Therapy Aligned, LLC · New Jersey

Notice of Privacy Practices

Notice to Patients · HIPAA & 42 CFR Part 2 · Effective: 2026-06-18 · Version 1.0

Notice of Privacy Practices of Therapy Aligned LLC

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to all health information created or maintained by Therapy Aligned LLC ("Therapy Aligned," "we," "us," or "our"). It explains your rights and our legal duties under the Health Insurance Portability and Accountability Act (HIPAA, 45 CFR Parts 160 and 164) and — because we provide substance use disorder (SUD) treatment — under the federal confidentiality regulations at 42 CFR Part 2.

Special Protection for Substance Use Disorder (SUD) Records — 42 CFR Part 2

Records that would identify you as someone who has applied for or received substance use disorder diagnosis, treatment, or referral for treatment are protected by special federal rules at 42 CFR Part 2, which in many cases are more protective than HIPAA.

We will not disclose your SUD records without your specific written consent, except in the limited circumstances permitted by Part 2 (for example, a bona fide medical emergency, a qualifying court order, scientific research, audit/evaluation, or a crime on our premises or against our staff).

A general HIPAA authorization does not satisfy Part 2. We will obtain a separate written consent that meets 42 CFR § 2.31 before disclosing your SUD records.

A single written consent may authorize all of your future uses and disclosures for treatment, payment, and health care operations (TPO), and may name recipients by a general designation — for example, "my treating providers, health plans, third-party payers, and the people who help operate this practice." You do not have to sign a new consent for each disclosure.

Your SUD records may not be used or disclosed to investigate or prosecute you in any federal, state, or local civil, criminal, administrative, or legislative proceeding without your specific written consent or a court order issued under 42 CFR §§ 2.64–2.65. A subpoena, warrant, or discovery request, by itself, is not enough.

Once a HIPAA covered entity or business associate receives your SUD records based on your consent for treatment, payment, or health care operations, that recipient may further use or disclose those records as permitted by the HIPAA Privacy Rule.

If you authorize disclosures through an intermediary or a general (TPO) designation, you have the right to obtain a list of entities to which your information has been disclosed (see Your Rights).

How We May Use and Disclose Your Health Information Without Your Authorization

Subject to the special SUD protections above, we may use and disclose your health information for the following purposes without a separate authorization:

Treatment. To provide, coordinate, or manage your care — for example, consulting with another provider treating you, or coordinating a referral. Example of a use that DOES require your written consent: disclosing your SUD records to an outside provider, a family member, your employer, a school, or a court.

Payment. To bill and obtain payment from you, a health plan, or another payer — for example, sharing a diagnosis, dates of service, and treatment summary to obtain reimbursement.

Health Care Operations. For quality review, clinical supervision, training, business management, and similar operations.

Where New Jersey law or 42 CFR Part 2 imposes a more stringent restriction than HIPAA, we follow the more protective rule.

Uses and Disclosures That Require Your Written Consent or Authorization

• Disclosure of SUD records protected by 42 CFR Part 2 (a § 2.31 consent).
• Psychotherapy notes and any separately maintained SUD counseling notes.
• Marketing, and any sale of your information.
• Most other uses and disclosures not described in this Notice. Except as described in this Notice, we will not use or disclose your health information without your written consent or authorization, which you may revoke at any time.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose health information without your authorization when required or permitted by law, subject to the heightened Part 2 protections for SUD records:

• When required by law, and for certain public-health activities and health-oversight audits.
• To report suspected abuse, neglect, or domestic violence, and to prevent a serious and imminent threat to health or safety.
• In response to a court proceeding. For SUD records protected by 42 CFR Part 2, a subpoena, warrant, or discovery request alone is not sufficient; we may disclose only pursuant to a court order that satisfies Part 2 (§§ 2.61–2.67), and only as that order allows.
• To coroners/medical examiners, for workers' compensation, and to certain government functions, as permitted by law and consistent with Part 2.

Fundraising

We do not use or disclose your information for fundraising.

Your Rights

You have the right to:

• Inspect and copy your health information (a reasonable, cost-based fee may apply for copies).
• Request an amendment of information you believe is incorrect or incomplete.
• Request an accounting of disclosures. You may request a list of certain disclosures of your records made during the three years before your request, including disclosures made electronically.
• Request a list of disclosures made by an intermediary. If your records are disclosed through an intermediary, you may request a list of entities to which the intermediary disclosed your information within the past three years.
• Request restrictions on how we use or disclose your information.
• Restrict disclosure of self-paid services. You may request that we not disclose information to your health plan about a service you paid for in full out of pocket, and we will honor that request except as required by law.
• Request confidential communications by alternative means or at an alternative location.
• Revoke your consent or authorization in writing at any time, except to the extent we have already acted in reliance on it.
• Obtain a paper or electronic copy of this Notice at any time, including from our website.

Our Duties

We are required by law to maintain the privacy and security of your protected health information, including your SUD records.

Breach notification. We will notify you following a breach of unsecured protected health information as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D), which applies to records protected under 42 CFR Part 2.

We are required to abide by the terms of the Notice currently in effect.

We reserve the right to change our privacy practices and the terms of this Notice and to make the revised terms effective for all records we maintain. If we make a material change, we will post the revised Notice on our website and make it available on request.

When we use or disclose your information, we limit it to the minimum necessary to accomplish the purpose, except where that standard does not apply (such as for treatment).

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer (below) or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), 200 Independence Avenue SW, Washington, DC 20201; 1-877-696-6775; www.hhs.gov/ocr/privacy/hipaa/complaints. You will not be penalized or retaliated against for filing a complaint.

Contact — Privacy Officer

Contact the Privacy Officer to ask questions about this Notice, request a copy, or exercise any of your rights.

Effective Date: June 18, 2026. This Notice supersedes any prior Notice of Privacy Practices.