Notice of Privacy Practices

Effective Date: March 23, 2026

Notice of Health Information Privacy Practices
This notice is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR §164.520. It describes Kindbridge Behavioral Health’s duties regarding the privacy of your Protected Health Information (PHI), how we use and disclose your PHI, your rights, and how to contact us with questions or complaints.

Kindbridge Behavioral Health (KBH) is committed to protecting the privacy of the personal and health information we collect or create as part of providing behavioral health services to you, known as “Protected Health Information” or “PHI.”

PHI typically includes your name, address, date of birth, billing arrangements, care received, and other information that relates to your health, health care provided to you, or payment for that care. PHI does not include information that has been de-identified or cannot be linked to you.

KBH reserves the right to amend this Notice at any time. Any revised notice will apply to all PHI we maintain — including information created or received before the revision — and will be made available to you upon request or mailed to you.

Section 01: About This Notice & How We Collect Your Information

KBH obtains most PHI directly from you through care applications, assessments, and direct questions during the provision of services. We may also obtain PHI from:

Community health care agencies
Other governmental agencies
Other health care providers assisting in setting up your service arrangements

KBH is required by law to maintain the privacy of your PHI, to provide you with this Notice, and to abide by the terms of the Notice currently in effect. We will comply with federal law and any state law that further limits or restricts the uses and disclosures described here.

Section 02: How We May Use or Disclose Your Information Without Your Authorization

The law permits Kindbridge Behavioral Health to use and disclose your PHI for the following purposes without requiring your written authorization:

For Your Treatment

We may share your PHI with physicians, psychologists, nurses, and other authorized health care professionals who need your information to conduct examinations, prescribe medication, or provide health care services to you.

To Obtain Payment

We may share your PHI with insurance companies, government agencies, or health plans to receive payment for services — for example, releasing dates of treatment to an insurance company.

For Health Care Operations

We may use or disclose your PHI for activities that support our operations, such as quality assurance reviews. We may also share PHI with Business Associates who help us provide services — they are required to protect the privacy of your information.

As Required by Law

In some cases we are required by law to disclose PHI. This includes requirements by statute, regulation, or court order; situations where we reasonably believe an individual is a victim of abuse, neglect, or domestic violence; and judicial or administrative proceedings.

Workers’ Compensation

We may disclose your PHI to comply with workers’ compensation or similar programs that provide benefits for work-related injuries or illnesses.

Public Health Activities

We may disclose your PHI for public health purposes such as reporting communicable disease results to public health departments as required by law, or when required for law enforcement purposes.

Health Oversight Activities

We may disclose your PHI in connection with governmental oversight activities such as licensure, auditing, and the administration of government benefits.

To Avert Serious Threat

We may disclose your PHI if we believe in good faith that doing so will prevent or lessen a serious or imminent threat to the health and safety of a person or the public.

To Personal Representatives

We may disclose your PHI to a person you have designated to act on your behalf and make decisions about your care, in accordance with state law and your written instructions on file.

To Family and Friends

We may share limited PHI with persons involved in your care or payment for care, when you agree or do not object. In emergencies, we may share limited PHI if we determine it is in your best interest, including for disaster relief purposes.

Health-Related Services

We may contact you regarding service reminders or health-related products and services that may be of interest to you. You have the right to opt out of receiving this information at any time.

Incidental Disclosures

Incidental uses that cannot reasonably be prevented, are limited in nature, and occur as a by-product of a permitted use are allowed — as long as we use reasonable safeguards and disclose only the minimum PHI necessary.

Section 03: Uses and Disclosures That Require Your Written Authorization

Except as described in Section 02 above, KBH will not use or disclose your PHI without your written authorization. An authorization form is available from KBH upon request.

✓ Your Right to Revoke

You have the right to revoke your written authorization at any time, except to the extent that KBH has already taken action in reliance upon it. To revoke an authorization, submit a written request to our Privacy Officer.

Section 04: Your Rights Concerning Your Health Information

You have the following rights with respect to your Protected Health Information. To exercise any of these rights, contact our Privacy Officer using the information in Section 06.

Right to Access Your Records

You have the right to inspect and copy your PHI in your designated record set. If we produce copies, we may charge up to $1.00 per page, up to a maximum of $50.00. If we deny your request, you may ask for that denial to be reviewed by another health care professional designated by KBH.

Right to Request Amendments

You have the right to request an amendment to your PHI if you believe information is incorrect or incomplete. If we deny your request, you have the right to submit a written statement of disagreement.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI for a period of up to six (6) years prior to the date of your written request. This does not include disclosures for treatment, payment, or health care operations.

Right to Request Restrictions

You have the right to request that we restrict certain uses and disclosures of your PHI. KBH is not required to agree to your request. You cannot restrict uses and disclosures that we are legally required or permitted to make.

Right to Revoke Authorization

You have the right to revoke any written authorization you have provided to KBH, except to the extent that KBH has already taken action in reliance on that authorization. Revocation requests must be submitted in writing.

Right to Receive by Alternate Means or Address

You have the right to request that KBH send your PHI to you by an alternate means (such as encrypted email) or to an alternate address. We will accommodate reasonable requests.

Right to File a Privacy Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with KBH or with the Secretary of the U.S. Department of Health and Human Services. KBH will not retaliate against you for filing a complaint.

Section 05: Our Legal Obligations

Maintain privacy of your PHI. KBH is required by law to maintain the privacy of your Protected Health Information.

Provide you with this Notice. We are required to provide you with this Notice of our legal duties and privacy practices and to follow the terms of the Notice currently in effect.

Notify you of amendments. If we amend this Notice, we will make the revised notice available upon request and mail it to you.

Comply with state law. KBH will comply with federal HIPAA requirements and any applicable state law that further limits or restricts the uses and disclosures described in this Notice.

Use minimum necessary information. KBH will make reasonable efforts to use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose.

Special Protections — Substance Use Disorder Records

Records related to substance use disorder treatment may receive additional federal protection under 42 CFR Part 2 and applicable state law, which may restrict disclosures beyond standard HIPAA requirements.

Section 06: Contact Us & How to File a Privacy Complaint

If you have questions about this Notice, wish to exercise any of your privacy rights, or believe your privacy rights have been violated, contact us or file a complaint with HHS. KBH will not retaliate against you for filing a complaint.

Privacy Officer — Kindbridge Behavioral Health