Legally Required Notice

Notice of Privacy Practices

Pura Vida Mind & Body PLLC  •  Effective August 1, 2026  •  Version 1.1

PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition, treatment, or payment for health care services. It includes both your medical records and personal information such as your name, Social Security number, address, and phone number.

I. Our Pledge Regarding Health Information

We understand that health information about you and your health care is personal, and we are committed to protecting it. We create a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all records of care generated by this mental health practice and describes the ways in which we may use and disclose health information about you, your rights with respect to that information, and certain obligations we have regarding its use and disclosure.

Under federal law, we are required to protect the privacy of your PHI, provide you this Notice explaining our duties and practices, notify you following a breach of your unsecured PHI, and follow the practices and procedures set forth in this Notice currently in effect. We may change the terms of this Notice, and any such changes will apply to all PHI we maintain. If we make a material change, the updated Notice will be made available (for example, posted on our website and provided on request), with a new effective date.

II. How We May Use and Disclose Health Information About You

The following categories describe the different ways we use and disclose health information. Not every use or disclosure in a category is listed, but all permitted uses and disclosures fall within one of these categories.

Treatment, Payment, and Health Care Operations

Federal privacy rules allow health care providers with a direct treatment relationship to use or disclose PHI, without written authorization, to carry out treatment, payment, or health care operations. We may disclose PHI to other providers involved in your care — for example, if a clinician consults with another licensed provider about your condition, refers you for specialized care, or coordinates with your primary care provider, therapist, pharmacy, or laboratory. Disclosures for treatment purposes are not limited to the "minimum necessary" standard, because providers need full and complete information to deliver quality care. For payment and health care operations, we limit disclosures to the minimum necessary for the purpose.

Business Associates and Technology Vendors

We use third-party service providers ("business associates") to help operate the practice — including, by category, an electronic health record and practice-management platform, telehealth video services, electronic prescribing, payment processing, laboratory ordering, secure fax, email and messaging delivery, and insurance claim/clearinghouse services. Your PHI may be shared with these vendors only as necessary to perform their functions. The specific vendors we use may change over time. A current list of vendor categories and functions is available on request from our Privacy Officer.

Health Information Exchanges

We may participate in one or more Health Information Exchanges (HIEs), which allow us and other health care providers and organizations involved in your care to electronically access and share your health information for treatment, payment, and health care operations purposes. If you are a resident of a state that allows you to opt out of our sharing your data with an HIE, and you would like to opt out, contact our Privacy Officer using the information below. You may opt out at any time; please note that information already shared cannot be withdrawn, though in some systems it may no longer be visible to requesting parties.

Appointment Reminders and Communications

We may contact you by phone, text, email, or patient portal with appointment reminders, and to tell you about treatment alternatives or other health-related services or benefits we offer. Email and text messages are not fully secure methods of communication, and there is some risk that unauthorized parties could access them. Messages you send us may become part of your medical record.

Lawsuits and Disputes

If you are involved in a lawsuit or administrative proceeding, we may disclose health information in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process, but only if efforts have first been made to notify you of the request or to obtain an order protecting the information.

III. Certain Uses and Disclosures Require Your Written Authorization

Psychotherapy Notes

We sometimes keep "psychotherapy notes" as defined in 45 CFR § 164.501. Any use or disclosure of these notes requires your written Authorization, except when the use or disclosure is for our use in treating you; for our use in training or supervising mental health practitioners; for our use in defending ourselves in legal proceedings you have instituted; for use by the Secretary of HHS to investigate our compliance with HIPAA; required by law; required for certain health oversight activities pertaining to the originator of the notes; required by a coroner performing duties authorized by law; or necessary to help avert a serious and imminent threat to the health or safety of a person or the public.

Substance Use Disorder Records (42 CFR Part 2)

To the extent we create, receive, or maintain substance use disorder (SUD) patient records subject to 42 CFR Part 2, we cannot use or share the information in those records in civil, criminal, administrative, or legislative proceedings against you without (1) your written consent, or (2) a court order accompanied by a subpoena. If and when such services are offered, we will provide any supplemental notice and consent required by that rule. Once information has been disclosed in a permitted way, the recipient may re-disclose it, and upon re-disclosure that information may no longer be protected by the HIPAA Privacy Rule or Part 2.

Marketing and Sale of PHI

As a mental health practice, we will not use or disclose your PHI for marketing purposes without your Authorization, and we will not sell your PHI in the regular course of our business. You may revoke an Authorization in writing at any time, except to the extent we have already relied on it; revocation will not affect disclosures already made.

IV. Certain Uses and Disclosures Do Not Require Your Authorization

Subject to certain limitations in the law, we may use and disclose your PHI without your Authorization: when required by state or federal law; for public health activities, including reporting suspected child, elder, or dependent adult abuse, or to prevent or reduce a serious threat to anyone's health or safety; for health oversight activities; for judicial and administrative proceedings; for law enforcement purposes; to coroners or medical examiners; for research purposes, subject to applicable oversight and privacy safeguards; for specialized government functions; and for workers' compensation purposes.

V. Disclosures That Give You the Opportunity to Object

We may provide your PHI to a family member, friend, or other person you indicate is involved in your care or the payment for your care, unless you object in whole or in part. In an emergency, we may make such a disclosure and obtain your agreement retroactively, as soon as reasonably possible.

VI. Your Rights With Respect to Your PHI

• Right to Request Limits on use or disclosure for treatment, payment, or health care operations. We may decline if we believe it would affect your care.
• Right to Request Restrictions for Self-Pay Services — if you pay out-of-pocket in full, you may request we not disclose that PHI to your health plan, and we must agree unless disclosure is otherwise required by law.
• Right to Choose How We Communicate With You — we will accommodate all reasonable requests.
• Right to Access and Copy Your PHI (other than psychotherapy notes) — we will respond within 30 days and may charge a reasonable, cost-based fee as permitted by Arizona law.
• Right to an Accounting of Disclosures — covering the prior six years, excluding routine treatment/payment/operations disclosures. We will respond within 60 days; the first request each year is free.
• Right to Amend Your PHI — we will respond within 60 days, in writing.
• Right to a Paper or Electronic Copy of This Notice at any time.
• Right to Be Notified of a Breach of your unsecured PHI, in accordance with applicable law.
• Right to File a Complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights, without retaliation.

Additional Protections for Certain Information

Because we are a psychiatric practice, much of your record consists of mental health information. Arizona law and federal law may provide additional protections for mental health records, and where they are more protective than this Notice, we follow those requirements. Certain other categories of information (such as HIV/AIDS or genetic information) may have additional protections under applicable law, which we follow.

VII. Contact Information

Questions, requests, or complaints regarding this Notice or your PHI should be directed to our Privacy Officer:

You may also contact the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints.