Rhythm Wellness Mental Health Counseling PLLC

Effective Date: July 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Rhythm Wellness Mental Health Counseling PLLC is committed to protecting the privacy of your health information. We are required by law to:

• Maintain the privacy of your Protected Health Information (PHI)

• Provide you with this Notice of our legal duties and privacy practices

• Follow the terms of the Notice currently in effect

• Notify you if we are unable to agree to a requested restriction

• Accommodate reasonable requests to communicate health information by alternative means or at alternative locations

This Notice applies to all records of your care maintained by Rhythm Wellness Mental Health Counseling PLLC.

What Is Protected Health Information (PHI)?

Protected Health Information includes:

• Information about your past, present, or future physical or mental health condition

• Information about healthcare services provided to you

• Payment information related to healthcare services

• Any information that could identify you (name, address, date of birth, Social Security number, and similar identifiers)

How We May Use and Disclose Your Health Information

Uses and Disclosures That Do Not Require Your Authorization

1. For Treatment. We may use and disclose your PHI to provide, coordinate, or manage your mental health treatment and related services. This may include consultation with other healthcare providers about your care, coordination of care between therapists in our practice, referrals to other mental health professionals or specialists, and emergency treatment situations.

Example: If your therapist believes you would benefit from specialized services the other therapist in our practice provides, they may consult with each other about your care.

2. For Payment. We may use and disclose your PHI to bill and receive payment for services provided to you. This may include submitting claims to your health insurance company, verifying insurance coverage and benefits, collecting payment for services, and responding to insurance company requests for information to justify treatment.

Example: We will submit claims to your insurance company that include your diagnosis, dates of service, and types of services provided.

3. For Healthcare Operations. We may use and disclose your PHI for healthcare operations, including quality assessment and improvement activities, case management and care coordination, professional training and education, business planning and administrative functions, and compliance with legal and regulatory requirements.

4. Required by Law. We may use and disclose your PHI when required by federal, state, or local law, including reporting suspected abuse, neglect, or domestic violence; complying with workers' compensation laws; responding to court orders or legal proceedings; and reporting certain communicable diseases to public health authorities.

5. Public Health Activities. We may disclose PHI to public health authorities for activities such as preventing or controlling disease, injury, or disability; reporting adverse events related to medications or medical devices; and conducting public health surveillance or investigations.

6. Health Oversight Activities. We may disclose PHI to health oversight agencies for activities authorized by law, including audits and investigations, licensure or disciplinary actions, and civil, administrative, or criminal proceedings.

7. Judicial and Administrative Proceedings. We may disclose PHI in response to court orders, subpoenas (when accompanied by appropriate court orders or your authorization), and administrative tribunal orders.

8. Law Enforcement. We may disclose limited PHI to law enforcement officials in specific circumstances, including in response to a court order, subpoena, or warrant; to identify or locate a suspect, fugitive, material witness, or missing person; about a victim of a crime (in limited circumstances); about a death suspected to be the result of criminal conduct; and about criminal conduct at our practice.

9. To Avert a Serious Threat to Health or Safety. We may use and disclose PHI when necessary to prevent a serious and imminent threat to your health or safety, the health or safety of another person, or the public's health or safety. This is often referred to as the "duty to warn" or "duty to protect."

Example: If you communicate a serious threat to harm yourself or another person, we may disclose information to law enforcement, the potential victim, or emergency services.

10. Specialized Government Functions. We may disclose PHI for military and veterans' activities (if you are a member of the armed forces), national security and intelligence activities, protective services for the President and others, and correctional institutions (if you are an inmate).

11. Workers' Compensation. We may disclose PHI for workers' compensation or similar programs that provide benefits for work-related injuries or illnesses.

12. Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI to coroners, medical examiners, or funeral directors to identify a deceased person, determine cause of death, or permit funeral directors to carry out their duties.

13. Research. Under certain circumstances, we may use and disclose PHI for research purposes when an Institutional Review Board has approved the research, the research involves only de-identified information, or you have provided authorization.

Uses and Disclosures That Require Your Written Authorization

For uses and disclosures beyond treatment, payment, and healthcare operations, we will obtain your written authorization, including:

Psychotherapy Notes. Psychotherapy notes are the therapist's personal notes about session content, kept separate from your official medical record. These notes have additional protections and require your specific written authorization for disclosure, except in very limited circumstances. Most of your treatment records are NOT psychotherapy notes and can be used for treatment, payment, and healthcare operations without separate authorization.

Marketing. We will not use or disclose your PHI for marketing purposes without your written authorization.

Sale of Information. We will not sell your PHI without your written authorization.

Other Uses. Any other use or disclosure of your PHI not described in this Notice will be made only with your written authorization. You may revoke your authorization at any time by providing written notice, except to the extent that we have already taken action in reliance on it.

Special Protections for Certain Information

Mental Health Records. Mental health records in New York State have additional privacy protections beyond HIPAA. We follow both HIPAA and New York State Mental Hygiene Law, whichever provides greater protection.

Substance Use Treatment. If you receive treatment for substance use issues, those records are protected by federal law (42 CFR Part 2) and generally cannot be disclosed without your specific written consent, except in limited emergency situations.

HIV/AIDS Information. HIV/AIDS-related information has special protections under New York State law and requires specific written authorization for disclosure.

Minors. For clients under 18, parents or legal guardians generally have the right to access health information. However, in certain circumstances (such as when a minor consents to their own treatment under New York law), the minor may have privacy rights that limit parental access.

Your Rights Regarding Your Health Information

1. Right to Inspect and Copy. You have the right to inspect and obtain a copy of your health information, including progress notes, treatment plans, assessment reports, and billing records. Submit a written request to info@rhythmwellnessnyc.com or by mail to our office. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies. We may deny access in certain limited circumstances, such as when a therapist determines that access would cause substantial harm; you may request a review of certain denials. We may deny access to psychotherapy notes, which are separate from your regular treatment records.

2. Right to Amend. If you believe information in your record is incorrect or incomplete, you may request an amendment by submitting a written request explaining what should be changed and why. We will respond within 60 days. We may deny your request if the information is accurate, complete, or was not created by us. If we deny your request, you may submit a statement of disagreement, which will be included in your record.

3. Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures we have made of your PHI within the past six years, other than disclosures for treatment, payment, or healthcare operations, disclosures made to you, or disclosures you authorized. The first accounting in a 12-month period is free; we may charge a reasonable fee for additional requests within the same period.

4. Right to Request Restrictions. You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, with one exception: if you pay for a service out-of-pocket in full and request that we not share information about that service with your health insurance plan, we must agree (unless the disclosure is otherwise required by law). Submit requests in writing to info@rhythmwellnessnyc.com or call (646) 875-8927.

5. Right to Request Confidential Communications. You have the right to request that we communicate with you about your PHI in a certain way or at a certain location, such as calling your cell phone instead of your home phone or emailing rather than mailing. Submit a written request specifying how or where you wish to be contacted. We will accommodate reasonable requests, and you do not need to provide a reason.

6. Right to a Paper Copy of This Notice. You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Request a copy by email, by phone, or during your appointment. This Notice is also available on our website at rhythmwellnessnyc.com.

7. Right to Be Notified of a Breach. You have the right to be notified if we discover a breach of your unsecured PHI.

How to Exercise Your Rights

To exercise any of the rights described above, contact:

Privacy Officer: Jack Szary, LMHC-D Email: info@rhythmwellnessnyc.com Phone: (646) 875-8927 Mail: 224 W 35th St #500, New York, NY 10001

Most requests should be made in writing. We will respond within the timeframes required by law.

Our Responsibilities

We are required by law to maintain the privacy and security of your PHI, provide you with this Notice, follow the terms of the Notice currently in effect, notify you if we cannot accommodate a requested restriction or confidential communication, and notify you following a breach of unsecured PHI.

We reserve the right to change our privacy practices and the terms of this Notice at any time, as permitted by law, and to make the new Notice effective for all PHI we maintain, including information created or received before the changes were made. If we make important changes, we will post the revised Notice on our website at rhythmwellnessnyc.com, provide it to active clients, and make it available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

To file a complaint with us:

Email info@rhythmwellnessnyc.com, call (646) 875-8927, or mail 224 W 35th St #500, New York, NY 10001. Please include your name and contact information, a description of the issue or concern, and any relevant dates or details.

To file a complaint with the federal government:

U.S. Department of Health and Human Services, Office for Civil Rights Online: https://ocrportal.hhs.gov/ocr/portal/lobby.jsf Phone: 1-800-368-1019 Mail: Region II Office, U.S. Department of Health and Human Services, Jacob K. Javits Federal Building, 26 Federal Plaza, Suite 3312, New York, NY 10278

Questions or Additional Information

If you have questions about this Notice or our privacy practices, contact:

Rhythm Wellness Mental Health Counseling PLLC Privacy Officer: Jack Szary, LMHC-D Phone: (646) 875-8927 Email: info@rhythmwellnessnyc.com Address: 224 W 35th St #500, New York, NY 10001