Notice of Privacy Practices

1. How Your PHI May Be Used and Disclosed

Your agency may use and disclose your PHI for the following purposes without your written authorization:

For Treatment: Clinicians and staff at your agency review your record to plan your care, prescribe medications, and coordinate with other providers involved in your treatment.

For Payment: Your agency submits claims to your insurance company or Medicaid managed care organization through our clearinghouse (Stedi). PHI may be disclosed to a collection agency if your account becomes delinquent.

For Health Care Operations: Your PHI is used for quality assessment, training, accreditation reviews, and business management. PHI used for these purposes is limited to the minimum necessary.

Required by Law: Your agency will use and disclose your PHI when required by federal, state, or local law — including reporting communicable diseases, abuse, neglect, or domestic violence; responding to court orders; complying with public health surveillance requirements.

Health and Safety Emergencies: Your PHI may be disclosed when there is a serious threat to your health or safety, or to public health and safety.

Other Uses Require Your Written Authorization: Marketing communications, sale of your PHI, most uses of psychotherapy notes, and disclosures to friends or family not involved in your care (except limited emergency disclosures) all require your written authorization. You may revoke an authorization in writing at any time except to the extent the agency has already acted on it.

2. Special Protections for Substance Use Disorder Treatment

If you receive substance use disorder (SUD) treatment, additional federal regulations (42 CFR Part 2) protect your information beyond standard HIPAA. Under Part 2:

• Your agency may not disclose information identifying you as someone who has received SUD treatment without your written consent — even to family, employers, or law enforcement — except in narrow circumstances (medical emergency, child abuse reporting, court order based on good cause, audits of programs).
• When Part 2-protected information IS disclosed, the recipient is notified that the information may not be redisclosed without your consent.
• Your consent may be revoked in writing at any time.

3. Your Privacy Rights

Under HIPAA, you have the following rights regarding your PHI:

Right to inspect and copy your record (§164.524): You may request access to your PHI. Your agency will respond within 30 days. You may receive your record electronically if it is maintained electronically (AgenciesForge does).

Right to request amendment (§164.526): You may request that incorrect or incomplete information be amended. Your agency will respond within 60 days. If they deny the request, you may submit a statement of disagreement.

Right to an accounting of disclosures (§164.528): You may request a list of certain disclosures of your PHI made by your agency in the six years prior to your request. The list excludes disclosures made for treatment, payment, health care operations, and a few other categories.

Right to request restrictions (§164.522(a)): You may request that your agency limit its use or disclosure of your PHI. They are not required to agree to all requests but must agree to restrict disclosure to your health plan if you pay out-of-pocket in full for a service.

Right to confidential communications (§164.522(b)): You may request that your agency contact you in a specific way (e.g., only by phone at work, only by mail at a specific address). Your agency will accommodate reasonable requests.

Right to receive notice of breach: You will be notified within 60 days if a breach of your unsecured PHI occurs.

Right to file a complaint: You may file a complaint with your agency or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Neither your agency nor AgenciesForge will retaliate against you for filing a complaint.

4. How to Make a Privacy Request

To exercise any of these rights, contact your treating agency. They are the Covered Entity responsible for your PHI and processes all privacy requests.

Please provide:

• Your full name and date of birth
• Description of your request (which right, what record, what time period)
• How you want the agency to respond (email, mail, secure portal)
• A copy of government-issued photo ID for identity verification (for record-access and amendment requests)

Your agency will acknowledge receipt within 5 business days and provide a substantive response within the timelines in Section 3.

5. AgenciesForge's Role as Business Associate

AgenciesForge operates the software platform your agency uses for electronic health records, billing, and patient communications. Under HIPAA, AgenciesForge is a Business Associate of your agency and is contractually required to protect your PHI in accordance with HIPAA + the Business Associate Agreement signed with your agency.

AgenciesForge uses the following subprocessors, each with a Business Associate Agreement in place for systems that handle PHI:

• Google Cloud Platform: hosting, database, file storage, machine translation, voice transcription
• Amazon Web Services (Bedrock): AI inference (Claude models)
• Stedi: insurance eligibility checks + claim submission
• WENO Online: electronic prescribing (when your provider uses it)
• iFax: fax delivery for record requests
• Resend: appointment-reminder + notification emails
• Stripe: AgenciesForge billing — does not handle your PHI

The complete subprocessor list is maintained at agenciesforge.com/subprocessors.

6. Changes to This Notice

Your agency reserves the right to change its Notice of Privacy Practices. The revised Notice will be effective for all PHI maintained, including PHI received before the revision. The current Notice will be posted in your agency's office and on the patient portal.

7. Contact Information

For privacy questions about how YOUR AGENCY handles your PHI: Contact your treating agency directly. Each agency designates a Privacy Officer responsible for privacy questions and requests.

For questions about the AgenciesForge platform itself (security, data retention, subprocessors): Contact AgenciesForge at privacy@agenciesforge.com.

For complaints to the federal government:

• U.S. Department of Health and Human Services, Office for Civil Rights
• Phone: 1-800-368-1019
• Email: ocrmail@hhs.gov
• Online: ocrportal.hhs.gov