1.Introduction

Welcome to Teen and Family Services. We are committed to protecting the privacy and security of your personal information and protected health information (PHI). This Privacy Policy applies to:

• Visitors to our website at www.tafs.org;
• Individuals who contact us through the website, email, phone, or other means; and
• Clients who receive therapy, counseling, or related mental health services from us (collectively, "Clients").

By using our website or receiving our services, you acknowledge that you have read and understood this Privacy Policy. For Clients, this document also constitutes our HIPAA Notice of Privacy Practices.

2.Information We Collect

2.1 Information Collected from Website Visitors

When you visit our website, we may collect:

• Automatically Collected Information: IP address, browser type, device information, pages visited, time spent on pages, referring website, and general location data through cookies and similar technologies.
• Information You Provide: Name, email address, phone number, and any message content when you fill out contact forms, request appointments, subscribe to newsletters, or communicate with us.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance your experience, analyze site traffic, and improve our services. You may control cookie settings through your browser.

2.2 Protected Health Information (PHI) — Therapy Clients

If you become a Client and receive therapy or counseling services, we collect and maintain Protected Health Information (PHI) as defined under HIPAA. PHI may include:

• Name, date of birth, address, phone number, email address, and other demographic information;
• Insurance information, payment details, and billing records;
• Medical and mental health history, diagnoses, treatment plans, and clinical notes;
• Session notes, progress notes, and psychotherapy notes (where applicable);
• Communications related to your care (emails, portal messages, etc.); and
• Any other information that relates to your physical or mental health condition, the provision of health care, or payment for health care.

3.How We Use Your Information

3.1 Website and General Communications

We use information collected from website visitors to:

• Respond to your inquiries and appointment requests;
• Operate, maintain, and improve our website;
• Send administrative or service-related communications;
• Comply with legal obligations and protect our rights.

3.2 Use of PHI for Treatment, Payment, and Health Care Operations

Under HIPAA, we may use and disclose your PHI without your written authorization for the following purposes:

4.Disclosures of Your Protected Health Information

We may disclose your PHI in the following circumstances without your authorization, as permitted or required by law:

• Required by Law: When federal, state, or local law requires disclosure.
• Public Health Activities: To public health authorities for purposes such as preventing or controlling disease.
• Abuse, Neglect, or Domestic Violence: To appropriate government authorities when we reasonably believe a client is a victim of abuse, neglect, or domestic violence.
• Health Oversight Activities: To health oversight agencies for audits, investigations, or inspections.
• Judicial and Administrative Proceedings: In response to a court order, subpoena, or other lawful process.
• Law Enforcement: For certain law enforcement purposes as permitted by HIPAA.
• Serious Threat to Health or Safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Workers' Compensation: As authorized by and to the extent necessary to comply with workers' compensation laws.
• Business Associates: To third parties who perform services on our behalf (e.g., billing companies, EHR providers, IT support) under a Business Associate Agreement that requires them to protect your PHI.

5.Your Rights Regarding Your PHI

As a Client, you have the following rights under HIPAA:

1. Right to Access: You may request to inspect or obtain a copy of your PHI (with certain limited exceptions, such as psychotherapy notes in some cases). We will respond within 30 days.
2. Right to Request Amendment: You may request that we amend your PHI if you believe it is incorrect or incomplete. We may deny the request in certain circumstances and will notify you of the reason.
3. Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made by us for purposes other than treatment, payment, or health care operations.
4. Right to Request Restrictions: You may request restrictions on certain uses or disclosures of your PHI. We are not required to agree to all requests, except in limited situations involving disclosures to health plans for services you paid for out-of-pocket in full.
5. Right to Request Confidential Communications: You may request that we communicate with you about your health information by alternative means or at alternative locations (e.g., only by email or only at a certain address).
6. Right to a Paper Copy of This Notice: You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.
7. Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

6.Security of Your Information

We implement appropriate administrative, physical, and technical safeguards to protect your personal information and PHI in accordance with HIPAA Security Rule requirements. These measures include, but are not limited to:

• Encryption of data in transit and at rest where appropriate;
• Access controls and unique user authentication;
• Secure electronic health record (EHR) systems;
• Regular risk assessments and workforce training; and
• Business Associate Agreements with vendors who handle PHI.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7.Telehealth and Electronic Communications

If you receive therapy services via telehealth (video or phone), we use HIPAA-compliant platforms. Communications via email or text messaging may not always be fully secure. By choosing to communicate electronically, you acknowledge and accept the associated risks. We recommend using our secure client portal when available for sensitive communications.

8.Children's Privacy

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 through the website. For therapy services provided to minors, we comply with applicable state and federal laws regarding parental consent and access to records. Parents or legal guardians generally have rights to access their minor child's PHI, subject to certain exceptions under state law and HIPAA.

9.Third-Party Websites and Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

10.Changes to This Privacy Policy

We reserve the right to revise this Privacy Policy and Notice of Privacy Practices at any time. Material changes will be posted on our website with an updated effective date. For Clients, we will provide notice of material changes as required by HIPAA. Your continued use of our website or services after changes become effective constitutes acceptance of the revised policy.

11.Contact Us / Privacy Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or need to file a complaint, please contact our Privacy Officer:

12.How to File a Complaint with the Government

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

Online: hhs.gov/hipaa/filing-a-complaint

13.Acknowledgment

By receiving services from us or using our website, you acknowledge that you have been provided with this Privacy Policy and Notice of Privacy Practices and have had the opportunity to ask questions about it.