Notice of Privacy Practices

Effective August 11, 2026

1. 1.Who this notice covers

   This notice applies to Shanti Orange County and to everyone who works for us — employees, clinicians, students, interns, and volunteers — as well as to the companies we hire to help run our services, who are bound by written agreements to protect your information as we do.

   It covers the health information we create or receive about you: your record with us, notes from your sessions, information about your care and services, and information used to bill for them. In this notice, that is called “your health information.”

2. 2.How we use and share your health information without asking you first

   For most day-to-day care, the law lets us use and share your health information without a signed authorization from you. The three main reasons are:

   • For your treatment. So the people caring for you can do it well. For example, your therapist may discuss your care with your case manager, or we may share information with a doctor or specialist you are referred to.
   • To get paid. To bill and be paid for services — for example, sending a claim to your health plan, which may include your diagnosis and the services you received. If you pay for a service yourself and ask us not to bill your plan, see your rights below.
   • To run our services. For the work of operating a clinic: reviewing quality of care, training staff and students, arranging services, and improving our programs. This is also why we may email you a short survey after a session asking how it went.

3. 3.Other times the law lets or requires us to share information

   There are specific situations, set by law, where we may or must share your health information without your authorization. We share only what the law allows, and no more:

   • Public health. To report disease, injury, births and deaths, and to public health authorities carrying out their duties.
   • Abuse or neglect. To report suspected abuse or neglect of a child, an older adult, or a dependent adult, as California law requires of us.
   • Serious threats to safety. To prevent a serious and imminent threat to your health or safety, or to someone else's. In California, a clinician may be required to warn an identified person and notify law enforcement when a patient makes a serious threat of violence against them.
   • Health oversight and audits. To agencies that license, audit, or investigate us, and to accreditation bodies.
   • Legal proceedings. In response to a court order, subpoena, warrant, or similar lawful process.
   • Law enforcement. In the limited circumstances the law permits, such as identifying a suspect or reporting a crime on our premises.
   • Coroners, medical examiners, funeral directors. To let them carry out their duties.
   • Organ and tissue donation. To organizations that handle donation and transplant.
   • Workers' compensation. As needed to comply with workers' compensation laws.
   • Military, veterans, national security. As required by law for military and veterans' activities, national security, and protective services.
   • Research. Only after a review board has approved the study and confirmed protections for your privacy, or where the information has been stripped of identifiers.
   • As required by law. Any other disclosure federal, state, or local law requires of us.

4. 4.Information that gets extra protection

   Some information about you is protected more strictly than the rest, and the general rules above do not fully describe how we treat it.

   HIV and AIDS information. California law protects the results of an HIV test more tightly than most health information, and in most cases we cannot share them without your specific written permission, even with people who could otherwise receive your records.

   Psychotherapy notes. A therapist's private notes about a counseling session, kept separate from the rest of your record, are not shared for treatment, payment, or operations without your written authorization, apart from a few narrow exceptions the law names.

   California medical privacy law. The California Confidentiality of Medical Information Act applies to us alongside HIPAA. Where the two differ, we follow whichever gives you more protection.

5. 5.Things we will not do without your written permission

   We will ask for your written authorization before we:

   • Share psychotherapy notes, except in the narrow situations the law allows.
   • Use or share your information for marketing.
   • Sell your information. We do not sell health information, and we will not.
   • Share your information with your family, a friend, or anyone else you name — unless you are present and agree, or you are unable to agree and sharing is in your best interest in an emergency.

6. 6.Your rights over your health information

   These are yours by law. To use any of them, contact us using the details at the end of this notice. We may ask you to put the request in writing.

   • See and get a copy of your record. You can inspect your record and get a copy, on paper or electronically. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies.
   • Ask us to correct it. If you believe something in your record is wrong or incomplete, you can ask us to amend it. If we deny the request we will explain why in writing, and you may submit a statement of disagreement to be kept with your record.
   • Get a list of disclosures. You can ask for an accounting of certain disclosures we have made in the past six years — broadly, those outside treatment, payment, and operations.
   • Ask us to limit what we share. You can ask us to restrict how we use or share your information. We are not required to agree, with one exception we must honor: if you pay for a service in full yourself and ask us not to tell your health plan about it, we will not.
   • Ask us to contact you a particular way. You can ask us to reach you at a specific phone number or address, or to avoid one — for example, not leaving voicemail at home. We will accommodate reasonable requests and will not ask you why.
   • Get a paper copy of this notice. Even if you have read it here or agreed to receive it electronically.
   • Choose someone to act for you. A parent, guardian, or person with legal authority may exercise these rights on your behalf; we will confirm their authority first.
   • Take back a permission you gave. You may revoke a written authorization at any time. That stops future use, but cannot undo something already done in reliance on it.
   • Be told if your information is breached. We will notify you if a breach compromises the privacy or security of your information.

7. 7.What we are required to do

   We are required by law to protect the privacy of your health information, to give you this notice explaining our privacy practices, and to follow the terms of the notice currently in effect.

   We may change this notice, and any change applies to information we already hold as well as information we receive afterwards. When we do, we will post the revised notice on this website with a new effective date, and make paper copies available where we provide services.

   We will not use or share your information for any purpose other than those described here without your written permission.

8. 8.If you think your privacy was violated

   Tell us. Contact our Privacy Officer using the details below and we will look into it.

   You can also complain directly to the federal government, and you do not have to talk to us first. Write to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, call 1-877-696-6775, or file online at hhs.gov/ocr/privacy/hipaa/complaints.

   We will not retaliate against you for making a complaint, and complaining will never affect the care you receive from us.