In this Notice, “we” and “our” mean SPROUT THERAPY PDX, its mental health care providers, interns, contractors, and employees.

I. OUR PLEDGE REGARDING YOUR PERSONAL HEALTH INFORMATION

SPROUT THERAPY PDX understands that health information about you and your health care is personal, and we are committed to protecting your privacy.

This Notice is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA). It applies to all records of your care created by this mental health care practice. This Notice describes:

• SPROUT THERAPY PDX’s duties to you regarding your protected health information (“PHI”)

• How we may use or disclose your PHI

• Your rights with respect to your PHI

All SPROUT THERAPY PDX providers and employees will follow the privacy practices in this Notice while it is in effect.

II. CHANGES TO THIS NOTICE

The effective date of this Notice is shown below. SPROUT THERAPY PDX may change this Notice and our privacy practices at any time, as long as the change is consistent with state and federal law.

Any revised Notice will apply to the PHI we already have about you and to any PHI created or received after the change takes effect. If we make an important change to our privacy practices, we will promptly update this Notice.

A copy of this Notice, or any revised Notice, is available on our website, in your client portal at any time, and upon request. You also have the right to receive a paper or email copy of this Notice when requested.

III. WHAT IS PHI?

PHI is individually identifiable health information about your past, present, or future physical or mental health or condition, the health care services you receive, and payment for your health care. It includes demographic information, such as your name, Social Security number, address, and date of birth. PHI may be in oral, written, or electronic form.

Your provider at SPROUT THERAPY PDX will create a record of the care and services you receive. We need this record to provide you with quality care and to comply with certain legal requirements. “Psychotherapy notes” (as defined in 45 CFR § 164.501) kept by your provider, and communications between you and your provider about your care, are examples of PHI.

IV. OUR DUTIES TO YOU REGARDING PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX is required by law to:

• Keep your PHI private

• Give you a copy of this Notice of our legal duties and privacy practices

• Follow the terms of the Notice currently in effect

• Communicate any changes in the Notice to you

• Notify you if a breach occurs that may have compromised the privacy or security of your PHI

Other ways SPROUT THERAPY PDX safeguards your PHI:

• We treat all personal information we collect as confidential.

• Our employee handbook states our confidentiality policies and practices.

• We limit access to your personal information to employees who need it to provide services to you, such as submitting a claim for a covered benefit.

• When a service provider performs functions on our behalf, we disclose only the personal information it needs, and it must agree to protect your information.

• We maintain physical, electronic, and procedural safeguards that comply with federal and state regulations.

V. HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX discloses your personal information only when the law allows or requires it, or when you (or your authorized representative) give us permission. If other laws further restrict our use or disclosure of your information, we will follow those laws as well. We will not use or disclose your PHI for marketing purposes, and we will not sell your PHI.

The following uses and disclosures of your PHI are allowed or required by law:

Treatment: We may use your PHI to provide your treatment or services and to contact you with appointment reminders. We may share your information with other health care providers involved in your treatment. In emergencies, we may use and disclose your PHI to help you get treatment.

Payment: We may use and disclose your PHI so that your services can be billed and paid. For example, we share PHI with business associates and programs that perform billing activities for us.

Health Care Operations: We may use and disclose your PHI to run our practice and improve the quality of care. Examples include quality reviews, clinical supervision and training, audits, and compliance activities. We may also share PHI with business associates, such as our electronic health record vendor, that perform services for us under written agreements requiring them to protect your information.

Death; Organ Donation: We may disclose the PHI of a deceased person to a coroner, funeral director, next of kin, or organ procurement organization for certain purposes. For example, we may disclose PHI to a funeral director so they can carry out their duties.

Legal Proceedings; Criminal Activity: We may disclose your PHI during a judicial or administrative proceeding, or in response to a court order, subpoena, discovery request, or other lawful process. For example, if you are a victim of a crime or commit a crime, we may disclose information as required by law.

Military Activity and National Security: We may disclose your PHI to authorized officials conducting national security and intelligence activities, as required by law.

Public Health and Safety; Abuse or Neglect: We may disclose your PHI if we believe it is necessary to prevent a serious and imminent threat to your health or safety, or the health or safety of others. For example, we may disclose PHI to appropriate authorities if we reasonably believe you are a possible victim or perpetrator of abuse, neglect, or other crimes.

Law Enforcement: We may disclose your PHI to authorized officials for law enforcement purposes. Examples include responding to a search warrant, reporting a crime on our premises, or helping identify or locate someone.

Required Uses and Disclosures: We must disclose your PHI when federal or state law requires it. For example, the Secretary of the U.S. Department of Health and Human Services may review our compliance with HIPAA, which may include seeing your PHI.

Uses and Disclosures That Require Your Written Authorization: We will make other uses and disclosures not described in this Notice only with your written authorization. This includes most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and any sale of PHI. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

Uses and Disclosures You Can Agree To or Object To: In some situations, you have the opportunity to agree to or object to the use or disclosure of all or part of your PHI. Examples include:

• Disclosure to a family member, relative, close friend, or other person you identify, related to that person’s involvement in your care

• Disclosure to someone who helps pay for your care

VI. YOUR RIGHTS WITH RESPECT TO YOUR PHI

You may exercise the following rights by submitting a request to SPROUT THERAPY PDX. We may deny some requests; if we do, you may ask for a review of the denial. With respect to your PHI, you have:

The Right to a Notice of Privacy Practices. You have the right to receive a notice that explains how your PHI may be used and shared.

The Right to See and Get Copies of Your PHI. Other than psychotherapy notes, you have the right to an electronic or paper copy of your record and other information we have about you.

• We will provide a copy of your record, or a summary if you agree to one, within 30 days of receiving your written request.

• We may charge a reasonable, cost-based fee.

The Right to Correct or Update Your PHI. If you believe your PHI contains a mistake or is missing important information, you may ask us to correct or add it. We may say no, but we will tell you why in writing within 60 days of receiving your request.

The Right to Request Limits on Uses and Disclosures of Your PHI. You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not required to agree, and we may say no if we believe it would negatively affect your care.

The Right to Restrict Disclosures to Health Plans for Self-Pay Services. If you pay for a service in full out of pocket, you may ask us not to share that information with your health insurer for payment or health care operations. We will agree unless the law requires us to share it.

The Right to Choose How We Send PHI to You. You may ask us to contact you in a specific way (for example, home or office phone) or at a different address. We will agree to all reasonable requests.

The Right to Get a List of the Disclosures We Have Made. You may request a list of times we disclosed your PHI for purposes other than those described in Section V.

• We will respond within 60 days of receiving your request.

• The list covers the last six years unless you ask for a shorter period.

• The first list in a 12-month period is free. We may charge a reasonable, cost-based fee for each additional request in that period.

The Right to Be Notified of a Breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI.

The Right to Get a Paper or Electronic Copy of This Notice. You may get a paper copy or an email copy of this Notice. Even if you agreed to receive it by email, you may still request a paper copy.

VII. COMPLAINTS

If you believe your rights have been denied or your health information has not been protected, you may file a complaint with SPROUT THERAPY PDX. Contact us at:

Sprout Therapy PDX Attn: Compliance Officer 6011 NE Oregon St Portland, OR 97213 Phone: 971-319-4827 Email: contact@sprouttherapypdx.com

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

VIII. ELECTRONIC RECORDS DISCLOSURE

SPROUT THERAPY PDX keeps client records in SimplePractice, a cloud-based record system. This means records are stored on secure servers connected to the internet. These records are protected in the following ways:

• We have a HIPAA Business Associate Agreement (BAA) with SimplePractice, which requires SimplePractice by law to protect these records from unauthorized use or disclosure.

• Records are stored in secure data centers that use physical security measures to prevent unauthorized access.

• SimplePractice uses technical security measures to protect records. You can learn more at https://www.simplepractice.com/trust-center/

We also protect the devices our staff use to access records. Our safeguards include required passwords, two-factor authentication at sign-in, encryption, automatic security updates, laptop privacy screens, and the ability to disable access if a device is lost or a staff member leaves.

Things to keep in mind:

• Both SimplePractice and SPROUT THERAPY PDX use security measures, but no system’s security can be guaranteed.

• Some SimplePractice workforce members, such as engineers or administrators, may be able to access records to maintain the system. As a business associate, SimplePractice must train its staff on handling confidential records and preventing misuse. This protection cannot be guaranteed.

• SimplePractice keeps a log of activity in the system to maintain the integrity of records and support security audits.

IX. USE OF ARTIFICIAL INTELLIGENCE (AI) TOOLS

SPROUT THERAPY PDX uses some AI tools to support documentation, care, and practice operations. This section explains which tools we use, what they do with your information, the protections in place, and your choices.

Our commitments:

• Staff complete specific training before using AI tools with client information.

• Your clinician reviews anything these features generate before relying on it, and reviews, edits, and signs any treatment plan before it becomes part of your record.

A. AI Features That Work With Information Already in Your Record

SPROUT THERAPY PDX clinicians may choose to turn on Care Aide, a set of AI features in our electronic health record, SimplePractice. If your clinician uses Care Aide, these features may be used with your information, whether or not you have signed our separate AI consent.

Care Aide features use information already in your chart, such as intake forms, progress notes, diagnoses, and assessment scores. They do not record or transcribe your sessions. Features include: summarization of intake forms so your clinician can review your background before your first session, providing session reminders and context so your clinician can pick up where you left off, drafting or updating treatment plans from your recent notes and intake information, and providing feedback to pre-licensed clinicians on how their progress notes are written, as part of supervised training. When using any of these features, your clinician reviews, edits, and signs off on the materials generated.

SimplePractice may also use AI within its standard features (for example, fraud detection and system security) and in insurance and billing tools. SPROUT THERAPY PDX does not control which AI capabilities SimplePractice builds into its standard features. These uses are covered by our Business Associate Agreement with SimplePractice.

The uses in this part are treatment and health care operations under HIPAA and do not require separate written consent.

Your choice: You may ask that Care Aide features not be used with your information. Tell your clinician or our Compliance Officer. We will note your preference in your record and make reasonable efforts to honor it, including connecting you with a clinician who does not use Care Aide. SimplePractice turns Care Aide on for each clinician, not for each client, so we cannot guarantee your preference in every situation.

B. AI That Records or Transcribes Sessions (Requires Your Separate Written Consent)

We will never record or transcribe your sessions with AI without your separate written consent. You may decline, or withdraw your consent at any time, without any effect on your care.

1. Google Gemini (Google Meet): Intern Clinical Supervision

For clients working with Graduate Interns, we use Google Gemini within Google Meet to transcribe telehealth sessions for clinical supervision.

• Transcripts are used by the Intern and their Licensed Supervisor to review clinical skills. They are not part of your permanent medical record.

• A HIPAA Business Associate Agreement is in place with Google.

• Under our Google Workspace agreement, your data is not used to train Google’s AI models.

• Transcripts are temporary and are permanently deleted after supervisory review.

2. SimplePractice Note Taker and Related Session Features

Note Taker is available to all SPROUT THERAPY PDX clinicians. Using it is optional for both clinicians and clients. A clinician must choose to use it, and it is only used in your sessions if you have signed a separate written consent. With your consent:

• Note Taker creates a transcript from audio in your session, and drafts a progress note for your clinician to review, edit, and sign.

• During telehealth sessions, related features may use the transcript to show your clinician brief recaps or the last few moments of conversation. Only your clinician sees these.

• After a session, a summary may be created from the transcript. Your clinician may review it and choose to share it with you through your client portal.

• Audio is deleted immediately after the transcript is created.

• The transcript and draft note are deleted when your clinician signs and locks your note, or after 7 days, whichever comes first.

Transcript retention: SimplePractice offers a setting that keeps de-identified copies of session transcripts to improve its AI features. SPROUT THERAPY PDX has opted out of transcript retention.

SimplePractice applies this setting to each clinician individually. For that reason, we require every clinician to turn transcript retention off before using Note Taker with any client, and we verify that it stays off.

We commit to keeping transcript retention off for as long as SimplePractice allows us to. If that changes, we will notify you and ask for your consent again before continuing to use Note Taker in your sessions.

Clinicians may also dictate their own notes after a session. Dictation does not record your audio.

C. Administrative and Operational Tools

SPROUT THERAPY PDX uses AI-assisted tools for internal administrative work, such as operational reporting, document drafting, and internal communications. PHI is not entered into these tools. We use business versions of these tools, under terms that do not allow the vendor to train its AI models on our data.

D. Outside AI Companies

Some AI features are powered by outside technology companies working on behalf of our vendors. These companies must follow HIPAA business associate requirements. They are contractually prohibited from using your information to train their AI models or for their own purposes.

E. De-Identified Information

Our vendors may remove all identifying details from records so the information cannot be linked to you, and may use that de-identified information to improve their products. HIPAA permits this. De-identified information is no longer considered protected health information.

F. What AI Tools at SPROUT THERAPY PDX Do Not Do

• Make clinical decisions, diagnoses, or treatment decisions

• Replace your clinician’s professional judgment or legal responsibility for your care

• Send you messages on their own

• Create final clinical documentation without clinician review and sign-off

• Make billing or coverage decisions

• Share your information beyond what HIPAA and Oregon law allow

G. What SPROUT THERAPY PDX Requires of AI Vendors That Handle PHI

• A signed HIPAA Business Associate Agreement

• Encryption of PHI in transit and at rest

• A prohibition on outside AI providers using identifiable client data to train their models

• Documented data retention and deletion practices

H. Oregon Law and Professional Standards

• Oregon law (ORS 165.540) restricts recording conversations without participants’ knowledge. We obtain your written consent before any session is recorded or transcribed.

• ORS 179.505 provides additional protections for mental health records beyond federal HIPAA requirements.

• Oregon Health Authority (OHA) requirements apply to Medicaid/OHP documentation.

• The Oregon Board of Licensed Professional Counselors and Therapists (OBLPCT) ethical standards apply to our counselors and therapists.

I. A Note on OHP and Insurance Documentation

Many of our clients are served through the Oregon Health Plan (OHP/Medicaid) or commercial insurance. These programs require clinical notes to meet specific documentation standards. No AI-assisted note is signed or submitted without a licensed clinician reviewing it and confirming it meets those standards.

J. Policy Updates

We review our AI vendors’ terms and practices regularly. We will update this Notice and notify clients of any change that materially affects how your information is handled. Your rights under this Notice are not reduced by our use of AI tools.

X. ACKNOWLEDGMENT OF RECEIPT OF THIS NOTICE

We will ask you to sign an acknowledgment that you received this Notice. Our goal is to make sure you know how your PHI may be used and disclosed, and what your privacy rights are.

If you choose not to sign, we will note that in your record. Declining to sign does not affect your ability to receive services. We will use and disclose your PHI for treatment, payment, and health care operations as described in this Notice.

Effective Date: 1/3/2019
Revised Date: 10/21/2026