SHIFT Your Journey ®Mental Health Counseling, PLLC

NOTICE OF PRIVACY PRACTICES

Effective Date: March 6, 2026  •  Version 2.0

Supersedes All Prior Versions

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

SHIFT Your Journey Mental Health Counseling, PLLC (“SHIFT Your Journey®,” “the Practice,” “we,” “us,” or “our”) is required by law to maintain the privacy and security of your Protected Health Information (“PHI”), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of this Notice currently in effect.

This Notice applies to all PHI created, received, maintained, or transmitted by SHIFT Your Journey® in connection with your mental health care. A copy is available at any time upon request or at www.shiftyourjourney.com.

Our intake and consent forms are administered through Jane App, a HIPAA-compliant practice management platform. Jane App operates under a Business Associate Agreement with this Practice, ensuring your PHI is handled in accordance with applicable law.

  I.  HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following describes how we may use or disclose your PHI without your written authorization. Where applicable, we note when 42 CFR Part 2, governing substance use disorder (SUD) records, imposes stricter protections than HIPAA.

  Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health care. For example, we may share relevant clinical information with another healthcare provider involved in your care — such as your primary care physician or psychiatrist — with your written consent or as otherwise permitted by law.

  Payment

We may use and disclose your PHI to obtain payment for services rendered. For example, we may provide your insurer with your diagnosis, treatment dates, and procedure codes to process a claim, verify coverage, or respond to a billing inquiry.

  Health Care Operations

We may use your PHI for internal operations, including quality improvement, staff supervision and training, compliance reviews, and general business management. For example, a clinical supervisor may review session documentation to support quality of care.

  As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law, including in response to a court order, subpoena, or lawful government request. We will assert all applicable legal privileges, including therapist-patient privilege, to the fullest extent permitted by law prior to complying with any such demand.

  To Avert a Serious Threat to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public, consistent with applicable law and ethical standards. This includes situations involving imminent risk of suicide, harm to another, or abuse.

  Mandatory Reporting

We are required by law to report certain information to appropriate authorities, including suspected child abuse or neglect, abuse or neglect of a vulnerable adult, and certain communicable diseases, as required by the laws of the state in which your services are delivered.

  Public Health Activities

We may disclose PHI to authorized public health authorities for activities permitted by law, such as reporting certain diseases or conditions to government health agencies.

  Health Oversight Activities

We may disclose PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure proceedings applicable to our practice.

  Judicial and Administrative Proceedings

We may disclose PHI in response to a court or administrative order. Our strong preference is to obtain your written authorization before doing so. We will assert all applicable privileges and provide you with notice when legally permissible.

  Workers’ Compensation

We may disclose PHI to the extent authorized by and necessary to comply with applicable workers’ compensation laws.

  Decedents

We may disclose PHI to a coroner, medical examiner, or funeral director as authorized or required by law.

  Disclosures to Family, Friends, or Others Involved in Your Care

We may share relevant information with a family member, friend, or caregiver involved in your care or payment, unless you instruct us otherwise. In a genuine emergency or if you are unable to communicate, we may share necessary information to ensure your safety. Once you are able to do so, we will confirm your preferences. Note: This type of disclosure may reveal that you are receiving mental health services. By designating an emergency contact, you consent to this limited disclosure in a genuine safety emergency.

  Business Associates

We work with third-party vendors (“Business Associates”) who perform services on our behalf, such as electronic health record management, billing, scheduling, and telehealth platform services. We require all Business Associates to safeguard your PHI through a signed Business Associate Agreement. Business Associates may only use your PHI as permitted by that agreement and applicable law.

  Appointment Reminders and Health-Related Information

We may use your PHI to contact you with appointment reminders or to share information about treatment alternatives or health care services or benefits we offer, consistent with applicable law.

  II.  SPECIAL PROTECTIONS FOR SUBSTANCE USE DISORDER RECORDS — 42 CFR PART 2

IMPORTANT: Federal Law Provides Special Protections for Substance Use Disorder Records.
If your records include information related to the diagnosis, treatment, or referral for treatment of a substance use disorder (SUD), those records are subject to additional federal protections under 42 CFR Part 2, in addition to HIPAA. Part 2 imposes stricter requirements in certain respects.

As of February 16, 2026, all covered entities that create or maintain SUD records are required to include Part 2 information in their Notice of Privacy Practices.

If we create or maintain records protected under 42 U.S.C. §290dd-2 and 42 CFR Part 2, the following additional protections apply:

• Your SUD records may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding conducted by a federal, state, or local authority against you, without your written consent or a court order that meets the specific requirements of 42 CFR Part 2.

• Under the updated 2024 Part 2 Final Rule, a single written consent may authorize the use and disclosure of your SUD records for treatment, payment, and health care operations purposes.

• You have the right to a written accounting of disclosures of your SUD records.

• You have the right to revoke consent for disclosure of SUD records at any time, in writing, for future disclosures.

• Violations of 42 CFR Part 2 are subject to federal criminal penalties under 42 U.S.C. §290dd-2(f).

Where any use or disclosure of SUD records that would otherwise be permitted under HIPAA is prohibited or materially limited by 42 CFR Part 2, the more protective Part 2 requirement governs.

  III.  USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION

Except as described in Section I above, we will not use or disclose your PHI without your signed written authorization. The following uses and disclosures always require your written authorization:

  Psychotherapy Notes

Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a private counseling session, maintained separately from the rest of your medical record. Under HIPAA (45 CFR §164.501), psychotherapy notes receive heightened protection and generally may not be used or disclosed without your specific written authorization, except in limited circumstances expressly permitted by law.

If your therapist maintains psychotherapy notes, those notes are handled with this heightened standard of protection. You may request information about our specific documentation practices by contacting our Privacy Officer.

  Marketing

We will not use or disclose your PHI for marketing purposes without your written authorization.

  Sale of PHI

We will not sell your PHI in the regular course of our business.

  Other Uses and Disclosures

Any use or disclosure of your PHI not described in this Notice will be made only with your written authorization. You may revoke a written authorization at any time in writing, except to the extent that we have already taken action in reliance on that authorization.

  IV.  YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have the following rights regarding your PHI. To exercise any of these rights, please submit a written request to our Privacy Officer at the contact information in Section VII below.

  Right to Access Your Records

You have the right to inspect and receive a copy of your PHI maintained in a designated record set, which includes your treatment records and billing records. We will respond to your request within 30 days of receipt. We may charge a reasonable, cost-based fee for copies. Psychotherapy notes and certain other records may be excluded from this right of access as permitted by law.

  Right to Request Amendment

You have the right to request that we amend PHI you believe is inaccurate or incomplete. We will respond in writing within 60 days. We may deny your request if the information was not created by us, is not part of the designated record set, or is accurate and complete as recorded. If we deny your request, you will receive a written explanation and may submit a written statement of disagreement, which will be added to your record.

  Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI made by us in the six (6) years prior to your request. This right does not apply to disclosures made for treatment, payment, health care operations, or disclosures you authorized in writing. We will respond within 60 days.

  Right to Request Restrictions

You may request that we restrict certain uses or disclosures of your PHI. We are not required to agree to most restriction requests. However, if you request that we not disclose your PHI to your health plan for a service you paid for entirely out of pocket, we are required by law to honor that request.

  Right to Confidential Communications

You have the right to request that we communicate with you by a specific method or at a specific location. We will accommodate all reasonable requests without requiring you to provide a reason.

  Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you agreed to receive it electronically. Contact our Privacy Officer to request a paper copy.

  Right to Revoke Authorization

You may revoke any authorization you have given us to use or disclose your PHI at any time in writing, except to the extent we have already taken action in reliance on that authorization.

  V.  OUR DUTIES

We are required by law to:

• Maintain the privacy and security of your PHI

• Provide you with this Notice of our privacy practices

• Follow the terms of this Notice currently in effect

• Notify you promptly, and no later than 60 days after discovery, if a breach of your unsecured PHI occurs

We reserve the right to change our privacy practices and the terms of this Notice at any time, to the extent permitted by applicable law. If we make a material change, we will post the updated Notice on our website and make it available upon request. A revised Notice applies to all PHI we maintain, including information created or received before the change.

  VI.  STATE LAW AND MULTI-STATE PRACTICE

SHIFT Your Journey® provides telehealth services to clients physically located in Connecticut, Florida, Massachusetts, New Jersey, New York, Pennsylvania, and Texas. Mental health privacy laws in each state where services are delivered may provide protections beyond those required by HIPAA. Where state law is more protective than HIPAA, state law governs.

For example, New York Mental Hygiene Law §33.13 imposes strict confidentiality protections for mental health records that we comply with in full. Other states we serve have their own applicable statutes, and our practices reflect the most protective standard applicable to your care.

For minor clients (ages 13–17), state law governs parental and guardian access to records. Record access requests for minor clients will be evaluated in accordance with applicable state law and the client’s consent status. Please refer to our Practice Policies for state-specific provisions.

  VII.  HOW TO FILE A PRIVACY COMPLAINT

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you in any way for filing a complaint.

  File a Complaint With SHIFT Your Journey®

Contact our Privacy Officer using the information in Section VIII below. All complaints will be reviewed and addressed promptly.

  File a Complaint With HHS OCR

• Website: www.hhs.gov/ocr/privacy/hipaa/complaints

• Phone: 1-877-696-6775 (toll-free)

• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201

  VIII.  CONTACT OUR PRIVACY OFFICER

For questions about this Notice, to exercise your rights, to request a paper copy, or for any privacy-related concern, please contact:

Privacy Officer

SHIFT Your Journey Mental Health Counseling, PLLC

Attn: Privacy Officer

75 S. Broadway, 4th Floor, Suite 439

White Plains, NY 10601

Email: Hello@shiftyourjourney.com

Phone: 914-221-3200

Website: www.shiftyourjourney.com

Email is the preferred method of contact. Requests submitted by mail will be processed in the order received and may take longer to address.

  IX.  CHANGES TO THIS NOTICE

We may update this Notice at any time as permitted by law. The current version will always be available on our website at www.shiftyourjourney.com and upon request at our office. The effective date at the top of this Notice reflects the most recent revision. We encourage you to review this Notice periodically.

© 2026 SHIFT Your Journey Mental Health Counseling, PLLC. All rights reserved.