Affect Provider Group, P.S.C. and Affect Therapeutics, Inc. (“Affect,” “we”, “us” or “our”) is required by law to maintain the privacy of your health information in accordance with federal and state law. We protect your health information in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and all other applicable laws. We also protect the privacy and security of your substance use disorder (“SUD”) patient records in accordance with 42 U.S.C. § 290dd–2 and 42 C.F.R. Part 2, the Confidentiality of Substance Use Disorder Patient Records (“Part 2”), and 45 C.F.R. Parts 160, 162, and 164.  Affect also provides mental health treatment services. Your mental health records, including any psychotherapy notes, are subject to additional protections under applicable federal and state law, as described further in this Notice. 

This Notice of Privacy Practices (“Notice”) outlines our legal duties and privacy practices with respect to your health information and informs you of your rights. We are required by law to: (1) maintain the privacy of your protected health information (“PHI”); (2) provide you with a copy of this Notice; and (3)  notify you if a breach occurs that may have compromised the privacy or security of your health information. 

We will abide by the terms of the Notice. We reserve the right to make changes to this Notice as permitted by law. We reserve the right to make the new Notice provisions effective for all health information we currently maintain, as well as any health information we receive in the future. If we make material or important changes to our privacy practices, we will promptly revise our Notice. Each version of the Notice will have an effective date listed on the first page. If we change this Notice, you can access the revised Notice on our website at www.affect.com/hipaa. 

You have the right to file a complaint if you believe your privacy rights have been violated. If you would like to file a complaint about our privacy practices, you can do so by contacting our Privacy Officer using the contact information provided in the Contact Information section of this Notice. You can also file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. You will not be penalized or otherwise retaliated against for filing a complaint.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION:

Because Affect provides substance use disorder treatment services, your health information is protected by both HIPAA and 42 C.F.R. Part 2. Under the 2024 amendments to Part 2 (effective February 16, 2026), we may use and disclose your SUD patient records for treatment, payment, and health care operations with your single, general written consent. More specific uses and disclosures are described below.

1. Uses and Disclosures That May Be Made With Your General Written Consent

Except in an emergency or other special situations, you may provide a single consent for all future uses or disclosures of SUD Records to your treating providers, health plans, third-party payers, and people helping to operate our program for the purposes of treatment, payment, and/or health care operations pursuant to Part 2, so that we may use and disclose your PHI and/or SUD Records for the following purposes:

Treatment. We may use and disclose health information about you in connection with your treatment, for example, to diagnose you. In addition, we may contact you to remind you about appointments, give you instructions prior to tests or surgery, or inform you about treatment alternatives or other health-related benefits or services. We may also disclose your PHI and/or SUD Records to other providers, doctors, nurses, technicians, medical students, clinical personnel, or other health care facilities or entities for treatment, care coordination, or quality improvement activities.

Payment. We may use and disclose your health information to obtain payment for services we provide to you. For example, we may share information with your health insurer, Medicare/Medicaid, or an ambulance company to obtain reimbursement for your treatment or transportation.

Health Care Operations. We may use and disclose your health information for our health care operations, including quality improvement, training, licensing, accreditation, business planning, and certain administrative activities necessary to run our practice.

2. Uses and Disclosures That May Be Made Without Your Written Authorization

Regardless of whether you have provided a general written consent under Section A, we may use and disclose your health information, including your PHI and SUD Records in the minimum necessary amount, without your written authorization, only in the limited circumstances described below. All such uses and disclosures are subject to the requirements of Part 2, HIPAA, and other applicable law:  

Disclosure to Relatives and Close Friends. We may disclose your health information to a family member, other relative, a close personal friend, or any other person if we: 1) obtain your agreement; 2) provide you with the opportunity to object to the disclosure; or 3) we can reasonably infer that you do not object to the disclosure. Please note that disclosure of your SUD records or your mental health records to family members may be subject to additional requirements under applicable federal and state law.

Within Our Organization. Affect’s personnel who have a need for your information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment may use and share your information. 

Emergency Treatment. In the event of a bona fide medical emergency in which your prior authorization cannot be obtained, we may disclose your identifying information to medical personnel. We will obtain your authorization prior to disclosing your information for non-emergent treatment. 

Business Associates/Qualified Service Organizations. We may disclose your information to third party “business associates” and “qualified service organizations” that perform various services on our behalf, such as transcription, billing, and collection services, and who agree to protect the privacy of your health information.

Audits and Oversight. We may disclose your health information to entities who are legally permitted to perform audits of our facilities. Those entities are required to maintain the privacy of your information.  We may also disclose your health information to health oversight agencies for activities such as audits, investigations, and inspections authorized by law.

Legal Proceedings and Court Orders. We must follow certain procedures before using or sharing your information for investigations and legal proceedings.  We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings against you without your written consent or a court order. We will only respond to a court order to use or share your health information if it is accompanied by a subpoena or other similar legal mandate requiring us to comply. We will only use or share your information in proceedings against you based on a court order after we have received notice and an opportunity to be heard or you tell us that you have received notice. We may use or share your information to respond to legal proceedings against our program based on a court order and you may not be notified in advance. You have the right to challenge or seek to modify any court order authorizing disclosure of your health information.

Reporting Crimes on Our Premises or Against Our Personnel. We may disclose a patient’s commission (or threatened commission) of a crime on our premises or against our personnel to a law enforcement agency or official. We are permitted to disclose information regarding the circumstances of such an incident, including the suspect’s name, address, last known whereabouts, and status as a patient in our program. 

Reporting Child Abuse or Neglect. We may report incidents of suspected child abuse and neglect to the appropriate state or local authorities.

Public Health Activities. We may use or disclose your health information for public health activities, including to prevent or control disease, injury, or disability; to report vital statistics; and to notify persons who may have been exposed to a communicable disease or may be at risk for contracting or spreading a disease or condition.

Deceased Persons. We may disclose information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

Organ and Tissue Donation. We may disclose your health information to organizations that obtain organs or tissues for banking and/or transplantation.

Research. Under certain circumstances, we may disclose your health information to researchers who are conducting a specific research project. Your identifying information will never be published without your written authorization.

FDA Reporting. We may disclose patient identifying information to medical personnel of the Food and Drug Administration (“FDA”) who assert a reason to believe that the health of any individual may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.

Workers’ Compensation. We may disclose your PHI as authorized by and to the extent necessary to comply with state workers’ compensation laws and other similar programs that provide benefits for work-related injuries or illnesses. Please note that disclosure of your SUD records or mental health records under workers’ compensation must still comply with applicable requirements of Part 2 and state law and may require your separate written consent.

Mental Health Records

Your mental health records have additional privacy protections under federal and state law. In general, we may only use or share these records:

• With your written permission;
• When the law allows or requires it (for example, to prevent a serious and immediate threat to your health or safety or someone else’s); or
• As required by law (for example, mandatory reporting of suspected child abuse or neglect).

Psychotherapy Notes

Psychotherapy notes are notes your mental health provider takes during or after a counseling session that are kept separate from your regular medical record. These notes have even stricter privacy protections. We will not use or share your psychotherapy notes without your specific written permission, except in the following situations:

• To provide treatment, process payment, or carry out certain health care operations allowed by law;
• For training programs for our staff;
• To defend ourselves in a legal action or proceeding brought by you;
• To prevent a serious and immediate threat to health or safety;
• To a health oversight agency for monitoring the provider who created the notes; or
• To coroners or medical examiners as required by law.

A general authorization to use or share your health information does not include psychotherapy notes. Any other use or disclosure of these notes requires a separate, specific written authorization.

OTHER USES AND DISCLOSURES:

Use or disclosure of your health information for any purpose other than those listed above requires your written authorization. Some examples include:

• Psychotherapy Notes: We will not use or disclose your psychotherapy notes without your specific written authorization, except as expressly permitted by law. Please see the “Mental Health Records” section of this Notice for a full description of the limited circumstances in which psychotherapy notes may be used or disclosed without your authorization. A general authorization to use or disclose your health information does not cover your psychotherapy notes. 
• Release of Your Presence in Treatment: We will not disclose your presence in treatment to individuals who may contact Affect unless you have provided your written authorization permitting the release.
• Marketing: We will not use or disclose your health information for marketing purposes without your written authorization except as otherwise permitted by law.
• Sale of Your Health Information: We will not sell your health information without your written authorization except as otherwise permitted by law.

If you change your mind after authorizing a use or disclosure of your health information, you may withdraw your permission by revoking the authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your health information that occurred before you notified us of your decision, or any actions that we have taken based upon your authorization. To revoke an authorization, please contact our Privacy Officer using the contact information provided in the Contact Information section of this Notice.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION:

This section describes your rights regarding the health information we maintain about you. All requests or communications to exercise your rights discussed below must be submitted in writing to our Privacy Officer using the contact information provided in the Contact Information section of this Notice.

Right to Inspect and Copy. You have the right to inspect and receive a copy of your health information, excluding your psychotherapy notes. We will usually respond to your request within 30 days. We may charge you a fee as authorized by law to meet your request. You may request access to your health information in a certain electronic form and format, if readily producible, or, if not readily producible, in a mutually agreeable electronic form and format. Further, you may request in writing that we transmit such a copy to any person or entity you designate. Your written, signed request must clearly identify such designated person or entity and where you would like us to send the copy. We may deny your request to inspect and copy in limited circumstances. If you are denied access to your health information, you may request that the denial be reviewed by a licensed health care professional chosen by us. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Request Confidential Communications. You have the right to request that we communicate your health information to you in a certain manner or at a certain location. For example, you may wish to receive information through a written letter sent to a private address. We will grant reasonable requests. We will not ask you the reason for your request.

Right to Amend. You have a right to request that we amend or correct your health information that you believe is incorrect or incomplete. For example, if your date of birth is incorrect, you may request that the information be corrected. To request a correction or amendment to your health information, you must make your request in writing and provide a reason for your request. You have the right to request an amendment for as long as the information is kept by or for us. Under certain circumstances we may deny your request. If your request is denied, we will provide you with information about our denial and how you can file a written statement of disagreement with us that will become part of your medical record.

Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures we make of your health information. Please note that certain disclosures need not be included in the accounting we provide to you, including most disclosures we make pursuant to your authorization. Your request must state a time period which may not go back further than six years. You will not be charged for this accounting, unless you request more than one accounting per year, in which case we may charge you a reasonable cost-based fee for providing the additional accounting(s). We will notify you of the costs involved and give you an opportunity to withdraw or modify your request before any costs have been incurred.

Right to Request Restrictions. You can ask us not to use or share certain health information for treatment, payment, or our health care operations after you have provided consent for all those purposes. We are not required to agree to your request, and we may say “no” if, for example, it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment.  If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our health care operations with your health insurer. We will say “yes” unless a law requires us to share that information. 

Please note that because most uses and disclosures of your SUD records require your written consent under Part 2, and because most uses and disclosures of your psychotherapy notes require a separate written authorization, you already have significant control over those disclosures beyond the general right to request restrictions described here.

Right to Revoke Your Authorization. You may revoke your authorization for us to use and disclose your PHI and/or SUD Records at any time by submitting a request in writing to our Privacy Officer using the contact information provided in the Contact Information section of this Notice.

Right to a Paper Copy of This Notice. You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive this Notice electronically. A copy of this Notice can be obtained at any time from our website at www.affect.com/hipaa. 

Right to Discuss This Notice. You have the right to speak with our designated Privacy Officer about the contents of this Notice or any questions you have about our privacy practices.  Contact information for our Privacy Officer is provided in the Contact Information section of this Notice.

Right to Choose Someone to Act for You.  If someone has authority to act as your personal representative, such as if someone has your medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.  We will make sure the person has this authority and can act for you before we take any action.

CONTACT INFORMATION:

If you have questions or concerns about your privacy rights,  the contents of this Notice, or our privacy practices, or if you wish to exercise any of the rights described in this Notice, please contact our Privacy Officer using any of the following methods: 

Affect Provider Group, Attn: Privacy Officer, 1640 Boro Place, 4th Floor, McLean, VA 22102 

Telephone at 845-769-8758, or by email at privacy@joinaffect.com.

STATE LAW:

To the extent applicable state law is even more restrictive than HIPAA or Part 2 on how we use and disclose any of your health information, we will comply with the more restrictive state law requirement.  State-specific privacy protections may apply depending on your state of residence or the state in which you receive services. Please contact our Privacy Officer if you have questions about the state-specific privacy protections that may apply to you.