Notice of Privacy Practices

MINDSET BEHAVIORAL HEALTH PC

DBA MYINDSET

7230 Arbuckle Commons, Suite 256 | Brownsburg, IN 46112

Phone: (317) 207-0273 | www.myindset.com

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective and Reviewed last on February 12, 2026.

OUR PLEDGE REGARDING YOUR HEALTH INFORMATION:

We understand that health information about you is personal. We are committed to protecting health information about you. MYINDSET will create a record of the services you receive at our offices. We need this record to provide you with quality services and to comply with certain legal requirements.

We are required by law to:

Make sure that health information that identifies you is kept private
Give you this notice of our legal duties and privacy practices regarding health information about you
Follow the terms of the notice that is currently in effect
Notify you if we are unable to agree to a requested restriction on how your health information is used or disclosed
Notify you following a breach of unsecured protected health information

USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION:

We will obtain your written authorization before using or disclosing your health information for purposes other than those described in this notice. You may revoke your authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose your health information for the reasons covered by your written authorization, except to the extent that we have already taken action in reliance on your authorization.

SUBSTANCE USE DISORDER RECORDS

(42 CFR Part 2 — Updated per 2024 Final Rule)

Records relating to substance use disorder (“SUD”) treatment receive special federal protections under 42 CFR Part 2. Under the 2024 final rule, these protections have been aligned more closely with HIPAA to simplify the consent and disclosure process while maintaining strong patient safeguards. MYINDSET complies with all Part 2 requirements.

How We May Use and Disclose SUD Records

General Consent for Treatment, Payment, and Health Care Operations: With your written consent, we may use and disclose SUD records for treatment, payment, and health care operations purposes, consistent with HIPAA. A single general consent form is sufficient to authorize these disclosures—you do not need to sign a separate authorization for each individual disclosure.
Disclosures Without Consent: SUD records may be disclosed without your consent only in limited circumstances permitted by federal law, including: medical emergencies where your life is in immediate danger; qualified research with appropriate safeguards; audits and evaluations by authorized entities; and disclosures required by a court order that meets specific legal standards under Part 2.
Prohibition on Redisclosure: Any person or entity that receives your SUD records from us is prohibited from redisclosing that information except as specifically permitted by 42 CFR Part 2. A written notice of this prohibition accompanies each disclosure.
Prohibition on Use in Legal Proceedings: Your SUD records may not be used in any criminal, civil, or administrative proceeding against you, whether conducted by a federal, state, or local authority, except as expressly permitted by 42 CFR Part 2. This means your SUD treatment information cannot be used to investigate, charge, or prosecute you.

Your Rights Regarding SUD Records

You have the right to request restrictions on how your SUD records are used or disclosed
You have the right to receive an accounting of disclosures of your SUD records
You have the right to access and obtain copies of your SUD records
You have the right to request amendments to your SUD records if you believe they are inaccurate or incomplete
Breach notification requirements apply to Part 2 records consistent with HIPAA requirements

INDIANA MENTAL HEALTH RECORDS PROTECTIONS

As a behavioral health practice, many of our records constitute mental health records under Indiana law. Indiana Code § 16-39-2 provides additional protections for mental health records beyond those required by federal HIPAA regulations. Where Indiana law provides greater protection than HIPAA, we follow the more protective standard.

Under Indiana law, mental health records may be subject to additional restrictions on disclosure, including requirements for specific patient consent before release. We comply with all applicable Indiana privacy laws governing the collection, use, and disclosure of mental health information, substance use disorder records, and HIV-related information.

Some information, such as HIV-related information, genetic information, substance use disorder treatment records, and mental health records may be entitled to special confidentiality protections under applicable state or federal law. We will abide by these special protections as they pertain to applicable cases involving these types of records.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION WITHOUT YOUR AUTHORIZATION

For Treatment

We may use health information about you to provide you with clinical treatment or services. We may disclose health information about you to clinical providers and support staff personnel who are involved in providing services to you. This includes coordination of care with other healthcare providers involved in your treatment, such as your primary care physician, OB/GYN, psychiatrist, therapist, or other specialists, to ensure you receive comprehensive, coordinated care.

For Payment

We may use and disclose health information about you so that the services you receive may be billed to, and payment may be collected from you, an insurance company, or a third party. For example, we may need to give your insurance company information about services you received to obtain payment or to determine whether your insurance will pay for the service.

For Health Care Operations

We may use and disclose health information about you for health care operations purposes, including quality assessment and improvement, staff training and credentialing, business management and administration, coordination of care with other health care providers, and compliance activities.

Appointment Reminders and Treatment Alternatives

We may contact you to remind you of appointments or to inform you of treatment alternatives or health-related benefits and services that may be of interest to you. We may contact you by phone, mail, email, or text message for these purposes, depending on your communication preferences. You may request confidential communications in a specific manner or at a specific location by submitting a written request to our office.

Fundraising Communications

We do not currently use your health information for fundraising purposes. If we do so in the future, we will inform you in advance, and you will have the right to opt out of receiving fundraising communications at any time.

DISCLOSURES REQUIRED OR PERMITTED BY LAW

We will disclose health information about you when required to do so by federal, state, or local law, including:

Public health activities: To prevent or control disease, injury, or disability; report deaths; report child abuse or neglect; report reactions to medications or problems with medical products
Health oversight activities: Audits, investigations, inspections, and licensure activities by government agencies
Lawsuits and disputes: In response to a court order or subpoena, subject to applicable legal requirements
Law enforcement: To identify or locate a suspect, report criminal conduct at our facilities, or respond to a court order, subject to applicable legal restrictions
Coroners and medical examiners: To identify a deceased person or determine cause of death
National security: To authorized federal officials for intelligence and national security activities
Abuse, neglect, or domestic violence: To appropriate government authorities if we believe you have been a victim of abuse, neglect, or domestic violence
Serious threat to health or safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public
Workers’ compensation: As authorized by, and to the extent necessary to comply with, workers’ compensation laws

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION:

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your protected health information maintained by our practice. If we maintain your health information electronically, you have the right to obtain an electronic copy in the electronic format you request, if it is readily producible in that format, or in a mutually agreed-upon alternative format. You also have the right to direct us to send an electronic copy of your health information to a third party that you designate. Submit your request in writing to our office. We will respond within 30 days. We may charge a reasonable fee for copies.

Right to Request Amendment

You have the right to request that we amend health information if you believe it is incorrect or incomplete. Submit your request in writing with a reason supporting your request. We will respond within 60 days. We may deny your request in certain circumstances, but if we do, we will provide you with a written explanation.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we have made of your health information, other than disclosures for treatment, payment, and health care operations, and certain other exceptions. Submit your request in writing, stating a time period (not longer than six years). We will respond within 60 days. The first accounting in a 12-month period is free. We may charge a reasonable fee for additional requests.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to your request, except that we must agree if you request that we not disclose information to your health plan for services you paid for entirely out of pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may ask that we contact you only at a specific phone number or by mail rather than by phone. We will accommodate all reasonable requests. Submit your request in writing to our office.

Right to Be Notified of a Breach

You have the right to be notified in the event that we discover a breach of your unsecured protected health information. We will notify you of any such breach within 60 days of discovering it, as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) and Indiana’s data breach notification law (Indiana Code § 24-4.9). Notification will include a description of the breach, the types of information involved, steps you should take to protect yourself, what we are doing in response, and contact information for further questions.

Right to Opt Out of Fundraising Communications

If we ever use your health information to contact you for fundraising purposes, you will have the right to opt out of receiving such communications. We do not currently engage in fundraising activities using patient health information.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this notice upon request, even if you agreed to receive the notice electronically.

MEDICAL RECORDS COPY FEES

The following fees apply to copies of medical records, in accordance with Indiana Code § 16-39-9:

Service Fee

Pages 1–10

$1.00 per page

Pages 11–50

$0.50 per page

Pages 51+

$0.25 per page

Labor fee (records over 10 pages)

$6.50

Certified records

$5.00

Postage (if mailing required)

Actual cost

Records sent to other healthcare providers for treatment

No charge

Processing Time

We will respond to medical records requests within 30 days. If additional time is needed, we may extend this period by up to 30 additional days with written notice to you explaining the reason for the delay.

Free Copy for Disability Benefits

If you need a copy of your medical records to support an application for, or appeal of a denial of, Social Security disability benefits, we will provide one free copy of your medical record upon request. Please inform our office that your request is for Social Security disability purposes.

Written authorization is required for all records requests.

TEXT MESSAGING AND MOBILE COMMUNICATIONS

Consent and Opt-In

By providing your mobile phone number and opting in to receive text messages from MYINDSET—whether through our website, patient intake forms, patient portal, contact forms, appointment scheduling tools, or verbally in our office—you consent to receive text messages (SMS and MMS) at the mobile number you have provided. Your consent to receive text messages is not a condition of receiving clinical care from MYINDSET

Types of Messages

Messages you may receive include appointment reminders and confirmations, appointment cancellation or rescheduling notifications, follow-up care check-ins, billing and payment reminders, practice updates (such as changes to office hours, locations, or provider availability), responses to inquiries you have submitted, and patient feedback requests. We will not send marketing or promotional text messages without obtaining your separate, explicit prior written consent as required by the Telephone Consumer Protection Act (TCPA).

Message Frequency and Costs

Message frequency varies based on your appointment schedule and interactions with our practice. Message and data rates may apply depending on your mobile carrier and plan. MYINDSET is not responsible for any charges incurred by your mobile carrier.

Opting Out

You have the right to opt out of receiving text messages from MYINDSET at any time. To opt out, reply STOP to any text message you receive from us. You may also call our office at (317) 207-0273 or email contact@myindset.com to request removal from text communications. After opting out, you will receive one final confirmation message. Opting out will not affect your ability to receive clinical care.

Getting Help

If you need assistance with our text messaging service, reply HELP to any message for our office contact information, or contact us directly at (317) 207-0273 or contact@myindset.com.

Privacy of Text Messages

Text messages from MYINDSET will not contain detailed protected health information such as diagnoses, medications, treatment plans, or clinical notes. Messages are limited to general, non-clinical content such as appointment dates and times. We do not sell, share, rent, or trade your mobile phone number, opt-in data, or any information collected through our text messaging program to third parties for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with third parties.

Carrier Disclaimer

Our text messaging services are supported by major U.S. mobile carriers. Carriers are not liable for delayed or undelivered messages. Message delivery is subject to carrier network availability and device compatibility.

TCPA and 10DLC Compliance

Our text messaging practices comply with the Telephone Consumer Protection Act (TCPA), the Cellular Telecommunications Industry Association (CTIA) Messaging Principles and Best Practices, and applicable 10DLC (10-Digit Long Code) registration requirements established by The Campaign Registry (TCR) and U.S. mobile carriers. MYINDSET has completed brand and campaign registration with TCR as required for all application-to-person (A2P) business text messaging in the United States. We maintain records of consent in accordance with TCPA requirements, including how and when consent was obtained, for a minimum of five (5) years.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with our office or with the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

MYINDSET

Privacy Officer

7230 Arbuckle Commons, Suite 256

Brownsburg, IN 46112

Phone: (317) 207-0273

Email: contact@myindset.com

Hours: Mon–Fri 9am–4pm

U.S. Dept. of Health & Human Services

Office for Civil Rights

Phone: 1-877-696-6775

Online: ocrportal.hhs.gov/ocr/smartscreen/main.jsf

Indiana Professional Licensing Agency

402 W. Washington St., Room W072

Indianapolis, IN 46204

Phone: (317) 234-2060

CHANGES TO THIS NOTICE

We reserve the right to change this notice. We reserve the right to make the revised notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice at each of our office locations and on our website at www.myindset.com. The notice will contain the effective date on the first page.

CONTACT INFORMATION:

If you have any questions about this notice, please contact: