Notice of Privacy Practices

Bridgeway Health PLLC | Effective October 3, 2026

Download or print this notice (PDF) · You can also ask us for a free paper copy at any time.

Your information. Your rights. Our responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Summary

Your rights

You have the right to:

• Get an electronic or paper copy of your medical record
• Ask us to correct your medical record
• Request confidential communications
• Ask us to limit the information we share
• Get a list of those with whom we have shared your information
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

Your choices

You have some choices in the way that we use and share information as we:

• Tell family and friends about your condition
• Provide mental health care
• Give or decline voluntary written authorizations for specially protected records or optional marketing

Our uses and disclosures

We may use and share your information as we:

• Treat you
• Run our organization
• Bill for your services
• Help with public health and safety issues
• Do research
• Comply with the law
• Work with a medical examiner or funeral director
• Address workers’ compensation, law enforcement, and other government requests
• Respond to lawsuits and legal actions

If we receive or maintain substance use disorder records protected by 42 CFR Part 2, or testimony about their contents, we do not use or disclose them in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a qualifying court order after notice and an opportunity to be heard as required by Part 2. The court order must be accompanied by a subpoena or another legal requirement compelling disclosure. A subpoena alone does not authorize release.

Your rights in detail

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

You can request access to health and billing information in the records we use to make decisions about you. Separately maintained psychotherapy notes and information compiled for a legal proceeding are excluded from this access right. Send a written request to privacy@bridgewayhealthky.com, through Spruce, by mail to our address below, or by fax to (606) 262-7903. Tell us which records you want and the preferred format and delivery method. No proprietary request form is required. Call (606) 202-7654 for help or a secure submission option. We verify identity and any representative’s authority.

We act as promptly as practicable and no later than 30 calendar days after receiving the request. If a legally permitted extension is needed, we give written reasons and a completion date within the initial 30 days; only one extension of up to 30 additional calendar days is allowed. We provide the requested electronic format when readily producible, or agree with you on an accessible alternative. We give a summary only if you agree in advance to it and any lawful fee. Your first requested copy is free under Kentucky law. Any additional-copy charge is explained in advance and limited by applicable law.

An unpaid balance does not delay or prevent access. If access is denied, we give a written reason, complaint information, and instructions for independent review when review is available.

Ask us to correct your medical record

To ask for correction, send a written request to our privacy contact describing the information and why you believe it is wrong or incomplete. We explain any request for a written reason in advance.

We act on an amendment request within 60 calendar days. If needed, one extension of up to 30 calendar days requires written reasons and a completion date within the initial 60 days. If we deny the request, we explain why in writing, how to submit a statement of disagreement, and how to complain.

Request confidential communications

You can ask us to contact you in a specific way, for example at a home, office, or cell phone number, or to send mail to a different address.

We will say yes to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say no, for example if it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment.

If you pay for a service or health care item out of pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say yes unless a law requires us to share that information.

Get a list of those with whom we have shared information

Ask our privacy contact in writing for an accounting of disclosures during the previous six years or a shorter period you choose. The accounting identifies covered disclosures, recipients, dates, and purposes.

HIPAA excludes treatment, payment, operations, authorized disclosures, and certain other disclosures from this accounting. We act within 60 calendar days; one extension of up to 30 calendar days requires written reasons and a completion date. The first accounting in a 12-month period is free. We explain any permitted fee for another request in advance so you can withdraw or change the request.

Get a copy of this privacy notice

You may request a free paper copy at any time, even if you agreed to electronic delivery. Call or contact us below; we provide it promptly. We make the current notice available in the office and provide it directly at your first service, including electronic service, except that emergency delivery occurs as soon as reasonably practicable. Website publication is handled separately from giving you a copy.

Choose someone to act for you

If someone has authority to act as your personal representative, for example if that person has your medical power of attorney or is your legal guardian, that person can exercise your rights and make choices about your health information.

We verify the person’s authority and its scope before acting. A support person, payor, conservator, or emergency contact does not automatically have healthcare or records authority. For a minor who may legally consent independently to particular care, a parent is not automatically the personal representative for that care. Current court orders, applicable state law, and safety-related exceptions govern access.

File a complaint if you feel your rights are violated

Contact our privacy contact below by phone, mail, fax, Spruce, or email to raise a concern; no special form is required. We can help you communicate the complaint. You may go directly to OCR, including if your concern involves Bridgett, without using or completing our internal process.

U.S. Department of Health and Human Services, Office for Civil Rights: call 1-800-368-1019 (TDD 1-800-537-7697), use ocrportal.hhs.gov/ocr/portal/lobby.jsf, or mail Centralized Case Management Operations, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201. Instructions: hhs.gov/hipaa/filing-a-complaint/. Complaints generally must be filed within 180 calendar days after you knew of the act or omission; OCR may extend this for good cause. You may also complain to OCR about protected Part 2 records.

We will not retaliate against you for filing a complaint.

Your choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care or payment for your care

Bridgeway does not routinely disclose information to disaster-relief organizations or maintain a hospital directory. Any unusual disclosure must satisfy applicable law and additional protections described here.

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases we never share your information unless you give us written permission:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

Marketing and sale of information. Bridgeway Health does not use or disclose your health information for marketing without your valid written authorization, and does not sell your health information. If you ever choose to give us permission to use your photograph, your story, or a testimonial, that permission is entirely voluntary, is requested on a separate form, is never a condition of treatment, and may be withdrawn at any time going forward.

Fundraising. Bridgeway Health does not conduct fundraising and does not use or disclose your health information for fundraising purposes.

Our uses and disclosures

How do we typically use or share your health information?

Treat you

Where permitted by applicable law, we use health information to provide care and share it with professionals involved in your treatment. Counseling records and protected Part 2 records may require written authorization or consent even for treatment, as explained below.

Example: your occupational therapist speaks with your child’s pediatrician about the reason for the referral and the results of the evaluation.

Run our organization

Where permitted by applicable law, we use and share health information to manage our practice, review quality, train authorized staff, and contact you. Additional counseling and Part 2 protections apply.

Example: we use health information about you to schedule appointments, review the quality of our services, and train our staff.

Bill for your services

Where permitted by applicable law, we use and share information to submit claims and receive payment from plans or other payors. Additional counseling and Part 2 protections apply; a billing permission does not replace a required records authorization.

Example: we give information about you to your health plan so it will pay for your services.

How else can we use or share your health information?

We are allowed or required to share your information in other ways, usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes.

The Part 2 protections described in this notice apply to every use or disclosure listed below when the information is a protected Part 2 record. HIPAA permission alone does not override Part 2 or stricter state confidentiality and privilege rules.

Help with public health and safety issues

We can share health information about you for certain situations such as:

• Preventing disease
• Reporting adverse reactions to medications
• Reporting suspected child abuse, neglect, or dependency, and abuse, neglect, or exploitation of a legally protected adult; other violence reporting only when applicable law permits or requires it
• Preventing or reducing a serious threat to anyone’s health or safety

Do research

We may use or share information for research only when applicable legal conditions are met, such as your valid authorization or a legally approved waiver. Additional counseling and Part 2 requirements still apply.

Comply with the law

We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we are complying with federal privacy law.

Work with a medical examiner or funeral director

We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests

We can use or share health information about you:

• For workers’ compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions

We review legal demands for applicable confidentiality, privilege, and authorization requirements before releasing records. A subpoena alone does not automatically permit disclosure. HIPAA may require satisfactory assurances of notice and an opportunity to object or a qualified protective order; Kentucky counseling privilege and Part 2 may require additional consent or a qualifying court order. An order limits disclosure to the information legally authorized. We disclose only the information permitted or required after this review.

Laws that give greater protection

Some state and federal laws protect certain information more strictly than HIPAA does. When that happens, we follow the stricter law.

Kentucky social work confidentiality and privilege can be stricter than HIPAA, including for treatment, payment, or operations. A signed authorization or a specific legal exception is required when applicable. A routine request from a school, insurer, referring provider, lawyer, or family member does not automatically override these protections.

Separately maintained psychotherapy notes generally require your specific written authorization, with limited legal exceptions. They are different from routine progress notes. A general release or treatment consent does not automatically authorize release of these notes.

When we receive or maintain records protected by 42 CFR Part 2, you may give a single written consent for future uses and disclosures for treatment, payment, and healthcare operations. You may revoke it in writing by contacting our privacy contact; revocation does not undo a use or disclosure already made in reliance on it. When a HIPAA covered entity or business associate receives records under that consent, it may redisclose them as HIPAA permits, subject to Part 2’s continuing prohibition on proceedings against you and any stricter applicable law. Other recipients remain subject to the applicable Part 2 limits. Separately maintained substance use disorder counseling notes require separate consent with limited exceptions. These rules do not make every mention of substance use a Part 2 record.

Kentucky law requires us to report suspected child abuse, neglect, or dependency, and suspected abuse, neglect, or exploitation of an adult who meets the definition in Kentucky law. Form BWH-108 explains this in more detail.

Kentucky law permits independent minor consent for certain care. Examples include outpatient mental health counseling by a qualified mental health professional for an unaccompanied youth aged 16 or older, and care or counseling covered by Kentucky’s substance-use-related minor-consent law. These are specific pathways, not blanket permission for all services. We document the applicable basis, explain confidentiality and records access, and verify parent or representative authority under the law and any current order. Form BWH-402 covers counseling assent and authority.

We retain clinical records under our clinic standard for at least seven years after the later of last service, termination/discharge, or death. Treatment records from before age 21 are also retained through at least age 24, whichever date is later. Longer law, payer, insurance, and hold requirements may apply. The end of a minimum period does not automatically authorize deletion.

Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We notify affected individuals when a breach of unsecured protected health information requires notice, without unreasonable delay and no later than 60 calendar days after discovery unless a legally authorized delay applies. We explain what happened, affected information, protective steps, our response, and how to contact us.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• Uses or disclosures not described in this notice require your written authorization unless another legal requirement applies. You may revoke an authorization in writing through our privacy contact. Revocation applies going forward and does not undo actions already taken in reliance on it.

For more information, see hhs.gov/hipaa.

Changes to the terms of this notice

We may change this notice and apply lawful changes to all information we maintain. The revised notice shows its effective date, is available on request and in our office, and must be prominently posted and available on our website at www.bridgewayhealthky.com when that site provides information about our services. Please contact us directly if you cannot obtain a copy online.

Free language assistance and appropriate communication aids are available for this notice and privacy requests. Call (606) 202-7654 or tell any staff member. Avoid sensitive health details in ordinary email; call or use Spruce for help with a secure submission.

How to contact us about your privacy