THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Legal — HIPAA

Notice of Privacy Practices

Your health information is protected. This notice explains your rights and how The Mindful Lemon uses and protects your protected health information (PHI).

Effective Date: April 1, 2026 | Updated: April 2026 — Includes Part 2 SUD Provisions

Table of Contents

Our Commitment

Our Commitment to Your Privacy

The Mindful Lemon, LLC (“TML”) is committed to protecting the privacy of your health information. As a HIPAA-covered entity, we are required by federal law to maintain the privacy and security of your protected health information (PHI) and to provide you with this Notice describing our legal duties and privacy practices.

We are required by law to:

  • Maintain the privacy of your protected health information

  • Provide you with notice of our legal duties and privacy practices with respect to your PHI

  • Notify you if a breach occurs that may have compromised the privacy or security of your information

  • Follow the terms of the Notice of Privacy Practices currently in effect

Combined HIPAA + Part 2 Notice

This Notice is a combined Notice of Privacy Practices covering both the HIPAA Privacy Rule (45 CFR Parts 160 and 164) and 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records), as permitted under the 2024 Final Rule effective April 16, 2024, with full compliance required by February 16, 2026.

How We Use PHI

How We May Use Your Health Information

Your PHI may be used and disclosed for the following core purposes without your written authorization:

Treatment

We use and share your PHI to provide, coordinate, and manage your mental health and/or substance use disorder treatment. This includes sharing information with other providers on your treatment team (e.g., referring therapists, prescribing physicians, step-down program staff) to coordinate your care.

Payment

We use and share your PHI to bill and collect payment for services rendered. This may include submitting claims to your insurance company, verifying eligibility, obtaining prior authorizations, and resolving billing disputes.

Healthcare Operations

We use PHI for internal operations including quality improvement, staff training, utilization review, care coordination, legal compliance, and accreditation activities. We will not sell your PHI or use it for marketing without your explicit authorization.

Permitted Disclosures

Other Permitted Uses & Disclosures

In certain circumstances, we may use or disclose your PHI without your written authorization:

Required by Law

When mandated by federal, state, or local law (e.g., mandatory reporting of child abuse or abuse of vulnerable adults).

Public Health Activities

To authorized public health authorities to prevent or control disease, report vital statistics, or comply with FDA reporting requirements.

Serious Threats to Safety

When necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of others.

Health Oversight Activities

To government agencies conducting audits, investigations, or licensure activities.

Workers' Compensation

As authorized by and necessary to comply with workers’ compensation laws.

Judicial and Administrative Proceedings

In response to a court order or properly issued subpoena.

Law Enforcement

In limited circumstances as required or permitted by law.

Decedents

To coroners, medical examiners, or funeral directors in limited circumstances.

Research

Under specific institutional review board approval with appropriate safeguards.

Military & National Security

As required by law for authorized military or national security purposes.

Family & Caregivers

We may share relevant PHI with family members, close friends, or other persons you identify as involved in your care or in paying for your care. You have the right to restrict such disclosures at any time by notifying us in writing.

SUD / Part 2 Records

Substance Use Disorder Records — 42 CFR Part 2

Special Federal Protections Apply to SUD Records

Records relating to substance use disorder (SUD) diagnosis, treatment, or referral that we maintain as a federally assisted program are subject to heightened confidentiality protections under 42 CFR Part 2, in addition to HIPAA. These records may be disclosed in more limited circumstances than other health information.

What Are Part 2 Records?

If you receive or have received treatment at TML for a substance use disorder (including alcohol use disorder, drug use disorder, or co-occurring SUD), records related to that diagnosis, treatment, or referral are protected under Part 2.

When Part 2 Records May Be Disclosed

Under the updated 2024 Final Rule (effective April 16, 2024, full compliance required February 16, 2026), Part 2 records may be disclosed:

  • With your written consent that identifies the specific recipients and purpose.

  • For treatment, payment, and healthcare operations — using a general consent that may be
    obtained at intake (in alignment with the 2024 rule changes).

  • For medical emergencies that pose an immediate threat to your life.

  • For audit and evaluation activities by oversight entities.

  • Pursuant to a court order that includes specific procedural protections.

  • In connection with research approved by an institutional review board.

  • To report a crime committed on program premises or against program personnel.

  • In connection with the de-identification of records under applicable standards.

Key Restriction: Law Enforcement

Part 2 records may NOT be disclosed to law enforcement agencies for the purpose of investigating or prosecuting a client. This protection is stronger than general HIPAA rules and is maintained under the updated 2024 rule.

Prohibition on Re-Disclosure

When Part 2 records are disclosed, recipients are prohibited from re-disclosing those records except as permitted by the regulation. Any disclosure of Part 2 records must include a statement informing the recipient of this restriction.

Special Categories

Special Categories of Information

Certain types of health information receive special confidentiality protections under applicable state or federal law. We abide by these special protections as they pertain to applicable cases involving these types of records:

Mental health records

Additional California state law protections apply (e.g., Lanterman-Petris-Short Act, psychotherapy notes).

HIV-related information

Subject to California Health & Safety Code requirements for disclosure.

Genetic information

Protected under GINA and applicable state law; not used for underwriting purposes.

Alcohol and substance use disorder records

Governed by 42 CFR Part 2 as described in Section 4 above.

Psychotherapy notes

Your written authorization is required for most disclosures of psychotherapy notes, which are maintained separately from your general medical record.

Minor treatment records

California law grants minors specific rights to consent to and control disclosure of mental health and SUD treatment records in certain circumstances.

Uses Requiring Your Written Authorization

Beyond the permitted uses above, we will obtain your signed authorization before using or disclosing your PHI for:

  • Marketing purposes
  • Sale of your PHI
  • Most uses of psychotherapy notes

  • Any other purpose not described in this Notice

You have the right to revoke a previously given authorization in writing at any time, except where we have already acted in reliance on it.

Your HIPAA Rights

Your Individual Rights

You have the following rights with respect to your protected health information. To exercise any of these rights, submit a written request to our Privacy Officer (contact information in Section 9).

Right to Access

Inspect and obtain a copy of your medical record and other PHI we maintain. We will provide records in the format requested where feasible, within 30 days (or 60 days for offsite records).

Right to Amend

Request that we amend health information you believe is inaccurate or incomplete. We may deny the request with written explanation in certain circumstances.

Right to an Accounting

Request a list of disclosures we have made of your PHI for purposes other than treatment, payment, operations, or those you authorized. Covers disclosures in the past 6 years.

Right to Restrict

Request restrictions on how we use or disclose your PHI. We must honor a request to restrict disclosure to a health plan for services you paid for out-of-pocket in full.

Right to Confidential Communications

Request that we communicate with you in a specific way or at a specific location (e.g., only by mail to a specific address, not by phone). We will accommodate reasonable requests.

Right to a Paper Copy

Receive a paper copy of this Notice of Privacy Practices upon request, even if you have agreed to receive it electronically.

Our Duties

Our Privacy Duties

The Mindful Lemon is required to:

  • Maintain the privacy and security of your protected health information

  • Follow the terms of the current Notice of Privacy Practices

  • Notify you promptly if a breach has occurred that may have compromised the privacy or security of your PHI

  • Provide you with a copy of this Notice upon your first date of service, and upon your request thereafter

We reserve the right to change the terms of this Notice. If we make a material change, we will notify you in writing (or by the means of your preferred communication) and post the updated Notice on our website. Changes will apply to PHI we already hold as well as new information.

No Retaliation

We will not retaliate against you for exercising your HIPAA privacy rights, filing a complaint, or participating in any proceeding related to your privacy rights.

Complaints

How to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with us and/or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

File a Complaint With Us

Contact our Privacy Officer using the contact information below. We will investigate all complaints promptly and will not retaliate against you for filing a complaint.

  • By Phone: (855) 435-3801

  • By Email: privacy@themindfullemon.com
File a Complaint With HHS OCR

You may file a complaint with the Office for Civil Rights:

  • Online: hhs.gov/ocr/privacy/hipaa/complaints

  • By Mail: U.S. Department of Health & Human Services, 200 Independence Ave, S.W., Washington, D.C. 20201

  • By Phone: 1-877-696-6775 (toll free)

Filing Expiration Date

Complaints must be filed within 180 days of when you knew or should have known about the violation (HHS may extend this deadline in some circumstances).

Contact Us

Privacy Officer Contact Information

For questions about this Notice, to exercise your rights, or to file a complaint, please contact our Privacy Officer:

The Mindful Lemon — Privacy Officer

The Mindful Lemon, LLC
Attn: Privacy Officer
Los Angeles, CA

Medical Records Requests
records@themindfullemon.com

Privacy Questions or Requests?

We Care About Your Privacy

Our Privacy Officer is available to help you understand your rights, access your records, or address any concerns about how your health information is handled.