Notice of Privacy Practices

1. Our Commitment to Your Privacy

At Didi Hirsch Mental Health Services (“Didi Hirsch,” “we,” “our”), your privacy and the confidentiality of your health information are our highest priorities.

We are required by federal and state law to protect your Protected Health Information (PHI) – any information that identifies you and relates to your health, treatment, or payment for care.

You have a right to a copy of this Notice (in paper or electronic form) and to discuss it with the Privacy and Compliance Office by emailing [email protected] or calling (310) 390-6612, if you have any questions.

This Notice Describes:

• How health information about you may be used and disclosed
• Your rights with respect to your health information
• How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information

We Are Required To:

• Maintain the privacy and security of your PHI
• Give you this Notice describing our privacy practices
• Notify you promptly if a breach occurs that may have compromised your information
• Follow the terms of this Notice currently in effect

We Comply With:

• The Health Insurance Portability and Accountability Act (HIPAA)
• 42 CFR Part 2 (Federal confidentiality rules for substance abuse disorder records)
• Applicable state privacy laws, which may provide additional protections

2. Your Rights Regarding Your Health Information

A. Access and Obtain Copies

You have the right to request to view or get a copy of your health records, including substance use disorder (SUD) records, with limited exceptions. You may receive electronic copies if available. We may charge a reasonable, cost-based fee for copying or mailing.

B. Request Amendments

If you believe your record is inaccurate or incomplete, you have the right to ask us to correct it. We may deny the request if the record is already accurate or if we did not create it, but we will explain our decision in writing.

C. Request Confidential Communications

You have the right to request that we contact you in a specific way (for example, only by mail or at a different phone number). We will accommodate reasonable requests.

D. Request Restrictions

You have the right to ask us not to use or share certain PHI for treatment, payment, or operations. While we are not required to agree to all requests, we will consider them carefully.

If you pay out-of-pocket in full for a service, you have the right to request that we do not share that information with your insurance company, and we must honor that request unless otherwise required by law.

E. Get an Accounting of Disclosures

You have the right to request and receive a list of certain disclosures we have made of your health information.

• Accounting of Disclosures under HIPAA
  You have the right to receive an accounting of certain disclosures for up to six (6) years prior to the date of request.
• Accounting of Disclosures for Substance Use Disorder (SUD) records
  You may request an accounting of disclosures made with your consent, including those TPO disclosures made through an electronic health record, for up to three (3) years prior to the date of request.

F. Obtain a Paper or Electronic Copy of This Notice

You have the right to request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

G. Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your privacy rights and choices on your behalf.

H. File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint. We will not retaliate against you for filing a complaint:

• With Didi Hirsch’s Compliance & Privacy Office
  [email protected]
  (310) 390-6612
  4760 S. Sepulveda Blvd., Culver City, CA 90230
• Or with the U.S. Department of Health and Human Services, Office of Civil Rights

Website: https://www.hhs.gov/ocr/privacy/hipaa/complaints/ 
Phone: 1-800-368-1019

3. How We May Use and Disclose Your Health Information

A. For Treatment

We may use and disclose your PHI to coordinate, manage, and provide your care. For example:

• Communicating with doctors, therapists, or case managers involved in your care
• Consulting with other professionals for treatment planning
• Referring you to community resources or crisis services

B. For Payment

We may use and share PHI to bill for your services and obtain payment from health plans or other payers. For example:

• Sending claims to Medi-Cal, Medicare, or your insurance provider
• Confirming coverage and eligibility
• Providing information required for reimbursement

C. For Health Care Operations

We may use and share PHI for activities that help us operate safely and effectively. For example:

• Quality assessment and improvement
• Staff training and supervision
• Accreditation, licensing, or audits
• Business planning and management

D. Other Permitted Uses and Disclosures

We may use or disclose PHI without your written authorization when allowed or required by law, including:

E. Uses and Disclosures That Require Your Authorization

We will not use or share your PHI for the following without your written authorization:

• Marketing or fundraising beyond permitted communications
• Psychotherapy notes, except as required by law or for treatment oversight
• Sale of PHI to third parties

If you authorize a disclosure, you may revoke it at any time in writing, and we will stop any future uses or disclosures (but cannot take back information already shared).

F. Use and Disclosure of Substance Use Disorder (SUD) Records:

Federal law (42 CFR Part 2) requires your written consent before we use or disclose your SUD records for treatment, payment, or health care operations (TPO). Once you provide this consent, your SUD records may be shared within the scope of that consent for these purposes. You may authorize a single consent for all future uses and disclosures for the purpose of TPO.

• You have the right to revoke your consent at any time, except to the extent that action has already been taken based on your consent.
• SUD records that are disclosed with your written consent for TPO purposes may be redisclosed by the recipient without your consent, to the extent of federal law.
• Your SUD records, or testimony relaying the content of such records, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you without specific written consent or a court order;
• SUD Records will only be used or disclosed based on a court order after you have been given formal notice of the action and an opportunity to object or argue against the disclosure in court.
• A court order authorizing use or disclosure of your SUD records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

G. Fundraising Communications

• Substance Use Disorder (SUD) Records
  We will not contact you for fundraising based on SUD treatment information unless you give us your written permission in advance.
• Non-Substance Use Disorder (SUD) Records
  We may contact you about fundraising efforts to support our mission. You may opt out of receiving such communications at any time by following the opt-out instructions or by contacting [email protected].

Your decision not to authorize fundraising communications will not affect your access to services.

4. Breach Notification

If a breach of unsecured PHI occurs, we will promptly notify you in writing, consistent with federal and state law, describing:

• What happened,
• What information was involved, and
• Steps you can take to protect yourself.

5. Business Associates

We contract with outside companies (called Business Associates) that help us perform certain functions — such as billing, data storage, or analytics. Business Associates must sign agreements requiring them to safeguard your PHI in compliance with HIPAA.

6. State Law Protections

State law may provide additional privacy protections beyond federal HIPAA rules.
Where state law is stricter, we will comply with the more protective requirement. This includes:

• HIV/AIDS information
• Genetic information
• Minor consent services
• Substance-use disorder records
• Gender affirming care and abortion-related information

7. Effective Date and Revisions

This Notice is effective as of February 16, 2026, and we are required to abide by the terms of this notice currently in effect. We reserve the right to change our privacy practices at any time and to make new terms effective for all PHI we maintain.

We will post the current Notice on our website and at each Didi Hirsch location, and copies will be available upon request.

8. Contact Information

Privacy and Compliance Office
Didi Hirsch Mental Health Services
4760 S. Sepulveda Blvd.,
Culver City, CA 90230
[email protected]
(310) 390-6612

9. Federal Reference

This Notice is provided in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related regulations found at 45 C.F.R. Parts 160 and 164, Subparts A and E, as well as Confidentiality of Substance Use Disorder Patient Records and related regulations found in 42 CFR Part 2.