Notice of Privacy Practices

01About this notice

This notice applies to Sunshine Health, PLLC and all of our providers and staff, including our nurse practitioners, our peer support specialist and any students training with us. We are required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to notify you if a breach affects your unsecured health information.

In this notice, "health information" means information that identifies you and relates to your past, present or future physical or mental health, the care you receive, or payment for that care.

02How we use and share your information for care

We may use and share your health information without your written authorization for the following purposes.

Treatment

We use your information to evaluate, diagnose and treat you, and we may share it with other professionals involved in your care. Example: we may send a visit summary to the clinician who referred you, coordinate with your primary care provider, or send a prescription to your pharmacy.

Payment

We use and share information to bill and get paid for your care. Example: we share information with your health plan through our billing partner to confirm coverage and submit claims.

Health care operations

We use and share information to run our practice, improve care and train providers. Example: we may review records for quality purposes, and psychiatric nurse practitioner students may take part in your care under supervision, because Sunshine Health is a teaching practice.

Our business associates

We work with companies that help us provide care, such as our electronic health record and prescribing system, our telehealth platform, our billing and payment partners and our secure email provider. They may receive your information only to do work for us, and they must protect it under a written agreement.

Appointment reminders and care communication

We may contact you by phone, text or email about appointments, telehealth visit links, billing and your care. You can ask us to contact you in a different way (see "Your rights").

AI-assisted documentation

With your consent, our providers may use secure AI-assisted tools that use passive audio capture to draft clinical notes during your visit. Your provider reviews and approves every note, and audio is not retained unless we tell you otherwise. You can ask your provider not to use these tools.

03People involved in your care

Unless you object, we may share information with a family member, friend or other person you identify who is involved in your care or helps pay for it, limited to what is relevant to their involvement. If you are not present or cannot agree, for example in an emergency, we may use our professional judgment to share what is in your best interest. If you join a telehealth visit with someone else present, we may discuss your care in front of them as needed for treatment.

Minors: for patients under 18, we generally share information with a parent or legal guardian, except where Texas law allows a minor to consent to their own care or limits a parent's access.

04Other uses and disclosures we may make

The law allows or requires us to share information without your authorization in certain situations. We share only what is allowed or required.

• As required by law, including federal, state or local law.
• Public health and safety: to report certain diseases, reactions to medications or product problems, and to help prevent or reduce a serious threat to anyone's health or safety.
• Abuse, neglect or violence: to report suspected abuse or neglect of a child, an elderly person or a person with a disability, as Texas law requires.
• Health oversight: to agencies such as licensing boards for audits, investigations and inspections.
• Lawsuits and legal actions: in response to a court or administrative order, or to a subpoena when the law permits.
• Law enforcement: for limited purposes, such as responding to a court-ordered warrant or reporting certain crimes.
• Coroners, medical examiners and funeral directors, when an individual dies.
• Organ and tissue donation requests.
• Research, when approved through a process that protects your privacy.
• Specialized government functions, such as military, national security and protective services.
• Workers' compensation claims, as allowed by law.
• Prescription monitoring: our providers check the Texas Prescription Monitoring Program, and pharmacies report certain prescriptions to it, as Texas law requires.

05Uses that require your written permission

We will not do the following without your written authorization:

• Psychotherapy notes: most uses and disclosures of a provider's separate psychotherapy notes, if any are kept.
• Marketing: we do not use or share your information for marketing.
• Sale of information: we never sell your health information.

Any other use or disclosure not described in this notice requires your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it. We do not use your information for fundraising.

06Additional protections under Texas law

Texas law gives mental health information extra protection. Under Texas Health and Safety Code Chapter 611, records of mental health care are confidential and may be shared only as that law allows, which in some cases is more limited than HIPAA. When Texas law is more protective than HIPAA, we follow Texas law.

Notice of electronic disclosure: as required by Texas Health and Safety Code § 181.154, your health information may be disclosed electronically. We do so without separate authorization only for treatment, payment, health care operations or as otherwise authorized or required by law.

07Your rights

You have the following rights regarding your health information. To use any of them, contact our Privacy Officer (see "Contact us"). Some requests must be in writing; you can send them by fax, or call, text, or message us through our contact form and we will send you a secure request form.

Get a copy of your records

You can ask to see or get an electronic or paper copy of your medical and billing records. Because we keep electronic health records, Texas law requires us to provide an electronic copy within 15 business days of your written request. We may charge a reasonable, cost-based fee. In limited cases, such as when a provider believes access to certain mental health information could harm you, we may deny part of a request; you may ask for that decision to be reviewed.

Ask us to correct your records

You can ask us to correct information you believe is wrong or incomplete. We may say no, but we will tell you why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way, such as a certain phone number, or to send mail to a different address. We will agree to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain information for treatment, payment or operations. We are not required to agree, except: if you pay for a service in full out of pocket, you can ask us not to share information about it with your health plan, and we will agree unless the law requires us to share it.

Get a list of those we have shared information with

You can ask for a list of the times we shared your information in the six years before your request, who we shared it with and why. It will not include disclosures for treatment, payment or operations, or ones you authorized. We provide one list a year free of charge.

Get a copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.

Be notified of a breach

In the case a breach compromises your health information, we will notify you as soon as possible.

08Our responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing.

09Changes to this notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on our website, and we will provide a copy on request.

10Complaints

If you believe your privacy rights have been violated, you can file a complaint with us by contacting our Privacy Officer. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/complaints.

11Contact us

Effective date of this notice: November 4, 2026