Privacy policy & Notice of Privacy Practices

Important Patient Notice

THIS NOTICE DESCRIBES HOW MEDICAL AND MENTAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: October 26, 2026  |  Last updated: October 26, 2026

1. Who We Are and Who This Notice Covers

This notice is provided by Arizona Mental Health, PLLC, doing business as Arizona Mental Wellness ("the Practice," "we," "us"), including our Peoria and Wickenburg, Arizona offices, our telehealth services for patients located in states where our clinician is licensed, and our PsychiatryCore division (psychiatrycore.com), which provides telehealth care for patients in Nevada and Hawaii. This notice covers information collected through both websites. It applies to all health information we create or receive about you while providing psychiatric evaluation, medication management, telehealth and related care.

Part A explains your rights under the Health Insurance Portability and Accountability Act (HIPAA), the HITECH Act and the state laws that apply to your care. Part B explains how we handle information collected through this website, forms, email and text messages.

2. Our Legal Duties

• We are required by law to keep your protected health information (PHI) private.
• We must give you this notice of our legal duties and privacy practices and follow the notice currently in effect.
• We must notify you if a breach occurs that compromises the privacy or security of your unsecured PHI.
• We will not use or share your information other than as described here unless you give us written permission.
• Where a state law gives your information more protection than HIPAA, we follow the stricter law.

3. How We Use and Share Your Health Information

We may use and share your information without your written authorization for the following purposes. We share only the minimum necessary, except when sharing with another provider for your treatment.

• Treatment: Providing and coordinating your care, for example sending prescriptions to your pharmacy, ordering lab work or pharmacogenetic testing, or talking with your primary care provider or therapist.
• Payment: Billing your health plan (such as UnitedHealthcare/Optum) and collecting payment for services, including copays, deductibles, self-pay fees, and receipts or superbills you can submit to your insurance plan.
• Health care operations: Running the Practice, for example quality reviews, staff training, compliance audits, legal and accounting services, and risk management.
• Appointment reminders and practice communications: Contacting you by phone, text, email or the patient portal about appointments, refills and care.
• Business associates: Vendors that perform services for us, such as our electronic health record and patient portal (ICANotes), e-prescribing and telehealth platforms, sign a Business Associate Agreement and must protect your information.
• People involved in your care: Sharing information with a family member, friend or caregiver you identify, unless you object. In an emergency, or if you cannot agree, we use professional judgment about what is in your best interest.
• Prescription monitoring: Checking and reporting to state prescription drug monitoring programs as state law requires when controlled substances are prescribed.

We may also use or share your information when the law requires or allows it, including:

• Abuse, neglect or exploitation: Reporting suspected abuse or neglect of a child or a vulnerable adult to the state agency or law enforcement, as Arizona, Nevada and Hawaii law requires.
• Serious threat to health or safety: Sharing information to prevent or lessen a serious and imminent threat to you or others, including the duty to warn and protect under state law.
• Public health and health oversight: Reporting to public health authorities and responding to licensing boards and government audits.
• Legal proceedings: Responding to a court order, or to a subpoena or other lawful process when the legal requirements for doing so are met.
• Law enforcement, coroners and medical examiners: Limited sharing as the law allows.
• Workers' compensation and specialized government functions: As required by those laws.
• As required by law: When a federal, state or local law requires it, including to the U.S. Department of Health and Human Services to show we comply with HIPAA.

4. Extra Protections for Mental Health and Substance Use Records

Mental health and substance use records receive extra protection under federal and state law, including Arizona (A.R.S. § 36-509 and §§ 12-2291 to 12-2297), Nevada (NRS Chapter 629) and Hawaii (HRS § 334-5). When one of these laws limits sharing more than HIPAA does, we follow it.

• Psychotherapy notes: If kept, separately filed psychotherapy notes are not shared without your written authorization, except in the narrow cases the law allows.
• Substance use disorder records (42 CFR Part 2): If we receive records about you from a federally assisted substance use disorder program covered by 42 CFR Part 2, or testimony relaying their content, they will not be used or shared in any civil, criminal, administrative or legislative proceeding against you unless you give specific written consent or a court issues an order that meets Part 2 requirements, along with a subpoena or similar legal mandate.
• Fundraising: We do not use your information for fundraising. If that ever changes, you will have a clear opportunity to opt out first.

5. Uses That Require Your Written Permission

We will ask for your signed authorization before we:

• Share psychotherapy notes, except as the law allows.
• Use or share your information for marketing.
• Sell your health information. We do not sell health information.
• Use or share your information for any purpose not described in this notice.

You may revoke an authorization at any time by writing to our Privacy Officer. Revoking it does not undo sharing that already happened while it was in effect.

6. Your Rights

To use any of these rights, contact our Privacy Officer (see section 14). We may ask you to make the request in writing.

• Get a copy of your records: You can see or get a paper or electronic copy of your medical and billing records. We will respond within 30 days and may charge a reasonable, cost-based fee. In limited cases the law allows us to deny part of a request; you can ask for that decision to be reviewed.
• Ask us to correct your records: You can ask us to amend information you believe is wrong or incomplete. If we say no, we will tell you why in writing within 60 days, and you can submit a statement of disagreement.
• Request confidential communications: You can ask us to contact you a certain way (for example, only on your mobile phone or only through the portal) or at a different address. We will agree to reasonable requests.
• Ask us to limit what we use or share: You can ask us not to use or share certain information. We are not required to agree, except as follows.
• Self-pay restriction: If you pay for a service or item out of pocket in full, you can ask us not to share that information with your health insurer for payment or operations. We will say yes unless a law requires us to share it.
• Get a list of disclosures: You can ask for a list (accounting) of the times we shared your information in the six years before your request, other than for treatment, payment, operations and certain other disclosures. One list a year is free.
• Get a copy of this notice: You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you: A health care power of attorney or legal guardian can exercise your rights. We will confirm their authority first.
• Be notified of a breach of your unsecured health information.
• File a complaint without fear of retaliation (see section 14).

7. Website and Online Privacy

This part applies when you visit psychiatrycore.com or arizonamentalwellness.com, fill out a website form, or contact us by email or text before becoming a patient. Once you become a patient, information in your health record is protected under Part A.

Information you give us. When you use the contact or appointment request form, we collect your name, email address, phone number, the state you are located in and your message. If you call, email or text us, we receive your phone number or email address and what you send.

Information collected automatically. Like most websites, our host and analytics tools collect technical information such as your IP address, browser and device type, pages viewed, the page that referred you, approximate location (city or region) and the date and time of your visit. This is collected through server logs and cookies or similar technologies.

How we use it. To respond to your inquiry, schedule appointments, prevent spam and abuse, keep the site secure and understand which pages are helpful so we can improve them. We do not sell personal information, and we do not use it for targeted advertising.

8. Third-Party Services on This Website

These outside services receive some information when you use our site. Each has its own privacy policy.

• Google Analytics 4 (website statistics): pages viewed, device and browser data, approximate location and cookie identifiers. You can opt out with the Google Analytics opt-out browser add-on.
• Cloudflare Turnstile (spam and bot protection on forms): browser and device signals used to tell people from automated bots.
• Google Workspace (Google Forms) (insurance verification): the insurance information you submit on our verification form is stored in our Google Workspace account, which is covered by a HIPAA Business Associate Agreement.
• DreamHost (website hosting and form delivery): hosts this website and emails what you type into our contact forms to the Practice. Form messages are not stored on the website.
• Google Maps (office maps): Google may receive your IP address and map interactions when a page with a map loads.
• Google Fonts and content delivery networks (fonts, icons and page styling): receive your IP address and browser information when pages load.
• ICANotes (patient portal and health record): covered by a Business Associate Agreement and HIPAA. Website analytics are not used inside the patient portal.

Tracking across sites and "Do Not Track." Third parties such as Google may collect information about your online activities over time and across different websites when you use our site. Our website does not currently respond to browser "Do Not Track" signals, but you can block or delete cookies in your browser settings and use the opt-out tool above. Blocking cookies does not affect your ability to call or book with us.

9. Text Messaging (SMS)

• Consent: We text you only if you text us first or agree to receive texts. Texts cover scheduling, reminders and practice updates. We do not send marketing texts.
• No sharing: Your mobile number and text-messaging consent are never sold, rented or shared with third parties or affiliates for their marketing.
• Opt out: Reply STOP to any message to stop texts. Reply HELP for help, or call (623) 362-0134.
• Rates: Message and data rates may apply. Message frequency varies.
• Privacy: Standard text messaging is not encrypted. Avoid sending detailed health information by text; use the patient portal instead.

10. Nevada Residents

Online privacy notice (NRS 603A.300–603A.360). Sections 7 and 8 describe the categories of personal information we collect through this website and the categories of third parties we share it with. You can ask to review and correct the personal information you submitted through the website by contacting us (section 14). We do not sell covered information. You may still send a request to opt out of any future sale to [email protected], and we will honor it.

Consumer health data (NRS 603A.400–603A.550). Health information in your medical record is protected by HIPAA and is not covered by this law. Some website information could be considered "consumer health data," such as a form message that mentions a health concern, or a visit to a page about a specific condition.

• What we collect and why: Contact details and anything you write in a form or message, to respond and schedule care; and website usage data, to secure and improve the site.
• Sources: You directly, and automatically from your browser or device.
• Who we share it with: The service providers listed in section 8, only to provide their services to us. We do not sell consumer health data.
• Your rights: You can ask us to confirm whether we collect or share your consumer health data, get a list of the third parties we shared it with, have it deleted, and withdraw your consent. Contact us (section 14). We will respond within 45 days, and may extend that once by 45 days if necessary, with notice. If we decline your request, you may appeal by replying to our response; we will answer the appeal in writing.

11. Arizona and Hawaii Residents

Arizona: Medical and mental health records are confidential and may be released only as allowed by A.R.S. §§ 12-2291 to 12-2297 and § 36-509. You have the right to access your records under A.R.S. § 12-2293. If a breach of computerized personal information affects you, we notify you as A.R.S. § 18-552 requires.

Hawaii: Mental health records are kept confidential under HRS § 334-5. If a security breach involving your personal information occurs, we notify you as HRS Chapter 487N requires, and we dispose of records securely as HRS Chapter 487R requires.

12. Security, Retention and Breach Notification

We use administrative, physical and technical safeguards, including encrypted connections (HTTPS) on this website, a HIPAA-compliant health record and patient portal, and access limited to people who need the information. Telehealth visits use a platform covered by a Business Associate Agreement. Please join telehealth visits from a private location. No system is perfectly secure, so we cannot guarantee absolute security.

We keep medical records for at least as long as state law requires (in Arizona, generally six years after the last visit for adults, and for minors until age 21 or six years after the last visit, whichever is later) and then dispose of them securely. Website form messages are kept only as long as needed to respond and run the Practice.

If a breach of unsecured health information or personal information occurs, we will notify affected people, and regulators where required, as required by HIPAA and Arizona, Nevada (NRS 603A.220) and Hawaii law.

Children: This website is not directed to children under 13, and we do not knowingly collect their information online. Care for minors is arranged with a parent or legal guardian.

13. Changes to This Notice

We may change this notice, and the changes will apply to all information we have about you. The new notice will be posted on this page and available at our offices, with an updated effective date. For material changes to how we handle website information, we will post a notice on our homepage before the change takes effect.

14. Questions, Requests and Complaints

To ask a question, use any right in this notice, or file a complaint, contact our Privacy Officer. If you believe your privacy rights were violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints, by calling 1-800-368-1019, or by writing to 200 Independence Avenue S.W., Washington, D.C. 20201. Nevada residents may also contact the Nevada Attorney General, and Arizona and Hawaii residents their state Attorney General. We will not retaliate against you for filing a complaint.