Notice of Privacy Practices

1. Who We Are and Who Follows This Notice

This Notice applies to Joy Family Center, PLLC, doing business as Joy Mental Health Group ("Joy Mental Health Group," "we," or "us"), an outpatient mental health practice owned by Dr. Adam Joy, PsyD, Licensed Clinical Psychologist. We provide therapy for children (age 4 and up), teens, and adults; psychological testing; and medication management. This Notice is followed by all of our clinicians (including psychologists, psychiatric mental health nurse practitioners, licensed and limited-licensed social workers, and temporary limited-licensed psychologists working under supervision), contractors, staff, and trainees at all of our locations and when we provide care by telehealth:

• Ann Arbor (main office): 2350 Washtenaw Ave, Suite 3, Ann Arbor, MI 48104
• East Lansing: 411 W. Lake Lansing Rd, C-125, East Lansing, MI 48823
• West Bloomfield: 6230 Orchard Lake Rd, Ste 270, West Bloomfield, MI 48322
• Macomb (co-located with Thera-Peds): 16137 Leone Drive, Macomb, MI 48042
• Telehealth: secure video visits

Some of our offices share space with other independent health care organizations (for example, Thera-Peds in Macomb). Those organizations are separate from us, keep their own records, and have their own privacy notices. We do not share your information with them except as described in this Notice (for example, to coordinate your care) or with your permission.

2. Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information ("PHI") — information that identifies you and relates to your health, care, or payment for care.
• We must give you this Notice of our legal duties and privacy practices, follow the terms of the Notice currently in effect, and let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time by letting us know in writing.
• Michigan law (including the Michigan Mental Health Code and the psychologist-patient privilege) gives mental health information extra protection. Where Michigan law is more protective of your privacy than federal law, we follow Michigan law.

3. How We Typically Use and Share Your Information

Treatment

We use and share your information to provide and coordinate your care. Example: Your therapist may consult with a supervising psychologist about your treatment, or our nurse practitioner may coordinate with your primary care doctor about a medication.

Payment

We use and share your information to bill and get paid by health plans or other payers. Example: We send information about your visit, diagnosis, and services to your insurance company (often through an electronic claims clearinghouse) so it will pay for your care. If an account becomes past due, we may share limited billing information with a collection agency that has agreed to protect it.

Health care operations

We use and share your information to run our practice, improve your care, and contact you when necessary. Examples: quality reviews, clinical supervision of limited-licensed clinicians, training, licensing and accreditation, audits, and legal and compliance reviews.

Business associates

We work with outside companies that perform services for us — such as our electronic health record and patient portal, telehealth, secure fax, email and file storage, billing and claims, online psychological testing platforms, and clinical documentation tools. These "business associates" must sign agreements requiring them to protect your information and use it only as we allow.

Appointment reminders and communications

We may contact you by phone, voicemail, text message, email, or through our secure patient portal to remind you of appointments, share information about your care, or handle billing. You can ask us to use a different method or address (see "Your Rights" below). Regular email and text messages are not fully secure; we will tell you about the risks, and you may choose not to receive them.

4. Other Ways We May Use or Share Your Information Without Your Written Permission

We are allowed or required to share your information in the following situations, but only when the law permits or requires it and, for mental health information, only to the extent Michigan law also allows:

• When required by law, including when federal, state, or local law requires disclosure.
• To prevent serious harm. We may share information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you, another person, or the public. Under Michigan law, a mental health professional may have a duty to take action (such as warning an identifiable person or notifying police) when a patient communicates a threat of physical violence against a reasonably identifiable third person and has the apparent intent and ability to carry it out.
• Abuse, neglect, or exploitation. We are required to report suspected abuse or neglect of children under Michigan's Child Protection Law, and we may report suspected abuse, neglect, or exploitation of vulnerable adults as permitted or required by law.
• Public health and safety, such as reporting certain diseases, adverse reactions to medications, or helping with product recalls.
• Health oversight activities, such as audits, investigations, inspections, and licensure actions by government agencies.
• Lawsuits and legal proceedings, in response to a court order, or — where permitted by Michigan law — a subpoena or other lawful process. Because of Michigan's privilege protections for mental health communications, we will generally require a court order or your written authorization before releasing mental health records in legal proceedings, unless the law requires otherwise.
• Law enforcement, for limited purposes as required or permitted by law.
• Coroners, medical examiners, and funeral directors, as permitted by law.
• Specialized government functions, such as military, national security, and protective services, as required by law.
• Workers' compensation, to the extent required by workers' compensation laws.
• Research. We do not currently conduct research. If we do in the future, we will use or share your information for research only with your written authorization, or without it only where HIPAA allows, such as when an Institutional Review Board or privacy board has approved a waiver of authorization.
• Organ and tissue donation, as permitted by law.
• To the Secretary of Health and Human Services, when the government wants to confirm we are complying with federal privacy law.
• Family members and others involved in your care. If you agree, do not object, or if we reasonably believe it is in your best interest (for example, in an emergency or if you are unable to agree), we may share information directly relevant to a family member's, friend's, or other person's involvement in your care or payment for your care. You can tell us not to do this.
• Disaster relief, to help coordinate notification of family members about your location and condition, unless you object.

5. Uses That Require Your Written Authorization

We will not do the following without your written authorization:

• Psychotherapy notes. "Psychotherapy notes" are notes a mental health professional may keep separately from the rest of your record to document or analyze the contents of counseling sessions. Most uses and disclosures of psychotherapy notes require your written authorization, except in limited situations allowed by law (for example, use by the clinician who wrote them for treatment, supervised training programs, defending ourselves in a legal action you bring, when required by law, for health oversight of the clinician who wrote them, to a coroner, or to prevent a serious and imminent threat). Psychotherapy notes do not include medication information, session start and stop times, types of treatment, test results, diagnosis, treatment plan, symptoms, prognosis, and progress summaries — those are part of your regular record.
• Marketing. We will not use or share your information for marketing purposes without your written authorization.
• Sale of your information. We will never sell your information without your written authorization.
• Other uses not described in this Notice.

You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance on it.

Fundraising: We do not conduct fundraising. If that changes, you will have the right to opt out of fundraising communications.

6. Special Protections

Minors and parents or guardians

We treat children and teens and take their privacy seriously. In general, a parent or legal guardian may consent to a minor's care and may access the minor's records, subject to Michigan law, any court orders (such as custody or parenting-time orders), and the clinician's professional judgment about the child's welfare. Under the Michigan Mental Health Code, a minor who is 14 years of age or older may request and receive limited outpatient mental health services without the consent or knowledge of a parent or guardian (MCL 330.1707). That law limits the number of sessions or length of time for such services and does not permit psychotropic medication to be provided without parental consent. When a minor consents to services under that law, we will not tell the parent or guardian about those services without the minor's consent, unless the treating professional determines there is a compelling need for disclosure based on a substantial probability of harm to the minor or to another person, and the minor is told of our intent to inform the parent or guardian.

We may ask for a copy of custody or guardianship documents before treating a minor or releasing a minor's records. We may limit a parent's access where permitted by law, for example where access could endanger the child.

Substance use disorder records

Joy Mental Health Group is not a federally assisted substance use disorder treatment program subject to 42 CFR Part 2. If we ever receive substance use disorder treatment records from a Part 2 program with your consent, those records will be handled according to the additional federal protections that apply to them, including limits on their use in legal proceedings against you.

Reproductive health care information

We do not provide reproductive health care services, but information about reproductive health may appear in your mental health record. We will use and disclose any such information only as permitted by HIPAA, Michigan law, and this Notice.

HIV/AIDS and other sensitive information

Certain information (such as HIV/AIDS-related or communicable disease information) may receive additional protection under Michigan law, and we will follow those protections.

7. Your Rights

To exercise any of these rights, contact the Privacy Officer using the information at the top and bottom of this Notice. We may ask that requests be made in writing, and we will verify your identity.

• Get a copy of your records. You can ask to see or get an electronic or paper copy of your medical and billing records. We will respond within 30 days of your request (we may extend once by up to 30 more days if we tell you in writing why). We may charge a reasonable, cost-based fee. In limited circumstances we may deny access (for example, if a licensed professional determines access is reasonably likely to endanger the life or physical safety of you or another person); in some cases you can ask for a review of the denial. Psychotherapy notes are not included in this right.
• Ask us to correct (amend) your record. If you think information in your record is incorrect or incomplete, you can ask us in writing to amend it. We will respond within 60 days. We may say "no," but we will tell you why in writing, and you may submit a statement of disagreement.
• Request confidential communications. You can ask us to contact you in a specific way (for example, only on your cell phone or only through the patient portal) or at a different address. We will say "yes" to all reasonable requests.
• Ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, except: if you pay for a service out of pocket in full, you can ask us not to share information about that service with your health plan for payment or operations, and we will agree unless a law requires us to share it.
• Get a list of those with whom we have shared information (an accounting). You can ask for a list of the times we have shared your information for up to six years before the date you ask, who we shared it with, and why. The list will not include disclosures for treatment, payment, or operations, disclosures you authorized, and certain others. We will provide one list per year free and may charge a reasonable, cost-based fee for additional lists within 12 months.
• Get a copy of this Notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically. It is also posted at each office and on our website, choosejoymi.com. We will ask you to acknowledge, on paper or electronically, that you received this Notice; if you do not, it will not affect your care.
• Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian or personal representative, that person can exercise your rights. We will confirm the person has this authority before we take any action.
• Be notified of a breach. You will be notified if a breach of your unsecured protected health information occurs.

8. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer (contact information below). You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), in writing:

• Online: OCR Complaint Portal, https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf (more information at www.hhs.gov/ocr/complaints)
• Mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, D.C. 20201
• Email: OCRComplaint@hhs.gov
• Phone: 1-800-368-1019 (toll-free) | TDD: 1-800-537-7697

We will not retaliate against you for filing a complaint. You may also contact the Michigan Department of Licensing and Regulatory Affairs (LARA) with concerns about a licensed health professional.

9. Changes to This Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you, including information created before the change. The new Notice will be available upon request, posted in our offices, and posted on our website. Federal regulators periodically update the required content of privacy notices (including recent updates relating to substance use disorder records); we review this Notice to keep it current with those requirements.

10. Contact Information