Privacy Policy

NOTICE OF PRIVACY PRACTICES

Effective Date: June 24, 2026 | Version 3

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE, PLEASE CONTACT OUR OFFICE AT (407) 477-4060 OR [email protected].

Protecting the privacy and confidentiality of your protected health information is important to the providers and staff at Inlight Psychiatry PLLC (d/b/a Inlight Psychiatry & Therapy). Every member of our team is required by law to maintain the privacy of protected health information and must abide by our commitment to privacy in handling protected health information and is informed about the importance of privacy. Our Notice of Privacy Practices applies to the Protected Health Information (PHI) of all patients that is in our possession and control.

Identifying Purposes

We collect and maintain protected health information to establish a treatment relationship and to provide you with mental health services. We obtain most information about you directly from you, or from a referring provider whom you have authorized to share information with us.

You have the right to determine how your PHI is used and disclosed beyond the purposes described in this Notice. Where your written authorization is required, we will obtain it before using or disclosing your information for that purpose. You may revoke any authorization you have provided at any time in writing, subject to the limitations described in Section B of this Notice.

With the exception of substance use disorder records (described below), applicable law permits certain uses and disclosures of your PHI without your written authorization, including for treatment, payment, and health care operations, as described in Section A of this Notice. In limited circumstances, a healthcare provider may be required or permitted by law to use or disclose PHI notwithstanding a restriction or directive you have in place, including in emergency situations or where strict adherence to such a directive would delay necessary care.

A. Permitted Disclosures of PHI

We may disclose your PHI for the following reasons:

Treatment: We may disclose your PHI to a physician or other healthcare provider providing treatment to you. For example, we may disclose medical/mental health information about you to physicians, nurses, technicians, or personnel who are involved with the administration of your care.

Payment: We may disclose your PHI to bill any insurance company or Medicare or its administrators any information needed to process and pay your claims and collect payment for the services we provide to you. For example, we may send a bill to you or to a third-party payer for the rendering of services by us. The bill may contain information that identifies you, your diagnosis, and procedures and supplies used. We may need to disclose this information to insurance companies to establish insurance eligibility benefits for you. We may also provide your PHI to our business associates, such as billing companies, claims processing companies, and others that process our healthcare claims.

Health Care Operations: We may disclose your PHI in connection with our healthcare operations. Health Care Operations include quality assessment activities, reviewing the competence or qualifications of healthcare professionals, evaluating provider performance, and other business operations. We may also provide your PHI to accountants, attorneys, consultants, and others to make sure we comply with the laws that govern us.

Communications: We may call your cell phone, home phone, or email or text, and leave messages on voicemail or in person regarding any items that assist the Practice in carrying out its Health Care Operations, such as appointment reminders, insurance items, and any calls pertaining to your clinical care, including laboratory test results. We may mail to your home or other location designated by you any items that assist the Practice in carrying out Health Care Operations. We may email you to the email address you provided us with for our records. We may email any items that assist the practice in carrying out our Health Care Operations, such as appointment reminders, telehealth links, patient statements, and informational items. Our email system uses reasonable safeguards designed to protect your information. If you email us your protected health information, you understand that your email system may not be HIPAA compliant. Otherwise, if you need to send us protected health information, we encourage you to use our secure electronic patient portal, or call us directly.

Artificial Intelligence Tools: We use artificial intelligence tools to support both administrative and clinical documentation functions. These uses may include insurance eligibility verification, claims processing, prior authorization requests, rewriting or reformatting clinical notes for clarity and completeness, and analysis of clinical documents for administrative or operational purposes. These tools do not record, listen to, or analyze the content of your clinical sessions in real time. All AI tools are bound by Business Associate Agreements in compliance with HIPAA and access your protected health information only as necessary to carry out treatment, payment, and health care operations functions. Your information is not used to train AI models or shared for marketing purposes. For information about the AI scribing tool used during appointments, which requires separate written consent, please refer to the AI Scribe Consent Form included in your intake packet.

Patient Portal and Telehealth: We may set up a secure electronic patient portal for you to use to access and view data of your appointments with us, results of diagnostic tests, vital signs taken during your visits with us, prescriptions ordered for you, and communications with us. We have made every effort to provide a secure patient portal; however, security may be compromised due to events beyond our control. If we discover the security of our patient portal has been compromised, we will notify you if the security breach involves your records maintained on our patient portal. We may provide services to you via secure electronic two-way audio and video communications (telehealth platform). We have made every effort to provide a secure telehealth platform; however, security may be compromised due to events beyond our control. If we discover the security of our telehealth platform has been compromised, we will notify you if the security breach involves you. We may send information to you including appointment reminders, care coordination to help manage your health, referrals to specialists, or general information about the practice via US mail, email, text message, cell phone, home phone, or other methods of communication. We make every effort to send information securely; however, security may be compromised due to events beyond our control. If we discover security has been compromised, we will notify you if the security breach involves your protected health information.

Emergency Treatment: We may disclose your PHI if you require emergency treatment or are unable to communicate with us.

Family and Friends: We may disclose your PHI to a family member, friend, or any other person who you identify as being involved with your care or payment for care, unless you object.

Required by Law: We may disclose your PHI for law enforcement purposes and as required by state or federal law. We will inform you or your representative if we disclose your PHI because we believe you are a victim of abuse, neglect, or domestic violence, unless we determine that informing you or your representative would place you at risk. In addition, we must provide PHI to comply with an order in a legal or administrative proceeding. Finally, we may be required to provide PHI in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made, by us or the requesting party, to contact you about the request or to obtain an order to protect the requested PHI.

Serious Threat to Health or Safety: We may disclose your PHI if we believe it is necessary to avoid a serious threat to the health and safety of you or the public.

Public Health: We may disclose your PHI to public health or other authorities charged with preventing or controlling disease, injury, or disability, or charged with collecting public health data.

Health Oversight Activities: We may disclose your PHI to a health oversight agency for activities authorized by law.

Workers’ Compensation: We may disclose your PHI to comply with laws relating to workers’ compensation or other similar programs.

Specialized Government Activities: If you are active military or a veteran, we may disclose your PHI as required by military command authorities. We may also be required to disclose PHI to authorized federal officials for the conduct of intelligence or other national security activities.

Coroners, Medical Examiners, Funeral Directors: We may disclose your PHI to coroners or medical examiners for the purposes of identifying a deceased person or determining the cause of death, and to funeral directors as necessary to carry out their duties.

B. Disclosures Requiring Written Authorization

Not Otherwise Permitted: In any other situation not described in Section A above, we may not disclose your PHI without your written authorization.

Psychotherapy Notes: For purposes of this Notice, “psychotherapy notes” refers specifically to notes recorded by a mental health professional that document or analyze the contents of a counseling session and that are kept separate from the rest of your medical record. Psychotherapy notes do not include medication prescriptions or monitoring records, session start and stop times, the modalities and frequencies of treatment, clinical test results, or any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress to date. These latter categories constitute standard treatment and progress notes and may be used and disclosed for treatment, payment, and health care operations purposes without your written authorization. Psychotherapy notes as defined above require your written authorization except where HIPAA expressly permits or requires disclosure. They may be used or disclosed without your authorization only in the following limited situations: use by the treating provider who originated the notes for purposes of your ongoing treatment; use in training programs to provide clinical supervision; use by us to defend against a legal action or proceeding initiated by you; oversight of the treating provider by a health oversight agency; and as otherwise required by law.

Marketing and Sale of PHI: We must receive your written authorization for any disclosure of PHI for marketing purposes or for any disclosure which is a sale of PHI.

C. Your Rights

Right to Receive a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice upon request.

Right to Access PHI: You have the right to inspect and copy your PHI for as long as we maintain your medical record. You must make a written request for access to the Privacy Officer at the address listed at the end of this Notice. We may charge you a reasonable fee for the processing of your request and the copying of your medical record pursuant to Chapter 456, Florida Statutes. In certain circumstances, we may deny your request to access your PHI, and you may request that we reconsider our denial. Depending on the reason for the denial, another licensed health care professional chosen by us may review your request and the denial.

Right to Request Restrictions: You have the right to request a restriction on the use or disclosure of your PHI for the purpose of treatment, payment, or health care operations, or to restrict information we share with a family member or friend involved in your care or payment. In most cases, we are not legally required to agree to such a restriction. However, we are required by law to honor a restriction request if: (1) the disclosure would be to a health plan for purposes of payment or health care operations; and (2) the PHI pertains to a health care item or service for which you, or someone on your behalf, paid us in full out of pocket. If you request such a restriction and it qualifies under these criteria, we will comply and will not disclose that information to your health plan.

Right to Request Amendment: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. You must make your request in writing to the Privacy Officer and provide a reason for the amendment. We may deny your request if we did not create the information you wish to amend or if we believe the information is accurate and complete.

Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI made by us in the past six years, except for disclosures made for treatment, payment, health care operations, or certain other purposes. Your request must be in writing to the Privacy Officer.

Right to Request Confidential Communications: You have the right to request that we communicate with you in a certain way or at a certain location if you feel that your confidentiality may be compromised.

Right to Notification of a Breach: You have the right to receive notification in the event that your unsecured protected health information is subject to a breach. In the event we discover that a breach of your unsecured PHI has occurred, we are required by law to notify you without unreasonable delay and in no case later than 60 days following the discovery of the breach. Notification will be provided to you in writing at the last address we have on file for you, or by alternative means if necessary.

Right to Receive an Electronic Copy of PHI: If your protected health information is maintained in an electronic health record, you have the right to request and receive an electronic copy of that information in the format you request, to the extent that such format is readily producible. If we are unable to provide the information in your requested format, we will provide it in an alternative readable electronic format. You may also request that we transmit a copy of your PHI directly to a third party you designate, provided your request is in writing, signed by you, and clearly identifies the designated recipient.

Right to Revoke Authorization: You have the right to revoke a written authorization at any time, provided that the revocation is submitted to us in writing. A revocation will not apply to any uses or disclosures already made by us in reliance on your prior authorization before we received notice of your revocation. To revoke an authorization, you must submit your written request to the Privacy Officer at [email protected] or 4700 Millenia Blvd Suite 175, Orlando, FL 32839.

D. Patient Responsibilities

Provide Accurate Information: It is your responsibility to provide accurate and complete information about your health, including your medical history and current health condition. This helps us provide you with appropriate and effective care.

Notify Us of Changes: You are responsible for notifying us of any changes in your personal and contact information, including your address, phone number, and insurance information.

Follow Treatment Plans: You are responsible for following the treatment plans and instructions provided by our healthcare providers.

E. Filing a Complaint

If you believe your privacy rights have been violated or if you have any concerns about our privacy practices, you may file a complaint with us or with the Secretary of Health and Human Services. Complaints filed with the Office for Civil Rights must generally be filed within 180 days of when you knew or reasonably should have known of the act or omission that is the subject of your complaint. Filing a complaint will not affect your ability to receive care from us.

To File a Complaint with Us: Contact our Privacy Officer at (407) 477-4060 or [email protected]. We will investigate your compalaint and respond promptly.

To File a Complaint with the Secretary of Health and Human Services: You may send your complaint to the Office for Civil Rights, U.S. Department of Health and Human Services, at 200 Independence Avenue, S.W., Washington, D.C. 20201. The website for filing complaints online is https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.

You will not be retaliated against for filing a complaint.

F. Retention of PHI

In accordance with Rule 64B8-10.002(3), FAC, a licensed physician shall keep adequate written medical records for a period of at least five years from the last patient contact. However, medical malpractice law requires that records must be kept for at least seven years.

In accordance with Chapter 491, Florida Statutes, licensed mental health counselors, marriage and family therapists, and clinical social workers are required to maintain treatment records for a period of no less than seven years from the date of the last entry.

G. Business Associate Agreement

Our business associates, who perform services on our behalf, are also required to adhere to the same privacy and security rules that apply to our practice. We maintain written agreements with our business associates to ensure they comply with HIPAA regulations and safeguard your PHI.

42 C.F.R. Part 2 — Confidentiality of Substance Use Disorder Records

To the extent that Inlight Psychiatry & Therapy receives or maintains records relating to substance use disorder treatment that are subject to 42 C.F.R. Part 2, such records are afforded confidentiality protections beyond those required under HIPAA and may not be used or disclosed except as expressly permitted by applicable federal law.

Inlight Psychiatry & Therapy may use and disclose Part 2-protected records only in accordance with the requirements of 42 C.F.R. Part 2, as amended, including pursuant to a valid written patient consent authorizing disclosure for treatment, payment, and health care operations purposes. Where a HIPAA-covered entity or business associate receives Part 2-protected records pursuant to such a consent, that entity may further use or disclose those records to the extent permitted by HIPAA; provided, however, that notwithstanding any such further disclosure, Part 2-protected records — and any information derived therefrom — may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding conducted against the patient without either: (i) the patient’s prior written consent; or (ii) a court order and accompanying subpoena, or other similar legal mandate, satisfying the requirements of 42 C.F.R. Part 2.

Nothing in this Notice shall be construed to limit the confidentiality protections afforded to substance use disorder treatment records under 42 C.F.R. Part 2 or any other applicable federal or state law.

Authorization to Disclose Substance Use Disorder Records for Treatment, Payment and Health Care Operations

Unlike other PHI, records relating to substance use disorder treatment cannot be disclosed for treatment, payment, or health care operations without the patient’s express authorization. By signing this Notice of Privacy Practices you, the patient, authorize Inlight Psychiatry & Therapy to disclose records (if any) of your substance use disorder treatment for the limited purposes of Treatment, Payment, and Health Care Operations as described in Section A, above.

You may revoke this authorization to disclose substance use disorder records at any time, except to the extent that action has been taken in reliance on it, including all activities occurring after the revocation that relate to claims for payment that had been initiated while this authorization was in effect. Unless you revoke this authorization, it will expire one hundred twenty (120) days after you are discharged as a patient of Inlight Psychiatry & Therapy.

Changes to This Notice

We may change the terms of this Notice at any time. The most current version will always be available on our website at https://inlightpsychiatry.com. The revised Notice will apply to all PHI we maintain, including records created prior to the revision.

We are required by law to maintain the privacy of, and provide individuals with, this notice of our legal duties and privacy practices with respect to protected health information. We are also required to abide by the terms of the notice currently in effect. If you have any questions in reference to this form, please ask to speak with our Practice Administrator by email or phone at our main phone number.

WEBSITE PRIVACY POLICY

Effective Date: October 1, 2024

1. Information We Collect

We collect personal and non-personal information when you interact with our website (www.inlightpsychiatry.com), including:

• Personal Information: Name, phone number, email address, and other details voluntarily submitted via contact forms or appointment requests.
• Usage Data: IP address, browser type, and activity on our site, collected via cookies and analytics tools.

If you submit health-related information through our website, it will be protected under HIPAA regulations.

2. Use of Information

We use the information collected for:

• Managing appointments and responding to inquiries
• Improving website functionality and user experience
• Sending updates, reminders, and service-related communications
• Complying with legal and regulatory requirements

We DO NOT sell, trade, or share your personal information with third parties, except as required for HIPAA-compliant services.

3. HIPAA & Security Measures

We implement industry-standard security practices, including:

• Secure Sockets Layer (SSL) encryption to protect data transmission
• HIPAA-compliant email and messaging systems
• Access controls and authentication measures

However, no method of transmission over the Internet is 100% secure. If you prefer not to submit PHI online, please contact us by phone.

4. Use of Cookies & Third-Party Tracking

We use cookies to enhance your browsing experience. You can disable cookies in your browser settings.

If we use third-party services (e.g., Google Analytics), we ensure that PHI is not improperly tracked or shared.

5. Third-Party Links

Our website may link to third-party sites. We are not responsible for their privacy practices. Please review their policies before submitting personal information.

6. Changes to This Policy

We may update this policy periodically. Changes take effect when posted on this page.

7. Contact Information

For privacy concerns or questions, contact:

Mailing address: 4700 Millenia Blvd Suite 175 Orlando FL 32839
Email: [email protected]
Phone: 407-477-4060