This notice describes how medical and psychiatric information about you may be used and disclosed through our virtual practice and how you can access this information. Please review it carefully.

Contact Information:

Forest Path Psychiatry & Healing
2020 N Academy Blvd
Ste 261 #2016
Colorado Springs, Colorado 80909
Phone: (719) 301-1232
Fax: (888) 520-6144
Website: www.ForestPathPsychiatry.com
Patient Portal: https://www.therapyportal.com/p/forestpathpsychiatry
Privacy Counsel: Holly Werstein, RN, MSN, MBA, APRN, PMHNP-BC

This notice describes how medical and psychiatric information about you may be used and disclosed through our virtual practice and how you can access this information. Please review it carefully.

TABLE OF CONTENTS

I. Introduction & Virtual Care Security

   A. About This Notice

   B. TherapyNotes Platform Security

   C. Telehealth Privacy Protections

   D. Interstate Practice Information

II. Your Privacy Rights & Protections

   A. Accessing Your Information

   B. Making Changes

   C. Confidential Communications

   D. Restrictions on Use

   E. Special Protections for Psychiatric Care

   F. Additional Rights

III. Use and Disclosure of Information

   A. Required Disclosures

   B. Permitted Disclosures

   C. Disclosures with Opportunity to Object

   D. Disclosures Requiring Authorization

   E. Research and Special Circumstances

   F. Business Associates

   G. Emergency Situations and Duty to Warn

IV. Safeguards & Security Measures

   A. Technical Safeguards

   B. Administrative Controls

   C. Risk Management

   D. Documentation & Audit Trails

   E. Breach Notification Procedures

   F. Patient Responsibilities

Additional Information

- Changes to This Notice

- Filing Complaints

- For More Information

- Acknowledgment

INTRODUCTION & VIRTUAL CARE SECURITY

A. About This Notice

Forest Path Psychiatry & Healing provides specialized psychiatric care through secure virtual platforms. We are required by federal law to maintain the privacy of Protected Health Information (PHI) and by Colorado law to provide additional protections for psychiatric information. This notice explains your rights and our responsibilities regarding your health information. As a virtual practice, we maintain particularly stringent security measures to protect your sensitive health information.

Our administrative team is available Monday through Friday, 10am MST - 5pm MST (hours subject to change). Clinical service hours vary by provider, and all services are delivered via secure telehealth platforms.

B. TherapyNotes Platform Security

We exclusively use TherapyNotes for all virtual care delivery, scheduling, and communication. TherapyNotes maintains HiTrust certification, the highest level of HIPAA security available. Your sessions are protected with enterprise-level encryption and security protocols. Every interaction, from video sessions to message exchanges, occurs within this secure environment. We do not conduct therapeutic interactions through standard email or text messaging, as these don't meet our security standards.

C. Telehealth Privacy Protections

Virtual Session Security:

All telehealth sessions occur through our HIPAA-compliant platform with end-to-end encryption. We maintain strict protocols for session privacy, including provider requirements to conduct sessions from secure, private locations. You must also be in a private location during sessions, using a secure internet connection rather than public WiFi.

Electronic Prescribing Security:

Our electronic prescribing system operates within the secure TherapyNotes platform and connects directly with Colorado's Prescription Drug Monitoring Program. All prescriptions, particularly controlled substances, are transmitted through encrypted channels meeting DEA requirements. We employ multi-factor authentication and maintain comprehensive audit trails for all prescribing activities.

D. Interstate Practice Information

As a Colorado-based practice, we serve Colorado residents wherever they may be temporarily located. Under Colorado law, we can continue providing care when you are temporarily out of state for vacation, visiting friends or family, attending school elsewhere, or traveling for business. Your primary residence must remain in Colorado, but this flexibility ensures continuity of care during temporary absences. All security protocols and practice policies remain in effect

YOUR PRIVACY RIGHTS & PROTECTIONS

A. Accessing Your Information

You have the right to inspect and receive electronic or paper copies of your health records through our secure portal. For psychiatric records, special handling procedures apply, and some information (such as psychotherapy notes) may have restricted access. We may charge a reasonable fee for copies. If we deny access based on potential harm, you have the right to have this decision reviewed by another licensed healthcare professional. We will respond to all requests within 30 days.

B. Making Changes

You may request corrections to your health information if you believe it is incorrect or incomplete. Submit your request and reason through our secure portal. We will respond within 60 days. If we deny your request, we'll provide a written explanation and allow you to submit a statement of disagreement that will be included with your records.

C. Confidential Communications

You may request that we contact you in specific ways or at specific locations. We will accommodate all reasonable requests without requiring an explanation. All electronic communications occur through our secure portal.

D. Restrictions on Use

You may request restrictions on how we use or share your health information for treatment, payment, or operations. While we're not required to agree to all restrictions, we will honor restrictions on sharing information with your health insurer if you pay for a service in full out-of-pocket.

E. Special Protections for Psychiatric Care

Your psychiatric records receive heightened protection under Colorado law and federal regulations. This includes special safeguards for:

- Psychotherapy notes

- Substance use disorder treatment information (protected under 42 CFR Part 2)

- Mental health treatment records

- Psychiatric medication information

- Genetic information related to psychiatric conditions

F. Additional Rights

You have the right to:

- Receive a paper copy of this notice upon request, even if you agreed to receive it electronically

- Receive an accounting of times we've shared your information during the past 6 years

- Choose someone to act for you via medical power of attorney

- Opt out of any fundraising communications

- Be notified of any breach of your unsecured health information

- Request alternative forms of communication

USE AND DISCLOSURE OF INFORMATION

A. Required Disclosures

We must share your information when:

- Required by federal, state, or local law

- Required by court order or subpoena

- Requested by the Secretary of Health and Human Services to review our compliance

- Required for health oversight activities by authorized agencies

- Necessary for workers' compensation claims

- Required by law enforcement in specific circumstances

- Necessary for specialized government functions

B. Permitted Disclosures

For Treatment: We use your health information to provide care and may share it with other healthcare providers treating you. Information sharing occurs through secure, encrypted channels. We may consult with other providers about your care, coordinate prescriptions, and manage your treatment plan.

For Payment: We use your information to bill for services and obtain insurance authorizations. This includes sharing necessary information with insurance companies or other payers. If you pay out-of-pocket in full for a service, you can request that we don't share information about that service with your insurer.

For Healthcare Operations: We use your information to improve our services, train staff, and conduct required business activities. This includes quality assessment, clinical supervision, and compliance monitoring, all conducted within our secure virtual environment.

C. Disclosures with Opportunity to Object

We may share relevant information with:

- Family members or friends involved in your care

- Disaster relief organizations

- Others you identify as involved in your healthcare

You may object to these disclosures, and we will honor your wishes unless required by law or emergency.

D. Disclosures Requiring Authorization

Written Authorization: We will obtain your written authorization for:

- Marketing purposes

- Sale of your information

- Most sharing of psychotherapy notes

- Release to employers or schools

- Release to life/disability insurance

- Most sharing with family members

- Substance use disorder treatment information

- Research studies

E. Research and Special Circumstances

Research Participation: If you choose to participate in research, we will obtain specific authorization. We may use de-identified information for research purposes without authorization.

Public Health Activities: We may share information for:

- Preventing disease spread

- Product recalls

- Adverse reaction reporting

- Abuse or neglect reporting

- Preventing serious threats to health/safety

F. Business Associates

We may share information with business associates who help us operate our practice (like our electronic health record vendor). All business associates are contractually obligated to protect your information and must comply with HIPAA regulations.

G. Emergency Situations and Duty to Warn

Colorado law requires us to break confidentiality when:

- You present an imminent danger to yourself

- You make a serious threat toward others

- You demonstrate grave disability

- We suspect child or elder abuse

Emergency Protocols: If a crisis occurs during a virtual session, we will:

- Implement our emergency response protocol

- Contact your local emergency services if necessary

- Notify your emergency contact

- Direct you to emergency resources: https://forestpathpsychiatry.com/emergency-resources

SAFEGUARDS & SECURITY MEASURES

A. Technical Safeguards

Our virtual practice employs multiple layers of security:

- HiTrust-certified telehealth platform through TherapyNotes

- End-to-end encryption for all communications

- Secure electronic prescribing system

- Protected electronic health records

- Multi-factor authentication

- Continuous system monitoring

- Regular security updates

B. Administrative Controls

We maintain strict administrative controls:

- Regular staff training on privacy and security

- Access controls based on job role

- Regular compliance audits

- Incident response procedures

- Business Associate Agreements with vendors

- Documentation of all privacy practices

- Regular policy and procedure reviews

C. Risk Management

Our comprehensive risk management program includes:

- Regular security risk assessments

- Vulnerability testing and monitoring

- Privacy impact assessments

- Security incident tracking

- Policy effectiveness reviews

- Staff compliance monitoring

- Technology assessment updates

D. Documentation & Audit Trails

We maintain detailed records of:

- All access to patient information

- Changes to health records

- Information disclosures

- Security incidents

- Staff training

- Policy updates

- System maintenance

E. Breach Notification Procedures

In the event of a breach of unsecured protected health information, we will:

- Notify affected individuals within 60 days

- Provide detailed information about the breach

- Explain steps taken to protect information

- Outline steps to prevent future breaches

- Provide steps individuals can take for protection

- Include contact information for questions

- Notify HHS and media if required by law

F. Patient Responsibilities

SAFEGUARDS & SECURITY MEASURES

To maintain security in our virtual practice:

- Use only secure, private internet connections

- Ensure privacy during virtual sessions

- Keep portal login credentials confidential

- Report any privacy concerns promptly

- Update emergency contact information

- Inform us of any unauthorized disclosures

ADDITIONAL INFORMATION

Changes to This Notice:

We reserve the right to change this notice. Any changes will apply to information we already have and information we receive in the future. We will post the current notice on our website and patient portal. If we make significant changes, we will provide the updated notice at your next visit and through our patient portal.

Filing Complaints:

If you believe your privacy rights have been violated, you may file a complaint with:

1. Our Privacy Counsel:

Holly Werstein, RN, MSN, MBA, APRN, PMHNP-BC

Forest Path Psychiatry & Healing

[Contact through your secure TherapyNotes patient portal]

2. U.S. Department of Health and Human Services

Office for Civil Rights

1961 Stout Street, Room 08-148

Denver, CO 80294

1-877-696-6775

www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.

For More Information:

- Visit our website: www.ForestPathPsychiatry.com

- Message through the patient portal: https://www.therapyportal.com/p/forestpathpsychiatry

- Review our emergency resources: https://forestpathpsychiatry.com/emergency-resources

ACKNOWLEDGMENT

By accessing our services, you acknowledge receipt of this Notice of Privacy Practices. A copy is available through our secure portal at any time.

This notice is effective October 1st, 2024.

END OF NOTICE