Your information.
Your rights. Our responsibilities.

→You Have the Right and Choice to Tell Us To

• Share information with your family, close friends, or others involved in your care or payment for your care.

If you are not able to tell us your preference (for example, if you are unconscious), we may share your information if we believe it is in your best interest. We may also share your information with a person or persons reasonably able to prevent or lessen a serious and imminent threat to health or safety, when sharing is necessary to lessen that threat.

→We Never Share Your Information Without Written Authorization For

• Marketing purposes
• Sale of your information
• Psychotherapy notes, except as permitted by law — such as for your ongoing treatment by the clinician who created the notes, for training programs supervised by that clinician, in a legal proceeding in which we are a defendant and the notes are necessary for our legal defense, for HHS compliance oversight, or in a medical emergency where the notes are needed for your treatment

→Fundraising Communications

We may contact you for fundraising efforts, but you can tell us not to contact you again at any time. If we have your substance use disorder records subject to 42 CFR Part 2, we will provide you with a clear and meaningful choice about whether to receive fundraising communications that use your Part 2 information at or before your first appointment with us, or as soon as reasonably practicable thereafter, and in any case before sending any such communications.

A ·Treatment, Payment, and Operations

Treat You

We can use your health information and share it with other professionals who are treating you.

Example: A clinician treating you asks a specialist about your overall health condition or current medications to coordinate your care.

Run Our Organization

We can use and share your health information to run our practice, improve your care, and contact you when necessary.

Example: We use health information about you to manage your treatment and services and to evaluate the quality of care we provide.

Bill for Your Services

We can use and share your health information to bill and get payment from health plans or other entities.

Example: We give information about you to your health insurance plan so it will pay for your services.

B ·Other Consent-Based Uses (42 CFR Part 2)

With your specific written consent, we may also use or share your substance use disorder records for the following purposes:

• Share information with whomever you name in a consent form.
• Report participation in treatment required by the criminal justice system. Note: this consent must be obtained as a specific condition of a criminal justice referral, not through a general intake consent, and the consent form must identify the criminal justice agency that referred you (42 CFR § 2.35).
• Prevent multiple enrollments in withdrawal management or maintenance treatment programs (42 CFR § 2.34).

C ·Uses and Disclosures That Do Not Require Your Consent

We are allowed or required to share your information in certain ways without your consent — usually in ways that contribute to the public good. We must meet many legal conditions before sharing your information for these purposes. In all cases, we share only the minimum necessary information.

Internal Communications and Contractors

We can share your information within our organization, with an entity that has administrative control over our program, and with contractors who help us run our program. Any contractor who receives your health information must sign a Business Associate Agreement (BAA) as required by HIPAA, committing them to protect your information and use it only for permitted purposes.

Disaster Relief

In a disaster relief situation, we may share information necessary to assist recognized disaster relief organizations (such as the American Red Cross) with coordinating relief efforts. We will seek your agreement when possible. If you are unable to agree or object due to the circumstances of the emergency, we may share your information in the exercise of professional judgment under 45 CFR § 164.510(b)(4) when doing so does not interfere with the ability to respond to the emergency circumstances.

Help with Public Health and Safety Issues

We can share health information about you for certain situations such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone's health or safety

Note: For substance use disorder records, we can only share de-identified information for public health purposes — not information that identifies you — except in the case of mandatory reporting obligations described in the Mississippi Law section below.

Medical Emergencies

We can share your information during a bona fide medical emergency with the personnel and health care providers responding to your emergency, even when you are unable to consent because of the emergency.

FDA Safety Notifications

Under 45 CFR § 164.512(b)(1)(iii), we may share your identifying information to assist the U.S. Food and Drug Administration in activities related to the quality, safety, or effectiveness of an FDA-regulated product or activity — for example, to notify you or your doctor about unsafe products you may be using.

Health Research

We can use or share your information for health research when appropriate legal safeguards are in place. For substance use disorder records, researchers cannot include any client-identifying information in their reports about the research.

Comply with the Law

We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we're complying with federal privacy law.

Organ and Tissue Donation

We can share health information about you with organ procurement organizations as permitted by law.

Medical Examiners and Funeral Directors

We can share health information with a coroner, medical examiner, or funeral director when an individual dies, as required or allowed by applicable law.

Report Suspected Child Abuse and Neglect

We will report suspected child abuse or neglect as required by state law (Miss. Code Ann. § 43-21-353). We will disclose only the minimum information required by law.

Prescription Drug Monitoring Program (PDMP)

We may report prescribed substance use disorder treatment medications to the Mississippi Prescription Monitoring Program (Miss. Code Ann. § 73-43-11) when required by state law. Under the 2024 amendments to 42 CFR Part 2 (§ 2.36), such reporting may occur without your consent where state law mandates it.

Prevent or Reduce Crime in Our Program

We may report to law enforcement when a client commits or threatens to commit a crime within our program or against our staff, limited to the information necessary to report the crime or threat.

Workers' Compensation, Law Enforcement, and Government Requests

We can use or share health information about you:

• For workers' compensation claims
• For law enforcement purposes or with a law enforcement official, subject to applicable legal standards
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Lawsuits and Legal Actions

We can share health information about you in response to a court or administrative order, or in response to a subpoena, subject to the additional requirements for substance use disorder records described in Section D below.

For your general health records, we will only respond to a subpoena that is not accompanied by a court order after receiving satisfactory assurance under 45 CFR § 164.512(e) that you have been notified of the request, or that the requesting party has sought a qualified protective order.

Management Audits and Program Evaluations

We can use or share your information to improve the quality of our services, obtain needed credentials, and cooperate with oversight agencies authorized by law, as long as those who view or receive the information agree to destroy or return it when finished and agree not to use it against you.

D ·Special Rules for SUD Records: Legal Proceedings

E ·Redisclosure Rules

When you consent to uses and disclosures for all future treatment, payment, and health care operations, we may share your information with other substance use disorder treatment programs, providers, and health care businesses for those activities. If the recipient is subject to HIPAA, they may use and share your information again without your consent for the purposes HIPAA allows.

However, your substance use disorder information still cannot be used in legal proceedings against you unless (1) you consent or (2) a Part 2 court order accompanied by a subpoena authorizes such use. Any disclosure made with your consent will include a written notice to the recipient stating that the information is protected under 42 CFR Part 2 and that further disclosure is prohibited without your consent or a court order.

• We are required by law to maintain the privacy and security of your protected health information.
• We are required to obtain your written consent before all uses and disclosures of your substance use disorder records except those specifically described in Part Three, Section C of this notice.
• We will notify you without unreasonable delay and within 60 days of discovering a breach that may have compromised the privacy or security of your information.
• We will share only the minimum necessary information in all disclosures that are not for treatment purposes.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you authorize us to do so in writing. If you authorize us, you may revoke that authorization in writing at any time. Revocation will not affect disclosures already made in reliance on your authorization.

→Changes to the Terms of This Notice

We reserve the right to change the terms of this notice, and the changes will apply to all information we have about you. We are required to follow the terms of this notice currently in effect. The updated notice will be available upon request, in our office, and on our website.

As a provider licensed and certified by the Mississippi Department of Mental Health (DMH), Heale Behavioral Health LLC and Heale Counseling LLC comply with all applicable Mississippi state privacy laws, which in several areas provide greater protections than HIPAA alone.

Mental Health Records — Miss. Code Ann. § 41-21-97

Mental health treatment records are confidential under Mississippi law. We will not disclose your mental health treatment records without your written consent, except in the following circumstances specifically authorized by law:

• To another provider involved in your care where you have provided written authorization at intake or thereafter
• To a person you have separately authorized in writing to receive the records
• As required by a court order issued by a Mississippi court of competent jurisdiction
• In a genuine medical emergency where disclosure is necessary for your immediate treatment
• As required by another Mississippi or federal law (e.g., mandatory reporting obligations described below)
• For legitimate research purposes with appropriate IRB-approved safeguards to protect your identity

Note: The duty to warn an identifiable third party of a credible, imminent threat of harm arises under Mississippi common law and professional ethical obligations, and is distinct from § 41-21-97's statutory exceptions. In such circumstances, we will disclose only the minimum information necessary to prevent the harm.

Substance Use Disorder Records — Miss. Code Ann. §§ 41-29-135 & 41-30-27 & 42 CFR Part 2

Mississippi law, consistent with federal 42 CFR Part 2 regulations, provides heightened confidentiality for substance use disorder treatment records. Miss. Code Ann. § 41-29-135 (Mississippi Controlled Substances Law) protects records of treatment for controlled substance use, and Miss. Code Ann. § 41-30-27 (Mississippi Alcoholism and Intoxication Treatment Act) separately protects records of alcohol treatment, applying the same heightened confidentiality standards. In accordance with Mississippi law and 42 CFR Part 2, we will never release any substance use disorder treatment records without your written permission, except where specifically authorized or required by law. Records protected under these provisions cannot be used in any civil, criminal, administrative, or legislative proceeding against you without (1) your written consent or (2) a court order accompanied by a subpoena.

Mississippi Mandatory Reporting Obligations

Mississippi law requires us to report the following without your consent:

• Suspected abuse, neglect, or exploitation of a child (Miss. Code Ann. § 43-21-353)
• Suspected abuse or neglect of a vulnerable adult — reporting requirement at Miss. Code Ann. § 43-47-37 (Mississippi Vulnerable Adults Act)
• A credible threat of imminent harm to an identifiable third party, under Mississippi common law duty-to-warn obligations

When we make a mandatory report, we will disclose only the minimum information required by law.

Mississippi Department of Mental Health (DMH) Oversight

As a DMH-certified behavioral health provider, we may be subject to audits, inspections, and evaluations by the Mississippi Department of Mental Health. Records reviewed during such oversight activities are handled under strict confidentiality requirements and may not be used against you.

Minor Clients — Mississippi Minor Health Care Consent Act

We treat clients under the age of 18. Under the Mississippi Minor Health Care Consent Act (Miss. Code Ann. § 41-41-14) and related provisions, a minor may consent to certain mental health and substance use disorder treatment in defined circumstances without parental involvement. The following privacy rules apply to minor clients:

• Where a minor lawfully consents to their own treatment under Mississippi law, the minor — not the parent or guardian — generally holds the right to control disclosure of those treatment records.
• Under 42 CFR § 2.14, where state law permits a minor to obtain substance use disorder treatment without parental consent, the minor's written consent is required before we may disclose their SUD records to a parent or guardian.
• For mental health treatment, the minor's consent may also be required for disclosure depending on the circumstances of treatment and the minor's age and capacity.
• We will follow all applicable Mississippi statutes, federal regulations, and court orders in determining who may access a minor client's records and who may consent to disclosure.

When a parent or guardian holds legal authority to act on the minor's behalf, they may exercise the minor's rights under this notice. In all cases, we will balance the minor's right to confidential treatment with applicable parental rights as required by law.