Notice of Privacy Practices

Effective Date: January 1, 2026

Our Commitment to Your Privacy

Nūr Behavioral Health ("Nūr," "we," "us," or "our") is required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other applicable federal and state laws to:

• Maintain the privacy of your Protected Health Information ("PHI")
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Notify you following a breach of unsecured PHI
• Abide by the terms of the Notice currently in effect

What Is Protected Health Information?

Protected Health Information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for that care. For our pediatric clients, PHI includes information about your child created or received by Nūr.

How We May Use and Disclose Your Health Information Without Your Authorization

We may use and disclose your PHI for the following purposes without requiring your written authorization:

1. Treatment

We may use and disclose PHI to provide, coordinate, or manage your child's care and related services. For example, we may share information with your child's primary care physician, school IEP team, pediatrician, or other behavioral, speech, or occupational therapists involved in your child's care, when such coordination is necessary for treatment.

2. Payment

We may use and disclose PHI to obtain payment for the services we provide. This may include sharing information with your insurance company to verify benefits, obtain prior authorizations, submit claims, or appeal denied claims.

3. Healthcare Operations

We may use and disclose PHI for our internal operations, including quality improvement, staff training and supervision, clinical audits, accreditation, licensing, credentialing, business planning, and customer service activities.

4. Business Associates

We may share PHI with third-party "business associates" who perform services on our behalf — such as billing companies, electronic health record vendors, accountants, attorneys, or IT providers. Each business associate is required by written contract to protect your PHI in accordance with HIPAA.

5. As Required by Law

We will use or disclose PHI when required to do so by federal, state, or local law.

6. Public Health Activities

We may disclose PHI for public health activities, such as preventing or controlling disease, reporting child abuse or neglect, or reporting adverse reactions to medications.

7. Victims of Abuse, Neglect, or Domestic Violence

As mandated reporters under Florida law, we are required to report suspected abuse, neglect, or exploitation of children or vulnerable adults to the appropriate state authorities.

8. Health Oversight Activities

We may disclose PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, and licensure.

9. Judicial and Administrative Proceedings

We may disclose PHI in response to a court order, subpoena, or other lawful process, subject to applicable legal protections.

10. Law Enforcement

We may disclose PHI to law enforcement officials as required by law or in response to a valid legal process.

11. To Avert a Serious Threat to Health or Safety

We may use or disclose PHI when necessary to prevent a serious and imminent threat to the health or safety of a person or the public.

12. Workers' Compensation

We may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or similar programs.

13. Military, National Security, and Other Specialized Government Functions

We may disclose PHI as required by military command authorities or for national security and intelligence activities authorized by law.

Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of PHI not described above will be made only with your written authorization. Specifically, the following always require your authorization:

• Psychotherapy notes (with limited exceptions)
• Marketing communications for which we receive payment from a third party
• Sale of PHI
• Any other use or disclosure not otherwise permitted by law

You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.

Special Protections for Minors

For clients who are minors, PHI is generally accessible to the parent or legal guardian who has the right to consent to treatment. In cases of divorce, joint custody, or other complex custody arrangements, both parents may have access rights unless a court order specifies otherwise. We may request documentation of legal custody before releasing information.

Your Rights Regarding Your Health Information

You have the following rights with respect to PHI we maintain about you or your child:

Right to Inspect and Copy

You have the right to inspect and obtain a copy of PHI in our designated record set, generally for as long as we maintain it. We may charge a reasonable, cost-based fee for copies. Requests must be made in writing. We will respond within 30 days (with one 30-day extension if needed). We may deny access in limited circumstances permitted by law, and you may have the right to request a review of any denial.

Right to Request Amendment

You have the right to request that we amend PHI you believe is incorrect or incomplete. Requests must be in writing and include the reason for the amendment. We may deny your request under certain circumstances (e.g., the information was not created by us, or it is accurate and complete).

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your PHI in the six years prior to your request. This does not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests.

Right to Request Restrictions

You have the right to request a restriction on the use or disclosure of your PHI for treatment, payment, or healthcare operations, or to family members or others involved in your care. We are not required to agree to your request, except that we must agree to a request to restrict disclosure to a health plan when the disclosure is for payment or healthcare operations and pertains solely to a healthcare item or service you paid for in full out-of-pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a specific way or at a specific location (e.g., only by mail at a specific address, or only by phone at work). We will accommodate reasonable requests.

Right to Notification of a Breach

You have the right to be notified following a breach of your unsecured PHI.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. You may request a copy by contacting our Privacy Officer (below).

Our Duties

• We are required by law to maintain the privacy of PHI and to provide you with this Notice of our legal duties and privacy practices.
• We are required to abide by the terms of the Notice currently in effect.
• We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain, including information created or received before the change. The revised Notice will be posted in our office and on our website.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal government. You will not be retaliated against, penalized, or treated differently for filing a complaint.

To file a complaint with Nūr Behavioral Health:

Contact our Privacy Officer using the information below. Complaints should be submitted in writing.

To file a complaint with the federal government:

Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Web: www.hhs.gov/ocr

Contact Information / Privacy Officer

If you have questions about this Notice, want more information about our privacy practices, or wish to exercise any of your rights, please contact our Privacy Officer:

Privacy Officer — Nūr Behavioral Health
316 E Bloomingdale Ave, Brandon FL 33511
Phone: (656) 222-0703
Email: [email protected]

Acknowledgment

By signing our intake form or by acknowledging receipt of this Notice, you confirm that you have received a copy of this Notice of Privacy Practices. Your acknowledgment does not waive any of your rights described above.

---

This Notice may be updated periodically. The current version is always available at nurbhealth.com/notice-of-privacy-practices.html. For the most recent printed copy, please contact our office.