NOTICE OF PRIVACY PRACTICES 

APEX BEHAVIORAL HEALTH PLLC

NICOLE JOSLIN, PMHNP-BC

THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: September 22, 2026

1. MY LEGAL DUTY



I am required by the Health Insurance Portability and Accountability Act (HIPAA) and by North Carolina law to protect the privacy of your protected health information (PHI), to provide you with this Notice describing my legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

I am also required to notify you if a breach occurs that may have compromised the privacy or security of your health information.

I reserve the right to change the terms of this Notice at any time. Any revised Notice will apply to all protected health information I maintain, including information created or received before the change. If I make a material change, the updated Notice will be posted on my website at apexncbehavioralhealth.com and a copy will be available at my office on request.

2. WHAT IS PROTECTED HEALTH INFORMATION

Protected health information, or PHI, is any information about your health, your health care, or payment for your health care that could reasonably be used to identify you.

For this practice, PHI includes but is not limited to:

Your name, date of birth, address, telephone number, and email address

Your insurance information and member identification numbers

Information you submit through the Send Message form on my website, including your date of birth and insurance verification details

Your psychiatric diagnosis and history

Session notes and clinical documentation from your evaluations and follow-up visits

Your medication history, current prescriptions, and prescription records

Your medical history, including information gathered during the 90-minute initial evaluation

Messages you send me through the secure client portal or Spruce

Appointment records, billing records, and payment authorizations

3. HOW I MAY USE AND DISCLOSE YOUR PHI WITHOUT YOUR AUTHORIZATION

Federal and state law permit me to use and disclose your PHI without your written authorization in the following circumstances.

TREATMENT

I may use your PHI to provide, coordinate, and manage your psychiatric care. This includes:

Coordinating with your therapist, primary care provider, or other treating clinicians when clinically appropriate

Communicating with pharmacies to transmit prescriptions and address prescription questions

Consulting with other health care professionals about your care, including consultation with a collaborating physician where appropriate

Making referrals to therapists or other providers

PAYMENT

I may use and disclose your PHI to obtain payment for services provided to you. This includes submitting claims to and communicating with the health plans this practice is contracted with: Aetna, Aetna State Health Plan, Anthem, Blue Cross Blue Shield, Cigna, UMR, UnitedHealthcare, Optum, MedCost, and Medicare.

Payment activities may include verifying your benefits and eligibility, obtaining prior authorization for medications or services, submitting claims, processing payments, and following up on unpaid claims. Billing and claims work is performed on my behalf by my billing specialist, described in Section 6. Billing communications may come from billing@apexncbehavioralhealth.com.

If you pay for a service in full out of pocket and ask me not to submit it to your health plan, I am required to honor that request, as described in Section 5.

HEALTH CARE OPERATIONS

I may use your PHI for the internal operation of my practice, including quality review of my own clinical work, appointment scheduling and reminders, staff supervision and training, business planning, and administrative functions.

My administrative assistant, Gia Joslin, has access to the scheduling and administrative information necessary to perform her role. My billing specialist, Liana DiBerto, works remotely and has access to the billing, insurance, and payment information necessary to perform hers. Both are bound by my confidentiality and HIPAA policies and work on a minimum-necessary basis.

APPOINTMENT REMINDERS

I may contact you by phone, text message, email, through Spruce, or through the SimplePractice client portal to remind you of an upcoming appointment or to follow up about your care. You may tell me at any time if you prefer a different method of contact.

AS REQUIRED BY LAW

I may disclose your PHI when required to do so by federal, state, or local law, including in response to a valid court order, a lawful subpoena, or a request from a health oversight agency.

MANDATORY REPORTING UNDER NORTH CAROLINA LAW

North Carolina law requires me to break confidentiality and make a report in the following circumstances:

Suspected child abuse, neglect, or dependency. Under N.C.G.S. Section 7B-301, any person who has cause to suspect that a juvenile is abused, neglected, or dependent, or has died as a result of maltreatment, must report to the director of the county department of social services. This is a universal reporting duty in North Carolina, meaning it applies to all persons and is not limited to licensed professionals.

Suspected abuse, neglect, or exploitation of a disabled adult. Under N.C.G.S. Section 108A-102, any person who has reasonable cause to believe that a disabled adult is in need of protective services must report to the director of the county department of social services. In North Carolina, "disabled adult" includes older adults and adults who are physically or mentally incapacitated.

Controlled substance prescription reporting. Because I prescribe psychiatric medications, including controlled substances, prescription information is reported to and reviewed through the North Carolina Controlled Substances Reporting System (CSRS) as required by Article 5E of Chapter 90 of the North Carolina General Statutes, including N.C.G.S. Section 90-113.74C. Before initially prescribing a targeted controlled substance, I am required to review your controlled substance prescription history in the CSRS for the preceding 12 months. This system is maintained by the North Carolina Department of Health and Human Services and access is restricted by law.

RISK OF SERIOUS HARM TO YOURSELF OR OTHERS

If I believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety, or to the health or safety of another person, I may disclose the minimum necessary information to someone able to prevent or reduce that threat, as permitted under 45 CFR Section 164.512(j).

Please note an important point about North Carolina law: unlike many other states, North Carolina has not adopted a general "duty to warn" for mental health providers. North Carolina courts have declined to impose the affirmative Tarasoff-style duty to warn third parties that exists in other jurisdictions (see Gregory v. Kilbride, 150 N.C. App. 601 (2002)). Even so, HIPAA permits disclosure in the circumstances described above, and I may take other protective action where clinically and legally appropriate, including initiating involuntary commitment proceedings under N.C.G.S. Chapter 122C where the statutory criteria are met.

PSYCHOTHERAPY NOTES - SPECIAL PROTECTION

Psychotherapy notes are separately maintained notes documenting the contents of a counseling session, kept apart from the rest of your medical record. Under 45 CFR Section 164.508(a)(2), psychotherapy notes receive heightened protection and generally may not be disclosed without your specific written authorization, even for treatment, payment, or health care operations purposes.

Because this practice focuses on psychiatric evaluation, diagnosis, medication management, psychoeducation, and brief supportive therapy within medication management visits, most of your record consists of standard clinical documentation rather than psychotherapy notes. Where psychotherapy notes do exist, they are protected as described above.

OTHER PERMITTED DISCLOSURES

I may also use or disclose your PHI without your authorization for public health activities, to report suspected abuse or neglect as described above, for health oversight activities, in judicial and administrative proceedings, for law enforcement purposes as permitted by law, to coroners and medical examiners, for workers' compensation purposes, and for specialized government functions, each subject to the limits set by HIPAA and North Carolina law.

4. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION

Your written authorization is required before I may:

Use or disclose your PHI for marketing purposes

Sell your PHI, which I do not do under any circumstances

Disclose psychotherapy notes, except in the narrow circumstances permitted by law

Disclose your PHI to a family member, partner, employer, attorney, or any other third party who is not involved in your treatment or payment

Use or disclose your PHI for any purpose not described in this Notice

You may revoke an authorization at any time by submitting your request in writing to my office. A revocation is effective when I receive it and does not apply to disclosures already made in reliance on the authorization.

5. YOUR RIGHTS REGARDING YOUR PHI

You have the following rights concerning the health information I maintain about you.

RIGHT TO ACCESS AND OBTAIN A COPY

You may inspect and obtain a copy of your health record. Submit your request in writing. I will respond within 30 days. A reasonable, cost-based fee may apply for copies. In limited circumstances permitted by law, access may be denied, and you may have a right to have that denial reviewed.

RIGHT TO REQUEST AN AMENDMENT

If you believe information in your record is incorrect or incomplete, you may request in writing that I amend it. I will respond within 60 days. If I deny your request, I will explain why in writing, and you may submit a statement of disagreement to be included in your record.

RIGHT TO AN ACCOUNTING OF DISCLOSURES

You may request a list of certain disclosures of your PHI made in the six years prior to your request. This list does not include disclosures made for treatment, payment, or health care operations, disclosures made to you, or disclosures you authorized. The first accounting in any 12-month period is provided at no charge.

RIGHT TO REQUEST RESTRICTIONS

You may request that I limit how I use or disclose your PHI. I am not required to agree to every requested restriction. However, I must agree to your request to restrict disclosure to your health plan when you have paid for that service in full out of pocket and the disclosure is not otherwise required by law.

RIGHT TO CONFIDENTIAL COMMUNICATIONS

You may ask me to communicate with you in a specific way or at a specific location, such as calling only your mobile number, avoiding voicemail, using only the secure client portal, or sending correspondence to an alternate address. I will accommodate reasonable requests.

RIGHT TO BE NOTIFIED OF A BREACH

You have the right to be notified if a breach of your unsecured PHI occurs.

RIGHT TO A PAPER COPY OF THIS NOTICE

You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

HOW TO EXERCISE YOUR RIGHTS

Submit requests in writing to:

Nicole Joslin, PMHNP-BC

Apex Behavioral Health PLLC

1600 Olive Chapel Road, Suite 124

Apex, NC 27502

Email: info@apexncbehavioralhealth.com

Phone: (984) 339-0869

I will respond within 30 days of receiving your written request, except where a longer period is permitted by law.

6. THIRD PARTIES AND PLATFORMS THAT HANDLE YOUR PHI

The following services and individuals handle your protected health information in the course of providing your care. Where a vendor handles PHI on my behalf, I maintain a Business Associate Agreement with that vendor as required by HIPAA.

ELECTRONIC HEALTH RECORD AND PRACTICE MANAGEMENT

SimplePractice

I use SimplePractice as my practice management and electronic health records platform. SimplePractice stores and processes your protected health information including clinical notes, appointment records, and billing details, and provides the secure client portal at nicole-joslin.clientsecure.me that you use to manage appointments and communicate with my practice. SimplePractice is HIPAA-compliant and I maintain a Business Associate Agreement with them. For more information, visit: simplepractice.com/privacy

WEBSITE CONTACT FORM

SimplePractice Send Message

The Send Message form on my website is provided and hosted by SimplePractice. When you use it, the information you enter, including your name, contact details, date of birth, gender, insurance verification details, and your message, is transmitted directly to SimplePractice and stored in my practice management system. This is covered by the same Business Associate Agreement I maintain with SimplePractice. Submitting this form does not create a provider-patient relationship. For more information, visit: simplepractice.com/privacy

TELEHEALTH PLATFORM

SimplePractice Telehealth

Follow-up visits are available by secure video for eligible patients across North Carolina. I conduct telehealth sessions using SimplePractice Telehealth, the HIPAA-compliant video platform built into my practice management system. Sessions are not recorded. This is covered by the same Business Associate Agreement I maintain with SimplePractice. Please use a private, secure internet connection during video visits. For more information, visit: simplepractice.com/privacy

SECURE PATIENT MESSAGING

Spruce Health

I use Spruce, a HIPAA-compliant secure communication platform, for non-urgent messages, routine questions, and prescription refill requests during office hours. Through Spruce you can send and receive messages and share documents or photos securely from your phone or computer. The application is free for patients. You will receive an invitation to Spruce after you join the practice. Spruce is HIPAA-compliant and I maintain a Business Associate Agreement with them. For more information, visit: sprucehealth.com/privacy

Please do not use Spruce for urgent or emergency concerns. If you are in immediate danger or experiencing a psychiatric emergency, call 911, go to the nearest emergency room, or call or text 988.

BILLING AND CLAIMS SERVICES

Liana DiBerto, Billing Specialist

Billing, insurance claims submission, and payment processing are performed on my behalf by Liana DiBerto, my billing specialist, who works remotely. She has access only to the information necessary to perform those functions, which includes your name, date of birth, contact details, insurance information, diagnosis and service codes, and payment authorization. She is bound by the confidentiality and HIPAA obligations that apply to this practice and works on a minimum-necessary basis. Billing questions may be directed to billing@apexncbehavioralhealth.com.

E-PRESCRIBING

SimplePractice ePrescribe, powered by DrFirst

Prescriptions are transmitted electronically to your pharmacy of choice through SimplePractice ePrescribe, which uses DrFirst as its e-prescribing partner. This includes electronic prescribing of controlled substances where applicable. The transmission includes your name, date of birth, prescription details, and prescriber information. This is covered by the Business Associate Agreement I maintain with SimplePractice.

INSURANCE CLAIMS SUBMISSION

SimplePractice integrated claim filing

Claims are submitted to the health plans listed in Section 3 through SimplePractice's integrated claim filing system, which transmits claims to payers through established clearinghouse partners. Claims submission includes your name, date of birth, insurance identification, diagnosis codes, and service codes. This is covered by the Business Associate Agreement I maintain with SimplePractice.

PAYMENT PROCESSING

SimplePractice Online Payments, powered by Stripe

Payment is processed through SimplePractice Online Payments, which uses Stripe as its payment processor. This practice does not collect payment in the office. You will be asked to sign an authorization permitting the credit or debit card you keep on file to be charged for services. Major credit and debit cards are accepted, as are HSA and FSA cards. Card information is transmitted using industry-standard encryption and is PCI-DSS compliant. I do not store your full card number. For more information, visit: simplepractice.com/privacy and stripe.com/privacy

NORTH CAROLINA CONTROLLED SUBSTANCES REPORTING SYSTEM

As described in Section 3, controlled substance prescription data is submitted to and reviewed through the North Carolina CSRS as required by state law. This is a state-operated system, not a vendor relationship, and access is restricted by statute.

WEBSITE HOSTING

Duda

My website, apexncbehavioralhealth.com, is hosted on the Duda platform. Duda hosts marketing content only. The Send Message form on the site is provided by SimplePractice, and information submitted through it is transmitted directly to SimplePractice rather than to Duda. Duda does not collect, store, or transmit protected health information, so no Business Associate Agreement with Duda is required. For more information, visit: duda.co/privacy

OFFICE LOCATION

My office at 1600 Olive Chapel Road, Suite 124, Apex, NC 27502 is subleased within space operated by Olical Health PLLC. This is a lease arrangement only. Olical Health PLLC does not provide reception, administrative, or clinical services to my practice and does not have access to your protected health information.

7. DATA RETENTION

Clinical records for adult patients are retained for a minimum of 11 years following the date of your last appointment. This reflects the retention standard established under North Carolina law at 10A NCAC 13B .3903 and the retention practice recommended for private practices in North Carolina.

This practice provides care to adults aged 18 and older only and does not maintain records created while a patient was a minor. Under North Carolina law, records created when a patient was a minor must be retained until the patient's 30th birthday.

Billing and financial records are retained for a minimum of seven years.

At the end of the applicable retention period, records are destroyed securely. Paper records are shredded. Electronic records are permanently deleted using secure deletion methods that render them unrecoverable.

8. DATA SECURITY

I take the following measures to protect your protected health information:

All electronic PHI is stored on HIPAA-compliant platforms that encrypt data in transit using TLS/SSL and at rest

Access to your records is limited to me, to my administrative assistant for scheduling and administrative functions, and to my billing specialist for billing and claims functions, in each case on a minimum-necessary basis

All devices used to access PHI are password-protected, encrypted, and secured with automatic screen locking

Multi-factor authentication is used where the platform supports it

Business Associate Agreements are in place with every vendor that creates, receives, maintains, or transmits PHI on my behalf

Any paper records are stored in a locked cabinet in a secured office

Everyone who works with this practice receives HIPAA privacy and security training and signs a confidentiality agreement

Please be aware that standard email and standard text messaging are not encrypted. If you choose to communicate with me by standard email or text, there is some risk the message could be intercepted. For clinical communication, please use Spruce or the secure SimplePractice client portal. You may ask me at any time to communicate with you only through those secure channels.

9. BREACH NOTIFICATION

If a breach occurs that compromises the privacy or security of your unsecured protected health information, I will notify you in writing without unreasonable delay and no later than 60 days after the breach is discovered, as required by the HIPAA Breach Notification Rule.

The notification will describe what happened, the types of information involved, the steps you can take to protect yourself, what I am doing to investigate the breach and mitigate harm, and how to contact me with questions.

Breaches are also reported to the U.S. Department of Health and Human Services Office for Civil Rights as required by law. Breaches affecting 500 or more individuals in a state or jurisdiction are additionally reported to prominent media outlets as required by federal law.

North Carolina's Identity Theft Protection Act (N.C.G.S. Section 75-65) may also require notification to affected North Carolina residents and to the North Carolina Attorney General's Consumer Protection Division where personal information is involved.

10. HOW TO FILE A COMPLAINT

If you believe your privacy rights have been violated, you may file a complaint with me directly:

Nicole Joslin, PMHNP-BC

Apex Behavioral Health PLLC

1600 Olive Chapel Road, Suite 124

Apex, NC 27502

Phone: (984) 339-0869

Email: info@apexncbehavioralhealth.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue SW

Washington, DC 20201

Phone: 1-800-368-1019

Online: hhs.gov/ocr/privacy/hipaa/complaints

You may also contact the North Carolina Board of Nursing regarding professional conduct:

ncbon.com | License #5006901

I will not retaliate against you in any way for filing a complaint. Filing a complaint will not affect your care or your standing as a patient of this practice.

11. GOOD FAITH ESTIMATE - NO SURPRISES ACT

Under the federal No Surprises Act, you have the right to receive a Good Faith Estimate explaining how much your medical care will cost.

Health care providers are required to give patients who do not have insurance, or who are not using insurance, an estimate of the expected charges for medical services, including psychiatric evaluation and medication management.

Current session rates at Apex Behavioral Health PLLC:

Initial Evaluation, 90 minutes: $275

Follow-Up Visits, 30 to 45 minutes: $150

Charges are applied to the credit or debit card you have authorized to be kept on file.

A cancellation or missed appointment fee of $100 may apply when less than 24 hours' notice is given.

You have the right to receive a Good Faith Estimate for the total expected cost of any non-emergency services. You may request a written Good Faith Estimate at least one business day before your appointment, and you may ask for one before scheduling.

If you receive a bill that is at least $400 more than your Good Faith Estimate, you may dispute the bill.

Keep a copy or photograph of your Good Faith Estimate. For questions or more information, visit cms.gov/nosurprises or call 1-800-985-3059.

To request a written Good Faith Estimate, contact my office at (984) 339-0869 or billing@apexncbehavioralhealth.com.

12. UPDATES TO THIS NOTICE

I reserve the right to change the terms of this Notice at any time. Changes will apply to all protected health information I maintain, including information created or received before the change took effect.

The current version of this Notice is posted on my website at apexncbehavioralhealth.com. A printed copy is available at my office on request. The effective date at the top of this Notice reflects the version currently in force.

ACKNOWLEDGMENT

You may be asked to acknowledge receipt of this Notice as part of your intake paperwork. Your acknowledgment confirms only that you received the Notice. It does not waive any of your privacy rights.

Nicole Joslin, MS, APRN, ANP-C, PMHNP-BC

Apex Behavioral Health PLLC

License #5006901 | North Carolina Board of Nursing | ncbon.com

1600 Olive Chapel Road, Suite 124, Apex, NC 27502

(984) 339-0869 | info@apexncbehavioralhealth.com