Effective Date: September 1, 2025

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

THIS JOINT NOTICE OF PRIVACY PRACTICES ("Notice") GIVES YOU INFORMATION REQUIRED BY LAW about the obligations and privacy practices of CHILDREN'S ADVOCACY CENTERS OF TEXAS, INC. ("CACTX") and EACH LOCAL CHILDREN'S ADVOCACY CENTER (each, a "Center", and collectively with CACTX, "CACTX OHCA").

An Organized Health Care Arrangement ("OHCA") is a clinically integrated care setting, in which individuals receive healthcare from more than one healthcare provider. An OHCA can be formed between covered entities that present themselves to the public as part of a joint arrangement. An OHCA allows legally separate entities to use and disclose health information as necessary to carry out treatment, payment, and healthcare operations activities relating to the operation of the arrangement. Generally, "health information" means any information that is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and relates to the past, present, or future physical or mental health or condition of an individual, the provision of healthcare services to an individual, or payment related to the same. CACTX OHCA is organized as an OHCA and this Notice applies to the participating members described below in the section entitled, "WHO WILL FOLLOW THIS NOTICE?"

CACTX OHCA provides services relating to child abuse investigations and delivery of services, including, but not limited to, healthcare services, to children and families in partnership with local communities and governmental agencies investigating and prosecuting child abuse. CACTX OHCA receives and maintains your health information while providing these services to you, and CACTX OHCA may contract with business associates to help it provide services to you. Business associates may receive, use, and maintain your health information in the course of providing services for or on behalf of CACTX OHCA. Business associates must agree in writing to ensure the privacy and security of your health information.

Should you have any questions about this Notice, please contact the Privacy Officer for your center, whose contact info is listed at the bottom of this document.

All members of CACTX OHCA's workforce, including employees, independent contractors, volunteers, and agents, whether CACTX or your Center, will follow this Notice. This Notice applies to children's advocacy centers across Texas that are providing services relating to child abuse investigations and delivery of services, including, but not limited to, healthcare services, in partnership with local communities and governmental agencies investigating and prosecuting child abuse. Participating members of the CACTX OHCA include 70 children's advocacy centers serving

210 counties in Texas. A complete list of the participating members of the CACTX OHCA is available
upon request.

CACTX OHCA understands the importance of your health information and is committed to protecting this information. This Notice applies to all the records of your health information created or maintained by CACTX OHCA. This Notice tells you about the ways CACTX OHCA may use and disclose your health information. It also describes your rights and our obligations regarding the use and disclosure of your health information.

CACTX OHCA will:

• Maintain the privacy and security of your health information and personal information;
• Provide you with notice of our duties and privacy and security practices with respect to
  information CACTX OHCA collects and maintains about you;
• Abide by the terms of this Notice;
• Accommodate reasonable requests you may have to communicate health information by
  alternative means or at alternative locations; and
• Notify affected individuals following a breach of unsecured protected health information.

The following categories describe different ways CACTX OHCA may use and disclose your health information. These examples serve only as guidance and do not include every possible use or disclosure.

Treatment. CACTX OHCA may use and disclose your health information to other healthcare
providers or those involved in your treatment or program services.

Payment. CACTX OHCA may use and disclose your health information to pay claims for
covered healthcare services or to provide eligibility information about you when you
receive treatment.

Healthcare Operations. CACTX OHCA may use and disclose your health information for its
own operations. These uses and disclosures are necessary to operate CACTX OHCA in an
efficient manner and to ensure that all CACTX OHCA participants receive their benefits.

Health Services. CACTX OHCA may use your health information to contact you or give you
information about treatment alternatives or other program- or health-related benefits and
services that may be of interest to you. CACTX OHCA may disclose your health information
to its business associates to assist CACTX OHCA in these activities.

Business Associates. CACTX OHCA may disclose information about you without your
authorization to obtain legal, financial, or other administrative services as long as CACTX
OHCA has a business associate agreement in place with the applicable third party.

2 of 7

As Required by Law. CACTX OHCA may disclose your health information when required to do so by federal or state laws or regulations, including disclosure to Texas Health and Human Services agency to audit CACTX OHCA records.

Electronic Disclosures of Health Information. Under Texas law, CACTX OHCA is required to provide notice to you if your health information is subject to electronic disclosure. This Notice serves as general notice that CACTX OHCA may disclose your health information electronically for treatment, payment, or health care operations or as otherwise authorized or required by state or federal law.

Health Oversight Activities. CACTX OHCA may disclose your health information to a health oversight agency for activities authorized by law. Health oversight agencies include public and private agencies authorized by law to oversee healthcare providers, health plans, and the healthcare industry in general. These activities are necessary to monitor providers or plans, government programs, eligibility or compliance, and to enforce civil rights and criminal laws.

Lawsuits and Disputes. If you are involved in certain lawsuits or administrative disputes, CACTX OHCA may disclose your health information in response to certain subpoenas, a court order, or administrative order.

To Avert an Imminent Threat of Injury to Health or Safety. CACTX OHCA may use and disclose your health information when necessary to prevent or decrease a serious and imminent threat of injury to your physical, mental, or emotional health or safety or the physical safety of another person. Such disclosure would only be to medical or law enforcement personnel.

Law Enforcement. CACTX OHCA may disclose your health information if asked to do so by a law enforcement official: (i) in response to a court order or subpoena; or (ii) if there is a probability of imminent physical injury harm to you or another person or immediate mental or emotional injury to you.

Coroners, Medical Examiners, and Funeral Directors. CACTX OHCA may release your health information to a coroner or medical examiner for activities such as identifying a deceased person or determining cause of death.

Personal Representatives. CACTX OHCA may disclose your health information to personal representatives appointed by you or designated by applicable law. However, CACTX OHCA is not required to disclose your health information to your personal representative in certain instances of abuse, neglect, or where disclosure is not in your best interest.

All disclosures will be made in accordance with the requirements of Texas and federal laws and regulations.

Unless otherwise permitted or required by law, CACTX OHCA will not use or disclose your health information for any other purposes without your written authorization to do so. If you give CACTX OHCA such written authorization for a purpose not described in this Notice, then you may, in most cases, revoke such authorization in writing at any time. Your revocation will be effective for all your health information CACTX OHCA maintains, unless CACTX OHCA has already taken action in reliance on your prior authorization.

You have the following rights regarding your health information received or maintained by Centers participating in the CACTX OHCA:

Right to Inspect and Copy. Under most circumstances, you have the right to inspect and/or copy your health information maintained by CACTX OHCA. Usually, this includes medical, dental, and billing records, but does not include psychotherapy notes.

To inspect and copy your health information, you must submit your request in writing to your Center's Privacy Officer (whose contact information is listed at the bottom of this document). If you request a copy of the information, CACTX OHCA may charge a nominal, cost-based fee to carry out your request.

In certain circumstances allowed by law, CACTX OHCA may deny your request to inspect and/or copy your health information. If you are denied access to your health information, we will notify you in writing of such denial. So long as the denial is subject to review under federal law, you may request that the denial be reviewed and CACTX OHCA will comply with the outcome of such review.

Right to Amend. If you feel that your health information is incorrect or incomplete, you may ask CACTX OHCA to correct or amend the information. You have the right to request an amendment for as long as the information is kept by CACTX OHCA.

To request an amendment, your request must be made in writing and submitted to your Center's Privacy Officer (whose contact information is listed at the bottom of this document), and you must provide a reason to support your request.

CACTX OHCA may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, CACTX OHCA may deny your request if you ask us to amend any medical or dental information that:

• CACTX OHCA did not create, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical or dental information maintained by CACTX OHCA;
• Is not part of the medical or dental information you could inspect and copy; or
• Is otherwise accurate and complete.

4 of 7

If we deny your request, we will notify you of that denial in writing.

Right to an Accounting of Disclosures. You have the right to request an "accounting of
disclosures." This is a list of the disclosures made of your health information for purposes
other than treatment, payment, or healthcare operations.

To request such an accounting, you must submit your request in writing to your Center's
Privacy Officer (whose contact information is listed at the bottom of this document). Your
request must state a time period, which may not be longer than six (6) years. Your request
should indicate in what form you want the list (for example, on paper or electronically). The
first list you request within a 12-month period will be provided to you by CACTX OHCA for
free. For additional lists within the 12-month period, you may be charged for the cost of
providing the list. CACTX OHCA will notify you of the cost involved, and you may choose to
withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the health information CACTX OHCA uses or discloses about you for treatment, payment, or healthcare operations. You also have the right to request a limit on the health information CACTX OHCA uses or discloses about you to someone involved in your care or for payment of your care. However, CACTX OHCA is not required to agree to your request. Should CACTX OHCA agree to your request, CACTX OHCA will comply with your request, unless the information is needed to provide you emergency treatment or disclosure is needed for certain authorized purposes, including disclosures for law enforcement purposes, in connection with cases of abuse, neglect or domestic violence, or as otherwise required by law.

To request restrictions, you must make your request in writing to your Center's Privacy
Officer (whose contact information is listed at the bottom of this document). In your
request you may indicate: (1) what information you want to limit; (2) whether you want to
limit CACTX OHCA's use or disclosure; and (3) to whom you want the limits to apply.

Right to Request Confidential Communications. You have the right to request that CACTX OHCA communicate with you about health or program matters in a certain way or at a certain location. For example, you can ask that CACTX OHCA contact you only at work or by mail.

To request that CACTX OHCA communicate in a certain manner, you must make your
request in writing to your Center's Privacy Officer (whose contact information is listed at
the bottom of this document). You do not have to state a reason for your request. CACTX
OHCA will accommodate all reasonable requests. Your request must specify how or where
you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. To obtain a copy of this Notice, you must make your request in writing to your Center's Privacy Officer (whose contact information is listed at the bottom of this document).

5 of 7

THE EFFECTIVE DATE OF THIS NOTICE IS REFLECTED AT THE TOP OF THE PAGE. CACTX OHCA reserves the right to change its privacy and security practices and to make the new provisions effective for all health information it holds or maintains. Should our privacy and security practices change, we will post the amended Notice on your Center's website. You may request a copy by contacting your Center's Privacy Officer (whose contact information is listed at the bottom of this document).

If you believe your privacy and security rights have been violated, you may file a complaint with your Center's Privacy Officer or with the Office for Civil Rights, U.S. Department of Health and Human Services. All complaints should be submitted in writing. You will NOT be penalized for filing a complaint.

To file a complaint with your Center, contact Nick Henderson at 512-321-6161 Ext. 204. Your complaint must be filed within 180 days of when you knew or should have known that the alleged violation occurred.

Contact information for your Center's Privacy Officer is:

Children's Advocacy Center Serving Bastrop, Lee, & Fayette Counties
c/o Privacy Officer
59 Loop 150 W. Bastrop, TX 78602
512-321-6161 Ext. 204
nick.henderson@cacbastrop.org

Contact information for CACTX OHCA's Privacy Officer is:

Children's Advocacy Centers of Texas
c/o Privacy Officer
1501 W Anderson Ln, #B-1
(512) 258-9920
Info@CACTX.org

Contact information for the Office of Civil Rights is:

Office for Civil Rights
U.S. Department of Health and Human Services
1301 Young Street, Suite 1169
Dallas, Texas 75202
(214) 767-4056; (214) 767-8940 (TDD); 214.767.0432 (Fax)

7 of 7