Notice of Privacy Practices

1. Who we are and who follows this notice

EMDR Unlocked LLC is a telehealth-only psychotherapy practice. We see clients by secure video who are located in Massachusetts and Florida. We do not have a walk-in office.

This notice applies to every clinician, staff member, and other person who works with EMDR Unlocked LLC and can see your health information, now and in the future. In this notice, "we," "us," and "our" mean EMDR Unlocked LLC and those people.

"Health information" (also called protected health information, or PHI) means information that identifies you and relates to your mental or physical health, the care you receive, or payment for that care.

2. Our duties to you

The law requires us to:

• Keep your health information private and secure.
• Give you this notice of our legal duties and privacy practices.
• Follow the notice that is currently in effect.
• Tell you if a breach occurs that may have compromised the privacy or security of your information.

We will not use or share your information other than as described in this notice unless you tell us we can in writing.

3. How we use and share your information for treatment, payment, and operations

Federal law allows us to use and share your health information for these purposes without your written permission. Where state law is stricter, we follow state law (see "Stricter state privacy laws" below).

• Treatment. We use your information to provide and coordinate your care. For example, your therapist keeps notes of your sessions and may consult with a supervisor or another clinician in our practice about the best approach for you. With your written permission, we share information with your other providers, such as a psychiatrist or primary care doctor, when it helps your care.
• Payment. We use and share your information to bill and get paid. For example, if you use insurance, we send your health plan the information it needs to pay the claim, such as your name, member ID, dates of service, the type of service, and your diagnosis. We may also check your coverage and benefits before your sessions.
• Health care operations. We use your information to run our practice well. For example, we may review records to improve the quality of care, provide clinical supervision, train new clinicians, respond to audits from health plans or licensing boards, and handle legal and business matters.

Companies that help us (business associates). We use outside companies for services such as our electronic health record and client portal, secure telehealth video, secure email, insurance claims and eligibility processing, and secure fax. Before they can handle your information, they must sign a written agreement that requires them to protect it and use it only for the work they do for us.

4. Appointment reminders and contacting you

We may contact you by email, text message, phone, or through our secure client portal to remind you of appointments, ask you to complete forms, or follow up about billing. You can ask us to contact you in a different way (see "Your rights").

5. Other ways we may share your information without your written permission

The law allows or requires us to share information in some other situations. We share only what the law allows, and we follow the stricter rule when state law gives you more protection.

• When the law requires it. We share information when a federal, state, or local law requires us to.
• Abuse or neglect. We must report suspected abuse or neglect of a child, an elder, or a person with a disability to the proper state agency.
• Serious threat to health or safety. We may share information to prevent or lessen a serious and imminent threat to your safety or someone else's, such as contacting emergency services, the person at risk, or law enforcement as state law allows.
• Public health. We may share information for public health activities, such as reporting certain diseases or helping with product recalls.
• Health oversight. We may share information with agencies that oversee health care, such as state licensing boards, Medicaid, and Medicare, for audits, investigations, and inspections.
• Lawsuits and legal actions. We may share information in response to a court order. Because therapy records have extra protection under state law, we will not release them in response to a subpoena alone; we need your written permission or a court order.
• Law enforcement. We may share limited information with law enforcement when the law requires it, such as in response to a court order or warrant.
• After death. We may share information with a coroner, medical examiner, or funeral director, or with an organ and tissue donation organization, as the law allows.
• Research. We do not take part in research. If that ever changes, we would use your information only with your written permission or as the law allows.
• Special government functions. We may share information for military, veterans, national security, or protective services as the law requires, or with a correctional institution if you are in custody.
• Workers' compensation. We may share information as needed to comply with workers' compensation laws.
• The U.S. Department of Health and Human Services. We must share information with the federal government if it asks to check that we are following privacy law.

6. Family, friends, and others involved in your care

With your permission, we may share information with a family member, friend, or other person you tell us is involved in your care or in paying for it. You can tell us not to, or change your mind at any time. In an emergency, or if you are unable to tell us your wishes, we may share information if we believe it is in your best interest, and we will give you a chance to object as soon as we can.

If you are a parent or legal guardian of a client who is a minor, or are otherwise legally authorized to make health care decisions for a client (a "personal representative"), you can usually exercise that client's rights under this notice, subject to the limits of state law.

7. Uses that need your written permission

For the following, we will ask for your signed authorization first:

• Psychotherapy notes. These are a therapist's separate personal notes about the content of a session, kept apart from the rest of your record. Most uses or sharing of psychotherapy notes need your written permission, except in limited cases the law allows, such as your own therapist using them to treat you, supervised training, defending ourselves in a legal action you bring, a government review of our compliance, or to prevent a serious threat to safety.
• Marketing. We do not use or share your information for marketing.
• Sale of information. We never sell your health information.
• Recording and technology tools. We record sessions, or use technology tools that process session content, only if you have signed a separate consent form for that purpose.
• Any other use not described in this notice.

You can take back (revoke) your permission at any time by telling us in writing. This stops future sharing, but it cannot undo anything we already did while we had your permission.

8. Stricter state privacy laws

Massachusetts and Florida both give communications between you and your therapist extra protection. In Massachusetts, these include the confidentiality and privilege laws for licensed social workers (Massachusetts General Laws, Chapter 112, Sections 135A and 135B). In Florida, they include Florida Statutes Section 491.0147, which covers confidentiality and privileged communications for licensed clinical social workers and other psychotherapists.

When a state law protects your information more than federal law does, we follow the state law. In practice, this means that, except for the situations listed in sections 5 and 6 and for billing your health plan, we ask for your written permission before sharing therapy information with anyone outside our practice.

9. Your rights

You have the following rights regarding your health information. To use any of them, contact our Privacy Officer. We may ask you to make some requests in writing, which you can do by email or through the client portal.

• See and get a copy of your record. You can ask to see or get a paper or electronic copy of your health and billing records. We will respond within 30 days. If we need more time, we will tell you why in writing and may take up to 30 more days. We may charge a reasonable, cost-based fee for copies, and we will tell you the cost first. In rare cases we may deny part of a request, for example if a licensed professional believes access could put someone in danger; if so, we will explain why in writing and how you can ask for a review. Psychotherapy notes are not part of this right.
• Ask us to correct your record. If you think information in your record is wrong or incomplete, you can ask us to correct it. We will respond within 60 days. If we say no, we will explain why in writing, and you can send us a statement of disagreement to keep with your record.
• Ask for confidential communications. You can ask us to contact you in a certain way (for example, only by email or only on your cell phone) or at a different address. We will agree to all reasonable requests, and we will not ask why.
• Ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a service in full yourself, you can ask us not to share information about that service with your health plan, and we will agree unless the law requires us to share it.
• Get a list of those we shared your information with. You can ask for a list (an "accounting") of the times we shared your information in the past six years, who we shared it with, and why. It will not include sharing for treatment, payment, or operations, or sharing you authorized. We will respond within 60 days. The first list in any 12-month period is free; we may charge a reasonable, cost-based fee for additional lists, and we will tell you the cost first.
• Get a copy of this notice. You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. It is always available on this page.
• Choose someone to act for you. If you have given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we act.
• Be told about a breach. We will notify you promptly, and no later than 60 days after we discover it (or sooner if state law requires), if a breach occurs that may have compromised the privacy or security of your information.
• File a complaint. See the next section.

10. How to file a complaint

If you believe your privacy rights have been violated, you can file a complaint with us by contacting our Privacy Officer (below). You can also file a complaint with the federal government:

• U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201. Phone 1-800-368-1019 (TDD 1-800-537-7697). Online: www.hhs.gov/ocr/complaints.

We will never retaliate against you for filing a complaint. Filing a complaint will not affect your care.

11. Changes to this notice

We can change the terms of this notice, and the changes will apply to all information we have about you. If we make an important change, we will post the new notice on this page with a new effective date, and you can ask us for a copy at any time.

12. Contact our Privacy Officer

For questions about this notice, to use any of your rights, or to file a complaint, contact:

• Privacy Officer: Sherly Millan, LICSW, EMDR Unlocked LLC
• Email: sherly.millan@emdrunlocked.com
• Phone: (617) 286-5581

Current clients can also send a secure message through the client portal. Please do not send detailed health information through our website contact forms.