Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

Mindcolor Autism LLC (“Mindcolor”) may use or disclose protected health information (PHI) for treatment, payment, and health care operations purposes.

To help clarify these terms, here are some definitions:

• PHI – refers to individually identifiable health information, including information that relates to your child’s past, present, or future health condition, the provision of health care to your child, or payment for that care, and that identifies or could reasonably be used to identify your child.
• Treatment – is when a health care professional provides, coordinates, or manages your child’s health care and other services related to your child’s health care. We may disclose your child’s PHI to other doctors, nurses, technicians or other personnel who are involved in your child’s care.
• Payment – is when Mindcolor obtains information about your or your child’s health care benefits and eligibility and/or seeks or obtains payment or reimbursement for your child’s health care. Payment activities may include verifying eligibility or coverage, obtaining prior authorization or precertification, conducting or responding to utilization or medical-necessity review, submitting and adjudicating claims, billing and collection activities, and responding to health plan requests relating to claims, coverage, reimbursement, or payment review. For example, Mindcolor may disclose your child’s PHI to a health plan to obtain authorization for services, submit or support a claim for reimbursement, or respond to a request concerning the medical necessity or payment for services.
• Health Care Operations – is when Mindcolor uses or discloses your child’s PHI for operation of our practice. For example, we may use health information to review our treatment and services and to evaluate the performance of our staff in caring for your child.
• Use – applies to activities within Mindcolor such as sharing, applying, utilizing, examining, and analyzing information that identifies you or your child.
• Disclosure – applies to releasing, transferring, providing access to, or otherwise making available information about you or your child outside of Mindcolor.
• Authorization – means written permission for specific uses or disclosures.

We are allowed or required to use or share your child’s information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. For more information see: https://www.hhs.gov/hipaa/for-individuals/index.html

Examples of Other Permissible or Required Uses and Disclosures Not Requiring Authorization

• Business Associates: Some of our activities are provided on our behalf through contracts with business associates. Examples of when we may use a business associate include coding and claims submission performed by a third party billing company, consulting and quality assurance activities provided by an outside consultant, billing and coding audits performed by an outside auditor, and other legal and consulting services provided in response to billing and reimbursement issues which may arise from time to time. When we enter into contracts to obtain these services, we may need to disclose your child’s PHI to our business associate so that the associate may perform the job which we have requested. To protect your child’s PHI, however, we require our business associate to appropriately safeguard your information.
• Communication with Family Members: Health professionals, including those employed by or under contract with us may disclose to a family member, other relative, close personal friend or any other person you identify, health information relative to that person’s involvement in your child’s care or payment related to your child’s care, unless you object to the disclosure.
• Notification: We may use or disclose your child’s PHI to notify or assist in notifying a family member, personal representative, close personal friend, or other person responsible for your child’s care, of your child’s location and general condition. We will not disclose your child’s PHI to your family members, personal representative, or close personal friends as described in this paragraph if you object to such disclosure. Please notify our Privacy Officer if you object to such disclosures.

Uses and Disclosures Requiring Authorization

Mindcolor may use or disclose PHI for purposes outside of treatment, payment, and health care operations when an appropriate authorization is obtained. Except as otherwise permitted or required by law and described below, when an authorization is required, Mindcolor will obtain it before using or disclosing the information. As a matter of Mindcolor policy, Mindcolor will also obtain an authorization before releasing treatment progress notes or session notes, except as required or permitted by law. Treatment progress notes or session notes are documentation completed by the health care provider regarding all conversations, actions, observations, treatment provided, etc., during any and all treatment sessions, including but not limited to direct sessions with the RBT, BCBA direction sessions, Caregiver Training sessions, etc. In addition, most uses and disclosures of psychotherapy notes (where applicable and as distinguished from treatment progress notes), uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization. Mindcolor does not sell PHI and does not use or disclose PHI for marketing purposes. Mindcolor may also use or disclose PHI for research with your written authorization or as otherwise permitted by applicable law. You may revoke an authorization at any time by notifying Mindcolor in writing. A revocation will not apply to the extent that Mindcolor has already taken action in reliance on the authorization, or where the authorization was obtained as a condition of obtaining insurance coverage and other law provides the insurer with the right to contest a claim under the policy.

Uses and Disclosures with Neither Consent nor Authorization

Mindcolor may use or disclose PHI without your consent or authorization in the following circumstances:

• Mandated Reporting: If any Mindcolor staff knows or suspects that a client has or is being abused, abandoned, or neglected, the law requires that they report such knowledge or suspicion to the proper authorities according to the county and state the client resides in.
• Adult and Domestic Abuse: If any Mindcolor staff knows or suspects that a vulnerable adult (disabled or elderly) has been or is being abused, neglected, or exploited, they are required by law to immediately report such knowledge or suspicion.
• Health Oversight: Mindcolor may disclose your child’s PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections and licensure. For example, if a complaint is filed and later is open for investigation; a subpoena for confidential health information from certain parties may be requested and therefore shared.
• Judicial or Administrative Proceedings: Mindcolor may disclose your child’s PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal, or in response to a subpoena, discovery request, or other lawful process, provided that Mindcolor makes reasonable efforts to give you advance notice or to obtain a qualified protective order, as required by applicable law. Some states in which Mindcolor operates may impose additional restrictions on these disclosures, and Mindcolor will comply with those requirements.
• Serious Threat to Health or Safety: Mindcolor may use or disclose your child’s PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Any such disclosure will be made only to a person or persons reasonably able to prevent or lessen the threat, and will be limited to the PHI necessary to accomplish that purpose.
• Law Enforcement: Mindcolor may disclose your child’s PHI to law enforcement officials for law enforcement purposes, including the following: reporting certain injuries as required by law; to identify or locate a suspect, fugitive, material witness, or missing person; about the victim of a crime, if the victim agrees, or under certain limited circumstances, where we are unable to obtain the person’s agreement.
• Workers’ Compensation, law enforcement, and other government requests: Information may be shared in relation to workers’ compensation claims, law enforcement purposes or with a law enforcement official, health oversight agencies for activities authorized by law, and/or special government functions, such as military, national security, and presidential protective services.
• Compliance with laws and regulations: Information may be shared about your child if state, federal, or local laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Use of Email, Phone, and Google Messages for Communication

Mindcolor may communicate with you via email, phone (including text messages), or Google Messages. Information contained in these communications may at times contain PHI. There are inherent risks of using such forms of communication, including, but not limited to:

• Email, voicemail, text messages, and Google Messages can be circulated, forwarded, stored electronically and on paper, and broadcast to unintended recipients.
• Email, voicemail, text messages, and Google Messages senders can easily misaddress an email or message and send the information to an undesired recipient.
• Backup copies of email, voicemail, text messages, and Google Messages may exist even after the sender and/or the recipient has deleted his or her copy.
• Employers and on-line services have a right to inspect emails sent through their company systems.
• Email, text messages, and Google Messages can be intercepted, altered, forwarded or used without authorization or detection.
• Email, voicemail, text messages, and Google Messages can be used as evidence in court.
• Email, voicemail, text messages, and Google Messages may not be secure and therefore it is possible that the confidentiality of such communications may be breached by a third party.

We will use reasonable means to protect the security and confidentiality of email, voicemail, text message, and Google Message information sent and received. If you feel uncomfortable receiving communication via email, voicemail, text messages, or Google Messages, you can inform us at any time and we will accommodate alternative means of communication.

Use of Mindcolor Together

Mindcolor makes available a mobile application for parents, legal guardians, and authorized adult caregivers. Entries you make in the app remain on your device unless you choose to send them to us. You may choose to send only when you decide to, or you may choose daily or weekly automatic sending. If you choose automatic sending, the app will send an updated copy when you open the app after the interval you selected has passed, and will keep doing so until you turn that setting off. If you send them, they are stored in Mindcolor’s records, where members of your child’s care team are able to access them; no one at Mindcolor is notified at the moment you send, and the app is not monitored. Mindcolor personnel cannot reply to you or otherwise send information to you through the app. The app is not a way to reach your child’s clinical team, and it must not be used for any emergency or any urgent or time-sensitive medical, behavioral, or safety matter. Information you send us through the app is handled as described in this notice. The app’s own data practices are described in our Website and Mobile App Privacy Policy.

Mindcolor Responsibilities

• We are required by law to maintain the privacy and security of your child’s protected health information.
• Mindcolor is required by law to provide a copy of this notice of Mindcolor’s legal duties and privacy practices with respect to PHI.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your child’s information.
• Mindcolor reserves the right to change the privacy policies and practices described in this notice, and to make the terms of a revised notice effective for all protected health information that we maintain, including information we created or received before the revised notice takes effect. We are required to abide by the terms of the notice currently in effect.
• If Mindcolor revises this notice, we will post the revised notice on our website at https://www.mindcolorautism.com/legal/hipaa, make copies available at each of our centers, and provide a copy to you upon request. The revised notice will take effect on the date stated in it. Please notify Mindcolor promptly of any change to your address, telephone number, or email address so that our records remain current.
• We will not use or share your child’s information other than as described here, unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind. For more information see: https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html

Rights of Client

When it comes to your child’s health information, you have certain rights. This section explains your rights and some of Mindcolor’s responsibilities to help you.

• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of protected health information about your child. However, Mindcolor is not required to agree to your requested restriction, and may deny the request if it would affect your child’s care and treatment, except that Mindcolor must agree to a request not to disclose to a health plan PHI relating solely to an item or service for which you have paid Mindcolor out-of-pocket in full, where the disclosure would otherwise be for payment or health care operations, unless the disclosure is required by law.
• Right to Receive Confidential Communications by Alternative Means and at Alternative Locations: You have the right to request and receive confidential communications of PHI by alternative means and alternative locations. A request may be made to contact the legal guardian/caregiver in a specific way, or to send an email to a different address. All reasonable requests will be accommodated. For example, you may not want a family member to know your child is in treatment. Upon request, Mindcolor will send your bills to another address.
• Right to Inspect and Copy: You have the right to inspect or obtain a copy of protected health information about your child in Mindcolor’s designated record set, including treatment and billing records and other records used to make decisions about your child, for as long as that information is maintained in the designated record set, subject to limited exceptions permitted by law. Upon your request, Mindcolor will discuss the details of the request process. A request can be made to see or receive an electronic or paper copy of your child’s medical record and other health information. Contact Mindcolor in writing to make a request. We will act on your request within the time required by law, usually within 30 days. If you agree to it in advance, we may provide a summary or explanation of the requested information instead of a copy, and we will tell you in advance of any fee for preparing that summary or explanation.
• Right to Amend: You have the right to request an amendment of PHI that is incorrect or incomplete for as long as the PHI is maintained in the record; however, Mindcolor may deny your request. These requests may be denied, but a response as to why a request was denied will be provided in writing within 60 days of the request. On your request, Mindcolor will discuss with you the details of the amendment process.
• Right to an Accounting: You generally have the right to receive an accounting of disclosures of PHI. On your request, Mindcolor will discuss with you the details of the accounting process. All disclosures will be included, except those about treatment, payment, and health care operations, and certain other disclosures (such as any requested by the legal guardian). We will provide one accounting free of charge in any twelve-month period. For additional requests within that period we may charge a reasonable, cost-based fee, and we will tell you the cost in advance so that you may withdraw or modify your request.
• Right to Have Someone Act on Your Behalf: If medical power of attorney for the client has been given to someone, or if someone else is the client’s legal guardian, that person can exercise rights and make choices about the client’s health information. Mindcolor will ensure and confirm that this individual has the authority and can act on behalf of the client/caregiver, before taking any action.
• Right to Obtain a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice of Privacy Practices from Mindcolor upon request, even if you agreed to receive it electronically. Contact us using the information below and we will provide one promptly.

Complaints

A complaint may be filed if you feel we have violated your child’s rights by contacting us using the information listed on this page.

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. We will not retaliate against you for filing a complaint.

This notice is effective as of August 17, 2026.

How to Contact Us

If you have a question, concern, or complaint regarding how your health information is protected, used, and/or disclosed, you may contact the Mindcolor Autism Compliance Department by telephone at 833-646-3222 or in writing:

Email: compliance@mindcolorautism.com

Parents, legal guardians, and other personal representatives who have authority under applicable law may request access to health and treatment records maintained in our electronic health record system, Rethink. Information you send us through Mindcolor Together is kept separately from that system. To request access to, or amendment of, information you have sent through the app — or to any of your child’s records, wherever we keep them — contact our Privacy Officer using the contact information provided in this notice, and we will respond as described in this notice regardless of which system holds the information.

Questions

Please contact us regarding any question about this Notice of Privacy Practices by phone or email at compliance@mindcolorautism.com.