Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

This Notice of Privacy Practices ("Notice") describes the privacy practices of Udoka Addy, PMHNP-BC ("we," "us," "our," or "the practice"), an independent telehealth psychiatric mental health nurse practitioner practice. It explains how we may use and disclose your protected health information ("PHI") for treatment, payment, and health care operations, and for other purposes permitted or required by law. It also describes your rights regarding your PHI.

This practice is licensed in Washington State and provides care only to patients who are physically located in Washington at the time of service. Because this is a psychiatric practice, your health information is especially sensitive, and both federal and Washington law give it strong protection. Where Washington law is more protective than HIPAA, we follow Washington law.

1. How we may use and disclose your protected health information

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your psychiatric care. For example, we may share information with your primary care provider, therapist, pharmacy, or another specialist involved in your care, in order to coordinate medication management, confirm diagnoses, or avoid adverse drug interactions.

Payment

We may use and disclose your PHI to obtain payment for the services we provide. Because our practice operates on a cash-pay basis, most payment activity involves processing your payment through our practice management and payment platform and, at your request, providing you with a superbill you may submit to your insurer for out-of-network reimbursement. If you choose to submit a superbill, you are authorizing release of the diagnosis, dates of service, and billing codes it contains to your insurer.

Health care operations

We may use and disclose your PHI as necessary to operate the practice. Examples include quality improvement activities, credentialing, licensure and audit responses, business planning, and consultations with attorneys, accountants, or other professional advisors who are bound by confidentiality obligations.

Appointment reminders and practice communications

We may contact you by telephone, text message, secure patient portal, or email to remind you of appointments, coordinate scheduling, or deliver other non-sensitive administrative information. If you wish to restrict how we contact you, tell us in writing and we will accommodate reasonable requests.

2. Uses and disclosures that require your written authorization

The following will be made only with your written authorization:

• Psychotherapy notes. Any use or disclosure of psychotherapy notes, notes documenting or analyzing the contents of a counseling session, kept separately from the rest of your medical record, requires your specific written authorization, with limited exceptions permitted by law (such as use by the originator for treatment, our own training, or defense in a legal action you bring).
• Audio recording and AI-assisted documentation. We do not record your sessions or use AI-assisted transcription unless you have separately signed a consent for it. Washington is an all-party consent state (RCW 9.73.030), and we will also tell you at the start of any session that is being recorded. You may decline, or withdraw consent later, without affecting your care.
• Marketing. Any use or disclosure of your PHI for marketing purposes, other than face-to-face communication or a promotional gift of nominal value, requires your written authorization.
• Sale of PHI. Any disclosure that constitutes a sale of PHI requires your written authorization.
• Any other purpose not described in this Notice.

You may revoke any written authorization at any time by giving us written notice. Revocation will not affect disclosures we already made in reliance on it.

3. Uses and disclosures that may be made without your authorization

Federal and Washington law permit or require us to use or disclose your PHI without authorization in certain circumstances, including:

As required by law

We will disclose your PHI when required by federal, state, or local law.

Public health activities

We may disclose PHI to public health authorities for purposes such as preventing or controlling disease, reporting adverse drug events to the FDA, or reporting births and deaths.

Abuse, neglect, or exploitation, mandated reporting

We are required by law to report suspected abuse, neglect, or exploitation of children and of vulnerable adults. In Washington we report under RCW 26.44 (children) and RCW 74.34 (vulnerable adults).

Health oversight activities

We may disclose PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, licensure, and disciplinary actions.

Judicial and administrative proceedings

We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to the heightened protections that apply to mental health records under federal and Washington law.

Law enforcement

We may disclose limited PHI to law enforcement officials in response to a court order, warrant, or subpoena, or as otherwise permitted by law.

Serious threat to health or safety

We may, and in some cases must, use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your safety or that of another person. In Washington this includes the duty to take reasonable precautions when a patient has communicated an actual threat of physical violence against a reasonably identifiable victim (RCW 71.05.120 and related case law).

Coroners, medical examiners, and funeral directors

We may disclose PHI to coroners and medical examiners to identify a deceased person or determine cause of death, and to funeral directors as necessary to carry out their duties.

Organ and tissue donation

If you are an organ donor, we may disclose PHI to organizations that handle organ procurement, transplantation, or tissue banking.

Research

We do not conduct research involving PHI. If that changes, we will use or disclose PHI for research only with your written authorization or as otherwise permitted by law.

Workers' compensation

We may disclose PHI to the extent necessary to comply with workers' compensation laws.

Military, veterans, and national security

If you are a member of the armed forces, we may disclose PHI as required by military command authorities. We may also disclose PHI for authorized national security, intelligence, and protective service activities.

Business associates

We may disclose PHI to third parties that perform services for us, our electronic health record and practice management platform, payment processing, secure messaging, telehealth video, and IT support, when necessary for them to perform those services. Each business associate must sign a written Business Associate Agreement obligating it to protect your PHI in accordance with HIPAA. Where we use AI-assisted documentation tools, they are covered by the same agreements, and we use them only for patients who have separately consented as described in Section 2.

4. Washington law and telehealth

Washington law that is more protective than HIPAA

RCW 70.02 (health care information access and disclosure) and RCW 71.05 (mental health treatment) impose additional restrictions on disclosure of mental health information and require specific written authorization for many disclosures that HIPAA alone would permit. Where those laws are more protective, we follow them.

Telehealth privacy and security

All clinical services are provided by telehealth. We use a HIPAA-compliant videoconferencing platform, electronic health record, and payment processor, each under a signed Business Associate Agreement. Standard email and standard text messaging are not fully secure; we limit them to scheduling and other non-PHI administrative communication unless you specifically request otherwise in writing and accept the associated risk.

At the start of each telehealth session we will confirm the physical address from which you are participating. This is necessary to confirm you are in Washington, where we are licensed, and to direct emergency services to you if a crisis arises during the session.

5. Your rights regarding your protected health information

Right to access, inspect, and copy

You have the right to inspect and obtain a copy of the PHI we maintain about you, in paper or electronic format, with limited exceptions. Under federal law you do not have a right to inspect or copy psychotherapy notes, or information compiled in anticipation of a civil, criminal, or administrative action. We will respond within 30 days and may charge a reasonable, cost-based fee.

Right to request an amendment

If you believe PHI we maintain is inaccurate or incomplete, you may request that we amend it. We may deny the request in circumstances permitted by law. If we deny it, you may submit a written statement of disagreement, which we will include in your record.

Right to an accounting of disclosures

You may request an accounting of disclosures we have made, with certain exceptions (including disclosures for treatment, payment, health care operations, and those made under your authorization). The first accounting in any 12-month period is free.

Right to request restrictions

You may request restrictions on our use or disclosure of your PHI. We are not generally required to agree. However, if you pay in full out of pocket for a service and ask us not to disclose that information to a health plan for payment or operations purposes, we will agree unless disclosure is otherwise required by law.

Right to request confidential communications

You may request that we communicate with you by alternative means or at alternative locations. We will accommodate reasonable requests.

Right to breach notification

You have the right to be notified if a breach of unsecured PHI compromises the privacy or security of your information, as required by the HITECH Act and 45 CFR Part 164 Subpart D.

Right to a paper copy of this Notice

You may receive a paper copy on request, even if you previously agreed to receive it electronically.

Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights. We will verify their authority before acting.

6. Our responsibilities

• Maintain the privacy and security of your PHI;
• Provide you with this Notice of our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect; and
• Notify you promptly of any breach of your unsecured PHI.

We will not use or disclose your PHI other than as described here unless you authorize it in writing. You may revoke that authorization in writing at any time, except to the extent we have already acted in reliance on it.

7. Changes to this Notice

We may change the terms of this Notice at any time and make the revised Notice effective for all PHI we maintain, including information created before the revision. The current version is posted at udokaaddy.com and available in the patient portal, and a copy will be provided on request.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below. You may also file with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, 1-877-696-6775, hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

9. Contact

Privacy Officer: Udoka Addy, MSN, ARNP, PMHNP-BC
Mailing address: 100 N Howard St #6553, Spokane, WA 99201
Phone: (509) 356-2424 · Email: udoka@udokaaddy.com