HIPAA Notice of Privacy Practices

1. Who This Notice Applies To

This Notice applies to protected health information (PHI) created, received, or maintained by Dragonfly Directions, LLC doing business as Dragonfly Behavioral Health, and by Daniel Munger, M.A., in his role as the records owner and custodian for the practice. The practice is a covered health care provider under the federal Health Insurance Portability and Accountability Act (HIPAA) and is required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices with respect to PHI, follow the terms of the Notice currently in effect, and notify you following a breach of unsecured PHI.

2. Clinical Systems Used by the Practice

The practice uses SimplePractice as its electronic health record (EHR) and as the platform for telehealth video sessions, secure client messaging, the client portal, intake paperwork, consent forms, acknowledgment of this Notice, clinical documentation, appointment scheduling, and billing. Clinical information about your care is stored and managed within SimplePractice under a Business Associate Agreement.

The public website at dragonflybehavioralhealth.org and the limited contact-request dashboard are separate systems that are not used as the EHR, the clinical record, the telehealth platform, the secure clinical-message system, the billing record, or the document portal.

3. How the Practice May Use and Disclose Your PHI

The practice may use and disclose your PHI without your specific authorization for treatment, payment, and health care operations, as summarized below.

Treatment

PHI may be used and disclosed to provide, coordinate, or manage your mental health care, including telehealth counseling sessions, safety planning, referrals, and coordination with other health care providers you authorize.

Payment

PHI may be used to bill and collect payment for services from you or a responsible party. The practice operates primarily as private pay. Under supervised, non-self-pay arrangements expressly permitted by the qualified supervisor, PHI necessary for billing may be shared with the supervising entity or its billing systems. Upon request, the practice can provide a superbill containing the minimum information needed for you to seek possible reimbursement from your insurance carrier. Submitting a superbill to your insurance carrier is your choice and may result in disclosure of diagnosis and service information to that carrier.

Health Care Operations

PHI may be used for internal operations such as quality improvement, records management, business planning, credentialing, and compliance activities.

Supervisory Consultation

Because Daniel Munger is a Registered Mental Health Counselor Intern, Florida law requires ongoing clinical supervision. Your PHI will be discussed with the qualified supervisor, Dr. April Brown, LMHC-QS #0968, and with other consultants bound by confidentiality when consultation is clinically or legally necessary. Only the information reasonably necessary for supervision or consultation will be shared.

4. Couples Therapy and Joint Records

When two adults are seen together as a couple, the practice maintains a single joint clinical record for the couple rather than two separate individual records. Both partners are considered clients of the couples treatment.

The practice follows a no-secrets policy. Information that is clinically important to the couples work may be brought into joint sessions at the therapist's discretion. Please do not share information privately that you would not want discussed in the couples treatment.

Any voluntary release of the couples record to a third party requires the written authorization of both partners. The practice will not release the couples record based on the request or authorization of only one partner, except where disclosure is required or permitted by law without authorization.

5. Uses and Disclosures That May Be Made Without Your Authorization

State and federal law permit or require disclosure of PHI without your authorization in limited circumstances, including but not limited to: suspected abuse or neglect of a child, elderly adult, or vulnerable adult; a serious and imminent threat to the health or safety of an identifiable person or the public; response to a valid court order, subpoena, or other lawful process; certain public health activities; health oversight activities; coroners, medical examiners, and funeral directors; workers' compensation; and specialized government functions. Where feasible and lawful, the practice will limit the disclosure to the minimum necessary.

6. Uses and Disclosures That Require Your Written Authorization

Except for the uses and disclosures described above, the practice will not use or disclose your PHI without your written authorization. Uses and disclosures that always require your written authorization include most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and any sale of PHI. You may revoke a written authorization at any time, in writing, except to the extent the practice has already acted in reliance on it.

7. Outside Part 2 Records Received by the Practice

If the practice receives substance use disorder treatment records from a program covered by 42 C.F.R. Part 2, those records remain subject to the special federal Part 2 confidentiality protections after they are received. The practice will not redisclose Part 2 records except as permitted by 42 C.F.R. Part 2, which generally requires specific written consent that is separate from a general HIPAA authorization.

8. Your Rights Regarding Your PHI

• Right to Inspect and Copy. You may request access to and a copy of your clinical record, subject to limited exceptions permitted by law. Psychotherapy notes may be withheld as allowed by HIPAA.
• Right to Request Amendment. You may request that the practice amend PHI you believe is incorrect or incomplete. The practice may deny the request in limited circumstances permitted by law.
• Right to an Accounting of Disclosures. You may request an accounting of certain disclosures of your PHI made by the practice.
• Right to Request Restrictions. You may request restrictions on certain uses and disclosures of your PHI. The practice is not required to agree to all requested restrictions.
• Right to Request Confidential Communications. You may request that the practice communicate with you about your care in a specific way or at a specific location.
• Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
• Right to Be Notified of a Breach. You have the right to be notified in the event of a breach of your unsecured PHI.

9. Record Retention

The practice retains clinical records for a minimum of five (5) years from the date of the last professional contact, or longer where required by law or where the client is a minor. Records are stored within SimplePractice and disposed of using methods designed to protect confidentiality when the retention period ends.

10. Billing, Superbills, and Payment Records

Fees and payment arrangements are discussed with each client before treatment. The practice operates primarily on a private-pay basis. Under supervised, non-self-pay arrangements expressly permitted by the qualified supervisor, billing may be processed through the supervising entity. Superbills are available upon request for clients who wish to seek possible insurance reimbursement on their own. Payment may be processed through GoDaddy Payments or through SimplePractice. Card information is entered directly into the payment processor's hosted system.

11. Breach Notification

If a breach of your unsecured PHI occurs, the practice will notify you as required by the HIPAA Breach Notification Rule and applicable state law, including a description of what happened, the types of information involved, steps you can take to protect yourself, and steps the practice is taking in response.

12. Complaints and Nonretaliation

If you believe your privacy rights have been violated, you may file a complaint directly with the practice using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. The practice will not retaliate against you for filing a complaint.

13. Changes to This Notice

The practice reserves the right to change this Notice and to make the revised Notice effective for all PHI it maintains. The current Notice will be posted on the practice's website and made available upon request.

14. Contact for Privacy Questions and Requests

Please do not send detailed clinical information by ordinary email. The practice may move privacy communications into the secure SimplePractice portal.

Effective Date: July 20, 2026.