Notice of Privacy Practices

Effective Date: September 23, 2026

Your Information. Your Rights. Our Responsibilities.

This Notice describes how medical information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully.

This Notice applies to Winston Integrative ADHD Care, PLLC, doing business as Winston Integrative ADHD Care, and to healthcare professionals and staff providing services through the practice as permitted by law.

Your Rights

Obtain a Copy of Your Medical Record

You may ask to see or obtain an electronic or paper copy of your medical record and other health information we maintain about you. We will provide access within the time required by applicable law. We may charge a reasonable, cost-based fee when permitted by law.

Request a Correction

You may ask us to amend health information that you believe is incorrect or incomplete. We may deny a request in circumstances permitted by law. If we do, we will explain the decision in writing and inform you of any additional rights you have.

Request Confidential Communications

You may ask us to communicate with you in a particular manner or at a particular address. For example, you may request that we contact you only at a particular telephone number or email address. We will accommodate reasonable requests as required by law.

Request Restrictions

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations. We are not generally required to agree to every requested restriction.

If you pay in full out of pocket for a healthcare service, you may ask us not to disclose information about that service to a health plan for payment or healthcare operations. We will honor such a request unless disclosure is otherwise required by law.

Obtain an Accounting of Certain Disclosures

You may request a list of certain disclosures of your health information made during the period provided by law. The accounting will not include certain disclosures, including many disclosures made for treatment, payment, or healthcare operations.

Receive a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Choose Someone to Act for You

If another person has legal authority to make healthcare decisions or exercise privacy rights on your behalf, we will recognize that person as your personal representative when required by law. We may verify that person’s authority before acting on a request.

File a Privacy Complaint

You may complain to us if you believe your privacy rights have been violated. You may also submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Your Choices

In certain circumstances, you may tell us how you want your information shared. These circumstances may include sharing information with:

• family members;
• close friends; or
• another person involved in your care or payment for your care.

If you cannot tell us your preference, we may disclose limited information when permitted by law and when we determine that disclosure is in your best interest or is necessary to reduce a serious and imminent threat to health or safety.

Uses Requiring Authorization

Except when applicable law provides otherwise, we will obtain written authorization before:

• using health information for marketing purposes that require authorization;
• selling protected health information; or
• using or disclosing psychotherapy notes in situations for which HIPAA requires authorization.

“Psychotherapy notes” has a specific definition under HIPAA and does not include ordinary psychiatric progress notes, medication-management documentation, diagnoses, treatment plans, or other information maintained in the medical record.

If you provide an authorization, you may revoke it in writing as permitted by law. Revocation will not affect actions already taken in reliance on a valid authorization.

How We Typically Use and Disclose Health Information

Treatment

We may use your health information and disclose it to healthcare professionals involved in your care. For example, with the permissions required by applicable law, we may communicate with other physicians, psychologists, therapists, pharmacists, laboratories, or other professionals involved in your treatment.

Healthcare Operations

We may use and disclose health information to operate our practice and improve the services we provide. This may include quality improvement, care coordination, staff training, compliance, security, credentialing, professional review, and practice administration.

Payment

We may use and disclose health information in connection with payment for services when applicable. Because some of our services may be provided on a private-pay or out-of-network basis, disclosures to insurers may differ depending upon whether you ask us to provide documentation, submit information, or otherwise assist with reimbursement.

Other Uses and Disclosures Permitted or Required by Law

Subject to applicable federal and state confidentiality requirements, we may use or disclose health information when permitted or required for purposes such as:

• public-health activities;
• reporting suspected abuse or neglect;
• preventing or reducing a serious threat to health or safety;
• health oversight activities;
• workers’ compensation;
• certain law-enforcement requests;
• responding to a court or administrative order or other lawful process;
• complying with other legal requirements;
• certain research activities permitted by law;
• medical examiner or funeral director activities; and
• other uses or disclosures permitted or required under applicable law.

Additional legal requirements may apply before we disclose mental-health, substance-use, adolescent, or other specially protected records.

Mental-Health Information

Mental-health information may receive protections under Washington or Idaho law that are more restrictive than the general HIPAA rules. When state law provides greater privacy protection than HIPAA, we follow the more protective applicable requirement.

We will not disclose specially protected mental-health information merely because HIPAA would otherwise permit a disclosure when applicable state law requires additional consent, authorization, or other conditions.

Substance Use Disorder Records

Some substance-use-disorder records may be subject to additional protections under federal law, including 42 CFR Part 2. To the extent we create, receive, or maintain records protected by Part 2, those records receive the protections required by federal law.

Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against a patient unless the disclosure is permitted by applicable law, including when authorized by the patient or pursuant to the required court order and legal process.

Minors and Adolescents

Privacy rights involving minors depend upon the patient’s age, the nature of the treatment, who consented to treatment, and applicable state and federal law.

A parent or legal guardian often acts as a minor patient’s personal representative. However, there are circumstances in which a minor may consent to treatment independently or may have confidentiality rights that limit a parent’s access to particular information.

Washington law, for example, permits adolescents in certain circumstances to request and receive outpatient behavioral-health treatment without parental consent. When a minor has the legal authority to consent to a healthcare service independently, the minor may also have privacy rights concerning information associated with that service.

We apply the laws of the state applicable to the patient’s treatment when determining:

• who may consent to care;
• who may authorize disclosure;
• who may access the record; and
• when information may or must be disclosed for safety or other legally authorized purposes.

We encourage parents and adolescents to discuss confidentiality expectations with the treating clinician.

Schools

We do not automatically disclose a child’s psychiatric record to a school.

When information is requested for an educational accommodation, 504 Plan, Individualized Education Program, or similar purpose, we generally seek appropriate authorization and disclose information consistent with the authorization and applicable law.

Clinical information maintained by Winston is generally governed by healthcare privacy law. Once information is lawfully disclosed to a school, different privacy laws may apply to the school’s copy.

Electronic Communications and Patient Portals

We may use electronic health records, secure patient portals, telehealth systems, electronic prescribing, laboratories, pharmacy systems, and other healthcare technology as part of your care.

We apply appropriate privacy and security safeguards and enter into business associate agreements when required by HIPAA.

Patients should use the secure communication methods we provide for sensitive clinical information whenever reasonably possible.

Our Responsibilities

We are required by law to:

• maintain the privacy and security of protected health information;
• provide you with this Notice describing our legal duties and privacy practices;
• follow the terms of the Notice currently in effect; and
• notify affected individuals when a breach occurs that requires notification under applicable law.

We will not use or disclose your protected health information other than as permitted by this Notice or by law unless you give us appropriate written permission.

Changes to This Notice

We may change the terms of this Notice and make the revised Notice effective for health information we already maintain as well as information we receive in the future. The current Notice will be available on our website and upon request.

Questions or Complaints

Winston will not retaliate against you for exercising a privacy right or filing a complaint.