Privacy Policy

NOTICE OF PRIVACY PRACTICES

Last revised: March 2026

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Purpose.

We respect your privacy. Wellness Together (“we”, “us” or “our”) will endeavor to maintain the privacy of your health personally identifiable information (PII) and protected health information (PHI), and describe to you how we handle that information. As part of our commitment, we are providing you with this Notice of Privacy Practices (“Notice”), which summarizes the privacy practices of Wellness Together, including its divisions, and describes how health information about you may be used and disclosed by us and how you can get access to this information. Please review it carefully.

In order to protect the privacy of your personally identifiable information (PII) and protected health information (PHI), we follow the requirements of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA), as applicable. We are also legally required to maintain the privacy of your PII and PHI under applicable state privacy laws, including when they are stricter or more protective of your PII and PHI than federal law.

As part of our commitment and legal compliance, we are providing you with this Notice. This Notice describes:

  • Our legal duties and privacy practices regarding your PII and PHI, including our duty to notify you following a data breach of your unsecured PII and PHI;

  • Our permitted uses and disclosures of your PII and PHI; and

  • Your rights regarding your PII and PHI.

2. Contact.

If you have any questions about this Notice, please contact the Privacy Officer at info@wellnesstogether.org or call (877) 412-8031

3. Scope.

We create a record of the care and health services you receive, to provide your care, and to comply with certain legal requirements. This Notice applies to all the PII and PHI that we generate and, if applicable, to substance use treatment-related records (substance use treatment records) under 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (Part 2) that we receive or maintain. We also follow the confidentiality protections of Part 2 for such records. We and our employees and other workforce members follow the duties and privacy practices that this Notice describes and any changes once they take effect.

4. Changes to this Notice.

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available on request, in our office, and on our website. 1869981.6

5. Our Responsibilities.

We will: 5.1. maintain the privacy and security of your PII and PHI. Only authorized personnel with legitimate need may access these records; 5.2. assure that you are notified if a breach occurs that may have compromised the privacy or security of your PII or PHI; 5.3. follow the duties and practices described in this Notice and provide you with a copy; and 5.4. not use or share your information other than as described here without your authorization. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

6. FERPA.

6.1. Our Role. This Notice of Privacy Practices describes how [Organization Name], as a contractor providing mental health services to students on behalf of [School/School District Name], handles and protects student education records in accordance with the Family Educational Rights and Privacy Act (FERPA). FERPA is a federal law that protects the privacy of student education records maintained by educational agencies or institutions that receive federal funding from the U.S. Department of Education. As a contractor designated as a “school official” under FERPA, we are committed to safeguarding the confidentiality of student information while delivering essential mental health services.

Wellness Together is contracted by certain schools and school districts (each a “School”) to provide mental health services, such as counseling, therapy, and support, to eligible students. In this capacity, we may create, receive, or maintain education records that include PII about students, such as notes from counseling sessions, treatment plans, or other health-related information directly related to the student’s education. Under FERPA, we are considered a “school official” with a legitimate educational interest in these records when:

  • We perform services that the School would otherwise provide using its own employees.

  • We access only the information necessary to fulfill our contractual obligations.

  • We operate under the direct control of the School regarding the use and maintenance of these records.

We comply with all FERPA requirements as if we were part of the School itself, including restrictions on the use and disclosure of student education records. For more information on FERPA, see: https://studentprivacy.ed.gov/ferpa.

6.2. Educational Records and PII.

(a) Educational Records. Education records are records that:

(i) Contain information directly related to a student.

(ii) Are maintained by the school or by us on the school's behalf.

This may include mental health records if they are part of the student's overall education file. However, certain records, such as sole-possession notes used only as personal memory 1869981.6 aids by our staff (and not shared with others except temporary substitutes), are not considered education records under FERPA.

(b) PII. PII includes details like the student's name, address, date of birth, or other identifiers that could reveal the student's identity.

6.3. Rights Under FERPA.

FERPA affords parents and students who are 18 years of age or older (“eligible students”) certain rights with respect to the student’s education records.

(a) Right to Inspect and Review Records: You have the right to inspect and review the student’s education records within 45 days of submitting a written request to the School or to us. We will coordinate with the School to arrange access. If records are not physically accessible, copies may be provided at a reasonable cost.

(b) Right to Request Amendment: If you believe the education records contain inaccurate or misleading information, you may request an amendment in writing. We or the school will review the request and notify you of the decision. If the request is denied, you have the right to a hearing and to place a statement in the record explaining your disagreement.

(c) Right to Consent to Disclosures: Generally, we must obtain your written consent before disclosing PII from education records. Consent must specify the records to be disclosed, the purpose, and the recipient. However, FERPA allows disclosures without consent in certain situations, including:

(i) To other school officials (including our staff) with a legitimate educational interest.

(ii) To comply with a judicial order or lawfully issued subpoena.

(iii) In connection with a health or safety emergency, if the information is necessary to protect the student or others.

(iv) To officials for audit or evaluation purposes related to education programs.

(v) To appropriate parties in response to a student’s involvement in a disciplinary proceeding (e.g., for violent crimes or nonforcible sex offenses).

(vi) Directory information (if the school has designated it as such and you have not opted out), which may include basic details like the student’s name, grade level, or honors. We will not redisclose PII without authorization, except as permitted by FERPA. Any unauthorized disclosure may result in the school restricting our access to records for at least five years.

(d) Right to File a Complaint: The right to file a complaint with the U.S. Department of Education concerning alleged failures by the School to comply with the requirements of FERPA. The name and address of the Office that administers FERPA are:

Student Privacy Policy Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, DC 20202

1869981.6

6.4. How We Use and Disclose Information.

(a) Uses for Treatment and Services: We use student education records to provide mental health services, coordinate care with school staff, and support the student’s educational needs.

(b) Disclosures to the School: We may share information with school officials as needed for educational purposes, such as reporting on student progress or addressing behavioral concerns.

(c) Emergency Situations: In an emergency, we may disclose information to protect the health or safety of the student or others, limited to what is necessary.

(d) No Marketing or Sale of Information: We do not use or disclose student information for marketing purposes or sell it to third parties.

(e) Compliance with Other Laws: Mental health records may also be subject to state confidentiality laws or, in some cases, the Health Insurance Portability and Accountability Act (HIPAA) if we are a covered entity. If HIPAA is applicable, then Section 7 below applies.

7. HIPAA.

7.1. PHI Defined. Your PHI:

  • Is health information about you:

  • which someone may use to identify you; and

  • which we keep or transmit in electronic, oral, or written form.

  • Includes information such as your:

  • name;

  • contact information;

  • past, present, or future physical or mental health or medical conditions;

  • payment for health care products or services; or

  • prescriptions.

7.2. Your Rights under HIPAA. When it comes to your health information, you have certain

rights. This section explains your rights and some of our responsibilities to help you.

(a) Get an copy of your medical record.

(i) You can ask to see or get an electronic or paper copy of your record and other health information we have about you.

(ii) You have to put your request in writing and we will provide you with access to your record.

(iii) We will provide a copy or, if you prefer, a summary of your health information, within the timeline required by law. We may charge a reasonable, cost-based fee.

(b) Ask us to correct your medical record. You can ask us to correct health information about you that you think is incorrect or incomplete. You have to put your request in writing. We may say “no” to your request, but we will tell you why in writing.

(c) Request confidential communications. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We require you to 1869981.6 ask us in writing, and we will honor any reasonable request.

(d) Ask us to limit what information we share.

(i) You can ask us, in writing, not to use or share certain health information for treatment, payment or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.

(ii) If you pay for a service or healthcare item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

(e) Get a list of those with whom we’ve shared information.

(i) You can ask for a list (accounting) of the times we’ve shared your health information for up to six years prior to the date you ask, with whom we’ve shared it and why.

(ii) We will include all the disclosures except for those about treatment, payment, and healthcare operations, and certain other disclosures, such as any you asked us to make. We’ll provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

(f) Get a copy of this privacy notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

(g) Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

(h) File a complaint if you feel your rights are violated. If you feel we have violated your rights, you may complain by contacting us at our Contact Information below.

(i) You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

(ii) We will not retaliate against you for filing a complaint.

7.3. Your Choices. For certain health information, you can tell us your choices about what we share. Let us know if you have a clear preference for how we share your information in the situations described below. We will follow your instructions where we can.

(a) In these cases, you have both the right and choice to tell us to:

(i) Share (or not share) information with your family, close friends or others involved in your care;

(ii) Share information in a disaster relief situation; or

(iii) Include you in a hospital directory. 1869981.6

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

(b) In the cases below, we never share your information unless we have received your written permission:

(i) Market our services and sell your information;

(ii) Certain research activities;

(iii) Most sharing of psychotherapy notes; or

(iv) Other uses and disclosures not described in this Notice.

Please note that you may revoke your authorization at any time, but it will not affect information that we already used and disclosed.

(c) In the case of fundraising:

(i) We may contact you for fundraising efforts, but you can tell us not to contact you again. If we have your substance use disorder patient records, subject to 42 CFR part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use your Part 2 information.

7.4. Our Uses and Disclosures. We use or share your health information in the following ways.

(a) Treatment. We can use your health information and share it with other professionals to provide you with mental health and related services, which you receive from us directly or a contracted provider.

(b) Run our organization. We can use and share your health information to run our organization, improve your care, and contact you when necessary. For example, we may use your health information to review provider performance, comply with laws and regulations, or to manage your treatment and services.

(c) Bill for your services. We can use and share your health information to bill and get payment from health plans or other entities.

7.5. Other Ways to Use or Share Your Health Information.

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. In all cases, including those listed below, if we have substance use disorder patient records about you, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.

(a) Help with public health and safety issues. We can share health information about 1869981.6 you for certain situations such as: Preventing disease; Helping with product recalls; Reporting adverse reactions to medications; Reporting suspected abuse, neglect or domestic violence; or Preventing or reducing a serious threat to anyone’s health or safety.

(b) Do research. We can use or share your health information for health research.

(c) Comply with the law. We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

(d) Disclosures to parents or legal guardians. We may release a minor’s health information to their parents or legal guardians consistent with applicable laws

(e) Health oversight activities. We may disclose your health information to a health oversight agency for activities authorized by law, including audits, investigations, inspections, and licensure.

(f) Legal activities. We may share your health information in response to a court or administrative order; a subpoena; a workers’ compensation claim; a law enforcement request; or in connection with special government functions such as military, national security, and presidential protective services. If you are or become an inmate of a correctional institution, we may disclose your health information to the institution or its agents for your health and the health and safety of others.

(g) Respond to lawsuits and legal actions. We can share health information about you in response to a court or administrative order, or in response to a subpoena. To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

(h) Health Information Exchange. We participate in health information exchanges (HIEs), which support electronic information sharing among members for treatment, payment, and health care operations purposes.

(i) Business Associates. There may be some services provided in our organization through contracts with business associates. Examples include transcribing your health record, surveying for patient satisfaction, or a copy service we use when making copies of your health record. When services are provided by contracted business associates, we may disclose the appropriate portions of your health information to them so they can perform the job we have asked them to do. However, our business associates are also required by law to safeguard your information.

(j) Other Uses of Health Information. Uses and disclosures of health information that are not discussed by this notice or required by law will only be made with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time.

7.6. Information: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.