Notice of Privacy Practices of Candace Cross Counseling, LLC

I. COMMITMENT TO YOUR PRIVACY:
Your providers at Candace Cross Counseling, LLC are dedicated to maintaining the privacy of your protected health information (PHI). PHI is information that may identify you and that relates to your past, present or future physical or mental health condition and related health care services either in paper or electronic format. This Notice of Privacy Practices (“Notice”) is required by law to provide you with the legal duties and the privacy practices that Candace Cross Counseling, LLC/ your therapist maintains concerning your PHI. It also describes how medical and mental health information may be used and disclosed, as well as your rights regarding your PHI. Please read carefully and discuss any questions or concerns with your therapist.

II. LEGAL DUTY TO SAFEGUARD YOUR PHI: By federal and state law, Candace Cross Counseling, LLC/ your therapist is required to ensure that your PHI is kept private. This Notice explains when, why, and how Candace Cross Counseling, LLC/ your therapist would use and/or disclose your PHI. Use of PHI means when Candace Cross Counseling, LLC/ your therapist shares, applies, utilizes, examines, or analyzes information within its practice; PHI is disclosed when Candace Cross Counseling, LLC/ your therapist releases, transfers, gives, or otherwise reveals it to a third party outside of the Candace Cross Counseling, LLC. With some exceptions, Candace Cross Counseling, LLC/ your therapist may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, Candace Cross Counseling, LLC/ your therapist is always legally required to follow the privacy practices described in this Notice.

III. CHANGES TO THIS NOTICE: The terms of this notice apply to all records containing your PHI that are created or retained by Candace Cross Counseling, LLC/ your therapist. Please note that Candace Cross Counseling, LLC reserves the right to revise or amend this Notice of Privacy Practices. Any revision or amendment will be effective for all of your records that Candace Cross Counseling, LLC has created or maintained in the past and for any of your records that Candace Cross Counseling, LLC may create or maintain in the future. Candace Cross Counseling, LLC/ your therapist will always have a copy of the current Notice in the office in a visible location or available to you on the website www.candacecrosscounseling.com. You may request a copy of the most current Notice at any time. The date of the latest revision will always be listed at the end of Candace Cross Counseling, LLC Notice of Privacy Practices.

IV. HOW CANDACE CROSS COUNSELING MAY USE AND DISCLOSE YOUR PHI: Candace Cross Counseling, LLC/ your therapist will not use or disclose your PHI without your written authorization, except as described in this Notice or as described in the “Information, Authorization and Consent to Treatment” document. Below you will find the different categories of possible uses and disclosures with some examples.
1. For Treatment: Candace Cross Counseling, LLC/ your therapist may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are; otherwise involved in your care. Example: If you are also seeing a psychiatrist for medication management, Candace Cross Counseling, LLC / your therapist may disclose your PHI to her/him in order to coordinate your care. Except for in an emergency, Candace Cross Counseling, LLC/ your therapist will always ask for your authorization in writing prior to any such consultation.
2. For Health Care Operations: Candace Cross Counseling, LLC/ your therapist may disclose your PHI to facilitate the efficient and correct operation of its practice, improve your care, and contact you when necessary. Example: We use health information about you to manage your treatment and services.
3. To Obtain Payment for Treatment: Candace Cross Counseling, LLC/ your therapist may use and disclose your PHI to bill and collect payment for the treatment and services Candace Cross Counseling, LLC/ your therapist provided to you. Example: Candace Cross Counseling, LLC might send your PHI to your insurance company or managed health care plan in order to get payment for the health care services that have been provided to you. Candace Cross Counseling, LLC could also provide your PHI to billing companies, claims processing companies, and others that process health care claims for Candace Cross Counseling, LLC’s office if either you or your insurance carrier are not able to stay current with your account. In this latter instance, Candace Cross Counseling, LLC/ your therapist will always do its best to reconcile this with you first prior to involving any outside agency.
4. Employees and Business Associates: There may be instances where services are provided to Candace Cross Counseling, LLC/ your therapist by an employee or through contracts with third-party “business associates.” Whenever an employee or business associate arrangement involves the use or disclosure of your PHI, Candace Cross Counseling, LLC/ your therapist will have a written contract that requires the employee or business associate to maintain the same high standards of safeguarding your privacy that is required of Candace Cross Counseling, LLC/ your therapist.

 

Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part 2:
If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as: (a) Medical Emergencies: to the extent necessary to treat you, (b) Reporting Crimes on Program Premises, (c) Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities, and
(d) Fundraising: We will provide you with an opportunity to decline to receiveany fundraising communications prior to making such communications.
You may revoke this consent at any time.

 

Prohibitions on Use and Disclosure of Part 2 Records:
SUD records received from programs subject to Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal,
administrative, or legislative proceedings against you unless based on your written consent, or a court order after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD record is used or disclosed. If SUD records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

Note: Kentucky and Federal law provides additional protection for certain types of health information, including alcohol or drug abuse, mental health and AIDS/HIV, and may limit whether and how Candace Cross Counseling, LLC/ your therapist may disclose information about you to others.

 

To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

V. USE AND DISCLOSURE OF YOUR PHI IN CERTAIN SPECIAL CIRCUMSTANCES – Candace Cross Counseling, LLC/ your therapist may use and/or disclose your PHI without your consent or authorization for the following reasons:

1. Law Enforcement and Other Government Requests: Subject to certain conditions, Candace Cross Counseling, LLC/ your therapist may disclose your PHI when required by federal, state, or local law; judicial, board, or administrative proceedings; or law enforcement. Example: Candace Cross Counseling, LLC/ your therapist may make a disclosure to the appropriate officials when a law requires Candace Cross Counseling, LLC/ your therapist to report information to government agencies, law enforcement personnel and/or in an administrative proceeding. We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
2. Lawsuits and Disputes: Candace Cross Counseling, LLC/ your therapist may disclose information about you to respond to a court or administrative order or a search warrant. Candace Cross Counseling, LLC/ your therapist may also disclose information if an arbitrator or arbitration panel compels disclosure, when arbitration is lawfully requested by either party, pursuant to subpoena duces tectum (e.g., a subpoena for mental health records) or any other provision authorizing disclosure in a proceeding before an arbitrator or arbitration panel. We can share health information about you in response to a court or administrative order, or in response to a subpoena. Candace Cross Counseling, LLC/ your therapist will only do this if efforts have been made to tell you about the request and you have been provided an opportunity to object or to obtain an appropriate court order protecting the information requested.
3. Public Health Risks: Candace Cross Counseling, LLC/ your therapist may disclose your PHI (that does not identify you) to public health or legal authorities charged with preventing or controlling disease, injury, disability, as mandated by law. This would include, for example, the reporting of a disease or injury; reporting vital events, such as births or deaths; and conducting public health surveillance, investigations, or interventions. See 45 CFR 164.512(b)(1)(i). Also, covered entities may, at the direction of a public health authority, disclose protected health information to a foreign government agency that is acting in collaboration with a public health authority.
4. Food and Drug Administration (FDA): Candace Cross Counseling, LLC/ your therapist may, to disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
5. Serious Threat to Health or Safety: Candace Cross Counseling, LLC/ your therapist may disclose your PHI if you are in such mental or emotional condition as to be dangerous to yourself or the person or property of others, and if Candace Cross Counseling, LLC/ your therapist determines in good faith that disclosure is necessary to prevent the threatened danger. Under these circumstances, Candace Cross Counseling, LLC/ your therapist may provide PHI to law enforcement personnel or other persons able to prevent or mitigate such a serious threat to the health or safety of a person or the public. We can share health information about you for certain situations such as:

• Preventing disease

• Helping with product recalls

• Reporting adverse reactions to medications

• Reporting suspected abuse, neglect, or domestic violence*

• Preventing or reducing a serious threat to anyone’s health or safety

*Kentucky’s mandatory reporting law for victims of domestic violence has been changed to a mandatory information and referral provision. The revised law requires certain professionals to provide educational material to victims of domestic and dating violence with whom they have had a professional interaction. This law also requires these same professionals to make a report to police IF requested to by the victim and to report to police if they believe that the death of a victim may be related to domestic or dating violence.

6. Minors: If you are a minor (under 18 years of age), Candace Cross Counseling, LLC/ your therapist may be compelled to release certain types of information to your parents or guardian in accordance with applicable law.
7. Abuse and Neglect: Candace Cross Counseling, LLC/ your therapist may disclose PHI if mandated by Kentucky child, elder, or dependent adult abuse and neglect reporting laws. Example: If Candace Cross Counseling, LLC/ your therapist has a reasonable suspicion of child abuse or neglect, your therapist will report this to the Kentucky Department of Child and Family Services.
8. Coroners, Medical Examiners, and Funeral Directors: Candace Cross Counseling, LLC/ your therapist may release PHI about you to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person, determine the cause of death or other duties as authorized by law. Candace Cross Counseling, LLC/ your therapist may also disclose PHI to funeral directors, consistent with applicable law, to carry out their duties.
9. Communications with Family, Friends, or Others: Candace Cross Counseling, LLC/ your therapist may release your PHI to the person you named in your Durable Power of Attorney for Health Care (if you have one), to a friend or family member who is your personal representative (i.e., empowered under state or other law to make health-related decisions for you), or any other person you identify, relevant to that person’s involvement in your care or payment related to your care. In addition, Candace Cross Counseling, LLC/ your therapist may disclose your PHI to an entity assisting in disaster relief efforts so that your family can be notified about your condition.
10. Military and Veterans: If you are a member of the armed forces, Candace Cross Counseling, LLC/ your therapist may release PHI about you as required by military command authorities. Candace Cross Counseling, LLC/ your therapist may also release PHI about foreign military personnel to the appropriate military authority.
11. National Security, Protective Services for the President, and Intelligence Activities: Candace Cross Counseling, LLC/ your therapist may release PHI about you to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state, to conduct special investigations for intelligence, counterintelligence, and other national activities authorized by law.
12. Correctional Institutions: If you are or become an inmate of a correctional institution, Candace Cross Counseling, LLC/ your therapist may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others
13. For Research Purposes: In certain limited circumstances, Candace Cross Counseling, LLC/ your therapist may use information you have provided for medical/psychological research, but only with your written authorization. The only circumstance where written authorization would not be required would be if the information you have provided could be completely disguised in such a manner that you could not be identified, directly or through any identifiers linked to you. The research would also need to be approved by an institutional review board that has examined the research proposal and ascertained that the established protocols have been met to ensure the privacy of your information.
14. For Workers' Compensation Purposes: Candace Cross Counseling, LLC/ your therapist may provide PHI in order to comply with Workers' Compensation or similar programs established by law. The Privacy Rule permits covered entities to disclose protected health information to workers’ compensation insurers, State administrators, employers, and other persons or entities involved in workers’ compensation systems, without the individual’s authorization:

• As authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs established by law that provide benefits for work-related injuries or illness without regard to fault.

• To the extent the disclosure is required by State or other law. The disclosure must comply with and be limited to what the law requires. See 45 CFR 164.512(a).

• For purposes of obtaining payment for any health care provided to the injured or ill worker. See 45 CFR 164.502(a)(1)(ii) and the definition of “payment” at 45 CFR 164.501.

15. Appointment Reminders: Candace Cross Counseling, LLC/ your therapist is permitted to contact you, without your prior authorization, to provide appointment reminders.

16. Health Oversight Activities: Candace Cross Counseling, LLC/ your therapist may disclose health information to a health oversight agency for activities such as audits, investigations, inspections, or licensure of facilities. These activities are necessary for the government to monitor the health care system, government programs and compliance with laws. Example: When compelled by U.S. Secretary of Health and Human Services to investigate or assess Candace Cross Counseling, LLC’s / your therapist’s compliance with HIPAA regulations.
17. If Disclosure is Otherwise Specifically Required by Law.

18. Respond to organ and tissue donation requests: We can share health information about you with organ procurement organizations.

19. Work with a medical examiner or funeral director: We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

20. To Prevent or Reduce Crime in Our Program: We may report to law enforcement when a patient commits or threatens to commit a crime within our program or against our staff.
21. In the Following Cases, Candace Cross Counseling, LLC/ Your Therapist Will Never Share Your Information Unless You Give us Written Permission: Marketing purposes, sale of your information, most sharing of psychotherapy notes, and fundraising. If we contact you for fundraising efforts, you can tell us not to contact you again. If we have your substance use disorder patient records, subject to 42 CFR part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use your Part 2 information.

VI. OTHER USES AND DISCLOSURES REQUIRE YOUR PRIOR WRITTEN AUTHORIZATION: In any other situation not covered by this notice, Candace Cross Counseling, LLC/ your therapist will ask for your written authorization before using or disclosing medical information about you. If you chose to authorize use or disclosure, you can later revoke that authorization by notifying Candace Cross Counseling, LLC/ your therapist in writing of your decision. You understand that Candace Cross Counseling, LLC/ your therapist is unable to take back any disclosures it has already made with your permission, Candace Cross Counseling, LLC/ your therapist will continue to comply with laws that require certain disclosures, and Candace Cross Counseling, LLC/ your therapist is required to retain records of the care that its therapists have provided to you.

If we have substance use disorder patient records about you, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.

 

VII. RIGHTS YOU HAVE REGARDING YOUR PHI:
1. The Right to See and Get Copies of Your PHI either in paper or electronic format: In general, you have the right to see your PHI that is in Candace Cross Counseling, LLC’s / your therapist’s possession, or to get copies of it; however, you must request it in writing. If Candace Cross Counseling, LLC/ your therapist does not have your PHI, but knows who does, you will be advised how you can get it. You will receive a response from Candace Cross Counseling, LLC/ your therapist within 30 days of receiving your written request. Under certain circumstances, Ms Cross/ Your Therapist/ Candace Cross Counseling, LLC may feel your request must be denied, but if so, Candace Cross Counseling, LLC/ your therapist will give you, in writing, the reasons for the denial. Candace Cross Counseling, LLC/ your therapist will also explain your right to have its denial reviewed. If you ask for copies of your PHI, you will be charged a reasonable fee per page and the fees associated with supplies and postage. Candace Cross Counseling, LLC/ your therapist may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.
2. The Right to Request Limits on Uses and Disclosures of Your PHI: You have the right to ask that Candace Cross Counseling, LLC/ your therapist limit how it uses and discloses your PHI. While Candace Cross Counseling, LLC/ your therapist will consider your request, it is not legally bound to agree. If Candace Cross Counseling, LLC/ your therapist does agree to your request, it will put those limits in writing and abide by them except in emergency situations. You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no,” for example, if it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. You do not have the right to limit the uses and disclosures that Candace Cross Counseling, LLC/ your therapist is legally required or permitted to make.
3. The Right to Choose How Candace Cross Counseling, LLC/ your therapist Sends Your PHI to You/ The Right to Request Confidential Communication: It is your right to ask that your PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via email instead of by regular mail). Candace Cross Counseling, LLC/ your therapist is obliged to agree to your request providing that it can give you the PHI, in the format you requested, without undue inconvenience. You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address. We will say “yes” to all reasonable requests.
4. The Right to Get a List of the Disclosures. You are entitled to a list of disclosures of your PHI that Candace Cross Counseling, LLC/ your therapist has made. The list will not include uses or disclosures to which you have specifically authorized (i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, or to corrections or law enforcement personnel. The request must be in writing and state the time period desired for the accounting, which must be less than a 6-year period and starting after April 14, 2003. Candace Cross Counseling, LLC/ your therapist will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list will include the date of the disclosure, the recipient of the disclosure (including address, if known), a description of the information disclosed, and the reason for the disclosure. Candace Cross Counseling, LLC/ your therapist will provide the list to you at no cost, unless you make more than one request in the same year, in which case it will charge you a reasonable sum based on a set fee for each additional request.
5. The Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
6. The Right to Amend Your PHI: If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that Candace Cross Counseling, LLC/ your therapist correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of Candace Cross Counseling, LLC’s/ your therapist’s receipt of your request. Candace Cross Counseling, LLC/ your therapist may deny your request, in writing within 60 days, if it finds that the PHI is: (a) correct and complete, (b) forbidden to be disclosed, (c) not part of its records, or (d) written by someone other than Candace Cross Counseling, LLC/ your therapist. Denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and Candace Cross Counseling, LLC’s/ your therapist’s denial will be attached to any future disclosures of your PHI. If Candace Cross Counseling, LLC/ your therapist approves your request, it will make the change(s) to your PHI. Additionally, Candace Cross Counseling, LLC/ your therapist will tell you that the changes have been made and will advise all others who need to know about the change(s) to your PHI.
7. The Right to Get This Notice by Email or Mail: You have the right to get this notice by email. You have the right to request a paper copy of it as well.

8. The Right to Ask Us to Limit What We Use or Share: You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no,” for example, if it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.
9. Submit all Written Requests: Submit to Candace Cross Counseling, LLC/ your therapist’s Director and Privacy Officer, Candace Cross, at Candace Cross Counseling, LLC
3070 Lakecrest Circle, Suite 400, #156, Lexington, Kentucky 40513. Email of Privacy Officer: therapist@candacecross.com, Telephone Number : (859)305-9466

10. File a Complaint if You Feel Your Rights Have Been Violated: If you are concerned your privacy rights may have been violated, or if you object to a decision Candace Cross Counseling, LLC/ your therapist made about access to your PHI, you are entitled to file a complaint. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. Under no circumstances will you be penalized or retaliated against for filing a complaint.

 

Please discuss any questions or concerns with your therapist. Your signature on the “Information, Authorization, and Consent to Treatment” (provided to you separately) indicates that you have read and understood this document.

VIII. YOUR CHOICES: For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care or payment for your care

• Share information in a disaster relief situation

• Include your information in a hospital directory.

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

 

In these cases we never share your information unless you give us written permission:

• Marketing purposes

• Sale of your information

• Most sharing of psychotherapy notes

IX. OUR RESPONSIBILITIES: We are required by law to maintain the privacy and security of your PHI. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We must follow the duties and privacy practices described in this notice and give you a copy of it. We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

• We are required to obtain your consent for most uses and sharing of your information.

• We are required by law to maintain the privacy and security of your information.

• We must let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

• We must follow the duties and privacy practices described in this notice and give you a copy of it.

• We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

 

X. REDISCLOSURE ACCORDING TO HIPAA:

When you consent to uses and disclosures for all future treatment and payment purposes and to run our business, we may share your information with other substance use disorder treatment programs, doctors’ offices, and health care businesses for those activities. If the person who receives it is subject to HIPAA, then they are allowed to use and share your information again without your consent for the purposes that HIPAA allows. Your information still cannot be used in legal proceedings against you unless (1) you consent or (2) based on a Part 2 court order and a subpoena (or similar legal requirement).

 

XI. LEGAL PROCEEDINGS AND COURT ORDERS:

We must follow certain procedures before using or sharing your information for investigations and legal proceedings.

• We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings against you without your written consent or a court order.

• We will only respond to a court order to use or share your health information if it is accompanied by a subpoena or other similar legal mandate requiring us to comply.

• We will only use or share your information in proceedings against you based on a court order after we have received notice and an opportunity to be heard or you tell us that you have received notice.

• We may use or share your information to respond to legal proceedings against our program based on a court order and you may not be notified in advance. You have the right to seek to overturn or change the court order after you learn about it.

 

XII. EFFECTIVE DATE:

This notice is effective as of: February 16, 2026

Date of Last Revision: 03/05/2026