THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: 06/01/2026 · Document Version: 2.0

Introduction

Applied Behavior Consultants, Inc. ("ABC," "we," "us," or "our") is required by federal law (the Health Insurance Portability and Accountability Act of 1996, or "HIPAA") and California state law to maintain the privacy of your protected health information ("PHI") and to provide you with this Notice of our legal duties and privacy practices.

This Notice describes how we may use and disclose your health information, your rights regarding your information, and our obligations to protect it. We are required to abide by the terms of this Notice currently in effect.

This Notice applies to all records of your care, or your child's care, that are created or maintained by ABC, including records held in our electronic health record system (Central Reach), our internal systems, and any paper records. Our staff, employees, contractors, and business associates are required to follow the practices described in this Notice.

Many of our clients are minors receiving Applied Behavior Analysis therapy. Where this Notice refers to "you" or "your information," it refers to the information of the client (the patient receiving services). For minor clients, parents or legal guardians generally exercise rights on the minor's behalf, subject to applicable state law exceptions described in this Notice.

How We May Use and Disclose Your Health Information

The following describes the ways we may use and disclose PHI without your specific written authorization. Not every use or disclosure in a category will be listed; however, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment

We use and disclose your PHI to provide, coordinate, or manage your behavioral health care and related services.

Examples:

  • Sharing treatment progress, behavior intervention plans, and clinical notes among ABC clinicians involved in your care.
  • Coordinating with your child's school district, Individualized Education Program (IEP) team, or other school-based professionals to support consistent treatment and educational outcomes (with your authorization where required).
  • Communicating with other healthcare providers involved in your care, such as your pediatrician, developmental pediatrician, neurologist, psychiatrist, speech-language pathologist, or occupational therapist.
  • Sharing information with a covering clinician when your assigned Behavior Consultant or Registered Behavior Technician is unavailable.

For Payment

We use and disclose your PHI to bill and receive payment for the services we provide.

Examples:

  • Submitting authorization requests, claims, and supporting documentation to your health insurance plan, regional center, school district, or other payer.
  • Sharing information with our billing service, clearinghouse, or practice management system (Central Reach) to process claims and payments.
  • Verifying eligibility and benefits with your health plan before initiating services.
  • Following up on outstanding balances or coordinating benefits between multiple payers.

For Healthcare Operations

We use and disclose your PHI for activities necessary to run our practice.

Examples:

  • Quality assessment and improvement of our clinical programs.
  • Reviewing the performance of our clinicians and providing supervision and training.
  • Training new clinicians, including Registered Behavior Technicians and supervised Behavior Consultants.
  • Preparing reports for accreditation bodies such as the Behavioral Health Center of Excellence (BHCOE).
  • Business planning, management, and general administrative activities.
  • Coordination with attorneys, accountants, auditors, or consultants who provide services to ABC under business associate agreements.

To Persons Involved in Your Care

Unless you object, we may share certain information with family members, friends, or other persons you identify as involved in your care, but only to the extent directly relevant to that person's involvement. For minor clients, this typically includes the parents or legal guardians who bring the child to therapy or coordinate care. In an emergency or when you are not able to agree or object, we will use professional judgment to determine whether disclosure is in your best interest.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your PHI without your authorization in the following circumstances, as permitted or required by law:

  • As Required by Law — when federal, state, or local law requires the disclosure.
  • Public Health Activities — to public health authorities for activities such as preventing disease, reporting child abuse or neglect, tracking adverse reactions to medications, or other public health purposes authorized by law.
  • Reporting Abuse, Neglect, or Domestic Violence — to government authorities authorized by law to receive such reports. As mandated reporters, our clinicians are required by California law to report suspected child abuse or neglect.
  • Health Oversight — to health oversight agencies for audits, investigations, inspections, licensure, and similar activities.
  • Judicial and Administrative Proceedings — in response to a court order, subpoena, discovery request, or other lawful process, with appropriate protections.
  • Law Enforcement — to law enforcement officials in limited circumstances permitted by law, such as in response to a court order or subpoena, to identify a suspect or missing person, or to report a crime.
  • Coroners, Medical Examiners, and Funeral Directors — as necessary to allow these officials to carry out their duties.
  • Organ and Tissue Donation — to organizations that handle organ procurement, transplantation, or donation.
  • Research — for research projects that have been approved by an Institutional Review Board with appropriate privacy protections in place. ABC does not currently participate in research using identifiable PHI.
  • Serious Threat to Health or Safety — when necessary to prevent a serious and imminent threat to the health or safety of you or others.
  • Workers' Compensation — as authorized by and to the extent necessary to comply with workers' compensation laws.
  • Military and Veterans — to authorized military command officials regarding members of the armed forces.
  • National Security and Intelligence — to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities.
  • Correctional Institutions — if you are or become an inmate of a correctional institution, to the institution or its agents as necessary for your health care or the safety of others.

Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization. In particular, the following uses and disclosures require your written authorization:

Marketing

We will not use or disclose your PHI for marketing purposes without your written authorization, except for face-to-face communications with you or promotional gifts of nominal value.

Sale of PHI

We will not sell your PHI to any third party without your written authorization.

Psychotherapy Notes

To the extent we maintain psychotherapy notes (notes documenting or analyzing the contents of a private counseling session that are kept separate from your regular treatment record), we will not use or disclose them without your written authorization, except as permitted by law (e.g., for our own training, in legal proceedings brought by you, or to defend ourselves against your claims).

Other Uses

Any other use or disclosure of your PHI not described in this Notice will be made only with your written authorization.

Right to Revoke Authorization

You may revoke any authorization you have given us, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the purposes covered by the authorization, except to the extent we have already taken action in reliance on it.

Your Rights Regarding Your Health Information

You have the following rights regarding the PHI we maintain about you. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information at the end of this Notice. We provide standardized request forms; please ask our front desk or our Privacy Officer for the appropriate form.

Right to Inspect and Receive a Copy

[45 CFR § 164.524]

You have the right to inspect and receive a copy of your PHI in our designated record set, in the form and format you request if readily producible, or in a readable hard copy form. We will respond to your written request within 30 days. If we need additional time, we may extend our response by one additional 30-day period; we will notify you in writing of the reason for the extension and the date we will respond. We may charge a reasonable, cost-based fee for copies (limited to the costs of supplies, labor for copying, postage, and preparation of an explanation or summary if requested).

If we deny your request, we will provide a written explanation. You may have the right to have the denial reviewed.

Right to Amend

[45 CFR § 164.526]

If you believe PHI we maintain about you is incorrect or incomplete, you have the right to request that we amend it. Your request must be in writing and must include a reason supporting the requested amendment. We will respond within 60 days; we may extend our response by one additional 30-day period, with written notice. If we deny your request, we will provide you with a written explanation. You may file a written statement of disagreement, which will be included in your record alongside the disputed information.

Right to an Accounting of Disclosures

[45 CFR § 164.528]

You have the right to receive an accounting of certain disclosures of your PHI made by ABC during the six years prior to your request. The accounting will not include disclosures made for treatment, payment, or healthcare operations; disclosures made with your written authorization; disclosures made to you; disclosures made for facility directory or notification purposes; or certain other limited categories. We will respond to your written request within 60 days. The first accounting in any 12-month period is free; subsequent requests within the same period may incur a reasonable, cost-based fee, and we will notify you of the fee before processing your request.

Right to Request Restrictions

[45 CFR § 164.522(a)]

You have the right to request restrictions on our use or disclosure of your PHI for treatment, payment, or healthcare operations, or to persons involved in your care. Your request must be in writing and must specify what information you want restricted and to whom the restriction applies. We are not generally required to agree to your requested restriction, except in one specific case: if you request that we not disclose information to your health plan for a service or item that you have paid for in full out of pocket, we are required to agree, unless the disclosure is required by law.

Right to Confidential Communications

[45 CFR § 164.522(b)]

You have the right to request that we communicate with you about your PHI in a particular way or at a particular location. For example, you may request that we contact you only at your work address, only by email, or only by mail rather than telephone. We will accommodate reasonable requests. You do not need to provide a reason for your request, though we may ask how payment will be handled if your request affects billing.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically. You may obtain a paper copy from our Privacy Officer, at any ABC office, or by downloading it from our website.

Right to Be Notified of a Breach

[45 CFR § 164.404, § 164.406, § 164.408]

You have the right to be notified in the event of a breach of your unsecured PHI. ABC will notify affected individuals without unreasonable delay and in no case later than 60 days after the breach is discovered, in accordance with federal and California state breach notification requirements.

Our Responsibilities

ABC is required by federal and California state law to:

  • Maintain the privacy and security of your protected health information.
  • Provide you with this Notice describing our legal duties and privacy practices.
  • Abide by the terms of the Notice currently in effect.
  • Notify you in the event of a breach affecting the privacy or security of your unsecured PHI.
  • Not retaliate against you for exercising your rights under this Notice, filing a complaint, or otherwise participating in a privacy investigation.

Changes to This Notice

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. When we make a material change to this Notice, we will:

  • Post the revised Notice prominently at each ABC office.
  • Post the revised Notice on our website.
  • Provide the revised Notice to clients at the next visit or upon request.
  • Make the revised Notice available to any person who asks for it.

You may obtain the most current Notice at any time from our Privacy Officer or from any ABC office.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with ABC, with the U.S. Department of Health and Human Services Office for Civil Rights, or both. You will not be retaliated against in any way for filing a complaint.

To file a complaint with ABC

Submit your complaint in writing to our Privacy Officer:

Privacy Officer Applied Behavior Consultants, Inc. 4540 Harlin Drive, Sacramento, CA 95826 Telephone: (916) 364-7800 Email: cwong@appliedbehavior.com

Our Privacy Officer will acknowledge your complaint and respond in writing within 14 business days of receipt. We will investigate the complaint and take corrective action where appropriate.

To file a complaint with the U.S. Department of Health and Human Services

Office for Civil Rights, U.S. Department of Health and Human Services Website: www.hhs.gov/ocr/privacy/hipaa/complaints Telephone: 1-800-368-1019 TDD: 1-800-537-7697 Mail: 200 Independence Avenue, S.W., Washington, D.C. 20201

Complaints to the Office for Civil Rights must generally be filed within 180 days of when you knew or should have known the violation occurred. The Office for Civil Rights may extend the 180-day deadline for good cause shown.

California complaint options

California residents may also file complaints with the California Department of Public Health, Office of Health Information Integrity (CalOHII), or with the California Attorney General's office for matters involving California medical information privacy law.

Additional Rights for California Residents

In addition to the rights described above under HIPAA, California state law provides additional protections for your medical information.

Confidentiality of Medical Information Act (CMIA)

California Civil Code Sections 56 through 56.37, known as the Confidentiality of Medical Information Act (CMIA), provides additional protections for medical information held by California healthcare providers. In general, CMIA requires written authorization for the disclosure of medical information, with limited exceptions. Where CMIA provides greater privacy protection than HIPAA, ABC will follow CMIA.

California Consumer Privacy Act / California Privacy Rights Act

Most medical information that ABC holds is exempt from the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) because it is governed by HIPAA and CMIA. However, you may have rights under CCPA and CPRA regarding certain non-medical personal information we collect, such as through our website or for purposes unrelated to your healthcare. To exercise these rights, please contact our Privacy Officer.

Breach Notification

California Civil Code Section 1798.82 requires notification in the event of a breach of personal information. ABC complies with both federal HITECH breach notification requirements and California state notification requirements. In the event of a breach, you will receive notification by mail (or email if you have agreed to electronic notification) describing what happened, what information was affected, what we are doing in response, and what steps you can take to protect yourself.

Minors and Mental Health Information

California law provides specific protections regarding access to mental health information of minors who are 12 years of age or older when the minor consented to certain services. For minor clients receiving ABA therapy, parents or legal guardians generally have the right to access the minor's records and exercise the rights described in this Notice on the minor's behalf, subject to applicable California law exceptions. If you have questions about how this applies to your situation, please contact our Privacy Officer.

Special Considerations for ABA Therapy

Most of ABC's clients are children receiving Applied Behavior Analysis (ABA) therapy services. The following provides additional context about how this Notice applies in our setting:

Parent and Guardian Authority

For minor clients, a parent or legal guardian generally signs authorizations and exercises the rights described in this Notice on behalf of the minor. We will require documentation of guardianship in cases involving foster care, divorce, or other custody arrangements.

School and IEP Coordination

ABA therapy goals are often most effective when coordinated with the educational team. With your written authorization, we may share treatment information with your child's school district, Individualized Education Program (IEP) team, classroom teachers, school psychologists, or other educational professionals. You may revoke this authorization at any time.

Coordination with Other Providers

With your written authorization, we may share information with other healthcare providers involved in your child's care, including pediatricians, developmental pediatricians, child psychiatrists, neurologists, speech-language pathologists, occupational therapists, and mental health providers.

Telehealth Services

When telehealth services are provided, sessions are conducted using HIPAA-compliant technology with end-to-end encryption. The privacy practices described in this Notice apply equally to telehealth sessions. Recordings of telehealth sessions, if any, are subject to the same protections as in-person session documentation.

Observation and Training Activities

ABC supervises and trains Registered Behavior Technicians and Behavior Consultants. As part of clinical supervision and training, supervisors may observe sessions and review clinical documentation. These activities are conducted within ABC's healthcare operations and do not require separate authorization. Observation by individuals outside ABC (e.g., for accreditation site visits or research) requires your written authorization unless otherwise permitted by law.

Contact Information

For questions about this Notice, our privacy practices, to exercise your rights, or to file a complaint, please contact our Privacy Officer:

Applied Behavior Consultants, Inc. — Privacy Officer Connie Wong, Clinical Administrator of Quality Control 4540 Harlin Drive, Sacramento, CA 95826 Telephone: (916) 364-7800 Email: cwong@appliedbehavior.com

ABC Office Locations

For general questions about ABC services, please contact the office serving your area:

Sacramento — 4540 Harlin Drive, Sacramento, CA 95826 · (916) 364-7800

Valencia — 23502 Lyons Avenue, Suite 304A, Newhall, CA 91321

Rancho Cucamonga — 10604 Trademark Parkway, Suite 308, Rancho Cucamonga, CA 91730

Central Valley — 7109 Danny Drive, Stockton, CA 95210

East Bay — 3075 Citrus Circle, Walnut Creek, CA 94598

Effective Date: 06/01/2026 · Version 2.0. This Notice supersedes any prior Notice of Privacy Practices issued by Applied Behavior Consultants, Inc.