HIPAA Notice of Privacy Practices

1. Our Commitment to Your Privacy

Elevate Autism ABA Center LLC ("Elevate," "we," "us," or "our") is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and applicable Virginia law to:

• Maintain the privacy and security of your Protected Health Information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Notify you of any breach of unsecured PHI
• Follow the terms of this Notice

2. How We May Use and Disclose Your PHI

We may use and disclose your or your child's PHI for the following purposes without your specific written authorization:

2.1 Treatment

To provide, coordinate, or manage your ABA therapy services. For example, BCBAs, BCaBAs, and RBTs involved in your child's care may share information to develop treatment plans and monitor progress.

2.2 Payment

To bill insurance, obtain prior authorizations, verify eligibility, and collect payment for services rendered.

2.3 Healthcare Operations

For activities such as quality improvement, staff training, supervision, licensing audits, accreditation reviews, and business planning.

2.4 Required by Law

We will disclose PHI when required by federal, state, or local law, including but not limited to:

• Reporting suspected child abuse or neglect (mandatory reporter obligations)
• Responding to court orders, subpoenas, or law enforcement requests
• Public health reporting (e.g., communicable disease)
• Health oversight activities (DBHDS, Board of Medicine, DMAS)

2.5 To Avert Serious Threat

To prevent a serious threat to the health or safety of you, your child, or others.

3. Uses and Disclosures Requiring Your Authorization

For any uses or disclosures not described above, we will obtain your written authorization. This includes:

• Marketing communications
• Sale of PHI
• Most uses or disclosures of psychotherapy notes
• Disclosures to schools, employers, or third parties not involved in treatment

You may revoke any authorization in writing at any time, except to the extent we have already acted on it.

4. Your Rights Regarding Your PHI

4.1 Right to Access and Copy

You may request to inspect or obtain a copy of your or your child's PHI. We will provide access within 30 days and may charge a reasonable cost-based fee for copying.

4.2 Right to Request Amendment

If you believe PHI we maintain is incorrect or incomplete, you may request an amendment in writing.

4.3 Right to an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made in the last 6 years, excluding disclosures for treatment, payment, and operations.

4.4 Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your PHI. We will consider but are not required to agree to all restrictions, except we must agree to restrict disclosures to a health plan for services you pay for entirely out-of-pocket.

4.5 Right to Confidential Communications

You may request that we communicate with you in specific ways (e.g., only by mail, only at a certain phone number). Reasonable requests will be accommodated.

4.6 Right to Paper Copy

You have the right to a paper copy of this Notice upon request, even if you received it electronically.

4.7 Right to be Notified of a Breach

If a breach of unsecured PHI occurs, we will notify you as required by the HIPAA Breach Notification Rule.

5. Special Situations for Minors

In general, parents or legal guardians have rights over PHI of children under 18. Exceptions may apply under Virginia law for certain services (e.g., mental health services for minors in specific circumstances). We will follow applicable law regarding minor consent and parental access.

6. Our Safeguards

We implement administrative, physical, and technical safeguards to protect PHI, including:

• Encrypted electronic health record systems
• HIPAA-compliant practice management and communication platforms
• Signed Business Associate Agreements (BAAs) with all vendors handling PHI
• Role-based access controls and audit logs
• Regular staff HIPAA training
• Secure physical storage for any paper records
• Data backup and disaster recovery procedures

7. How to Exercise Your Rights or File a Complaint

To exercise any rights under this Notice, or if you believe your privacy rights have been violated, contact our Privacy Officer:

Privacy Officer
Elevate Autism ABA Center LLC
Fairfax, Virginia 22030
Phone: (571) 351-7529
Email: info@elevateautismaba.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

HHS Office for Civil Rights
200 Independence Avenue, SW
Washington, DC 20201
Phone: 1-800-368-1019 (TDD: 1-800-537-7697)
Website: www.hhs.gov/ocr

We will not retaliate against you for filing a complaint.

8. Changes to This Notice

We reserve the right to change this Notice at any time. Changes will apply to all PHI we maintain. Updated Notices will be posted on our website and available at our office. Clients will be provided a copy of the current Notice at intake and may request a copy at any time.

9. Secure Communication

For secure communication regarding PHI, please:

• Do not send sensitive medical information through our website contact form or unencrypted email
• Call us at (571) 351-7529 to discuss clinical matters
• Use our secure client portal (once established) for ongoing communication
• Request secure document transfer via our HIPAA-compliant system

10. Acknowledgment

At intake, clients or their legal guardians will be asked to sign an acknowledgment that they have received this Notice of Privacy Practices, as required by HIPAA.