HIPAA Notice of Privacy Practices

Cypress Counseling, LLC, and Amy Spear, LPC, are committed to protecting the privacy of your health information. We are required by law to maintain the privacy of your protected health information (PHI), to provide you with this notice of our legal duties and privacy practices, and to follow the terms of this notice while it is in effect.

Cypress Counseling LLC.

HIPAA NOTICE OF PRIVACY POLICIES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

**PLEASE REVIEW IT CAREFULLY.**

Effective Date: 09/22/2026

Cypress Counseling, LLC provides psychotherapy services through Amy Spear, LPC. In this notice, “Cypress Counseling,” “we,” “us,” and “our” refer to Cypress Counseling, LLC, and “you” refers to the individual receiving services. Amy Spear, LPC is the licensed clinician providing services through the practice.

1. YOUR RIGHTS

You have the following rights regarding your protected health information (PHI), subject to applicable federal and South Carolina law:

1. Get a copy of your paper or electronic medical record, subject to applicable law.

Access requests will generally be fulfilled within 30 days of receipt. If more time is reasonably necessary, Cypress Counseling may extend the response period by up to one additional 30-day period as permitted by law and will provide the required written notice of the extension.
Where permitted by law, Cypress Counseling may charge a reasonable, cost-based fee for copies, limited to allowable costs such as copying, supplies, postage, and permitted labor associated with preparing the requested copy or a requested summary or explanation.

2. Ask us to correct health information about you that you believe is incorrect or incomplete.

Cypress Counseling may deny an amendment request when permitted by applicable law. If we deny

your request, we will provide a written explanation of the denial and information about your rights regarding the denial.

3. Request confidential communications, such as asking us to contact you in a particular way or at a

particular location.

Examples include asking us to contact you at home, at your office, on your cell phone, or by mail

at an alternate mailing address. Cypress Counseling will honor reasonable requests as required

by applicable law.

4. Ask us to limit the information we use or share about you for treatment, payment, or health care

operations, subject to applicable law. You may also ask us to restrict disclosures to a health plan

concerning services you have paid for in full out of pocket, when HIPAA permits and requires such a

restriction.

5. Ask for an accounting of certain disclosures of your health information.

An accounting may cover disclosures made during the six years before the date of your request, subject to applicable law and exclusions from the accounting requirement. Exclusions include, among others, disclosures for treatment, payment, or health care operations; disclosures to you or your personal representative; certain disclosures to persons involved in your care or payment or for disaster relief; disclosures made pursuant to an authorization; and other disclosures excluded by law.

6. Get a paper or electronic copy of this Notice of Privacy Practices.

7. Choose someone to act for you when that person has legal authority to do so.

8. File a complaint with Cypress Counseling or the U.S. Department of Health and Human

Services Office for Civil Rights.

9. Receive notice as required by law if a breach occurs that compromises the privacy or security of your

PHI.

2. HOW WE MAY USE AND DISCLOSE YOUR PHI

Treatment

We may use or disclose your PHI to provide, coordinate, or manage your care. For example, when legally permitted, we may communicate with another health care professional involved in your treatment.

Payment

We may use and disclose PHI as necessary to obtain payment for services, process claims, manage billing, and conduct other payment-related activities. Cypress Counseling is primarily a self-pay practice and may provide you with a superbill that you may choose to submit to your health plan for possible out-of-network reimbursement.

Health Care Operations

We may use and disclose PHI for activities necessary to operate the practice, including quality improvement, administrative activities, compliance, training, and other permitted health care operations.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your written authorization when permitted or required by applicable law, including for purposes such as:

Required by law.
Public health activities.
To prevent or lessen a serious and imminent threat to health or safety when permitted by law.
Abuse, neglect, or domestic violence reporting when required or permitted by law.
Health oversight activities.
Judicial and administrative proceedings.
Law enforcement purposes when permitted by applicable law.
Coroners and medical examiners.
Research when permitted by law.
Workers’ compensation purposes.
Appointment reminders and information about treatment alternatives or health-related benefits and services.
Other uses or disclosures permitted or required by applicable federal or state law.

3. YOUR CHOICES AND AUTHORIZATIONS

For certain uses and disclosures, we will obtain your written authorization when required. You may revoke an

authorization in writing at any time, except to the extent we have already relied on it.

Your Choices

When you have a clear preference about sharing information in certain situations, you may tell us what you want us to do. Subject to applicable law, you may choose whether we share relevant PHI with a family member, close friend, or another person involved in your care or payment for your care, and whether we share relevant PHI with disaster-relief organizations or personnel when applicable.

If you are unable to express a preference, such as because you are unconscious or otherwise incapacitated, Cypress Counseling may use or disclose relevant PHI when, based on professional judgment and applicable law, doing so is in your best interest. We may also disclose PHI when necessary to lessen a serious and imminent threat to health or safety, as permitted by law.

Marketing and Sale of PHI

HIPAA generally requires your written authorization before Cypress Counseling may use or disclose your PHI for marketing purposes, subject to limited exceptions recognized by law. Cypress Counseling does not currently use or disclose client PHI for marketing purposes.

HIPAA also requires your written authorization before Cypress Counseling may make a disclosure that constitutes a sale of PHI. The authorization must state that the disclosure will result in remuneration to Cypress Counseling. Cypress Counseling does not currently sell client PHI.

Cypress Counseling does not use or disclose client PHI for marketing purposes and does not sell client PHI.

If you authorize us to disclose PHI to a family member, partner, physician, psychiatrist, therapist, school, employer, attorney, or another person or organization, the authorization will identify the information and recipient as required by applicable law.

4. PSYCHOTHERAPY NOTES

Psychotherapy notes are notes maintained separately from the regular clinical record that document or analyze the contents of a counseling session and receive special protection under HIPAA. Most uses or disclosures of separately maintained psychotherapy notes require your written authorization, subject to limited legal exceptions.

Psychotherapy notes are distinct from the broader clinical record. Cypress Counseling does not authorize its contracted data or practice-analytics professional to access psychotherapy/session notes or mental-health assessments.

5. COMMUNICATION WITH OTHER PEOPLE

Cypress Counseling may communicate with family members, spouses/partners, physicians, psychiatrists, other therapists, schools, employers, attorneys, or other third parties when legally permitted and when the appropriate written authorization or other legal basis is present. As a general practice, Cypress Counseling will obtain a signed authorization specifying the person or organization, the information to be disclosed, the purpose, and any applicable expiration or other required terms.

Emergency contacts are handled separately. When a client has designated an emergency contact and provided appropriate consent, Cypress Counseling may contact that person when reasonably necessary for an emergency or safety concern and will seek to disclose only the minimum information reasonably necessary in the circumstances.

6. ELECTRONIC COMMUNICATIONS, EMAIL, AND TEXT MESSAGING

Cypress Counseling uses electronic systems, including the SimplePractice client portal, for scheduling, administrative communication, and other practice functions. Clients should use SimplePractice Secure Messaging through the Client Portal or mobile app for non-urgent clinical or sensitive communications when available.

Direct text messaging with Cypress Counseling/Amy may be used for brief logistical matters or to notify her of an urgent concern. Direct text messaging is not a secure messaging platform, is not continuously monitored, and should not contain detailed or highly sensitive mental-health information. It should not be relied upon for emergency assistance or an immediate response.

Cypress Counseling may also use automated SMS features provided through SimplePractice for appointment reminders, telehealth reminders, document reminders, and cancellation notifications. These automated messages are not a substitute for direct communication with the practice and are not monitored as an emergency service. SMS consent and opt-out preferences are handled through the messaging system.

Email and text messages may not provide the same level of privacy as the secure client portal. Do not use email, direct text, or automated SMS for emergencies.

For an immediate emergency, call 911, go to the nearest emergency department, call or text 988, or use an appropriate South Carolina crisis resource.

7. BUSINESS ASSOCIATES AND CONTRACTED PROFESSIONALS

Cypress Counseling may use outside service providers and contractors to perform services for the practice. When required by HIPAA, Cypress Counseling enters into Business Associate Agreements (BAAs) with appropriate business associates and requires them to use and disclose PHI only as permitted by law and their authorized responsibilities.

Cypress Counseling has entered a BAA with a contracted data and practice-analytics professional (“Analytics Professional”). Their current responsibilities may involve access to certain client-related and practice-management information, including limited identifying information, inquiry and consultation information, treatment and scheduling information, attendance information, and financial information necessary for their authorized responsibilities. Their access may expand in the future if additional client-facing website functionality is implemented and their responsibilities require access to additional identifying or client-related information. The Analytics Professional will not have access to psychotherapy/session notes or mental-health assessments.

Cypress Counseling has also entered a BAA with a website and marketing development professional (“Development Professional”) who provides website and marketing development and/or related services. Their work may, in some circumstances, result in incidental exposure to PHI or other confidential information. Their access is limited to what is authorized and reasonably necessary for the services they provide, consistent with applicable law and the BAA.

8. SUBSTANCE USE DISORDER RECORDS

If Cypress Counseling creates or maintains records that are subject to the federal confidentiality protections for substance use disorder patient records under 42 CFR Part 2, those records will be handled in accordance with applicable Part 2 requirements. In particular, Part 2-protected records may not be used or disclosed to initiate or substantiate a civil, criminal, administrative, or legislative investigation or proceeding against the patient except as permitted by Part 2, including with the patient's written consent or an appropriate court order. A court order authorizing use or disclosure does not by itself compel disclosure; a subpoena or other similar legal mandate may also be required to compel disclosure, as provided by Part 2.

9. SOUTH CAROLINA CONFIDENTIALITY AND PRIVILEGE

South Carolina law provides confidentiality and privilege protections for communications and treatment records of clients of licensed professional counselors, subject to exceptions provided by applicable state and federal law. Cypress Counseling will follow applicable federal and South Carolina confidentiality requirements, including laws that provide greater protection or impose additional restrictions on disclosure.

10. OUR RESPONSIBILITIES

We are required by law to maintain the privacy and security of your PHI.
We will let you know promptly as required by law if a breach occurs that may have compromised the privacy or security of your information.
We must follow the privacy practices described in this notice while it is in effect.
We reserve the right to change our privacy practices and make the new provisions effective for all PHI we maintain, as permitted by law.
We will not use or disclose your information other than as described in this notice or as otherwise permitted or required by law unless you provide written authorization when authorization is required.

11. QUESTIONS OR COMPLAINTS

Privacy questions, requests, or complaints may be directed to:

Amy Spear, LPC

Cypress Counseling, LLC
1 Carriage Lane,

Building E, Suite 206
Charleston, SC 29407

Amy@CypressCounselingSC.com
843-896-2692

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Cypress Counseling will not retaliate against you for filing a privacy complaint.

You may contact OCR at:

Office for Civil Rights,

U.S. Department of Health and Human Services,

200 Independence Avenue, S.W.,

Room 509F, HHH Building,

Washington, D.C. 20201

OCRComplaint@hhs.gov.

Toll-free 1-800-368-1019; TDD 1-800-537-7697

Health information privacy complaints may also be submitted through the HHS OCR complaint process at https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html.

12. CHANGES TO THIS NOTICE

We may change the terms of this notice. Changes may apply to all PHI we maintain, as permitted by law. The current notice will be available upon request and will be posted on the practice website.

13. EFFECTIVE DATE AND AVAILABILITY

Effective Date: 09/22/2026

A copy of this notice may be requested in paper or electronic form. The practice website will provide access to the current notice.

Cypress Counseling, LLC. • HIPAA Notice of Privacy Practices

Updated: 09/22/2026