In this notice we use the term "we" and "our" to include SPROUT THERAPY PDX, its mental health care providers, interns, contractors, and employees.

I. OUR PLEDGE REGARDING YOUR PERSONAL HEALTH INFORMATION

SPROUT THERAPY PDX understands that health information about you and your health care is personal and is committed to protecting your privacy.

This Notice is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA) and applies to all of the records of your care generated by this mental health care practice. This Notice describes SPROUT THERAPY PDX's duties to you regarding your personal health information ("PHI"), how we may use or disclose your PHI, and your rights with respect to your PHI. The privacy practices described in this Notice will be followed by all SPROUT THERAPY PDX providers and employees while the Notice is in effect.

II. CHANGES TO THIS NOTICE

The effective date of this Notice is shown below. SPROUT THERAPY PDX reserves the right to change this Notice and our privacy practices at any time, as long as the change is consistent with state and federal law. Any revised notice will apply both to the PHI we already have about you at the time of the change, and any PHI created or received after the change takes effect. If we make an important change to our privacy practices, we will promptly change this Notice. A copy of this or any revised Notice will be available upon request and is available for you to review at any time in your client portal. You also have the right to receive a paper and/or e-mail copy of this Notice upon request.

III. WHAT IS PHI?

PHI is individually identifiable health information, including demographic information, about your past, present or future physical or mental health or condition, health care services you receive, and past, present or future payment for your health care. Demographic information means information such as your name, social security number, address, and date of birth. PHI information also relates to your past, present, or future mental health care services. PHI may be in oral, written or electronic form.

Your provider at SPROUT THERAPY PDX will create a record of the care and services you receive. SPROUT THERAPY PDX needs this record to provide you with quality care and to comply with certain legal requirements. "Psychotherapy notes" (as that term is defined in 45 CFR § 164.501) kept by your provider and communications between you and your health care provider about your care are examples of PHI.

IV. OUR DUTIES TO YOU REGARDING PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX is required by law to do the following:

• Make sure that your PHI is kept private;

• Give you a copy of this Notice of our legal duties and privacy practices for the use and disclosure of your PHI;

• Follow the terms of the Notice currently in effect;

• Communicate any changes in the Notice to you; and

• Notify you if a breach occurs that may have compromised the privacy or security of your PHI.

Other ways SPROUT THERAPY PDX safeguards your PHI:

• Treats all of your personal information that we collect as confidential;

• States confidentiality policies and practices in our employee handbook;

• Restricts access to your personal information to only those employees who need to know your personal information in order to provide services to you, such as submitting a claim for a covered benefit;

• Discloses only your personal information necessary for a service provider to perform its functions on your behalf, and the provider agrees to protect and maintain the confidentiality of your personal information; and

• Maintains physical, electronic, and procedural safeguards that comply with federal and state regulations to guard your personal information.

V. HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX can only disclose your personal information when allowed or required by law to make the disclosure, or if you (or your authorized representative) give us permission. If there are other legal requirements that further restrict our use or disclosure of your personal information, we will comply with those legal requirements as well. Your provider will not use or disclose your PHI for marketing purposes, or sell your PHI in the regular course of business.

The following types of uses and disclosures of your PHI are allowed or required by law:

• Treatment: SPROUT THERAPY PDX may use your PHI to carry out your treatment or services and contact you to remind you about appointments. We may disclose your medical information other health care providers who are involved in your treatment. In emergencies, SPROUT THERAPY PDX may use and disclose your protected health information to assist you in obtaining treatment.

• Payment: SPROUT THERAPY PDX may use and disclose your PHI so that the treatment and services you receive may be properly billed and paid. For example, SPROUT THERAPY PDX will share your protected health information with third-party business associates and/or programs who perform various billing activities for SPROUT THERAPY PDX.

• Death; Organ Donation: SPROUT THERAPY PDX may disclose the PHI of a deceased person to a coroner, funeral director, next of kin, or organ procurement organization for certain purposes. For example, we may disclose protected health information to a funeral director to enable them to carry out their duties.

• Legal Proceedings; Criminal Activity: SPROUT THERAPY PDX may disclose your PHI during any judicial or administrative proceeding, in response to a court order, subpoena, discovery request, or other lawful process. For example, if you are a victim of a crime or you commit a crime, SPROUT THERAPY PDX may disclose information as required by law.

• Military Activity and National Security: SPROUT THERAPY PDX may also disclose your PHI to authorized officials conducting national security and intelligence activities as required by law.

• Public Health and Safety/Abuse or Neglect: SPROUT THERAPY PDX may disclose your PHI if we believe disclosure is necessary to avert a serious and imminent threat to your health or safety or the health or safety of others. For example, we may disclose your protected health information to appropriate authorities if we reasonably believe that you are a possible victim and/or perpetrator of abuse, neglect, or other crimes.

• Law Enforcement: SPROUT THERAPY PDX may disclose your PHI to authorized officials for law enforcement purposes, for example, to respond to a search warrant, report a crime on our premises, or help identify or locate someone.

• Required Uses and Disclosures: By law, SPROUT THERAPY PDX must make disclosures when required by federal or state law to disclose your PHI to others. For example, the Secretary of the Department of Health and Human Services may review our compliance efforts, which may include seeing your PHI. the Secretary of the U.S. Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 of HIPAA.

In some circumstances, you have the opportunity to authorize or object to the use or disclosure of all or part of your PHI. The following are examples in which your agreement or objection are required:

• Disclosure of your PHI to a member of your family, a relative, a close friend, or any other person you identify, that directly relates to that person's involvement in your health care.

• Disclosure of your PHI to someone who helps pay for your care.

You may revoke such an authorization in writing at any time, except to the extent that we have already taken action in reliance on the authorization.

VI. YOUR RIGHTS WITH RESPECT TO YOUR PHI

You may exercise the following rights by submitting a request to SPROUT THERAPY PDX. Depending on your request, you may also have rights under the Privacy Act of 1974. SPROUT THERAPY PDX can guide you in pursuing these options. Please be aware that SPROUT THERAPY PDX may deny your request; however, you may seek a review of the denial. With respect to your PHI, you have the following rights:

• The Right to a Notice of Privacy Practices. You have right to receive a notice that tells you how your PHI may be used and shared;

• The Right to See and Get Copies of Your PHI. Other than "psychotherapy notes," you have the right to get an electronic or paper copy of your record and other information that SPROUT THERAPY PDX has about you. SPROUT THERAPY PDX will provide you with a copy of your record, or a summary of it, if you agree to receive a summary, within 30 days of receiving your written request, and may charge a reasonable, cost based fee for doing so;

• The Right to Correct or Update Your PHI. If you believe that there is a mistake in your PHI, or that a piece of important information is missing from your PHI, you have the right to request that SPROUT THERAPY PDX correct the existing information or add the missing information. SPROUT THERAPY PDX may say "no" to your request, but will tell you why in writing within 60 days of receiving your request;

• The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask SPROUT THERAPY PDX not to use or disclose certain PHI for treatment, payment, or health care operations purposes. SPROUT THERAPY PDX is not required to agree to your request, and may say "no" if SPROUT THERAPY PDX believes it would adversely affect your health care;

• The Right to Restrict Disclosures to Health Plans for Self-Pay Services. If you pay for a service or health care item out-of-pocket in full, you have the right to ask SPROUT THERAPY PDX not to share that information with your health insurer for the purpose of payment or health care operations. SPROUT THERAPY PDX will agree to your request, except where we are required by law to share that information;

• The Right to Choose How We Send PHI to You. You have the right to ask SPROUT THERAPY PDX to contact you in a specific way (for example, home or office phone) or to send mail to a different address, and SPROUT THERAPY PDX will agree to all reasonable requests;

• The Right to Get a List of the Disclosures We Have Made. You have the right to request a list of instances in which SPROUT THERAPY PDX has disclosed your PHI for purposes other those described in "HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION" earlier in this Notice. SPROUT THERAPY PDX will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list SPROUT THERAPY PDX will give you will include disclosures made in the last six years unless you request a shorter time. SPROUT THERAPY PDX will provide the list to you at no charge, but if you make more than one request in the same year, SPROUT THERAPY PDX will charge you a reasonable cost-based fee for each additional request;

• The Right to Be Notified of a Breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI; and

• The Right to Get a Paper or Electronic Copy of this Notice. You have the right to get a paper copy of this Notice, and you have the right to get a copy of this notice by e-mail. And, even if you have agreed to receive this Notice via e-mail, you also have the right to request a paper copy of it.

VII. COMPLAINTS

If you believe your rights are being denied or your health information isn't being protected, you can file a written complaint with SPROUT THERAPY PDX. You may contact our HIPAA Security Officer for further information about the complaint process at 7704 N Hereford Ave, Portland, OR 97203, or reach us at info@sprouttherapypdx.com. You may also lodge a complaint with the U.S. Department of Health and Human Services.

No retaliation will occur against you for making a complaint about our privacy practices.

VIII. ELECTRONIC RECORDS DISCLOSURE

SPROUT THERAPY PDX keeps and stores records for each client in a record-keeping system produced and maintained by Simple Practice. This system is "cloud-based," meaning the records are stored on servers which are connected to the Internet. Here are the ways in which the security of these records is maintained:

· SPROUT THERAPY PDX has entered into HIPAA Business Associate Agreement with SimplePractice. Because of this agreement, SimplePractice is obligated by federal law to protect these records from unauthorized use or disclosure.

· The computers on which these records are stored are kept in secure data centers, where various physical security measures are used to maintain the protection of the computers from physical access by unauthorized persons.

· SimplePractice employs various technical security measures to maintain the protection of these records from unauthorized use or disclosure.

o You can learn more about these methods here: https://www.simplepractice.com/security/ SPROUT THERAPY PDX has our own security measures for protecting the devices that we use to access records:

o On computers, we employ firewalls, antivirus software, passwords, and encryption to protect our computers from unauthorized access and thus to protect the records from unauthorized access.

o With mobile devices, we use passwords, remote tracking, and remote wipe to maintain the security of the device and prevent unauthorized persons from using it to access records.

Here are things to keep in mind about our record-keeping system:

· While our record-keeping companies and SPROUT THERAPY PDX both use security measures to protect these records, their security cannot be guaranteed.

· Some workforce members at SimplePractice such as engineers or administrators, may have the ability to access these records for the purpose of maintaining the system itself. As a HIPAA Business Associate, SimplePractice is obligated by law to train their staff on the proper maintenance of confidential records and to prevent misuse or unauthorized disclosure of these records. This protection cannot be guaranteed, however.

· Our record-keeping company keeps a log of our transactions with the system for various purposes, including maintaining the integrity of the records and allowing for security audits.

IX. ACKNOWLEDGEMENT OF RECEIPT OF PRIVACY NOTICE

SPROUT THERAPY PDX requests that [clients] provide a signed acknowledgment of receipt of this Notice. Our intent is to make you aware of the possible uses and disclosures of your protected health information and your privacy rights. If you decline to provide a signed acknowledgment, SPROUT THERAPY PDX may determine not to continue to provide you with requested services. SPROUT THERAPY PDX will disclose your protected health information for treatment, payment, and health care operations when necessary.