Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES - BT RPN PLLC & Kristina Castro, Nurse Practitioner in Family Health, PLLC, providing services under the licensed name Healing Soulutions

Effective Date: October 1, 2026

This notice is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), 45 CFR Parts 160 and 164, and applicable New York State law to inform you of how your Protected Health Information (PHI) may be used and disclosed, and your rights regarding your PHI.

PERMITTED USES AND DISCLOSURES: Your PHI may be used and disclosed without your authorization for the following purposes: (a) Treatment - to provide, coordinate, and manage your healthcare and related services, including consultations between healthcare providers; (b) Payment - to obtain reimbursement for services, including billing, claims management, and collection activities; (c) Healthcare Operations - to support the business activities of the Practice including quality assessment, staff training, compliance, auditing, and business planning; (d) As Required by Law - when federal, state, or local law requires disclosure; (e) Public Health Activities - as required for public health surveillance, investigations, or interventions; (f) Business Associates - to entities that perform services on our behalf under a Business Associate Agreement that requires them to safeguard your PHI.

AUTHORIZATION REQUIRED: Written authorization is required before we may use or disclose your PHI for the following: psychotherapy notes; marketing purposes; sale of PHI; HIV-related information (NY PHL Article 27-F); substance abuse treatment records (42 CFR Part 2); mental health records (NY MHL Section 33.13); and genetic information (Genetic Information Nondiscrimination Act - GINA). You may revoke any authorization in writing at any time, except to the extent the Practice has already acted in reliance upon it.

YOUR RIGHTS: You have the following rights regarding your PHI: (1) Right to Access - request copies of your PHI within 30 days; (2) Right to Amendment - request corrections to your PHI; (3) Right to an Accounting of Disclosures - request a list of certain disclosures made of your PHI; (4) Right to Request Restrictions - request limitations on how your PHI is used or disclosed; (5) Right to Confidential Communications - request that we communicate with you by alternative means or at alternative locations; (6) Right to a Paper Copy - obtain a paper copy of this notice upon request; (7) Right to Breach Notification - be notified in the event of a breach of your unsecured PHI as required by the HITECH Act.

MINIMUM NECESSARY STANDARD: The Practice applies the minimum necessary standard when using or disclosing PHI, ensuring that only the minimum amount of information necessary to accomplish the intended purpose is used or disclosed.

DATA SECURITY: The Practice implements administrative, physical, and technical safeguards to protect your PHI, including encryption of electronic records, secure storage of physical records, access controls, and regular security assessments. Electronic health records are maintained using HIPAA-compliant systems.

RETENTION: Medical records are retained for a minimum of 6 years per New York State requirements (8 NYCRR Section 29.2), or longer if required by applicable federal regulations.

COMPLAINTS: If you believe your privacy rights have been violated, you may file a complaint with the Practice's Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

ELECTRONIC COMMUNICATIONS: The Practice may communicate with you by email, text message (SMS), telehealth platforms, and other electronic means for treatment, scheduling, care coordination, and billing purposes. Standard email and SMS are not fully secure methods of communication and carry a risk that information could be intercepted or accessed by unauthorized persons. By providing your email address or mobile number and electing to receive electronic communications, you acknowledge and accept this risk. You have the right to request confidential communications by alternative means or at an alternative location, and you may withdraw your election to receive electronic communications at any time by notifying the Practice in writing. Telehealth services are delivered using HIPAA-compliant, encrypted platforms.

CHANGES TO THIS NOTICE: The Practice reserves the right to change this notice and to make the revised notice effective for PHI already maintained as well as for PHI received in the future.

ELECTRONIC COMMUNICATIONS CONSENT: I understand that email and text (SMS) messages are not fully secure and that there is a risk that Protected Health Information sent to me by these methods could be intercepted, misdirected, or accessed by others. Having been informed of this risk, I request and consent to receive appointment confirmations, reminders, and related communications that may include limited health information (such as the service or treatment I have booked) from Healing Soulutions by email and/or text message at the address(es) and phone number(s) I provide. I understand that I may withdraw this consent at any time by notifying the Practice in writing or by replying STOP to a text message, and that doing so may limit the Practice's ability to send me confirmations and reminders. This consent applies only to communications sent to me; it does not authorize the Practice to disclose my information to any third party.

MINOR PATIENTS (PARENTAL/GUARDIAN ACKNOWLEDGMENT): Healing Soulutions services are intended for adults 18 and over; patients under 18 are accepted only at the practitioner's discretion, with a parent or legal guardian present during the visit. If the patient is under 18 years of age, I am the patient's parent or legal guardian and I acknowledge this Notice of Privacy Practices on the patient's behalf. I understand that certain categories of a minor's health information may carry additional protections under federal and New York State law, and that in limited circumstances a minor may control the release of specific categories of their own health information as provided by law.

ACKNOWLEDGMENT: By signing below, I acknowledge that I have received, read, and understand this Notice of Privacy Practices. I understand my rights regarding my Protected Health Information and how it may be used and disclosed by the Practice.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us at the contact below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, by mail (200 Independence Avenue SW, Washington, DC 20201), by phone (1-800-368-1019), or online at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Contact

Privacy Officer, Healing Soulutions — email info@healingsoulutions.care or call (585) 747-2215.