Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to health information created, received, or maintained by Amaze Behavior Consultants, LLC ("Amaze") in providing applied behavior analysis (ABA) and related healthcare services. It applies to our workforce and authorized service locations. It is intended for clients and their legally authorized representatives, not as an employee-personnel privacy notice.

1. Your Privacy Rights

You or your legally authorized personal representative may exercise the following rights, subject to applicable federal and California law. Some information relating to care a minor may independently consent to has additional protections.

Access, inspect, and obtain a copy

You may request to inspect or obtain paper or electronic copies of health and billing records used to make decisions about your care. We will respond within the deadlines required by applicable law and may charge only legally permitted, reasonable fees. California law may provide shorter inspection or copy timelines than HIPAA in some circumstances. Contact our privacy officer to submit a request or discuss an accessible format.

Request correction or amendment

You may ask us to correct information you believe is incomplete or incorrect. If we deny a request, we will explain the reason in writing and tell you about your rights to submit a disagreement, as required by law.

Request confidential communications

You may ask us to contact you in a particular way or at a different address or telephone number. We will accommodate reasonable requests as required by law.

Request limits on certain uses or disclosures

You may ask us to restrict sharing for treatment, payment, or healthcare operations or disclosures to people involved in your care. We are not generally required to agree, but we must honor qualifying requests to restrict disclosure to a health plan for payment or operations when the applicable service has been paid in full out of pocket and other conditions are met, unless disclosure is required by law.

Receive an accounting of disclosures

You may request a list of certain disclosures of your protected health information for up to six years before the request, subject to legal exclusions. We will explain any fee permitted for repeated requests before preparing the accounting.

Receive this notice and choose a representative

You may receive a paper copy of this notice on request even if you agreed to receive it electronically. A personal representative with legal authority may exercise your rights; we may ask for documentation of that authority. California protections for certain minor-consented services still apply.

Complain without retaliation

You may complain to Amaze or to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), if you believe your privacy rights were violated. Amaze will not retaliate against you or reduce the quality of care because you made a complaint. Contact details appear below.

2. Your Choices

For some disclosures, you may tell us your preferences, including whether to share relevant information with family members, friends, or others involved in your care or payment for care. If you are unable to express a preference, we may share limited information when legally permitted and in your best interests. We may make permitted disaster-relief disclosures. We will comply with stricter confidentiality protections when they apply.

Other uses, such as most uses of psychotherapy notes, marketing communications for which authorization is required, and any sale of protected health information, generally require your prior written authorization. You may revoke an authorization in writing, except to the extent we have already relied on it or another legal exception applies. Optional clinical recording or promotional uses are addressed through separate consent or authorization when required.

3. How We Use and Disclose Health Information

We may use or disclose your protected health information when permitted or required by law. The examples below describe the kinds of information-sharing Amaze may perform; disclosures are limited by California law and any other more protective law.

Treatment

We may share relevant information with your treating clinicians, supervisors, or other providers involved in coordinating care. Example: a supervising BCBA reviews treatment goals and progress data with a member of your healthcare team.

Payment

We may share necessary information with health plans, payers, or authorized administrative partners to establish coverage, seek authorization, submit and review claims, or receive payment. Example: we provide dates of service and required treatment documentation to a health plan or its authorized administrator, including Catalight Care Services when applicable.

Healthcare operations

We may use or disclose information for lawful quality assurance, staff supervision and training, credentialing, audits, compliance, business administration, and improvements to clinical services. Example: authorized clinical leadership reviews records to evaluate treatment quality. Business associates must appropriately safeguard information under applicable agreements.

Business associates and third-party service providers

Amaze may use third-party companies and professionals, known as business associates, to support services such as electronic health records, ABA practice management software, scheduling, billing, secure data storage, information technology, and administrative or professional services. These service providers may create, receive, maintain, or transmit protected health information on our behalf only as permitted by law and as needed to perform their contracted functions.

When required by HIPAA, Amaze enters into written Business Associate Agreements requiring these providers to safeguard protected health information, limit its use and disclosure, and report unauthorized uses, disclosures, or breaches as required. Some vendors that provide services without handling protected health information are not business associates. Amaze remains responsible for complying with applicable federal and California privacy requirements.

Other uses or disclosures permitted or required by law

• Public health and safety: report communicable diseases, adverse events, or serious threats when applicable legal conditions are met.

• Abuse, neglect, and mandated reporting: report suspected child abuse or neglect or other matters when California law requires or permits it.

• Health oversight: respond to authorized government audits, investigations, inspections, and compliance reviews.

• Legal proceedings and law enforcement: respond to valid legal processes only when and to the extent authorized or required by law; subpoenas do not automatically authorize every disclosure.

• Emergency or serious safety threat: share relevant information when needed to prevent or lessen a serious and imminent threat, as permitted by law.

• Workers’ compensation and other government functions: make legally authorized disclosures, including certain law enforcement, military, or national security functions.

• Deceased persons and donation: share limited information with coroners, medical examiners, funeral directors, or organ donation organizations when applicable.

• Research: use or disclose information for research only with the required authorization, waiver, or other legal basis.

• Appointment reminders and treatment alternatives: contact you about sessions or treatment-related options using permitted information.

Individuals involved in your care

We may share information relevant to a person’s involvement in your care or payment when permitted and consistent with your preferences, applicable representative authority, and legal protections. For children, we verify the authority of parents, guardians, and other individuals as appropriate.

4. Additional Protections for Certain Records

Some information may be subject to more protective federal or California rules, including certain mental-health information, minor-consented care, HIV-related information, and substance-use-disorder (SUD) treatment records. We will comply with those more restrictive requirements, which may require specific consent or impose other limits even when HIPAA otherwise permits disclosure.

Records protected by 42 CFR Part 2

If Amaze receives or maintains records protected under 42 CFR Part 2, we will follow the applicable Part 2 confidentiality and consent requirements. Records protected by Part 2, or testimony describing them, generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without the required written consent or a qualifying court order following notice and an opportunity to be heard. A court order must also be accompanied by the required subpoena or other legal mandate before use or disclosure. Additional rules apply if Amaze itself is a Part 2 program; this notice does not assume that it is.

5. Our Responsibilities

• Protect the privacy and security of protected health information and follow the terms of the notice currently in effect.

• Notify affected individuals following a reportable breach of unsecured protected health information, as required by law.

• Use and disclose health information only as described in this notice or otherwise permitted or required by law; obtain written authorization when required.

• Give you a copy of this notice, make it available on request, and post it on our website when required.

• Follow applicable California confidentiality protections and maintain appropriate arrangements with business associates.

We may change this notice and apply the revised terms to health information we already maintain as permitted by law. A revised notice will be available upon request, at applicable service sites, and on our website. Material changes will not be implemented before their required effective date.

6. Contact, Questions, and Privacy Complaints

You may submit a privacy concern or a request to exercise your rights using the contact information above. You may also contact the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr/complaints/ or 1-800-368-1019 (TTY: 1-800-537-7697). No retaliation is permitted for filing a complaint.