Notice of Privacy Practices 2026

Community Roots Counseling, LLC

PO Box 5312

Salem, OR 97304

(503) 583-2121

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We at Community Roots Counseling, LLC, are required by law to maintain the privacy of Protected Health Information (“PHI”) and to provide you with notice of our legal duties and privacy practices with respect to PHI. References to "Community Roots Counseling," “Community Roots Counseling, LLC,” “CRC,” “we,” “us,” and “our” are understood to mean Community Roots Counseling, LLC, for purposes of compliance with the Health Insurance Portability and Accountability Act (“HIPAA”). Community Roots Counseling, LLC, its employees, contractors, and workforce members who are involved in providing and coordinating health care are all bound to follow the terms of this Notice of Privacy Practices (“Notice”). The members of Community Roots Counseling, LLC, will share PHI with each other for treatment, payment, and health care operations as permitted by HIPAA and this Notice.

PHI is information that may identify you and that relates to your past, present, or future physical or mental health care or condition, the provision of health care products and services to you, or payment for such services. This Notice describes how we may use and disclose PHI about you, as well as how you obtain access to such PHI. This Notice also describes your rights with respect to your PHI. We are required by HIPAA to provide this Notice to you.

Community Roots Counseling, LLC, is required to follow the terms of this Notice or any change to it that is in effect. We reserve the right to change our practices and this Notice and to make the new Notice effective for all PHI we maintain. If we do so, the updated Notice will be posted on our website and will be available at our locations where you receive health care and services from us. Upon request, we will provide any revised Notice to you.

I. OUR PLEDGE REGARDING HEALTH INFORMATION

Community Roots Counseling, LLC, understands that health information about you and your health care is personal. We are committed to protecting health information about you. Our office creates a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by this mental health care practice. This Notice will tell you about the ways in which we may use and disclose health information about you. It also describes your rights to the health information our office keeps about you and describes certain obligations we have regarding the use and disclosure of your health information. Community Roots Counseling, LLC, and its providers are required by law to:

• Make sure protected health information (“PHI”) that identifies you is kept private.

• Give you this Notice of our legal duties and privacy practices with respect to health information.

• Follow the terms of the Notice that is currently in effect.

• Notify you of any changes to the terms of this Notice, and that such changes will apply to all information we have about you. The new Notice will be available upon request, in our office, and on our website.

II. HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following categories describe different ways that Community Roots Counseling, LLC, and its providers use and disclose health information. We have provided some examples in certain categories; however, not every permissible use or disclosure will be listed in this Notice. Note that some types of PHI, such as HIV information, genetic information, alcohol and/or substance abuse records, and mental health records, may be subject to special confidentiality protections under applicable state or federal law. We will abide by these special protections.

For Treatment. Federal privacy rules and regulations allow us to use and disclose your health care information, without your consent, to another licensed health care provider directly involved in your physical and mental health activities. This also includes, among other things, coordination and management of health care providers with third parties, consultations between health care providers, and referrals of a client for health care from one health care provider to another. For example, if your primary care doctor referred you to us for services, and we needed to obtain additional information for assessment, we would be permitted to exchange personal health information in order to assist with the treatment of your mental health condition.

Payment. We may use and disclose your PHI in order to obtain payment for the health care and services that we provide to you, and for other payment activities related to the services that we provide. For example, we may contact your insurer or other health care payer to determine whether it will pay for health care and services you need, and to determine the amount of your co-payment. We will bill you or a third-party payer for the cost of healthcare and services we provide to you. The information on or accompanying the bill may include information that identifies you, as well as information about the services that were provided to you or the medications you are taking. We may also disclose your PHI to other health care providers or HIPAA covered entities who may need it for their payment activities.

Health Care Operations. We may use and disclose your health information to support our operational activities. Health care operations are activities necessary for us to operate our health care business. For example, we may use your PHI to monitor the performance of the staff providing treatment to you. We may use your PHI as part of our efforts to continually improve the quality and effectiveness of the services we provide. We may also analyze PHI to improve the quality and efficiency of health care, for example, to assess and improve outcomes for health care conditions. We may also disclose your PHI to other HIPAA-covered entities that have provided services to you so that they can improve the quality and effectiveness of the health care services that they provide. We may use your PHI to create de-identified data, which is stripped of your identifiable data and no longer identifies you.

Business Associates. We may contract with third parties to perform certain services for us, such as billing services, copy services, or consulting services. These third-party service providers, referred to as Business Associates, may need to access your PHI to perform services for us. They are required by contract and law to protect your PHI and only use and disclose it as necessary to perform their services for us.

Health Information Exchange (HIE). We may participate in a Health Information Exchange (HIE) network, which helps members of your health care team share your health information to serve you better. For example, Community Roots Counseling, LLC, may share or receive your health information from hospitals, urgent care centers, laboratories, health care providers, public health departments, health plans, or your health insurance.

Lawsuits and Disputes. If you are involved in a lawsuit, we may disclose health information in response to a court or administrative order. We may also disclose health information about your child in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

III. CERTAIN USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION

Psychotherapy Notes. Community Roots Counseling, LLC, and its providers keep “psychotherapy notes” as that term is defined in 45 CFR § 164.501, and any use or disclosure of such notes requires your Authorization unless the use or disclosure is:

a. For use in treating you.

b. For use in training or supervising mental health practitioners to help them improve their skills in group, joint, family, or individual counseling or therapy.

c. For use in defending Community Roots Counseling, LLC, and/or its providers in legal proceedings instituted by you.

d. For use by the Secretary of Health and Human Services to investigate our compliance with HIPAA.

e. Required by law and the use or disclosure is limited to the requirements of such law.

f. Required by law for certain health oversight activities pertaining to the originator of the psychotherapy notes.

g. Required by a coroner who is performing duties authorized by law.

h. Required to help avert a serious threat to the health and safety of others.

Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part 2. If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as:

a. Medical Emergencies: to the extent necessary to treat you.

b. Reporting Crimes on Program Premises.

c. Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities.

d. Fundraising: We will provide you with an opportunity to decline to receive any fundraising communications prior to making such communications. You may revoke this consent at any time.

Prohibitions on Use and Disclosure of Part 2 Records. SUD records received from programs subject to Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent, or a court order after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD record is used or disclosed. If SUD records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.”

Marketing and Sales Purposes. Community Roots Counseling, LLC, will not use or disclose your PHI for marketing or sales purposes.

Other Uses and Disclosures. Uses and disclosures other than those described in this Notice will only be made with your written authorization.

IV. CERTAIN USES AND DISCLOSURES DO NOT REQUIRE YOUR AUTHORIZATION

Subject to certain limitations in the law, Community Roots Counseling, LLC, and its providers can use and disclose your PHI without your Authorization for the following reasons:

a. When disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of such law.

b. For public health or safety activities, including reporting suspected animal, child, elder, or dependent adult abuse or neglect, or preventing or reducing a serious threat to any animal or person’s health or safety.

c. For services or functions necessary to conduct business on our behalf through a Business Associate Agreement.

d. For health oversight activities, including audits and investigations.

e. For judicial and administrative proceedings, including responding to a court or administrative order, although our preference is to obtain an Authorization from you before doing so.

f. For law enforcement purposes, including reporting crimes occurring on the premises.

g. To coroners or medical examiners, when such individuals are performing duties authorized by law.

h. For research purposes, including studying and comparing the mental health of patients who received one form of therapy versus those who received another form of therapy for the same condition.

i. Specialized government functions, including, ensuring the proper execution of military missions; protecting the President of the United States; conducting intelligence or counterintelligence operations; or, helping to ensure the safety of those working within or housed in correctional institutions.

j. For workers' compensation purposes. Although our preference is to obtain an Authorization from you, we may provide your PHI in order to comply with workers' compensation laws.

k. Appointment reminders and health-related benefits or services. We may use and disclose your PHI to contact you to remind you that you have an appointment. We may also use and disclose your PHI to tell you about treatment alternatives, or other health care services or benefits offered by Community Roots Counseling, LLC, or its providers.

V. CERTAIN USES AND DISCLOSURES REQUIRE YOU TO HAVE THE OPPORTUNITY TO OBJECT

Disclosures to family, friends, or others. Community Roots Counseling, LLC, and/or its providers may disclose your PHI to a family member, friend, or other person that you indicate is involved in your care, or the payment for your health care, unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.

VI. YOU HAVE THE FOLLOWING RIGHTS WITH RESPECT TO YOUR PHI

The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask us not to use or disclose certain PHI for treatment, payment, or health care operations purposes. Community Roots Counseling, LLC, is not required to agree to your request, and may say “no” if it is believed it would affect your health care or mental health status.

The Right to Request Restrictions. You have the right to request, in writing, a restriction of our use or disclosure of your health information for treatment, payment, or health care operations. We are not required to agree to such restriction unless the disclosure is to a health plan for payment or health care operations and pertains solely to an item or service for which you have paid out-of-pocket in full. This does not pertain to expenses paid by you while meeting your health plan deductible.

The Right to Choose How We Send PHI to You. You have the right to ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address, and we will agree to all reasonable requests. If we cannot agree, we will notify you verbally or in writing as to the reasons why we cannot accommodate your request.

The Right to See and Get Copies of Your PHI. Other than “psychotherapy notes,” you have the right to get an electronic or paper copy of your health information. To obtain your health information, you must submit a request, in writing, to the Privacy Officer. Your request must specify a time period. We will provide you with the health information for the specified time period on one occasion at no charge. For subsequent requests, you will be charged fees as allowed by state statute. We may deny inspection and copying in limited circumstances. Community Roots Counseling, LLC, is prohibited by law from sharing information that did not originate within Community Roots Counseling, LLC, such as records obtained from third-party providers. Upon completion of a written request for personal records, we will provide you with a copy of your record, or a summary of it, if you agree to receive a summary, within 30 days of receiving your written request. If we are unable to fulfill your request within 30 days, the states of Oregon and Washington allow for an additional 30 days after notifying you of the reasons for the delay verbally or in writing.

The Right to Get a List of the Disclosures We Have Made. With the exception of certain disclosures, you have a right to receive a list of the disclosures we have made of your PHI, in the six years prior to the date of your request, to entities or individuals other than you. To request an accounting, you must submit a request, in writing, to the Privacy Officer. Your request must specify a time period. We will provide you with the list for the specified time period on one occasion at no charge. For subsequent requests, you will be charged fees as allowed by state statute.

The Right to Correct or Update Your PHI. If you believe there is a mistake in your PHI, or that a piece of important information is missing from your PHI, you have the right to request, in writing, that we correct the existing information or add the missing information. We may deny your request for an update in certain circumstances.

Right to Receive Notification of a Breach. You have the right to be notified if we discover a breach of your unsecured health information.

The Right to Get a Paper or Electronic Copy of this Notice. You have the right get a paper copy of this Notice, even if you have agreed to receive this Notice electronically.

WHERE TO OBTAIN FORMS FOR SUBMITTING WRITTEN REQUESTS

You may obtain forms for submitting written requests by contacting the Privacy Officer at Community Roots Counseling, LLC, PO Box 5312, Salem, OR 97304, or by telephone at (503) 583-2121.

FOR MORE INFORMATION OR TO REPORT A PROBLEM

If you have questions or would like additional information about Community Roots Counseling, LLC’s, privacy practices, you may contact our Privacy Officer at Community Roots Counseling, LLC, PO Box 5312, Salem, OR 97304, or by telephone at (503) 583-2121.

If you believe your privacy rights have been violated, you can file a complaint with the Privacy Officer or with the Secretary of Health and Human Services. There will be no retaliation for filing a complaint.

EFFECTIVE DATE OF THIS NOTICE

This notice went into effect on February 1, 2026.