NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: July 6, 2026

MY LEGAL DUTY

I am required by law to maintain the privacy of your protected health information, to provide this Notice describing my legal duties and privacy practices, and to follow its terms. I reserve the right to change this Notice at any time. Any revised Notice will be posted on my website and provided to you upon request.

WHAT IS PROTECTED HEALTH INFORMATION (PHI)

Protected health information is any information relating to your past, present, or future physical or mental health condition, the care you receive, or payment for that care, that can identify you. Examples include your name, contact information, diagnosis, session notes, and billing records.

HOW I MAY USE AND DISCLOSE YOUR PHI WITHOUT AUTHORIZATION

Treatment: I may share information with other healthcare providers involved in your care to coordinate treatment.

Payment: I am independently credentialed with United Healthcare and submit claims for United Healthcare clients directly through United's provider portal. For clients using Aetna, Cigna, or Anthem/Blue Cross Blue Shield (BCBS) benefits, I submit claims through Headway, my insurance billing platform. Copayments for United Healthcare clients are billed through Ivy Pay. Payments and copayments for clients using Aetna, Cigna, or Anthem/BCBS are handled through Headway. Private pay clients are billed through Ivy Pay.

Healthcare Operations: I may use PHI internally for quality assurance, administration, and practice operations.

As Required by Law: I may disclose PHI in response to a court order, subpoena, or other legal process.

Mandatory Reporting: Colorado law requires me to report suspected child abuse or neglect (C.R.S. § 19-3-304) and suspected mistreatment of an at-risk adult (C.R.S. § 18-6.5-108).

Serious Threat to Health or Safety: Colorado law permits, and in some circumstances requires, disclosure to protect against a serious and imminent threat to the health or safety of you or a specifically identifiable third party (C.R.S. § 13-21-117).

Psychotherapy Notes: Psychotherapy notes, where kept separately from your clinical record, receive special protection and generally require your separate written authorization before disclosure.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

Any use or disclosure of your PHI for marketing, any sale of your PHI, and any use not described above requires your written authorization. You may revoke a prior authorization in writing at any time, except to the extent I have already relied on it.

YOUR RIGHTS REGARDING YOUR PHI

You have the Right to Access a copy of your records within 30 days. You have the Right to Amendment to request correction of inaccurate information. You have the Right to an Accounting of Disclosures made outside treatment, payment, and operations. You have the Right to Request Restrictions on how your PHI is used. You have the Right to Confidential Communications specifying how you wish to be contacted, subject to the platform limitation described in Section 6 below regarding Ivy Pay. You have the Right to a Copy of This Notice at any time. To exercise any of these rights, submit a written request to kate@stayingthecoursecounseling.com or 6222 East Pine Lane, Suite 6212 #1067, Parker, CO 80138. I will respond within 30 days.

THIRD-PARTY PLATFORMS THAT HANDLE YOUR PHI

SimplePractice: I use SimplePractice as my electronic health records, practice management, and telehealth platform. SimplePractice stores and processes your protected health information, including session notes, appointment records, secure messages, intake forms, and billing details, and is used to conduct telehealth sessions. Clients communicate with me and complete all intake paperwork through the SimplePractice Client Portal. SimplePractice is HIPAA-compliant, and I maintain a signed Business Associate Agreement with them. For more information, visit simplepractice.com/privacy.

United Healthcare: I am independently credentialed with United Healthcare and submit claims for United Healthcare clients directly through United's provider portal. Copayments for United Healthcare clients are processed through Ivy Pay, as described below.

Headway: For clients using Aetna, Cigna, or Anthem/Blue Cross Blue Shield (BCBS) insurance benefits, I use Headway to manage insurance billing, including claims submission and copayment collection. Headway processes your name, contact information, insurance details, and billing information. Headway is a HIPAA-compliant platform. Visit headway.co/privacy.

Ivy Pay: I use Ivy Pay to process payments for private pay clients and for copayments from clients using United Healthcare benefits, including credit and debit cards, HSA cards, and FSA cards. I do not accept cash or checks. Ivy Pay is a HIPAA-compliant payment platform built specifically for licensed therapists, and I maintain a signed Business Associate Agreement with them. Please note that Ivy Pay sends payment confirmations by SMS text message; if you would prefer a different method of contact regarding payments, please discuss this with me directly. For more information, visit talktoivy.com/ivypay.

DATA RETENTION

Adult clinical records are retained for a minimum of seven years from the date of last service, consistent with Colorado recordkeeping standards. Records for minor clients, if applicable, are retained until age 18 plus any additional period required by Colorado law. Financial and billing records are retained for a minimum of seven years. Records are securely destroyed at the end of the applicable retention period.

DATA SECURITY

I use encryption in transit and at rest to protect your PHI. Access to your records is limited through access controls and password protections. All vendors who handle your PHI are required to sign a Business Associate Agreement and use HIPAA-compliant platforms.

BREACH NOTIFICATION

In the event of a breach involving your unsecured PHI, I will notify you within 60 days of discovering the breach, consistent with HIPAA requirements. Breaches will also be reported to the U.S. Department of Health and Human Services, Office for Civil Rights.

HOW TO FILE A COMPLAINT

If you believe your privacy rights have been violated, you may file a complaint with me directly at kate@stayingthecoursecounseling.com, (720) 727-1554, 6222 East Pine Lane, Suite 6212 #1067, Parker, CO 80138. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints. You will not be retaliated against for filing a complaint.

GOOD FAITH ESTIMATE — NO SURPRISES ACT

You have the right to receive a Good Faith Estimate of expected charges before your first appointment, and any time your services change, if you are not using insurance or if you ask for one.

Standard Fee: Private Pay Rate, 50-minute session: $130. A limited number of sliding scale spots are available on a case-by-case basis; all sliding scale spots are currently filled. If you are billed an amount substantially higher than your Good Faith Estimate (at least $400 more), you have the right to dispute the bill. For questions or a written estimate, contact kate@stayingthecoursecounseling.com.

UPDATES TO THIS NOTICE

I reserve the right to change the terms of this Notice, and any changes will apply to PHI I already have about you as well as PHI I receive in the future. A revised Notice will be posted on my website and available in print upon request.