NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: 18 July 2026

Introduction

This Notice of Privacy Practices (“Notice”) describes how CC Counseling PLLC d/b/a TrueBridge Therapy (“TrueBridge Therapy,” “the practice,” “we,” “us,” or “our”) may use and disclose your protected health information (“PHI”), explains your privacy rights, and describes our responsibilities for protecting your information.

This Notice applies to protected health information maintained by the practice in connection with your mental health care, care coordination, billing, insurance, telehealth services, communications, and related practice operations.

PHI generally includes information that identifies you and relates to your past, present, or future physical or mental health, health care services, or payment for health care services.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify you if a breach occurs that may have compromised the privacy or security of your PHI, as required by law.
• Not retaliate against you for filing a privacy complaint or exercising your rights.

Your Rights Regarding Your PHI

You may exercise the rights below by contacting the practice using the contact information listed in this Notice. We may ask you to submit certain requests in writing so that we can verify, document, and respond to them properly.

Access your record. You may request to inspect or receive a copy of your health and billing records. We will generally provide a copy or summary within the timeframe required by law and may charge a reasonable, cost-based fee when permitted by law.

Request an amendment. You may ask us to correct health information that you believe is inaccurate or incomplete. We may deny the request, but we will explain the reason in writing within the timeframe required by law.

Request confidential communications. You may ask us to contact you in a specific way or at a specific location. We will accommodate reasonable requests and will follow applicable rules when disclosure could endanger you.

Request restrictions. You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We are not always required to agree. If you pay out of pocket in full for a service and ask us not to disclose that service to your health plan, we will honor that request unless disclosure is required by law.

Request an accounting. You may request a list of certain disclosures of your PHI. The accounting does not include every disclosure, such as disclosures for treatment, payment, health care operations, or disclosures you authorized.

Receive this Notice. You may request a paper or electronic copy of this Notice at any time, even if you previously agreed to receive it electronically.

Choose a personal representative. If another person has legal authority to act for you, such as a legal guardian or health care power of attorney, that person may exercise your privacy rights as permitted by law.

File a complaint. You may file a complaint with the practice or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Your Choices About Certain Uses and Disclosures

For certain health information, you may tell us your choices about what we share. If you have a clear preference, tell us what you want us to do, and we will follow your instructions when required or permitted by law.

You may generally tell us your choice about whether to:

• Share information with family members, close friends, caregivers, or others involved in your care or payment for your care.
• Share information in a disaster relief situation.
• Communicate with a personal representative or another person legally authorized to act for you.

If you are unable to tell us your preference, we may share information when we believe it is in your best interest or when needed to lessen a serious and imminent threat to health or safety.

We will not use or disclose your PHI for marketing purposes, sell your PHI, or disclose most psychotherapy notes without your written authorization, except where HIPAA or other applicable law permits or requires the use or disclosure.

How We May Use and Disclose Your PHI for Treatment, Payment, and Health Care Operations

We may use and disclose your PHI without your written authorization for treatment, payment, and health care operations as permitted by HIPAA and other applicable law.

Treatment. We may use and disclose PHI to provide, coordinate, or manage your care. This may include communicating with clinicians, other health care providers, emergency providers, or others involved in your treatment when appropriate.

Payment. We may use and disclose PHI to bill and collect payment for services. This may include eligibility checks, benefits verification, authorizations, claims, coordination of benefits, appeals, collections, and communications with health plans.

Health care operations. We may use and disclose PHI for practice operations, including quality review, clinical documentation review, compliance, credentialing, auditing, training, care coordination, business planning, and administrative functions.

Other Uses and Disclosures Permitted or Required by Law

We may also use or disclose your PHI without your written authorization when permitted or required by law, including in the following situations:

• When required by federal, state, or local law.
• To report abuse, neglect, exploitation, domestic violence, or other mandatory-reporting matters when required or permitted by law.
• To avert a serious and imminent threat to your health or safety or the health or safety of another person.
• For health oversight activities, such as audits, investigations, inspections, licensure, credentialing, or disciplinary activities.
• For judicial, administrative, or law enforcement purposes when legally authorized, such as in response to a valid court order, subpoena, warrant, or other lawful process.
• For workers’ compensation or similar programs when applicable and authorized by law.
• For public health activities, when applicable, such as reporting certain diseases, injuries, or threats to public health.
• For health research when permitted by law.
• To organ procurement organizations for organ or tissue donation when applicable.
• To coroners, medical examiners, or funeral directors when permitted by law.
• To business associates and vendors who support the practice, but only under appropriate privacy and security requirements.
• For specialized government functions or other legally permitted purposes when applicable.

Mental Health Information, Psychotherapy Notes, and Specially Protected Records

Mental health treatment records are PHI and are protected under HIPAA and applicable state law. We use and disclose mental health information as described in this Notice and as otherwise permitted or required by law.

Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a counseling session and kept separate from the rest of the medical record. If the practice maintains psychotherapy notes, most uses and disclosures of those notes require your separate written authorization unless a HIPAA exception applies.

To the extent that we maintain substance use disorder patient records subject to 42 CFR Part 2, we will not use or disclose information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order and subpoena, as required by law. We will follow any additional consent, notice, and disclosure restrictions that apply to those records or to other specially protected information.

For minors, guardians, personal representatives, and family members, the practice will handle access, consent, and disclosure questions under applicable federal and North Carolina law, including circumstances where disclosure may be limited because of safety, legal, or clinical considerations.

Telehealth, Client Portal, and Electronic Communications

The practice may provide services and communicate with you through secure electronic tools, including telehealth platforms, the client portal, electronic health record systems, secure messaging, email, phone, or text messaging when appropriate.

We take reasonable steps to protect electronic communications, but electronic communication may carry privacy and security risks. The practice may limit the type of information sent by email or text and may direct you to use the client portal or another approved secure method for sensitive information.

Electronic messages are not appropriate for emergencies. If you are experiencing a life-threatening emergency, call 911 or go to the nearest emergency department. If you are in mental health crisis, call or text 988 for the Suicide & Crisis Lifeline.

Business Associates, Vendors, and Practice Workforce

We may disclose PHI to business associates and vendors that perform services for the practice, such as electronic health record systems, billing and clearinghouse services, telehealth platforms, secure communication tools, cloud storage, IT/security support, document management, legal counsel and compliance support, or other approved services.

Business associates are required by law and contract to protect PHI and use or disclose it only as permitted.

Members of the practice workforce, including clinicians and administrative staff, may access PHI only as needed to perform assigned duties and must follow the practice’s privacy, security, documentation, and confidentiality requirements.

Uses and Disclosures Requiring Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice or otherwise permitted or required by law.

Uses and disclosures requiring authorization generally include:

• Marketing communications where authorization is required by HIPAA.
• Sale of PHI.
• Most uses and disclosures of psychotherapy notes.
• Other uses or disclosures not permitted by this Notice or by applicable law.

You may revoke an authorization in writing at any time. A revocation will not affect actions we already took in reliance on your authorization before receiving the revocation.

Breach Notification

If a breach of unsecured PHI occurs that compromises the privacy or security of your information, the practice will notify you without unreasonable delay and within the timeframe required by law. The practice will also make any required reports to the U.S. Department of Health and Human Services and, when applicable, other required parties.

Complaints and Privacy Questions

If you have questions about this Notice, our privacy practices, or believe your privacy rights have been violated, you may contact the practice:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to:

You may also call 1-877-696-6775 or use the HHS Office for Civil Rights online complaint portal.

The practice will not retaliate against you for filing a complaint, cooperating in an investigation, or exercising your privacy rights.

Changes to This Notice

We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we maintain, including PHI created or received before the Notice was revised.

The current version of this Notice will be available upon request and prominently posted on the practice website.