Effective Date: November 3, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Commitment to Protecting Your Health Information

Shifa Health, (“Shifa Health,” “we,” “our,” or “us”) is committed to protecting the privacy and confidentiality of your personal health information.

We understand that information about your mental health, medical history, treatment, and personal circumstances is sensitive. We are required by law to maintain the privacy of your Protected Health Information (PHI), provide you with this Notice of Privacy Practices, and follow the privacy practices described in this notice.

This notice applies to the health information we create, receive, maintain, or disclose when providing healthcare services, including psychiatric evaluations, medication management, psychotherapy, Transcranial Magnetic Stimulation (TMS), Spravato treatment, and other behavioral and mental health services.

This notice also applies to healthcare services provided through telehealth and our authorized healthcare-related systems.

2. How We May Use and Disclose Your Health Information

We may use and disclose your Protected Health Information for the following purposes without obtaining your written authorization, as permitted by law.

A. Treatment

We may use or share your health information to provide, coordinate, or manage your healthcare and related services.

Examples include:

• Reviewing your medical and psychiatric history.
• Coordinating care among authorized healthcare professionals.
• Sharing relevant information with specialists or other providers involved in your treatment.
• Discussing treatment plans, medications, and clinical progress.
• Coordinating referrals and follow-up care.

B. Payment

We may use and disclose your health information to obtain payment for healthcare services.

Examples include:

• Verifying insurance coverage and eligibility.
• Submitting insurance claims.
• Processing payments and billing.
• Obtaining prior authorizations for certain treatments.
• Responding to insurance payment inquiries.

C. Healthcare Operations

We may use or disclose your health information to support our healthcare operations and improve the quality of our services.

Examples include:

• Reviewing treatment quality and clinical performance.
• Conducting internal audits and administrative reviews.
• Training authorized healthcare personnel.
• Managing appointments and patient records.
• Evaluating the effectiveness of our services.
• Maintaining compliance with healthcare regulations.

D. Appointment Reminders and Healthcare Communications

We may contact you through phone calls, voicemail, email, text messages, or other communication methods to:

• Remind you about upcoming appointments.
• Provide appointment confirmations or scheduling updates.
• Share information about treatment or healthcare services.
• Communicate billing and payment matters.
• Provide follow-up instructions or other healthcare-related information.

You may request reasonable alternative communication arrangements if you have concerns about how we contact you.

E. Business Associates

We may share your health information with trusted third-party service providers, known as business associates, who perform services on our behalf.

These may include electronic health record providers, billing companies, secure communication platforms, technology providers, and administrative support services.

Business associates are required to protect your information through appropriate agreements and safeguards as required by law.

F. Individuals Involved in Your Care

We may share relevant health information with a family member, caregiver, personal representative, or another person involved in your care or payment for your healthcare when permitted by law.

You may object to certain disclosures, and we will respect your preferences when legally required or appropriate.

If you are unable to communicate your preference because of an emergency or other circumstance, we may share limited information when permitted by law and when it is determined to be in your best interest.

3. Other Permitted Uses and Disclosures

We may also use or disclose your health information without written authorization in certain situations permitted or required by federal and state law.

These situations may include:

• Public Health Activities: Reporting certain diseases, injuries, public health events, or medication-related concerns to authorized public health authorities.
• Abuse or Neglect Reporting: Reporting suspected abuse, neglect, or domestic violence when required or authorized by law.
• Health Oversight Activities: Cooperating with authorized government agencies responsible for healthcare oversight, inspections, audits, and licensing.
• Legal Proceedings: Responding to valid court orders, subpoenas, or other lawful legal processes.
• Law Enforcement: Disclosing information to law enforcement officials in circumstances permitted or required by law.
• Preventing Serious Threats: Sharing necessary information to prevent or reduce a serious and imminent threat to the health or safety of an individual or the public.
• Workers’ Compensation: Providing information as authorized by workers’ compensation laws.
• Government Functions: Supporting certain authorized military, national security, and government activities.
• Research: Supporting approved healthcare research activities when applicable legal privacy requirements are satisfied.
• Medical Examiners and Funeral Directors: Providing information when necessary for legally authorized duties following a patient’s death.

We will limit disclosures to the information reasonably necessary for the applicable purpose, when required by law.

4. Uses and Disclosures Requiring Your Written Authorization

Certain uses and disclosures of your health information require your written authorization.

These may include:

A. Marketing

We will not use or disclose your Protected Health Information for marketing purposes when HIPAA requires your written authorization.

B. Sale of Health Information

We will not sell your Protected Health Information without your written authorization when such authorization is required by law.

C. Psychotherapy Notes

Psychotherapy notes maintained separately from your general medical record receive special protection under HIPAA.

In most circumstances, we must obtain your written authorization before using or disclosing separately maintained psychotherapy notes, except in limited situations permitted by law.

D. Other Uses and Disclosures

Any use or disclosure of your health information not covered by this notice or otherwise permitted or required by law will require your written authorization.

You may revoke an authorization in writing at any time, except to the extent that we have already acted in reliance on it.

5. Special Protection for Mental Health and Substance Use Information

Because Shifa Health provides psychiatric and behavioral healthcare, certain health information may receive additional protections under federal and Washington State law.

This may include:

• Mental health treatment information.
• Psychotherapy notes.
• Substance use disorder treatment records.
• Other specially protected medical information.

We will handle these records in accordance with applicable federal and state privacy requirements.

If we receive records protected by federal substance use disorder confidentiality regulations under 42 CFR Part 2, additional restrictions may apply to their use and disclosure.

Nothing in this notice is intended to reduce the privacy protections available to you under applicable law.

6. Your Rights Regarding Your Health Information

You have several rights regarding the Protected Health Information we maintain about you.

A. Right to Inspect and Obtain a Copy

You have the right to request access to and obtain a copy of your medical and health records, subject to certain legal exceptions.

You may request your records in paper or electronic format, where available.

We may charge a reasonable, cost-based fee for copies as permitted by law.

B. Right to Request an Amendment

If you believe information in your medical record is incorrect or incomplete, you may request an amendment.

Your request should be submitted in writing and explain why the information should be corrected.

We may deny your request in certain circumstances permitted by law. If we deny your request, we will provide an explanation and information about your available options.

C. Right to Request Confidential Communications

You may request that we communicate with you about your healthcare through a particular method or at a specific address.

For example, you may request that we:

• Contact you using a specific phone number.
• Send correspondence to an alternative mailing address.
• Avoid leaving detailed voicemail messages.
• Use another reasonable communication method.

We will accommodate reasonable requests as required by law.

D. Right to Request Restrictions

You may request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations.

We are generally not required to agree to every requested restriction.

However, if you pay for a healthcare service entirely out of pocket and in full, you may request that we not disclose information about that service to your health insurer for payment or healthcare operations purposes, unless disclosure is otherwise required by law.

E. Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your health information made by Shifa Health during the applicable period.

This accounting generally covers the six years before the date of your request, subject to legal exceptions.

Certain disclosures, including those made for treatment, payment, and healthcare operations, are excluded from this accounting requirement.

F. Right to Receive a Copy of This Notice

You have the right to receive a paper or electronic copy of this Notice of Privacy Practices at any time.

You may request a copy even if you previously agreed to receive it electronically.

G. Right to Choose Someone to Act for You

If you have legally authorized a personal representative, such as a person with medical power of attorney or a legal guardian, that individual may exercise certain privacy rights on your behalf.

We will verify the individual’s legal authority before providing access to your health information.

H. Right to Be Notified of a Breach

You have the right to receive notification if a breach of your unsecured Protected Health Information occurs that requires notification under applicable law.

7. Our Responsibilities

Shifa Health is required by law to:

• Maintain the privacy and security of your Protected Health Information.
• Provide you with this Notice explaining our privacy practices.
• Follow the terms of the notice currently in effect.
• Notify you if a breach occurs that may have compromised the privacy or security of your health information, as required by law.
• Obtain your written authorization for uses and disclosures when required.
• Respect your applicable privacy rights under federal and state law.

We reserve the right to change our privacy practices and the terms of this notice.

Any revised notice will apply to all Protected Health Information we maintain, including information created or received before the revision.

8. How to Exercise Your Privacy Rights

To exercise any of your rights regarding your health information, please submit a written request to Shifa Health.

You may contact our office to request the appropriate forms or assistance with submitting your request.

Depending on the type of request, we may need to verify your identity or legal authority before processing it.

We will respond to your request within the timeframes required by applicable law.

9. How to File a Privacy Complaint

If you believe your privacy rights have been violated, or you have concerns about how your health information has been used or disclosed, you have the right to file a complaint.

You may submit a complaint directly to Shifa Health using the contact information below.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

U.S. Department of Health and Human Services

Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201

Phone: 1-877-696-6775

Website: https://www.hhs.gov/hipaa/filing-a-complaint/

Shifa Health will not retaliate against you for filing a privacy complaint or exercising your rights under applicable privacy laws.

10. Changes to This Notice

Shifa Health reserves the right to revise or update this Notice of Privacy Practices as necessary to reflect changes in applicable laws, regulations, or our privacy practices.

Any updated notice will be made available at our office and on our website.

The revised notice will include an updated effective date and will apply to the health information we maintain as permitted by law.

11. Contact Information

If you have questions about this Notice of Privacy Practices, want to exercise your privacy rights, or need assistance with a privacy-related concern, please contact us.

Shifa Health

Email: info@shifahealth.org

Silver Lake / Everett Office

10333 19th Ave SE, Suite #109
Everett, WA 98208
Phone: (425) 742-4600
Fax: (425) 225-6859

Mount Vernon Office

1103 Cleveland Ave
Mount Vernon, WA 98273
Phone: (360) 336-6868
Fax: (360) 336-6866

Website: https://shifahealth.org/

Privacy Officer: Please contact Shifa Health using the information above and request to speak with the Privacy Officer.

PLEASE REVIEW THIS NOTICE CAREFULLY. IT EXPLAINS YOUR RIGHTS AND OUR LEGAL RESPONSIBILITIES REGARDING YOUR PROTECTED HEALTH INFORMATION.