HIPAA Notice of Privacy Practices

Golden Life Foundation respects the privacy of Protected Health Information ("PHI") and complies with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, including the Privacy Rule, Security Rule, and Breach Notification Rule. To the extent Golden Life Foundation operates as a covered entity or business associate under HIPAA in connection with behavioral health services, referrals, or coordination of care, the following Notice applies.

1. Our Obligations

We are required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice describing our legal duties and privacy practices
• Abide by the terms of the Notice currently in effect
• Notify affected individuals following a breach of unsecured PHI as required by federal law

2. What Is Protected Health Information

Protected Health Information includes individually identifiable information that relates to your past, present, or future physical or mental health, the provision of health care, or payment for health care, in any form or medium. This may include your name, date of birth, address, diagnoses, treatment records, and similar information.

3. How We May Use and Disclose PHI

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share information with licensed clinical partners such as GLC Wellness Center to coordinate behavioral health care.

Payment

We may use and disclose PHI to obtain payment for services provided to you, including activities such as billing, claims management, and collection. We may share information with insurers or other payers as needed.

Health Care Operations

We may use and disclose PHI for our operations, including quality assessment and improvement, training, credentialing, audits, compliance, accreditation, and general administration.

Disclosures Required or Permitted by Law

We may use or disclose PHI without your authorization in the following circumstances:

• As required by federal, state, or local law
• For public health activities, including disease prevention and reporting
• To report suspected abuse, neglect, or domestic violence to authorized agencies
• For health oversight activities such as audits, investigations, and inspections
• In response to a court order, subpoena, or other legal process
• For law enforcement purposes as permitted by law
• To coroners, medical examiners, and funeral directors
• For organ and tissue donation purposes
• For approved research purposes with appropriate safeguards
• To avert a serious and imminent threat to health or safety
• For specialized government functions, including military and national security
• For workers' compensation as authorized by law

Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing PHI for:

• Most uses and disclosures of psychotherapy notes
• Marketing communications
• Sale of PHI
• Any other purpose not described in this Notice

You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

4. Special Protections for Substance Use Records

Records related to substance use disorder treatment may be subject to additional protections under federal law (42 CFR Part 2). These records generally cannot be disclosed without your specific written consent except in limited circumstances permitted by that regulation.

5. Your Rights Regarding PHI

You have the following rights with respect to PHI we maintain about you:

• Right to Access: You may request to inspect and obtain a copy of your PHI in a designated record set, in the form and format you request when reasonably available.
• Right to Amend: You may request that we amend PHI you believe is incorrect or incomplete. We may deny the request in limited circumstances permitted by law.
• Right to an Accounting of Disclosures: You may request an accounting of certain disclosures of your PHI made by us, subject to the limitations of the law.
• Right to Request Restrictions: You may request that we restrict certain uses and disclosures of your PHI. We are not required to agree to a requested restriction except in certain limited cases.
• Right to Confidential Communications: You may request that we communicate with you in a specific way or at a specific location.
• Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
• Right to Notification of Breach: You will be notified following a breach of your unsecured PHI as required by federal law.

6. How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to our Privacy Officer using the contact information below. We may require you to use a specific form and verify your identity before responding.

7. Changes to This Notice

We reserve the right to change this Notice at any time, and to make the revised Notice effective for all PHI we maintain. The current Notice will be posted in our offices and on our website, and the effective date appears above.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

• To file a complaint with Golden Life Foundation: Email support@myglf.org or write to our Privacy Officer at the address below.
• To file a complaint with HHS: Visit www.hhs.gov/ocr or call 1-800-368-1019.

9. Contact Information

This Notice is provided to comply with the HIPAA Privacy Rule and applicable state law. The most protective standard applies where requirements differ. This Notice does not create rights independent of those granted by law.