Privacy Policy

Notice of Privacy Practices

TruMediq Mental Health

Effective September 16 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to TruMediq Mental Health, its clinicians, workforce members, and persons or organizations that assist TruMediq in providing health care and are permitted by law or contract to use protected health information. It applies to in-person and telehealth services provided to patients located in Florida, Maryland, and North Carolina.

Protected health information, or PHI, is information that identifies you and relates to your past, present, or future physical or mental health, health care, or payment for health care. This Notice explains your rights, our duties, and how we may use or disclose PHI. More protective federal or state law will control when it applies.

Privacy Contact

Privacy Officer
TruMediq Mental Health
700 Geipe Road, Suite 260
Catonsville, Maryland 21228-4152
Telephone: (800) 954-4558
Website: www.trumediq.com

You may contact the Privacy Officer to ask questions, exercise a privacy right, request a copy of this Notice, or file a complaint.

Your Rights at a Glance

Your Privacy Rights

Inspect and Obtain Your Health Information

You may ask to inspect or obtain an electronic or paper copy of your medical record and other PHI in a designated record set. We will explain how to submit a request. We ordinarily will act within 30 days. If additional time is permitted and needed, we will notify you in writing. We may charge only a reasonable, cost-based fee permitted by law. In limited circumstances, we may deny access and will explain the denial and any available review rights in writing.

Request an Amendment

You may ask us in writing to amend PHI that you believe is incorrect or incomplete and explain why it should be changed. We ordinarily will respond within 60 days. We may deny the request for reasons allowed by law, including when the information was not created by us, is not part of the records available for access, or is accurate and complete. If denied, we will explain your rights in writing, including the right to submit a statement of disagreement.

Request Confidential Communications

You may ask us to contact you in a particular way or at a different address. For example, you may request that we call only a specified number or send mail to another address. We will accommodate reasonable requests. Tell us whether and how messages may be left and promptly update your communication preferences.

Request Restrictions

You may ask us not to use or disclose specified PHI for treatment, payment, or health care operations. We are not generally required to agree, but if we agree we will follow the restriction except when disclosure is needed for emergency treatment or otherwise permitted by law. If you pay in full out of pocket for a specific item or service, you may ask us not to disclose information about that item or service to your health plan for payment or health care operations. We will honor that request unless disclosure is required by law.

Receive an Accounting of Disclosures

You may ask for an accounting of certain disclosures made during the six years before your request. The accounting generally does not include disclosures for treatment, payment, health care operations, disclosures made to you or under your authorization, and other disclosures excluded by law. One accounting in a 12-month period is free; we may charge a reasonable, cost-based fee for another request after notifying you in advance.

Receive a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. We will provide a copy promptly. The current Notice is also available at our office and on our website.

Choose a Personal Representative

A person legally authorized to act for you, such as a health care agent, legal guardian, or other authorized representative, may exercise your privacy rights. We will verify the person’s identity and legal authority before acting. We may decline to treat a person as your representative when permitted by law, including when we reasonably believe doing so could endanger you or involve abuse, neglect, or exploitation.

Your Choices and Authorizations

Family Friends and Others Involved in Care

You may tell us whether we may share relevant PHI with a family member, friend, caregiver, or another person involved in your care or payment for care. If you are unavailable or unable to state a preference, we may use professional judgment to disclose information that is directly relevant and in your best interest, when permitted by law. We may also disclose information needed for disaster-relief notification or to reduce a serious and imminent threat.

Uses Requiring Written Authorization

We will obtain your written authorization before using or disclosing PHI when authorization is required by law. Examples generally include most uses or disclosures of psychotherapy notes, uses for marketing that involve financial remuneration, sale of PHI, and disclosures not otherwise described in this Notice. We do not sell PHI.

An authorization will describe the information, recipient, purpose, expiration, and your right to revoke. You may revoke an authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization and may not affect an insurer’s rights when the authorization was obtained as a condition of coverage.

Psychotherapy Notes

Psychotherapy notes receive special protection. We generally will obtain written authorization before using or disclosing psychotherapy notes. Authorization may not be required for limited purposes allowed by law, such as use by the originator for treatment, certain supervised training, defending TruMediq in a legal action brought by you, health oversight of the note originator, or uses required by law. Psychotherapy notes do not include medication prescriptions and monitoring, session times, treatment modalities and frequencies, test results, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress.

Fundraising and Marketing

TruMediq does not currently use PHI to solicit fundraising donations. If that practice changes, we will provide any advance notice and opt-out opportunity required by law. We will not use or disclose PHI for marketing when written authorization is required unless you authorize it.

How We Typically Use and Disclose Information

Treatment

We may use PHI to evaluate, diagnose, coordinate, and provide care. We may share relevant information with physicians, therapists, pharmacies, laboratories, hospitals, emergency services, and other professionals involved in your treatment, subject to more protective laws. For example, a psychiatrist may review medication history or coordinate with another treating professional.

Payment

We may use and disclose PHI to bill and collect payment, verify coverage, obtain authorization, determine benefits, respond to payer review, and coordinate benefits. For example, we may send diagnosis, service, and provider information to a health plan. Special protections may restrict payment disclosures involving psychotherapy notes, minor-consented services, or Part 2 records.

Health Care Operations

We may use and disclose PHI to operate the practice, improve quality, train and supervise personnel, credential clinicians, conduct compliance and auditing activities, assess performance, manage risk, obtain legal or accounting services, and perform other lawful health care operations. We require business associates that handle PHI for us to safeguard it as required by law and contract.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your authorization for the purposes below only when applicable legal requirements are satisfied. More protective federal or state confidentiality law may limit a disclosure.

• Public health activities, including disease reporting, product recalls, medication adverse-event reporting, and preventing or controlling disease.
• Reporting suspected child abuse or neglect, vulnerable-adult abuse, neglect, exploitation, or domestic violence when authorized or required by law.
• Preventing or reducing a serious and imminent threat to a person or the public, consistent with applicable law and professional standards.
• Health oversight activities such as audits, investigations, inspections, licensing, credentialing, and disciplinary proceedings authorized by law.
• Judicial or administrative proceedings in response to a valid court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable protections.
• Law-enforcement purposes permitted by law, including certain identification requests, required reports, crimes on the premises, and emergencies.
• Workers’ compensation and similar programs as authorized by law.
• Coroners, medical examiners, and funeral directors for lawful duties following a death.
• Organ and tissue procurement or donation organizations when applicable.
• Research approved or permitted under applicable privacy requirements, including authorization, waiver, preparatory review, decedent research, or use of de-identified or limited data.
• Special government functions, including lawful military, national-security, protective-service, correctional, and custodial activities.
• The U.S. Department of Health and Human Services when it investigates or determines our compliance with federal privacy law.
• Any other use or disclosure required by federal or state law.

Appointment Reminders and Care Communications

We may contact you about appointments, treatment, medication refills, care coordination, health-related services, and administrative matters. Communications may be sent through telephone, voicemail, mail, secure portal, text, or email consistent with your preferences, reasonable safeguards, and applicable law. Ordinary email and text may carry privacy risks. Tell us if you want an alternative method or limited message content.

Substance Use Disorder Records and 42 CFR Part 2

Some substance use disorder, or SUD, records are protected by 42 CFR Part 2 in addition to HIPAA. Not every reference to substance use or every record held by TruMediq is automatically a Part 2 record. The following protections apply to the extent TruMediq receives, creates, maintains, or rediscloses records that are subject to Part 2.

When Part 2 requires consent, we will obtain a written consent that meets applicable requirements before using or disclosing the records. A patient may, when permitted, give one consent for future treatment, payment, and health care operations uses and disclosures. A recipient that is a HIPAA covered entity or business associate may redisclose records received under such a consent as permitted by HIPAA, but the records remain protected from use in proceedings against the patient as described below.

Special Protection for Part 2 Records

Investigations and Legal Proceedings

We will not use or disclose Part 2 records, or testimony describing those records, in a civil, criminal, administrative, or legislative investigation or proceeding against the patient unless the patient gives specific written consent or the use or disclosure is authorized by a Part 2 court order and accompanied by a subpoena or other legal mandate when required. A general medical authorization, subpoena alone, or request alone may be insufficient.

Permitted Part 2 Uses and Disclosures

Part 2 may permit limited uses or disclosures without patient consent, subject to its conditions, including communications within a Part 2 program and with qualified service organizations, bona fide medical emergencies, certain research, audits and evaluations, reports of suspected child abuse or neglect, reports of crimes or threats on program premises or against program personnel, and certain cause-of-death activities. We will disclose only as allowed and will apply required safeguards.

Fundraising and Breach Rights for Part 2 Records

If Part 2 information would be used for fundraising, you will receive clear advance notice and a choice about whether to receive those communications. Breach-notification protections apply to unsecured Part 2 records as required by law.

Mental Health Records and State Law

Mental health records, communications, and test information may receive protections in addition to HIPAA. We will follow the law of the state where care is delivered and any other applicable law. When state law is more protective than HIPAA, we will apply the more protective requirement. We will not treat a subpoena or informal request as automatic permission to release specially protected records.

Minors

A parent or legal guardian usually acts as a minor’s personal representative, but not in every circumstance. A minor may control some information when state law allows the minor to consent independently, when a court or other legally authorized person consents, or when another exception applies. Access and disclosure may depend on who consented, the service provided, payment responsibility, custody or guardianship orders, and safety considerations. We may ask for documentation of authority and may limit access when required or permitted by law. We will explain applicable confidentiality boundaries as reasonably appropriate.

Personal Representatives and Deceased Individuals

We will treat a legally authorized personal representative as the patient for relevant privacy rights, after verifying authority and scope. Authority may arise from guardianship, health care power of attorney, court order, estate appointment, or other law. Information about a deceased person remains protected for the period required by law, and disclosure to an authorized representative, family member, or other person will be limited as applicable.

Our Responsibilities

• Maintain the privacy and security of PHI as required by law.
• Follow the duties and privacy practices described in the Notice currently in effect.
• Provide this Notice and make the current version available upon request, at our office, and on our website.
• Notify affected individuals following a breach of unsecured PHI when notification is required, without unreasonable delay and within applicable legal deadlines.
• Use or disclose only the minimum necessary information when the minimum-necessary rule applies.
• Not use or disclose PHI other than as described in this Notice unless you authorize it in writing or law otherwise permits or requires it.
• Honor a valid written revocation prospectively, subject to actions already taken and other legal limitations.

Complaints and Questions

Contact TruMediq

If you believe your privacy rights were violated, have a question, or want to exercise a right, contact:

Privacy Officer
TruMediq Mental Health
700 Geipe Road, Suite 260
Catonsville, Maryland 21228-4152
Telephone: (800) 954-4558
Website: www.trumediq.com

Contact the U.S. Department of Health and Human Services

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201; calling 1-877-696-6775; or visiting www.hhs.gov/hipaa/filing-a-complaint.

No Retaliation

TruMediq will not retaliate against you for filing a complaint, asking a privacy question, or exercising a privacy right.

Changes to This Notice

We may change the terms of this Notice and make the revised Notice effective for all PHI we maintain, including information created or received before the change. When we materially revise the Notice, the current version will be available upon request, posted in a clear and prominent location at our office, and posted on our website. The Notice will identify its effective date. We will distribute or otherwise provide a revised Notice when required by law.

Availability and Delivery

The current Notice is available to any person who asks for it. For an initial in-person service, we will provide the Notice no later than the date of first service delivery and make a good-faith effort to obtain written acknowledgment. For an initial service delivered electronically, we will provide the electronic Notice as required and make a good-faith effort to obtain acknowledgment or another confirmation of receipt. If acknowledgment cannot be obtained, we will document the effort and reason. The acknowledgment records receipt; it is not an authorization for additional uses or disclosures.

Scope of This Notice

This Notice applies to TruMediq Mental Health’s covered health care activities, including psychiatric evaluation, medication management, psychotherapy and supportive services, care coordination, telehealth, billing, and related operations. It is intended for services provided to patients located in Florida, Maryland, and North Carolina. Specific clinicians, facilities, health plans, laboratories, pharmacies, hospitals, or other organizations may provide their own privacy notices and remain responsible for their own practices.

Effective Date

This Notice is effective September 16, 2026 and supersedes prior versions of TruMediq Mental Health’s Notice of Privacy Practices.