the federal HIPAA Privacy Rule (45 CFR Parts 160 and 164) and California's Confidentiality of Medical Information Act (CMIA, Civil Code §56 et seq.).

2. CMIA — California adds stricter protections

California's Confidentiality of Medical Information Act (Civil Code §56 et seq.) is in many respects stricter than HIPAA. Where federal and state law conflict, the stricter (more protective) standard applies. CMIA particularly affects:

• Authorization for marketing communications — California requires affirmative written authorization for many uses HIPAA permits without authorization.
• Mental health records — Welfare and Institutions Code §5328 imposes additional confidentiality protections for mental-health records where applicable.
• HIV/AIDS information — Health and Safety Code §120975 et seq. imposes specific written-authorization requirements.
• Genetic information — California's Genetic Information Privacy Act (Civil Code §56.18) provides additional protections.
• Substance use disorder records — 42 CFR Part 2 federal regulations also apply.

3. How we may use and disclose your PHI without your authorization

HIPAA permits PCG to use and disclose your PHI without your authorization for the following purposes:

• Treatment — coordinating care among the clinicians involved in your treatment, consulting with other providers, making referrals.
• Payment — billing your insurance, processing payment, providing superbills for out-of-network reimbursement.
• Health Care Operations — quality assurance, peer review, training, business management.
• Required by Law — disclosures mandated by federal, state, or local law (see Section 4).
• Public Health Activities — limited disclosures to prevent serious threats to health or safety.
• Health Oversight Activities — disclosures to government agencies authorized to oversee health care.
• Coroners, Medical Examiners, and Funeral Directors — limited disclosures.
• Workers' Compensation — for claims you have made.
• Judicial and Administrative Proceedings — in response to valid court orders or subpoenas, with safeguards required by California law.

4. Mandatory reports under California law

California law requires us to break confidentiality and report in specific situations. We will inform you when this occurs. Required reports include:

• Child abuse or neglect — California Child Abuse and Neglect Reporting Act (CANRA), Penal Code §11164 et seq.
• Elder or dependent adult abuse — Welfare and Institutions Code §15630.
• Tarasoff duty to warn or protect — when a patient communicates a serious threat of physical violence against a reasonably identifiable victim, Civil Code §43.92.
• Imminent danger to self — when a patient is in imminent risk of suicide or serious self-harm.

5. Disclosures requiring your written authorization

Most other uses and disclosures of your PHI will be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it. Specifically requiring authorization:

• Most disclosures of psychotherapy notes (separately maintained process notes — see Section 6).
• Most marketing communications (under both HIPAA and California's stricter CMIA).
• Sale of PHI (we do not sell PHI).
• HIV/AIDS-related information (California Health & Safety Code §120975 et seq.).
• Substance use disorder records (42 CFR Part 2).

6. Psychotherapy notes

"Psychotherapy notes" are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, kept separately from the rest of the medical record. They are protected more strictly than other PHI under both HIPAA and California law. They are not released without your specific written authorization, except in limited circumstances (e.g., the clinician's own use, defense in a legal action you initiate, mandatory reports). They are not part of the clinical record provided to insurance companies.

7. Couples therapy — special considerations

For couples therapy, the "patient" is generally the couple as a unit. We follow a "no secrets" policy by default — meaning we will not keep significant relational secrets between partners that compromise the work. If we meet with you alone for an assessment session, we discuss in advance what we will and won't share with your partner. Records of joint sessions belong to the couple as a unit; release typically requires both partners' written authorization or a court order. These provisions are explained in detail in our Treatment Consent.

8. Your rights regarding your PHI

You have the following rights regarding the PHI we maintain about you:

• Right to inspect and copy — California Health & Safety Code §123100 et seq. provides specific access rights to your records, including for mental-health records (with limited clinical-judgment exceptions). HIPAA also provides this right.
• Right to amend — you may request that we amend PHI you believe is incorrect or incomplete. We may deny the request if we believe the information is accurate; you have the right to file a written statement of disagreement that becomes part of the record.
• Right to an accounting of disclosures — you may request a list of certain disclosures we have made of your PHI in the last six years.
• Right to request restrictions — you may request restrictions on certain uses and disclosures. We are not required to agree, but if we do, we are bound by the agreement (with limited exceptions for emergencies).
• Right to confidential communications — you may request that we communicate with you in a specific way or at a specific location (e.g., do not call my work; mail correspondence to a P.O. box).
• Right to a paper copy of this Notice — even if you have agreed to receive it electronically.
• Right to be notified of a breach — we will notify you in the event of a breach of unsecured PHI per HIPAA breach notification requirements.

9. Records retention

We retain clinical records for at least seven (7) years from the last date of service for adult patients, and for minors, until one (1) year past the age of majority or seven (7) years from the last date of service, whichever is later. These retention periods are consistent with California recordkeeping standards.

10. Our duties

We are required by law to maintain the privacy of your PHI, provide you with this Notice, abide by the terms of the current Notice in effect, and notify you of any breach of unsecured PHI. We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain. We will provide an updated Notice when we make material changes.

11. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal government. To file with us: contact our Privacy Officer at privacy@pasadenaclinicalgroup.com or write to Pasadena Clinical Group, Privacy Officer, 301 N. Lake Ave, STE 600, Pasadena, CA 91101. To file with the federal government: contact the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. You may also file with the California Department of Public Health. We will not retaliate for filing a complaint.

12. Contact us

Pasadena Clinical Group — Privacy Officer
301 N. Lake Ave, STE 600
Pasadena, CA 91101
Email: privacy@pasadenaclinicalgroup.com
Phone: (626) 354-6440