A Word Before You Begin

Privacy is not incidental to the work we do here. It is foundational to it. The nature of psychological care requires that you be able to speak freely, without concern that what you share will travel beyond this space. This Notice of Privacy Practices exists because federal law requires it, and because you deserve to understand precisely how your Protected Health Information is handled before our work together begins.

This Notice applies to all records of your care generated by Alafiora LLC and by Dr. Esther Lapite-Garrett in her capacity as your treating psychologist. It describes the ways in which we may use and disclose your health information, the rights you hold with respect to that information, and our obligations to you under the law.

We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of your Protected Health Information, to provide you with this Notice, and to abide by the terms of the Notice currently in effect. If we ever revise our privacy practices in a material way, we will provide you with an updated Notice and post the revised version on our website at https://www.alafiora.com/.

Please read this document in full. If you have questions before completing your intake paperwork, you are encouraged and welcome to ask them.

Section 1: What Is Protected Health Information?

Protected Health Information, referred to throughout this Notice as "PHI," means any information about your health, mental health, treatment, or payment for care that can be linked to you as an individual. This includes your name, contact details, dates of service, diagnoses, treatment notes, session records, assessments, and any other information that identifies you in connection with your care at Alafiora.

Section 2: How We May Use and Disclose Your Protected Health Information

2A. Uses and Disclosures That May Occur Without Your Written Authorization

Federal and state law permit certain uses and disclosures of your PHI without requiring your advance written authorization. These are limited and handled with the minimum necessary information:

For Treatment. We use your health information internally in the course of providing your psychological care. If we choose to share information with another health care provider involved in your treatment, such as a psychiatrist, primary care physician, or specialist, we will ask you to sign a written authorization for release of information before doing so, except in emergency circumstances. An authorization is also required for most uses and disclosures of psychotherapy notes, which are described separately in Section 4 of this Notice.

For Payment. Alafiora LLC is a private pay practice. We do not bill insurance companies or submit claims to third-party payers. Your payment records are used solely for internal bookkeeping and service documentation. If you choose to pursue reimbursement from your insurance carrier using a superbill, the decision to share your clinical information with that insurer is yours alone, and we will make that choice explicit at every relevant step.

For Health Care Operations. We may use your health information as part of our internal operations, including quality assurance, compliance review, and practice administration. We may also use your contact information to share services, educational resources, or programs that may be relevant to your care.

As Required by Law. We will disclose your PHI when required to do so by federal or state law, including in response to valid court orders, lawful subpoenas of which you have been properly notified and to which you have not objected, or requests from government agencies conducting health oversight activities within their lawful authority.

Court Proceedings. If you are involved in litigation and a court requests information concerning your diagnosis or treatment, that information is protected by the psychotherapist-patient privilege. We will not provide information without your written authorization or a valid court order. If you are involved in or contemplating litigation, we encourage you to consult with an attorney regarding the likelihood that a court would order disclosure.

Defense Against Complaints. If you file a complaint or lawsuit against Alafiora LLC or Dr. Lapite-Garrett, we may disclose relevant PHI to the extent necessary to defend against that complaint.

Workers' Compensation. If you file a workers' compensation claim and services provided at Alafiora are related to that claim, we may be required to submit treatment reports to the appropriate parties upon valid request.

Business Associates. We may disclose the minimum necessary health information to our business associates, which are third-party vendors who perform functions on our behalf. All business associates are required to execute a Business Associate Agreement with Alafiora LLC before accessing any PHI, and they are bound by confidentiality obligations at least as protective as those governing our own practice.

2B. Uses and Disclosures We Are Legally Obligated to Make

There are situations in which we are legally required to act to protect the safety of individuals or the public. In these situations, we may disclose limited information about your care:

Child Abuse or Neglect. If we know or have reasonable cause to suspect that a child under the age of eighteen has been abused, abandoned, or neglected by a parent, legal custodian, caregiver, or any other person responsible for the child's welfare, we are required by law to file a report with the appropriate child protective services agency in the state where services are being provided. In New Mexico, reports are made to the Children, Youth and Families Department (CYFD) Statewide Central Intake at 1-855-333-SAFE (1-855-333-7233). In other states where we are licensed to practice, we will comply with the mandatory reporting requirements of the applicable jurisdiction. Once a report is filed, we may be required to provide additional information.

Vulnerable Adult Abuse or Exploitation. If we know or have reasonable cause to suspect that a vulnerable adult has been abused, neglected, or exploited, we are required by law to report this to the appropriate adult protective services agency in the state where services are being provided. In New Mexico, reports are made to Adult Protective Services (APS) at 1-800-477-6282. In other states where we are licensed to practice, we will comply with the applicable state law.

Serious Threat to Safety. If we believe there is a clear and immediate probability of physical harm to you, to an identifiable third party, or to society, we may be required to take protective action. This may include communicating relevant information to a potential victim, to an appropriate family member, to law enforcement, or to seek emergency services or hospitalization on your behalf. We will disclose only the minimum information necessary to address the threat.

2C. Uses and Disclosures That Require Your Written Authorization

Beyond the circumstances described above, we will not use or disclose your PHI without your written authorization. You may revoke any authorization you have provided at any time by submitting a written request to our office. Revocation will not affect any uses or disclosures that occurred in reliance on your authorization before we received notice of revocation.

Uses and disclosures that always require your written authorization include, but are not limited to:

• Marketing communications using your PHI

• Any sale of your PHI

• Most uses and disclosures of psychotherapy notes, as described in Section 4

Section 3: Special Circumstances and Additional Disclosures

Health Oversight. We may be required to disclose PHI to a government agency conducting lawful health oversight activities, such as audits, investigations, or inspections authorized under federal or state law.

Deceased Individuals. We may disclose PHI to a coroner, medical examiner, or funeral director as authorized or required by law.

Research. We may use de-identified health information for research purposes under the conditions permitted by HIPAA, which include independent review board oversight or an authorized waiver of the authorization requirement. We will not use your identifiable PHI for research without your written authorization.

Specialized Government Functions. We may disclose PHI as required by federal law in connection with military and veterans' activities, national security, or intelligence activities.

Section 4: Special Protections for Psychotherapy Notes and Substance Use Disorder Records

4A. Psychotherapy Notes

Psychotherapy notes are a distinct category under HIPAA. They are defined as notes recorded by a mental health professional that document or analyze the content of private counseling sessions, kept separately from the rest of your clinical record. Psychotherapy notes receive the highest level of protection available under federal law. Your written authorization is required before we may use or disclose your psychotherapy notes for any purpose, including treatment, payment, or health care operations, with limited exceptions such as our own supervision and training, defense against a complaint you have filed, or when required by law.

You have the right to know that this heightened protection exists and applies to your care at Alafiora.

4B. Substance Use Disorder Records

Federal law under 42 Code of Federal Regulations Part 2 (42 CFR Part 2) provides special privacy protections for records relating to substance use disorder (SUD) treatment. These protections apply specifically to records created by or received from a federally-assisted substance use disorder treatment program, which includes programs that accept Medicare or Medicaid.

Alafiora LLC is a private pay practice and does not accept Medicare or Medicaid. Accordingly, 42 CFR Part 2 may not apply to treatment records we generate within this practice. However, if we receive records protected under 42 CFR Part 2 from another provider or program, those records will be treated with the heightened protections required by that law.

If your records are or become protected under 42 CFR Part 2:

• We will not share them without your written authorization, except in the limited circumstances allowed by law.

• Your written authorization may permit future sharing for treatment, payment, and health care operations.

• Anyone who receives these protected records is generally prohibited from re-disclosing them without proper authorization.

• These records cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide separate written authorization for that specific purpose or a court issues a special order compliant with federal law.

A separate Authorization for Release of Substance Use Disorder Records will be required if you wish to authorize disclosure of any such records.

Section 5: Working With Minors

At this time, Alafiora LLC serves adult clients. As the practice expands to serve clients of all ages, the following will apply:

When a minor is receiving psychological services, the minor's parent or legal guardian generally serves as the personal representative and holds the right to access the minor's health records under both HIPAA and applicable state law. However, there are circumstances under which a minor may consent to treatment independently, and in those cases, access to records may be governed by state law rather than parental consent alone. We will provide parents, guardians, and minor clients with information specific to their situation and the applicable legal framework at the time services are initiated.

When a minor discloses information suggesting that they have been abused, neglected, or are at serious risk of harm, we are required by law to take the protective reporting actions described in Section 2B, regardless of parental authorization.

Section 6: Working With Couples, Families, and Conjoint Clients

At this time, Alafiora LLC serves individual clients. As the practice expands to include couples therapy, family therapy, or conjoint treatment modalities, the following will apply:

When more than one individual is formally identified as a client within a shared treatment relationship, each client holds independent rights over their own PHI. Before treatment begins, we will establish in writing how records, confidentiality, and information-sharing will function within that therapeutic arrangement, and what will happen in the event of a conflict between clients' interests. We will not disclose one client's information to another client in a conjoint arrangement without explicit written authorization from the individual whose information is being shared.

Section 7: Telehealth and Electronic Communication

Alafiora LLC provides psychological services through secure, HIPAA-compliant telehealth platforms. The specific platforms we use may change over time as we evaluate the best available tools for clinical quality and privacy protection. Regardless of platform, all telehealth vendors are required to execute Business Associate Agreements with Alafiora LLC before any PHI is transmitted through their systems.

Standard email is not a fully secure method of communication. We use secure messaging channels for clinical correspondence and encourage you to do the same. Where possible, we will respond to any sensitive communication through a more secure channel.

Sessions are not recorded by Alafiora LLC without your explicit written consent obtained in advance. If you wish to record any portion of a session on your own device, you must notify Dr. Lapite-Garrett before recording begins, and you bear full responsibility for the secure storage and appropriate handling of that recording.

To protect the privacy of your sessions, please join from a private location, use a secured internet connection, and avoid public or shared networks when possible. Alafiora LLC is not responsible for privacy breaches that result from your choice of device, network, or environment.

Section 8: Your Rights Regarding Your Protected Health Information

You hold meaningful rights with respect to your PHI. To exercise any of the rights described below, please submit a written request to our office through our Compliance Contact Form at https://www.alafiora.com/ or by emailing legal@alafiora.com.

Right to Ethical Treatment. You have the right to ethical psychological care without discrimination on the basis of race, ethnicity, national origin, gender identity, sexual orientation, religion, disability status, age, or any other protected characteristic.

Right to Confidentiality. You have the right to have your health information protected. Because Alafiora is a private pay practice, your payment records are not shared with insurers as part of standard operations. If you pay for services entirely out of pocket, you may also request that we not use that payment information in any communications with a health insurer, and we will honor that request unless required by law to do otherwise.

Right to Inspect and Obtain a Copy of Your Records. You have the right to inspect and receive a copy of your PHI, with limited exceptions permitted by law. Requests must be submitted in writing. We will respond within thirty days. A reasonable fee may be charged for the cost of copying, postage, and preparation in accordance with applicable law. If we deny your request for access, we will explain the reason in writing and, where applicable, describe your right to have that denial reviewed.

Right to Request Amendment. If you believe that information in your records is inaccurate or incomplete, you may request that we amend it. Requests must be submitted in writing with a description of the amendment and your reason for requesting it. We will respond within sixty days. If we deny your request, we will explain why in writing, and you have the right to submit a written statement of disagreement for inclusion in your record.

Right to an Accounting of Disclosures. You have the right to receive an accounting of certain disclosures of your PHI. This right does not apply to disclosures made for treatment, payment, or health care operations, or to disclosures you authorized in writing. Please contact us to discuss what an accounting of disclosures would include in your specific situation.

Right to Request Restrictions. You have the right to request that we limit certain uses or disclosures of your PHI. We are not always required to agree to a requested restriction; however, if we do agree, we are bound by that agreement except in emergency circumstances.

Right to Confidential Communications by Alternative Means. You have the right to request that we communicate with you through a particular method or at a particular location. We will accommodate reasonable requests.

Right to Choose a Personal Representative. If you have a legal guardian or another individual authorized to act on your behalf, that person may exercise your HIPAA rights on your behalf. We will verify their authority before taking action.

Right to a Copy of This Notice. You have the right to receive a copy of this Notice of Privacy Practices at any time. A current version is always available on our website at https://www.alafiora.com/ and will be provided upon request.

Right to Choose and to Terminate Services. You have the right to decline services with Alafiora LLC at any time. If you would prefer to work with another provider, we will, where clinically appropriate, assist you in identifying qualified alternatives. You may terminate services at any time without legal obligation beyond fees already incurred. We ask that you communicate your decision, either in session or by contacting us directly, so that we may support a thoughtful and appropriate close to our work together.

Right to Release Information With Your Written Consent. With your written authorization, any portion of your record may be released to any person or agency you designate. We will discuss with you any clinical concerns we may have about a particular release before it takes place.

Section 9: Our Duties to You

We are required by law to:

• Maintain the privacy of your Protected Health Information.

• Provide you with this Notice of Privacy Practices and abide by its current terms.

• Notify you in the event of a breach of your unsecured PHI, in accordance with the HIPAA Breach Notification Rule.

• Reserve the right to revise our privacy practices. Any changes will apply to PHI we already hold, as well as to PHI we create or receive in the future. We will provide you with a revised Notice and post the updated version on our website.

We are committed to honoring both the letter and the spirit of these obligations.

Section 10: How to File a Complaint

If you believe your privacy rights have been violated, or if you disagree with a decision we made regarding access to your records, we encourage you to contact us first so that we may address your concern directly and promptly.

Contact Alafiora LLC:
Email: legal@alafiora.com
Compliance Contact Form
Mail: 1209 Mountain Road Place Northeast, Suite R, Albuquerque, NM 87110

Privacy Officer: Alafiora LLC has designated a Privacy Officer responsible for the development and implementation of our privacy policies and for receiving privacy-related concerns. You may reach the Privacy Officer at: legal@alafiora.com.

U.S. Department of Health and Human Services, Office for Civil Rights (OCR): Website: https://www.hhs.gov/ocr/complaints Phone: 1-800-368-1019 TTY: 1-800-537-7697

New Mexico State Board of Psychologist Examiners: P.O. Box 25101, Santa Fe, NM 87504 Phone: (505) 476-4890 Website: https://www.rld.nm.gov/boards-and-commissions/individual-boards-and-commissions/psychologist-examiners/

All Other Licensed States: You may locate the psychology licensing board for your jurisdiction through the Association of State and Provincial Psychology Boards (ASPPB) at https://www.asppb.net.

Filing a complaint, whether with our office or with any external agency, will not affect the quality of your care, your access to services, or your relationship with Dr. Lapite-Garrett in any way.

Section 11: Effective Date and Updates

This Notice of Privacy Practices is effective as of the date listed above. We reserve the right to revise its terms at any time. Any revised Notice will be posted on our website at https://www.alafiora.com/ and provided to you at your next scheduled session or upon request.

For questions about this Notice, please contact us at legal@alafiora.com or through our Compliance Contact Form. Your intake paperwork will include a separate Acknowledgment of Receipt confirming that you have received and reviewed this Notice.