HIPAA Notice of Privacy Practices

Effective Date: February 25, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

POM Therapy Collective, operated by Sukhi Sandhu, MS, LCPC, is committed to protecting the privacy of your health information. This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your protected health information (“PHI”) and your rights regarding that information. We are required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

Therapy services are provided via telehealth throughout the state of Illinois. Appointment scheduling and insurance billing are facilitated through Headway, a third-party platform. Headway maintains its own privacy practices, and we encourage you to review Headway’s privacy policy for information about how they handle your data.

How We May Use and Disclose Your Protected Health Information

We may use and disclose your PHI for the following purposes without your written authorization:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health treatment. For example, we may use your PHI to develop a treatment plan, provide therapy services, or consult with other healthcare providers involved in your care (with your knowledge).

Payment

We may use and disclose your PHI to obtain payment for services we provide to you. This may include submitting claims to your health insurance company, verifying your insurance coverage, or conducting utilization review activities. Payment-related activities are primarily facilitated through the Headway platform.

Healthcare Operations

We may use and disclose your PHI for our healthcare operations, which include activities necessary to run our practice and ensure quality care. These activities may include quality assessment and improvement activities, professional competency reviews, training programs, business planning, and administrative functions.

As Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your PHI for public health activities as permitted or required by law, such as reporting suspected child abuse or neglect, or reporting certain conditions to public health authorities.

Victims of Abuse, Neglect, or Domestic Violence

If we reasonably believe you are a victim of abuse, neglect, or domestic violence, we may disclose your PHI to a government authority authorized to receive such reports, to the extent the disclosure is required or authorized by law.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure proceedings.

Judicial and Administrative Proceedings

We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order or a lawful subpoena, provided appropriate conditions are met.

Law Enforcement Purposes

We may disclose your PHI to law enforcement officials under certain limited circumstances, such as in response to a court order, warrant, or grand jury subpoena, or to report certain types of wounds or physical injuries.

To Avert a Serious Threat to Health or Safety

We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public. Any disclosure will be made only to a person or persons reasonably able to prevent or lessen the threat.

Specialized Government Functions

We may disclose your PHI for certain government functions, including military and veterans’ activities, national security and intelligence activities, and protective services for the President and other officials.

Workers’ Compensation

We may disclose your PHI as authorized by and necessary to comply with laws relating to workers’ compensation or other similar programs.

Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their duties.

Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above. In particular:

• Psychotherapy Notes: We will not use or disclose psychotherapy notes (as defined by HIPAA) without your written authorization, except in limited circumstances permitted by law, such as for our own training, to defend ourselves in legal proceedings, for required government health oversight, or when required by law.
• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization.
• Sale of PHI: We will not sell your PHI without your written authorization.

You may revoke any authorization you have given us at any time by submitting a written revocation. Your revocation will not affect any uses or disclosures made by us in reliance on your authorization prior to receiving your revocation.

Illinois Mental Health and Developmental Disabilities Confidentiality Act

In addition to federal HIPAA protections, your mental health records are protected under the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110/). This state law provides additional protections for mental health information, including:

• Mental health records may not be disclosed except as authorized by the Act
• Stricter requirements for disclosure in judicial proceedings
• Specific protections for communications made during therapy
• A private right of action for unauthorized disclosures

In cases where the Illinois Mental Health and Developmental Disabilities Confidentiality Act provides greater protection than HIPAA, we will follow the stricter standard.

Your Rights Regarding Your Protected Health Information

You have the following rights with respect to your PHI:

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. For example, you may ask us not to disclose certain information to your health insurance company. We are not required to agree to your request, except that we must agree to a restriction request if the disclosure is to a health plan for the purpose of payment or healthcare operations and the PHI pertains solely to a healthcare service for which you have paid us in full out of pocket. To request a restriction, please submit your request in writing to us.

Right to Access Your PHI

You have the right to inspect and obtain a copy of your PHI that is maintained in our clinical and billing records. To request access, please submit your request in writing. We may charge a reasonable, cost-based fee for copies. In certain limited circumstances, we may deny your request for access. If we deny your request, we will explain the reason for the denial and inform you of your right to have the denial reviewed.

Right to Request Amendments

You have the right to request that we amend your PHI if you believe the information is incorrect or incomplete. To request an amendment, please submit your request in writing, along with an explanation of why you believe the amendment is appropriate. We may deny your request in certain circumstances. If we deny your request, we will provide you with a written explanation and inform you of your right to submit a statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI that we have made during the six years prior to your request (or a shorter period if you prefer). This accounting will not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization, among other exceptions. To request an accounting, please submit your request in writing.

Right to Receive Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain manner or at a certain location. For example, you may ask that we contact you only by mail or only at a specific phone number. We will accommodate reasonable requests. To make such a request, please submit your request in writing.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have previously agreed to receive this Notice electronically. To obtain a paper copy, please contact us using the information provided below.

Right to Be Notified of a Breach

You have the right to be notified if there is a breach of your unsecured PHI. We will notify you of any such breach in accordance with applicable federal and state law.

Our Duties

We are required by law to:

• Maintain the privacy of your PHI and provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Abide by the terms of this Notice currently in effect
• Notify you if we are unable to agree to a requested restriction on how your PHI is used or disclosed
• Accommodate reasonable requests to communicate your health information by alternative means or at alternative locations
• Notify you in the event of a breach of your unsecured PHI

We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will make the revised Notice available to you upon request and will post the updated Notice on our website.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint. You may file a complaint with us directly, or you may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

POM Therapy Collective Sukhi Sandhu, MS, LCPC Email: sukhi@pomtherapycollective.com Phone: (224) 497-2893

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 Toll-Free: 1-877-696-6775 Website: https://www.hhs.gov/ocr/

Illinois Department of Financial and Professional Regulation You may also file a complaint with the Illinois Department of Financial and Professional Regulation if you believe your rights under the Illinois Mental Health and Developmental Disabilities Confidentiality Act have been violated.

We will not retaliate against you for filing a complaint.

Contact Information

For questions about this Notice or to exercise any of your rights described above, please contact:

POM Therapy Collective Sukhi Sandhu, MS, LCPC Email: sukhi@pomtherapycollective.com Phone: (224) 497-2893