HIPAA Notice

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: August 18, 2026

Contact for More Information: Alan R. Blankstein, General Counsel
InSite Health
5 Greentree Center, Suite 302
(833) 494-6724
alan@insitehealth.net
www.insitehealth.net

Notice Summary

This Notice of Privacy Practices describes the privacy practices of InSite Health (referred to as "we," "us," or "our" in this Notice). We are required by law to maintain the privacy and security of your protected health information (PHI), provide you with this Notice of our legal duties and privacy practices regarding your health information, and notify you following a breach of unsecured PHI. This Notice applies to health information created, received, or maintained by us in connection with the behavioral health and outpatient healthcare services we provide, including in-person and telehealth services and the health information systems that support those services.

School-Based Services. When we provide services in connection with a school, certain records maintained by or on behalf of the school may be education records governed by the Family Educational Rights and Privacy Act (FERPA) rather than protected health information governed by HIPAA. This Notice applies to information that is subject to HIPAA. Rights relating to FERPA education records may be different and are governed by applicable education privacy law.

YOUR RIGHTS

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you exercise them.

Get a Copy of Your Health and Claims Records

1.  Right to Access. You can ask to see or get a copy of your health and claims records and other health information we have about you.

a.  How to Request. You may request access by submitting a written request to our Privacy Officer at the contact information provided above.

b.  Timeframe and Format. We will provide access to your requested health information no later than 30 calendar days after receiving your request, or sooner when required by applicable law. If we cannot provide access within 30 days, HIPAA permits one extension of no more than 30 additional days. If an extension is necessary, we will notify you in writing within the initial 30-day period, explain the reason for the delay, and tell you when we expect to provide access. We may charge a reasonable, cost-based fee for copying, mailing, or preparing a summary. You may request that we provide your records in electronic format, and we will do so if we can readily produce your health information in the electronic form and format you request. If we cannot, we will work with you to agree on an alternative electronic format.

c.  Denial. We may deny access in certain limited circumstances permitted by law. If we deny your request, we will provide a written explanation. When the law gives you a right to have the denial reviewed, we will explain how to request that review by another licensed healthcare professional who was not involved in the original decision.

Ask Us to Correct Your Health and Claims Records

1.  Right to Amendment. You can ask us to correct your health and claims records if you think they are incorrect or incomplete.

a.  How to Request. You may request an amendment by submitting a written request to our Privacy Officer, including the specific information you believe should be corrected and your reason for the request.

b.  Response. We may deny your request if we did not create the information, if the information is not part of the records we maintain, if the information is not part of the information you would be permitted to inspect and copy, or if the information is accurate and complete. We will respond to your request in writing within 60 days, subject to any extension permitted by law. If we deny your request, we will explain why. You may submit a statement of disagreement, which we will include with your health information as required by law.

Request Confidential Communications

1.  Right to Confidential Communication. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.

a.  Reasonable Requests. We will accommodate all reasonable requests. You do not need to provide a reason for your request.

b.  How to Request. You must make your request in writing to our Privacy Officer, specifying how or where you wish to be contacted.

Ask Us to Limit What We Use or Share

1.  Right to Request Restrictions. You can ask us not to use or share certain health information for treatment, payment, or our operations.

a.  Consideration. We are not required to agree to your request, and we may deny a request if it would affect your care. However, if you pay for a service or healthcare item out-of-pocket in full and request that we not share information about that service or item with your health plan for payment or healthcare operations purposes, we will honor that request unless we are required by law to share the information.

b.  How to Request. You must make your request in writing to our Privacy Officer, describing the specific restriction you are requesting.

c.  Agreement. If we agree to your request, we will comply with your request except in emergency treatment situations or as required by law.

Get a List of Those with Whom We've Shared Information

1.  Right to an Accounting of Disclosures. You can ask for a list (accounting) of the times we have shared your health information for purposes other than treatment, payment, and healthcare operations, and certain other exceptions, during the six years prior to the date you ask.

a.  How to Request. You may request an accounting by submitting a written request to our Privacy Officer.

b.  Timeframe and Fees. We will provide the accounting within 60 days of your request. The first accounting you request within a 12-month period will be free. For additional requests within that same 12-month period, we may charge you a reasonable, cost-based fee.

Get a Copy of This Privacy Notice

1.  Right to a Paper or Electronic Copy. You can ask for a paper or electronic copy of this Notice at any time, even if you have agreed to receive the Notice electronically. You may obtain a copy by contacting our Privacy Officer at the information provided above or by visiting our website at www.insitehealth.net.

Choose Someone to Act for You

1.  Personal Representatives. If someone has authority to act as your personal representative under applicable law (such as a parent, guardian, or holder of a healthcare power of attorney), that person may exercise your rights and make choices about your health information on your behalf.

a.  Minors and Personal Representatives. A parent, guardian, or other person authorized by law generally may act as a minor's personal representative. However, applicable federal or state law may permit a minor to consent independently to certain healthcare services or may limit a parent's or guardian's access to information relating to those services. When such laws apply, we will honor the minor's confidentiality and access rights as required by law.

b.  Verification. We will verify that the person has this authority and can act for you before we take any action.

File a Complaint if You Feel Your Rights Are Violated

1.  Right to Complain. You can complain if you feel we have violated your rights.

a.  Internal Complaint. You may file a complaint with us by contacting our Privacy Officer at the contact information provided above.

b.  Federal Complaint. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by:

1.1.  Sending a letter to: 200 Independence Avenue, S.W., Washington, D.C. 20201

1.2.  Calling: 1-877-696-6775

1.3.  Visiting: www.hhs.gov/ocr/privacy/hipaa/complaints/

c.  No Retaliation. We will not retaliate against you for filing a complaint.

YOUR CHOICES

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In These Cases, You Have Both the Right and Choice to Tell Us To:

1.  Family and Friends. Share information with your family, close friends, or others involved in payment for your care or in coordinating your care.

2.  Disaster Relief. Share information in a disaster relief situation.

3.  Incapacity or Emergency. If you are not able to tell us your preference (for example, if you are unconscious), we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In These Cases, We Never Share Your Information Unless You Give Us Written Permission:

1.  Marketing Purposes. We will not use or disclose your health information for marketing purposes without your written authorization.

2.  Sale of Your Information. We will not sell your health information without your written authorization.

3.  Psychotherapy Notes. We will not use or disclose psychotherapy notes, as defined by HIPAA and maintained separately from the rest of your medical record, without your written authorization except for the limited uses and disclosures permitted or required by law. In general, your written permission is required for most sharing of psychotherapy notes.

4.  Other Uses and Disclosures. Other uses and disclosures of your health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. You may revoke such authorization in writing at any time, and we will no longer use or disclose your health information for the purposes covered by that authorization, except to the extent we have already taken action in reliance on your authorization.

5.  Fundraising. If we contact you for fundraising efforts, you may tell us not to contact you again. If we have substance use disorder patient records that are subject to 42 CFR Part 2 and such records are used for fundraising communications as permitted by law, we will give you clear and conspicuous notice in advance and a choice about whether to receive those communications.

OUR USES AND DISCLOSURES

How Do We Typically Use or Share Your Health Information?

We typically use or share your health information in the following ways:

1.  Help Manage the Healthcare Treatment You Receive.

a.  Treatment. We may use your health information to provide, coordinate, or manage your behavioral health treatment and related services. This includes coordination or management of your healthcare with other providers and consultation between providers concerning your care.

1.1.  Example: A therapist treating you for anxiety may share information about your diagnosis and treatment plan with a psychiatrist we work with to coordinate medication management.

b.  Electronic Health Records and Health Information Systems. We use electronic health records and other health information systems to store, manage, and transmit your health information securely in support of your treatment and our healthcare operations.

c.  Telehealth and Electronic Services. We may use secure electronic communications, telehealth platforms, electronic health record systems, and other technologies to provide and coordinate your care. We use and disclose health information through these technologies as permitted by law and described in this Notice. Additional consent requirements applicable to telehealth services are addressed through our clinical consent process.

2.  Run Our Organization.

a.  Healthcare Operations. We may use and disclose your health information for our healthcare operations, which include quality assessment and improvement activities, case management, care coordination, conducting or arranging for medical review and auditing functions, and business planning and development.

2.1.  Example: We use health information about you to evaluate the quality and effectiveness of the behavioral health services we provide and to improve our outpatient programs.

b.  Business Associates. We may share your health information with third parties who perform functions on our behalf or provide us with services if the information is necessary for those functions or services. These third parties, called "business associates," are required by law and by contract to protect your health information and may include our technology vendors, cloud storage providers, billing companies, and consultants.

3.  Pay for Your Health Services.

a.  Payment. We may use and disclose your health information to bill and receive payment from you, your health plan, or other third parties for the treatment and services you receive from us.

3.1.  Example: We share information about your behavioral health treatment with your health insurance plan so it will pay for or reimburse you or us for the services.

b.  Health Plan Coordination. We may also share your health information with other healthcare providers and health plans for their payment activities.

How Else Can We Use or Share Your Health Information?

We are permitted or required to share your information in other ways, usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes.

Special Protection for Certain Substance Use Disorder Records. Substance use disorder treatment records received from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent, or a court order issued after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.

1.  Help with Public Health and Safety Issues.

a.  We can share your health information for certain public health and safety situations, such as:

1.1.  Preventing disease, injury, or disability

1.2.  Reporting suspected abuse, neglect, or domestic violence

1.3.  Preventing or reducing a serious and imminent threat to anyone's health or safety

2.  Do Research.

a.  We can use or share your information for health research when an institutional review board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of your health information, or when you provide written authorization.

3.  Comply with the Law.

a.  We will share your health information if federal, state, or local laws require it, including compliance with the Department of Health and Human Services if it wants to verify that we are complying with federal privacy law.

4.  Respond to Organ and Tissue Donation Requests and Work with a Medical Examiner or Funeral Director.

a.  We can share your health information with a coroner, medical examiner, or funeral director when an individual dies, and with organ procurement organizations for the purpose of facilitating organ, eye, or tissue donation and transplantation.

5.  Address Workers' Compensation, Law Enforcement, and Other Government Requests.

a.  We can use or share your health information:

5.1.  For workers' compensation claims

5.2.  For law enforcement purposes or with a law enforcement official in response to a court order, subpoena, warrant, summons, or similar process, or to report certain types of wounds or injuries

5.3.  With health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure actions

5.4.  For special government functions, such as military, national security, protective services for the President, and correctional institutions (if you are an inmate)

6.  Respond to Lawsuits and Legal Actions.

a.  We can share your health information in response to a court or administrative order, or in response to a subpoena or discovery request, if certain conditions are met.

STATE-SPECIFIC PRIVACY PROTECTIONS

Your health information may be subject to additional protections under the laws of the state where you reside, where you receive services, or where we maintain facilities. The following provisions apply to residents of, or individuals receiving services in, the specified states. Where state law provides greater privacy protections or individual rights than federal HIPAA requirements, we will comply with the stricter standard.

Illinois

If you are an Illinois resident or receive services from us in Illinois, applicable Illinois laws may provide additional protections for mental health and other health records beyond HIPAA. We will not use or disclose information protected by those laws except as permitted or required by applicable Illinois law, including any consent, authorization, privilege, court-order, or redisclosure requirements that apply.

New Jersey

If you are a New Jersey resident or receive services from us in New Jersey, applicable New Jersey laws and regulations may provide additional protections for mental health, psychiatric, substance use disorder, telehealth, and other health information. We will comply with those requirements when they are more protective of your information or provide you with greater rights than HIPAA.

Pennsylvania

If you are a Pennsylvania resident or receive services from us in Pennsylvania, applicable Pennsylvania laws may provide additional protections for mental health, drug and alcohol treatment, minor consent and access, telehealth, and confidential communications. We will comply with those requirements when they are more protective of your information or provide you with greater rights than HIPAA.

Multi-State Application

Because we provide services in multiple states, including through telehealth, the privacy protections and individual rights that apply to your health information may depend on:

1.  The state in which you reside

2.  The state in which you are physically located when receiving services

3.  The state in which your treating provider is licensed or located

4.  The type of health information involved (mental health, substance use disorder, general medical, etc.)

5.  The nature of the service (telehealth vs. in-person, diagnostic vs. treatment, etc.)

If you have questions about which state law applies to your health information or your specific rights under state law, please contact our Privacy Officer at the contact information provided in this Notice.

OUR RESPONSIBILITIES

1.  Legal Requirements.

a.  We are required by law to maintain the privacy and security of your protected health information.

b.  We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

c.  We must follow the duties and privacy practices described in this Notice and give you a copy of it.

2.  Limitations on Use and Disclosure.

a.  We will not use or share your information other than as described in this Notice unless you give us written permission. If you give us permission, you may revoke it in writing at any time, and we will honor your revocation, except to the extent we have already acted in reliance on your permission.

3.  Compliance with Stricter State Laws. Where applicable state law provides greater privacy protections or individual rights than federal HIPAA requirements, we will comply with the stricter standard. The state-specific provisions described in this Notice are examples of areas where state law may be more protective, but other state law protections may also apply depending on your circumstances.

CHANGES TO THE TERMS OF THIS NOTICE

We can change the terms of this Notice at any time. The changes will apply to all information we have about you. The new Notice will be available upon request and on our website at www.insitehealth.net. We will also provide you with a revised Notice if you request one and will post the current Notice with its effective date prominently on our website.

ELECTRONIC ACCESS AND WEBSITE POSTING

You may access an electronic copy of this Notice on our website at www.insitehealth.net. If you receive this Notice electronically and would like a paper copy, please contact our Privacy Officer at the contact information provided above.

Complaints:

If you believe your privacy rights have been violated or you have concerns about our privacy practices, you may:

• Contact our Privacy Officer using the contact information at the beginning of this Notice, or

• File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints/ or by calling 1-877-696-6775.

We will not retaliate against you for filing a complaint.