HIPAA Notice of Privacy Practices

I. INTRODUCTION

We at Greenbrook TMS NeuroHealth Centers understand the importance of patients’ privacy. This Notice of Privacy Practices, or “Notice”, sets forth the ways in which we may use and disclose your protected health information, or “PHI”, and describes generally our duties to protect privacy and your rights in this regard. This Notice also describes the privacy policies and procedures that are in place at our Centers, to ensure that the PHI of our patients is used and disclosed, and otherwise handled, in accordance with applicable state law and the Privacy Rule under HIPAA.

We ask that you read this Notice carefully and make sure you understand it. Note that we are not providing you with a comprehensive description of all of your rights, nor are we providing you with legal advice.

We may amend this Notice and our privacy policies and procedures at any time, as permitted by law. You may request a copy of the current version of this Notice at any time.

II. Permitted Uses and Disclosures

Without your authorization, we are permitted to use and disclose your PHI for following purposes or situations:

(A) To the Individual: We may disclose your PHI to you.

(B) Treatment, Payment, Health Care Operations: We may use and disclose your PHI for our own treatment, payment and health care operations activities and the treatment and payment activities of another health care provider with whom you have a relationship. We may also provide disclosure to health plans and health care clearinghouses, with which you have a relationship, for some of their health care operations activities.

(C) Uses and Disclosures with Opportunity to Agree or Object: We may use and disclose your PHI by asking your permission to do so outright or in circumstances that clearly give you the opportunity to agree, acquiesce or object. In an emergency or in a situation where you are incapacitated or otherwise not available, we generally may make such use and disclosure of

your PHI that, in the exercise of our professional judgment, would be in your best interests.

(D) Incidental Use and Disclosure: We may use or disclose your PHI as a result of, or as “incident to”, an otherwise permitted use or disclosure as long as we have adopted reasonable safeguards and your PHI being shared is limited to the “minimum necessary”, all as required by the Privacy Rule under HIPAA.

(E) Public Interest and Benefit Activities: The Privacy Rule under HIPAA permits use and disclosure of PHI for 12 separate public interest purposes, in recognition of the important uses made of health information outside of the health care context. Among other circumstances, these public interest purposes permit us to disclose your PHI in circumstances where we are required to do so by law.

(F) Limited Data Set: A limited data set is PHI from which certain specified direct identifiers of individuals and their relatives, household members and employers have been removed. We may use or disclose a limited data set, that is created with the use of your PHI, for research, health care operations and public health purposes, subject to there being certain safeguards

for the PHI within the limited data set.

III. AUTHORIZED USES AND DISCLOSURES

Your written authorization is required for the use or disclosure of your PHI that is not for one of the purposes or situations set forth in Section II above, entitled “Permitted Uses and Disclosures”, or that is not otherwise permitted or required by applicable state law or the Privacy Rule under HIPAA. If we should wish to use or disclose your PHI for any purpose or situation for which your written authorization is required, we will obtain it from you prior to any such use or disclosure of your PHI. Your treatment at the Center will be unaffected by your refusal to grant any such written authorization that we may request in the future.

IV. OUR PRIVACY POLICIES AND PROCEDURES

We have policies and procedures in place to ensure that our patients’ PHI is used and disclosed, and otherwise handled, in accordance with applicable state law and the Privacy Rule under HIPAA.

(A) Staff Training and Management: Staff members are trained regarding the safeguarding and protection of patients’ PHI. Staff members are prohibited from discussing any patient’s care with anyone other than other staff members who are involved in that patient’s care or in the context of use or disclosure of PHI that is permitted pursuant to this Notice. Violations by staff members of their confidentiality obligations will be sanctioned appropriately, including, when warranted, by dismissal from employment.

(B) Limiting Uses and Disclosures to the Minimum Necessary: We are obligated to, and do, make reasonable efforts to use, disclose and request only the minimum amount of patients’ PHI that is needed to accomplish the intended purpose of the use, disclosure or request. This “minimum

necessary” requirement does not apply in certain circumstances—for example, with respect to disclosure of PHI to, or a request for PHI, by a health care provider for treatment.

(C) Mitigation: To the extent practicable, we will mitigate any harmful effect, of which we become aware, caused by the use or disclosure of our patients’ PHI by the Center’s staff members or business associates in violation of our privacy policies and procedures.

V. PATIENTS’ RIGHTS

Set forth below is a summary description of certain rights that you have with respect to your PHI.

(A) Access: Except in certain circumstances, you have the right to review and obtain a copy of your PHI in the Center’s “designated record set”. The “designated record set” is that group of records maintained by us that is used, in whole or part, to make decisions about patients, our medical and billing records and our case or medical management record systems. Your right of access is restricted in the case of psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act prohibits access and information held by certain research laboratories. In addition, we may deny you access in certain situations, such as when we believe that access could cause harm to you or another person. In such situations, you will have the right to have our denial reviewed by a licensed health care professional for a second opinion. We reserve the right to charge reasonable, cost-based fees for access requests.

(B) Amendment: You have the right to have us amend your PHI in the Center’s designated record set when our information is inaccurate or incomplete. If we accept your amendment request, we must make reasonable efforts to provide the amended information to persons whom you identify to us as needing it and to persons that, we know, might rely on the incorrect information to your detriment. If we deny your amendment request, we must provide you with a written denial and allow you to submit a statement of disagreement for inclusion in the Center’s designated record set. In addition, we must amend your PHI in our designated record

set upon receipt of a notice to amend from another health care provider, a health plan or a health care clearinghouse.

(C) Disclosure Accounting: You have the right to an accounting of the disclosures of your PHI made by us during the six-year period immediately preceding the date of your accounting request. Note, however, that we are generally not required to provide you with an accounting of certain

disclosures that we are permitted to make.

(D) Restriction Request: You have the right to request that we restrict use or disclosure of your PHI for (a) treatment, payment or health care operations, (b) disclosure to persons involved in your health care or payment for health care or (c) disclosure to notify family members or others about your general condition, location or death. We are under no obligation to agree to any such request for restriction. However, if we do agree to any restrictions, we must comply with the agreed upon restrictions, other than for purposes of treating you in a medical emergency.

(E) Confidential Communication Requirements: You are permitted to request a means or location for receiving communications of PHI from us that is different than those we usually employ. For example, you may request that we communicate with you through a designated address or

phone number. In connection with your request, we may require you to specify an alternative address or method of contact and to explain how payments will be handled.

VI. COMPLAINTS

Any questions, concerns or complaints regarding our privacy practices or our privacy policies and procedures should be put in writing and directed to our Privacy Officer whose contact information is set forth below. Receipt of your correspondence will be acknowledged, and our Privacy Officer

will provide a response after conducting whatever investigation he or she may deem appropriate.

Contact:

Greenbrook TMS NeuroHealth Centers 8405 Greensboro Drive, Suite 120 McLean, VA 22102

ATTN: Privacy Officer

Email: Privacy@greenbrooktms.com