Koa Mind, PLLC (“Koa Mind,” “we,” “us,” or “our”) is committed to protecting the privacy of your health information. This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your protected health information (“PHI”), your rights regarding your PHI, and our responsibilities under applicable privacy laws, including the Health Insurance Portability and Accountability Act (“HIPAA”).

This Notice applies to PHI created or received by Koa Mind in connection with your care.

1. YOUR RIGHTS

You have the following rights regarding your health information:

Get a copy of your records

You may request to inspect or obtain a paper or electronic copy of your medical and health information maintained by Koa Mind, subject to certain legal limitations.

Request corrections

You may ask us to correct health information that you believe is incorrect or incomplete. We may deny a request in certain circumstances, but we will provide you with a written explanation if we do.

Request confidential communications

You may ask us to contact you in a particular way or at a particular location—for example, by phone rather than email, or at a different mailing address.

We will consider reasonable requests.

Ask us to limit certain uses or disclosures

You may request restrictions on how we use or disclose your health information.

We are not required to agree to every restriction request. However, if you pay for a service completely out of pocket and request that information regarding that service not be disclosed to your health plan for payment or health care operations, we generally must honor that request unless disclosure is required by law.

Receive a list of certain disclosures

You may request an accounting of certain disclosures of your health information made by Koa Mind during the applicable period.

Certain disclosures, including disclosures for treatment, payment, health care operations, and disclosures you authorized, are generally not included.

Receive a copy of this Notice

You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is legally authorized to act on your behalf, that person may exercise your privacy rights and make decisions regarding your health information as permitted by law.

File a complaint

You may complain to Koa Mind or to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

You will not be retaliated against for filing a complaint.

2. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

We may use or disclose your PHI without your written authorization for purposes permitted by HIPAA and other applicable law.

Treatment

We may use and disclose your health information to provide, coordinate, or manage your psychiatric care.

For example, we may communicate with other health care professionals involved in your treatment when permitted by law.

Payment

We may use or disclose your health information to obtain payment for services.

For example, this may include submitting claims to your health insurance plan, verifying eligibility and benefits, determining coverage, or responding to payment-related requests.

Health Care Operations

We may use or disclose your health information for health care operations, such as:

• Quality improvement

• Care coordination

• Reviewing treatment and services

• Credentialing

• Auditing

• Compliance activities

• Business planning

• Administrative activities

• Training and professional development

• Managing our practice

Appointment reminders and communications

We may use your contact information to contact you regarding appointments, scheduling, treatment-related matters, billing, or other health care communications.

Business associates and service providers

Koa Mind may use third-party companies and service providers that perform services on our behalf and may require access to PHI.

These may include organizations supporting:

• Telehealth

• Scheduling and intake

• Electronic health records

• Insurance and billing

• Claims processing

• Prescription processing

• Secure communications

• Technology and information systems

• Administrative services

When required by HIPAA, these organizations are subject to appropriate contractual privacy and security obligations.

Koa Mind also uses Headway in connection with administrative, insurance, technology, and related practice functions. Headway maintains its own privacy practices and notices applicable to information it handles in its role as a separate organization.

Required by law

We may disclose health information when required to do so by federal, state, or local law.

Public health

We may disclose health information for certain public health activities permitted by law, such as reporting certain diseases, preventing or controlling disease, or addressing public health threats.

Serious and imminent threats

We may disclose information when permitted by law when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Abuse, neglect, or domestic violence

We may disclose information to appropriate authorities when legally permitted or required to report suspected abuse, neglect, or domestic violence.

Legal proceedings

We may disclose health information in response to a court order, subpoena, discovery request, or other lawful process when permitted by applicable law.

Law enforcement

We may disclose health information to law enforcement when permitted or required by law.

Coroners and medical examiners

We may disclose information to coroners or medical examiners as permitted by law.

Workers' compensation

We may disclose health information as necessary to comply with workers' compensation laws.

3. SUBSTANCE USE DISORDER INFORMATION

Certain substance use disorder (“SUD”) records may receive additional protection under 42 CFR Part 2, in addition to HIPAA.

Where Part 2 applies, Koa Mind will handle protected SUD information in accordance with applicable federal and state requirements.

Part 2 may require additional authorization or other protections for certain uses and disclosures of SUD records.

The current federal requirements require HIPAA covered entities to address applicable Part 2 protections in their Notice of Privacy Practices.

4. MENTAL HEALTH INFORMATION

Mental health information may receive additional protections under federal or state law.

Koa Mind will comply with applicable federal and state requirements governing the confidentiality, use, and disclosure of mental health information.

Certain information may only be disclosed with your authorization or pursuant to specific legal requirements.

5. PSYCHOTHERAPY AND TREATMENT NOTES

Psychotherapy and treatment notes are subject to additional federal protections.

In circumstances where HIPAA requires your written authorization for the use or disclosure of treatment notes, Koa Mind will obtain the required authorization unless another legal exception applies.

6. MARKETING AND SALE OF HEALTH INFORMATION

Koa Mind will not use or disclose your PHI for marketing purposes when HIPAA requires your authorization without first obtaining that authorization.

We will not sell your health information without your authorization when authorization is required by law.

We may communicate with you about treatment, health-related services, or other activities permitted by HIPAA.

7. OTHER USES AND DISCLOSURES

Uses and disclosures of your health information that are not described in this Notice or otherwise permitted by applicable law generally require your written authorization.

If you provide an authorization, you may revoke it in writing at any time, except to the extent Koa Mind has already relied upon it.

8. YOUR CHOICES REGARDING CERTAIN INFORMATION

You may have choices regarding how certain health information is shared, including information involving:

• Family members or other individuals involved in your care

• Individuals helping with payment for your care

• Disaster relief activities

• Certain communications about your care

Where applicable, we will provide you with an opportunity to express your preferences or obtain the authorization required by law.

9. TELEHEALTH AND ELECTRONIC COMMUNICATIONS

Koa Mind provides psychiatric services primarily through telehealth.

We may communicate with you through electronic systems and technology platforms used to provide or administer your care.

Although we take reasonable measures to protect your information, no electronic communication system can be guaranteed to be completely secure.

For your privacy and security, please avoid sending sensitive medical information through ordinary email, text messaging, social media, or other communication methods unless Koa Mind has specifically instructed you to do so.

10. HEADWAY AND OTHER THIRD-PARTY SERVICES

Koa Mind works with Headway and other third-party service providers to support certain administrative, insurance, technology, billing, scheduling, and health care functions.

These organizations may have their own privacy policies and legal obligations.

Where an organization acts as a business associate of Koa Mind, Koa Mind requires appropriate contractual safeguards as required by applicable law.

Where an organization operates independently and is separately responsible for information it receives or maintains, its own privacy practices may apply.

For questions regarding information handled directly by Headway, you may also review Headway's applicable privacy notices.

11. YOUR INFORMATION AND INSURANCE

If you use health insurance to pay for services, Koa Mind may disclose information necessary for billing, claims processing, eligibility verification, and other payment-related activities.

Your insurance company may independently maintain information about your health care and may have its own Notice of Privacy Practices.

12. BREACH NOTIFICATION

If a breach of unsecured protected health information occurs that requires notification under applicable law, Koa Mind will provide notification as required by federal and state law.

Federal law generally requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a reportable breach.

13. OUR RESPONSIBILITIES

Koa Mind is required by law to:

• Maintain the privacy of your protected health information

• Provide you with this Notice describing our legal duties and privacy practices

• Follow the terms of the Notice currently in effect

• Notify you if a breach of your unsecured PHI requires notification under applicable law

• Provide you with a copy of this Notice upon request

Koa Mind reserves the right to change this Notice.

If we make a material change to our privacy practices, we will revise the Notice and make the revised Notice available as required by law.

14. REPRODUCTIVE HEALTH INFORMATION

Koa Mind will comply with applicable federal and state laws governing the privacy of health information related to reproductive health care.

Certain federal requirements concerning reproductive health information were modified following federal litigation, and applicable requirements may continue to change. Koa Mind will follow the requirements that are legally in effect at the time a use or disclosure is made.

15. HOW TO FILE A PRIVACY COMPLAINT

If you believe Koa Mind has violated your privacy rights, you may submit a complaint to:

Koa Mind, PLLC
Email: info@koa-mind.com

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

You may obtain information about filing a complaint through the U.S. Department of Health and Human Services Office for Civil Rights.

Koa Mind will not retaliate against you for filing a complaint.

16. QUESTIONS ABOUT THIS NOTICE

If you have questions about this Notice or would like a paper copy, please contact:

Koa Mind, PLLC
Email: info@koa-mind.com
Website: koa-mind.com

PLEASE REVIEW THIS NOTICE CAREFULLY.

Effective Date: October 2026