Mindset Psychological Care, LLC

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION / PHI (PROTECTED HEALTH INFORMATION) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

By law I am required to ensure that your Protected Health Information (PHI) is kept private. PHI constitutes information created or noted by me that can be used to identify you. It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care. I am required to provide you with this Notice about my privacy procedures. This Notice explains when, why, and how I would use and/or disclose your PHI. “Use” of PHI means when I share, apply, utilize, examine, or analyze information within my practice; PHI is “disclosed” when I release, transfer, give, or otherwise reveal it to a third party outside my practice. With some exceptions, I may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, I am always legally required to follow the privacy practices described in this Notice.

Please note that I reserve the right to change the terms of this Notice and my privacy policies at any time as permitted by law. Any changes will apply to PHI already on file with me. Before I make any important changes to my policies, I will immediately update this Notice and post a new copy of it on my website (www.mindsetpsycare.com). You may also request a copy of this Notice from me at any time, or view the current version on my website (www.mindsetpsycare.com).

A. Introduction

This Notice will tell you how I handle your medical information. It explains how I use this information in my practice, how I share it with other professionals and organizations, and how you can see it. I want you to know all of this so that you can make the best decisions for yourself and your family. If you have any questions or want to know more about anything in this Notice, please ask me for additional explanation or more detail.

Mindset Psychological Care, LLC is a telehealth-only practice. I provide all services remotely by secure video and audio from a private, confidential location in the State of Florida, to patients located in states where I am authorized to practice.

B. What I Mean by “Your Medical Information,” “PHI,” or “Protected Health Information”

Each time you meet with me or any doctor’s office, hospital, clinic, or other healthcare provider, information is collected about you and your physical and mental health. It may be information about your past, present, or future health or conditions, the tests and treatment you received from me or others, or about payment for healthcare. The information I collect from you is called, under the law, “PHI,” which stands for Protected Health Information. This information goes into your medical or healthcare record or file.

PHI is likely to include, but is not limited to, the following types of information in this practice:

• Your personal history (relationships, professional, social, family, etc.).
• Your stated presenting concerns, symptoms, needs, and goals for treatment.
• Diagnoses, which are the medical terms for your problems or symptoms.
• A treatment plan: a list of the treatments and services I think will best help you.
• Progress notes, which include information about how you are doing, what I notice about you, and what you tell me.
• Records I receive from others who treated or evaluated you.
• Psychological test scores, school records, and other reports provided to me.
• Information about current medications or past medication trials.
• Legal matters.
• Insurance and billing information.

This information will be used for reasons including:

• To coordinate and plan your treatment.
• To assess how effective the current treatment course is.
• As a reference when coordinating your care with other healthcare professionals who are also treating you — such as your family doctor or the professional who referred you — when you have authorized me to do so in writing.
• To show that you actually received the services from me that I billed to you or to your health insurance company.
• To improve the way I do my job by measuring the results of my work.

Although your health record is the physical property of the healthcare practitioner or facility that collected it, the information belongs to you. You can read it, and if you want a copy I can make one for you (this will involve a charge for the costs of copying and mailing, if you want it mailed to you; I will provide this cost in advance).

In some rare situations, you cannot see all of what is in your records. If you find anything in your records that you think is incorrect, or believe that something important is missing, you can ask me to amend (add information to) your record, although there are some situations in which I don’t have to agree to do that. If you have any further questions about this, please do not hesitate to ask.

C. Privacy and the Law

I am also required to tell you about privacy because of the privacy regulations in a federal law called the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires me to keep your PHI private and to give you this Notice of my legal duties and privacy practices, called the Notice of Privacy Practices (NPP). I will obey the rules of this Notice as long as it is in effect; if I change it, the rules of the new NPP will apply to all the PHI I keep, and you will be provided with a copy.

D. How Your Protected Health Information (PHI) Can Be Used and Shared

When your information is “used,” that means it is read by me and used to make decisions about your care. When your information is “disclosed,” that means it is shared with or sent to others outside this practice. Except in some special circumstances, when I use your PHI here or disclose it to others, I share only the minimum necessary PHI needed for those other people to do their jobs. The law gives you rights to know about your PHI, how it is used, and to have a say in how it is disclosed.

I use and disclose PHI for several reasons. For certain uses or disclosures, I must tell you about them and have a written Authorization form. For other uses or disclosures, I do not need your consent or authorization. Each situation is explained below.

1. Uses and Disclosures of PHI That Require Your Consent

After you have read this Notice, you will be asked to sign a separate Consent form to allow me to use your PHI within my practice to provide treatment to you, arrange for payment for my services, and carry out certain business functions called “health care operations.” Together, these routine purposes are called “Treatment, Payment, and Health Care Operations (TPO).”

Important: Although HIPAA would permit me to share your PHI with other providers for treatment purposes without your authorization, as a matter of my own practice I do not do so. I will not disclose your PHI to anyone outside my practice — including your physician, another therapist, a family member, or any other party — unless you have signed a written Authorization (a “release”) permitting it, except in the limited circumstances described in Section D3 below, where the law requires or permits disclosure without your authorization (for example, a mandatory abuse report, a duty to warn, or a court order).

1a. For Treatment, Payment, or Health Care Operations

I need information about you and your condition in order to provide care to you. Therefore, in order to begin treating you, you must sign the Consent form, because if you do not agree and consent, I am unable to provide you with treatment. When we meet, I will collect information about you, and all of it may go into your healthcare records. I use your PHI for three routine purposes: treatment, obtaining payment, and health care operations — as described below and subject to the release requirement stated above.

For treatment. I use your medical information within my practice to provide you with psychological treatments or services. These might include individual therapy; psychological, educational, or vocational testing; treatment planning; or measuring the efficacy of services rendered. If coordinating your care with another provider (such as your physician) or making a referral would be helpful, I will discuss it with you and ask you to sign a written Authorization (release) before I share any of your PHI with them. If another provider sends me records about you with your authorization, those records will go into your file here and I will keep them confidential in the same way as the rest of your PHI.

For payment. My practice operates primarily on a self-pay basis. In most cases, you pay directly for your sessions, and I use your information only to prepare and process your bill and payment records.

Because I am an out-of-network provider, I can, at your request, provide you with a “superbill” — an itemized receipt containing your diagnosis, dates and types of service, and fees — which you may submit to your insurance plan to seek out-of-network reimbursement. If you choose to do this, you are electing to share that information with your insurer, and I may also respond to reasonable follow-up requests from your plan needed to process your reimbursement. Submitting a superbill is always your choice.

If you pay for a service in full, out of pocket, and do not submit it to your insurance, you have the right to request that I not disclose any information about that service to your health plan, and I am required to honor that request (see Section E, “Your Rights Regarding Your PHI,” below).

For health care operations. There are a few other ways I may use or disclose your PHI for “health care operations.” For example, I may use your PHI to see where I can make improvements in the care and services I provide. I may be required to supply some information to government health agencies so they can conduct studies on certain disorders and treatments and plan for needed services; if I do, your name and personal information will be removed from what I send.

1b. Other Uses in Healthcare

Scheduling. I may use and disclose medical information to schedule and/or reschedule our appointments. For example, if you want me to contact you only at your home, at your work, or in some other way, I can typically make arrangements to communicate that way. Please make the request and we can discuss it.

Business Associates. There are some jobs I hire other businesses to do for me. Under the law, they are called my “business associates.” These business associates need to receive some of your PHI to do their jobs properly, and to protect your privacy they must agree in their contract with me (a Business Associate Agreement, or “BAA”) to safeguard your PHI in compliance with HIPAA. My business associates include:

• iPlum — provides my HIPAA-compliant telephone service for communicating with you about your services.
• Google — provides HIPAA-compliant email transmission to and from my practice email address (drrood@mindsetpsycare.com).
• SimplePractice — my primary electronic health record (EHR) system, which I also use to conduct secure video and audio telehealth sessions, and for scheduling, documentation, and secure client communication through its client portal.
• Doxy.me — a HIPAA-compliant video platform I use as a backup for telehealth sessions if SimplePractice video is unavailable.

I maintain a current Business Associate Agreement with each of these providers.

A Note on AI-Assisted Documentation. For some clients, and only with a separate written consent specific to that tool, I use SimplePractice’s AI-powered Note Taker feature to help draft clinical documentation from session audio. This feature is covered under an addendum to my Business Associate Agreement with SimplePractice governing its AI-enabled products. I personally review, edit, and approve every AI-generated note before it becomes part of your record, and I remain fully responsible for its accuracy and content. Use of this feature is always optional and is never a condition of receiving services; it is governed by a separate consent form that explains how the tool works, how the resulting data is handled, and how you may decline or withdraw consent at any time.

A Note on Telehealth and Electronic Communication. Because my practice is conducted entirely by telehealth, all sessions take place through the secure, HIPAA-compliant platforms described above. While I use encrypted platforms and take reasonable steps to protect your privacy, no method of electronic communication or transmission over the internet can be guaranteed to be completely secure. There are inherent risks to telehealth — for example, the small possibility of a technology breach, or the risk that someone nearby could overhear a session. You share responsibility for protecting your own privacy by participating in sessions from a private location where you will not be overheard, using a secure internet connection when possible, and letting me know if you are ever in a setting where confidentiality cannot be maintained. I will do the same on my end.

2. Uses and Disclosures That Require Your Authorization

I will obtain an Authorization from you before using or disclosing PHI in a way that is not described in this Notice. If I want to use your information for any purpose besides TPO or those described above, I will explain my proposed use and provide you with an Authorization form. It is up to you to decide whether to provide your consent through a Release of Information / Authorization form. I do not anticipate needing this frequently.

If you do authorize me to use or disclose your PHI in that way, you can revoke (cancel) that permission, in writing, at any time. After that, I will not use or disclose your information for the purposes you had agreed to. I cannot take back any information I had already disclosed with your permission prior to the revocation.

3. Uses and Disclosures of PHI That Do Not Require Your Consent or Authorization

The law lets me use and disclose some of your PHI without your consent or authorization in certain cases. There are some federal, state, and local laws that require me to disclose PHI. Here are examples of when I might be required to share your information:

(1) Mandatory Reporting of Abuse or Neglect. Because I provide services via telehealth, certain of my legal obligations — including mandatory reporting of suspected abuse or neglect — are governed by the law of the state in which you are physically located at the time of your session (your “receiving state”), consistent with my authority to practice under the Psychology Interjurisdictional Compact (PSYPACT). If I have reasonable cause to suspect abuse or neglect of a child, elder, or dependent adult, I am legally mandated to report it to the appropriate authority in the state where you are located during our session. Because these obligations depend on your location, it is important that you inform me if your physical location changes, or if you will be in a different state for a scheduled session, so that I can confirm I am authorized to provide services and can meet my legal obligations in that state.

(2) Legal Proceedings. If you are involved in a lawsuit or legal proceeding and I receive a subpoena, discovery request, or other lawful process, I may have to release some of your PHI. I will only do so after trying to notify you about the request, consulting a lawyer, or trying to obtain a court order to protect the requested information.

(3) Compliance Oversight. I am required to disclose some information to government agencies that work to ensure I am obeying the privacy laws.

(4) To Warn or Protect a Potential Victim. If you communicate a serious threat of physical harm against a reasonably identifiable person or persons, I may be legally required or permitted to take protective action — which may include notifying the potential victim, contacting law enforcement, or seeking hospitalization. Whether I am required to act, and what steps I must take, is governed by the law of the state in which you are physically located at the time of your session (your “receiving state”) under my PSYPACT authority. Because these laws differ from state to state, the specific obligations that apply may vary depending on where you are located when we meet. As with my other legal duties, this is why it is important that you tell me if your physical location changes for a scheduled session.

Additional Circumstances Permitting Disclosure Without Consent

Use and disclosure without your consent or authorization may also be allowed under other provisions of Section 164.512 of the HIPAA Privacy Rule and applicable state confidentiality law. This includes certain narrowly defined disclosures as follows:

• For Law Enforcement Purposes: I may release medical information if asked to do so by a law enforcement official to investigate a potential crime or criminal.
• For Public Health Activities: I may disclose some of your PHI to agencies that investigate diseases or injuries, or for purposes relating to FDA-regulated products.
• Relating to Decedents: I may disclose PHI to coroners, medical examiners, or funeral directors, and to organizations relating to organ, eye, or tissue donation or transplant.
• For Specialized Government Functions: I may disclose PHI relating to military personnel and veterans for benefit-eligibility and enrollment purposes; to Workers’ Compensation and disability programs; to correctional facilities if you are an inmate; and for national security and intelligence reasons.
• To Prevent a Serious Threat to Health or Safety: If I believe you are a serious threat to your own health or safety, or to the health or safety of another individual or group, I may disclose some of your PHI in order to help prevent the threat.

4. Uses and Disclosures Where You Have an Opportunity to Object

I will share information about you with your family members, close friends, clergy, or others only with your permission. I will ask you whom, if anyone, you want me to be able to speak with, and what information you want me to share, and I will honor your wishes as long as it is not against the law. You can add, change, or withdraw this permission at any time.

The only exception is a genuine emergency in which you are unable to agree or object — for example, if you are experiencing a medical or psychiatric crisis. In that narrow situation, I may share the minimum information necessary with those able to help protect your health or safety. If I do, I will tell you as soon as I am able, and if you do not approve, I will stop, as long as it is not against the law.

5. An Accounting of Disclosures

When I disclose your PHI, I may keep some records of to whom I sent it, when I sent it, and what I sent. You can get an accounting (a list) of many of these disclosures.

E. Your Rights Regarding Your PHI

1. You can ask me to communicate with you about your health and related issues in a particular way or at a certain place that is more private for you. For example, you can ask me to call you at a particular phone number to schedule appointments.

2. You have the right to ask me to limit what I share with people involved in your care or the payment for your care, such as family members and friends. Because I already do not share your PHI with these individuals without your permission, I will honor your request to restrict or withhold such information. The only circumstances that can override your wishes are the limited legal exceptions described in Section D3 (for example, a mandatory abuse report, a duty to warn, or a court order) or a genuine emergency in which you are unable to agree or object and disclosure is necessary to protect your health or safety.

3. You have the right to look at the health information I have about you, such as your medical and billing records. You can get a copy of these records, but there will be a processing/administrative charge, which I will tell you about in advance. Contact me to arrange how to see your records.

4. If you believe the information in your records is incorrect or missing important information, you can ask me to make some types of changes (called “amending”) to your health information. You must make this request in writing and tell me the reasons you want to make the changes.

5. You have the right to a copy of this NPP. If I change this NPP, I will post the updated version on my website (www.mindsetpsycare.com), and you may request a copy from me at any time.

6. You have the right to file a complaint if you believe your privacy rights have been violated. You can file a complaint with me and with the Secretary of the U.S. Department of Health and Human Services (HHS). All complaints must be in writing. Filing a complaint will not change the health care I provide to you in any way. (See Section F for how to file.)

7. Right to Restrict Disclosures When You Pay Out-of-Pocket. If you pay in full, out of pocket, for a service, you have the right to instruct me not to disclose any information about that service to your health plan, and I must honor that request. This right applies to services you keep entirely private; it does not apply to a service for which you have asked me to prepare a superbill or otherwise submit information to your insurer for reimbursement, since that involves your own choice to share the information with your plan.

8. Right to Be Notified if There Is a Breach of Your Unsecured PHI. You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) my Risk Assessment fails to determine that there is a low probability that your PHI has been compromised.

What is considered a breach? The HITECH Act added a requirement to HIPAA that psychologists (and other covered entities) must give notice to patients and to HHS if they discover that “unsecured” PHI has been breached. A “breach” is defined as the acquisition, access, use, or disclosure of PHI in violation of the HIPAA Privacy Rule.

You may also have other rights granted to you by the laws of the state in which you are located, which may be the same as or different from the rights described above. I will be happy to discuss these with you now or as they arise.

F. If You Have Questions

If you need more information or have questions about the privacy practices described above, ask at any time. If you have a problem with how your PHI has been handled, or if you believe your privacy rights have been violated, please contact Mindset Psychological Care, LLC at (239) 350-3636.

You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). All complaints must be in writing. Filing a complaint will not change the health care I provide to you. Complaints may be filed as follows:

• Online: www.hhs.gov/ocr/complaints/index.html
• By email: OCRComplaint@hhs.gov
• By mail (region serving Florida): Office for Civil Rights, U.S. Department of Health and Human Services, Atlanta Federal Center, Suite 3B70, 61 Forsyth Street SW, Atlanta, GA 30303-8909  |  Phone: (404) 562-7886

A complaint must name the entity that is the subject of the complaint, describe the acts or omissions believed to violate the privacy requirements, and be filed within 180 days of when you knew or should have known that the act or omission occurred (unless OCR waives this deadline for good cause).

Mindset Psychological Care, LLC — Notice of Privacy Practices — Effective October 1, 2026, Revised October 16, 2026.