15203 NE 72nd Ave, Vancouver, WA 98686

Notice of Privacy Practices for Protected Health Information Effective October 9, 2025

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and disclosed, and how you can access this information. Please review it carefully.

The Villa Health PLLC ("we," "our," or "The Villa Health") is committed to protecting your privacy. As a provider of integrated behavioral health, addiction medicine, aesthetic services, and wellness care, we are required by law to keep your information confidential and secure under federal and state law. We are required by law (45 CFR Parts 160 and 164) to maintain the privacy and security of your protected health information ("PHI").

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. You can contact our Privacy Officer using the information at the end of this notice to make any of these requests.

We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee. Fee details are available upon request. You may also direct us, in writing, to send a copy of your health information to another person or entity of your choice, if you clearly identify the recipient and where to send the information.

Ask us to correct your medical record

You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.

We may say "no" to your request, but we'll tell you why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.

We will say "yes" to all reasonable requests. For example, you can ask us to send mail to your work address instead of your home, or contact you only on your cell phone.

Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say "no" if it would affect your care.

If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say "yes" unless a law requires us to share that information.

Get a list of those with whom we've shared information

You can ask for a list (accounting) of the times we've shared your health information for six years prior to the date you ask, who we shared it with, and why.

We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make

We'll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this privacy notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.

We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated

You can complain if you feel we have violated your rights by contacting us using the information at the end of this notice.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

You may also file a complaint with your state agency:

• Washington: Washington State Department of Health, Health Systems Quality Assurance, P.O. Box 47857, Olympia, WA 98504-7857, phone 360-236-4700
• Oregon: Oregon Health Authority, Health Care Regulation and Quality Improvement, 800 NE Oregon Street, Suite 465, Portland, OR 97232, phone 971-673-0540

We will not retaliate against you for filing a complaint.

Your Choices 

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation
• Include your information in a hospital directory (if applicable)

If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we never share your information unless you give us written permission or as otherwise permitted by law.

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

Our Uses and Disclosures / How do we typically use or share your health information?

Treat you

We can use your health information and share it with other professionals who are treating you. Example: A provider treating you for depression asks another provider about your overall health condition.

Run our health care operations

We use health information to review the quality of our services and improve coordination of care. Example: We use health information to evaluate provider performance and enhance service quality.

Bill for your services

We can use and share your health information to bill and get payment from health plans or other entities. Example: We give information about you to your health insurance plan so it will pay for your services.

Other limited situations where we may be required or permitted to share information In certain limited situations, federal or state law may require us to share your health information - for example, to protect public health or to comply with a court order.

We do not share your information for these reasons unless the law specifically allows or requires it, and we make sure that only the minimum necessary information is disclosed.

These situations include:

• Public health and safety: To help prevent disease, report suspected abuse or neglect, report adverse medication reactions, recall products, or reduce a serious and imminent threat to health or safety.
• Legal and compliance obligations: To comply with laws, respond to lawful requests such as subpoenas or court orders, or to cooperate with government oversight or audits.
• Organ and tissue donation: To respond to organ and tissue donation requests.
• Coroner, medical examiner, or funeral director: To identify a deceased person or determine the cause of death.
• Workers' compensation and law enforcement: When required to meet legal reporting obligations.
• Telehealth and Electronic Communication: The Villa Health may use secure telehealth platforms to deliver care. We take steps to protect your privacy when using electronic communication, including encrypted video sessions and secure messaging. We will not record sessions without your written consent.

Fundraising: The Villa Health does not use or share your information for fundraising purposes.

For more information about when sharing may be required by law, visit www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html

Our Responsibilities

We are required by law to maintain the privacy and security of your protected health information.

We will notify you promptly, and no later than 60 days after discovery, if a breach occurs that may have compromised your information.

We must follow the duties and practices described in this notice and provide you with a copy. You may also request that your medical records be provided in electronic format if they are available electronically, consistent with federal law (HITECH Act

We will not use or share your information other than as described here unless you give us written permission. If you do, you may change your mind at any time in writing.

Special Notes for Behavioral Health and State Law

Psychotherapy Notes: These are given special protection under HIPAA and will not be shared without your written authorization except where required by law. Psychotherapy notes are separate from your medical record and include your therapist's personal notes from counseling sessions.

42 CFR Part 2 (Substance Use Disorder Records): Substance use disorder treatment records are specially protected and cannot be disclosed without your written permission, except as permitted by law. Redisclosure of these records without your consent is prohibited. Any disclosure of substance use disorder treatment information is protected by federal law (42 CFR Part 2 The recipient of this information is prohibited from redisclosing it unless expressly permitted by your written consent or as otherwise allowed by 42 CFR Part 2. A general authorization for the release of medical or other information is not sufficient for this purpose.

Washington State (RCW 71.34, RCW 70.02): Youth age 13 and older may consent to their own mental health and substance use treatment. Parents/guardians cannot access these records without youth authorization unless required by law. Providers may, but are not required to, share certain limited information with parents or guardians if it is clinically appropriate and necessary to prevent a serious harm to the youth or others, consistent with RCW 71.34.530.

Oregon (ORS 109.675): Youth age 14 and older may consent to their own outpatient mental health or substance use treatment. Providers must attempt to involve parents before the end of treatment unless refused or clinically inappropriate. Parents do not have automatic access to youth records without the youth's written authorization, except as required by law.

Redisclosure Prohibited: Both WA and OR law prohibit redisclosure of mental health and substance use records without specific written consent.

Changes to the Terms of This Notice We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our website.

Non-Discrimination and Accessibility Notice The Villa Health PLLC complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex. Language assistance services and auxiliary aids are available free of charge. If you need these services, contact 360-209-4449 or contact@thevillahealth.com

Contact Information

• Privacy Officer: Chief Operating Officer/Privacy Officer
• Phone: 360-209-4449
• Email: contact@thevillahealth.com
• Address: The Villa Health PLLC, 15203 NE 72nd Ave, Vancouver, WA, 98686

Acknowledgment of Receipt of Notice of Privacy Practices

HIPAA requires us to make a good faith effort to obtain your written acknowledgment that you have received a copy of our Notice of Privacy Practices (45 CFR $164.520(c2 You are not required to sign.

I acknowledge that I have received a copy of The Villa Health PLLC's Notice of Privacy Practices.