THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: October 21, 2026

Website: www.changingseasonshealthcare.com
Name: Changing Seasons Healthcare (including Alternative Family Living (AFL services)
As a licensed home healthcare and Alternative Family Living (AFL) provider, Changing Seasons Healthcare is required by law, including the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable state privacy statutes—to maintain the privacy of your Protected Health Information (PHI), to secure your records using robust administrative, physical, and technical safeguards (such as TLS 1.3 encryption in transit and AES-256 encryption at rest), and to provide you with this comprehensive notice of our legal duties and privacy practices.

We may use and disclose your medical records and Protected Health Information (PHI) for the following standard purposes without requiring your prior written authorization:

• For Treatment: We may use and disclose your PHI to provide, coordinate, or manage your home health care services, skilled nursing, physical therapy, speech therapy, and Alternative Family Living (AFL) support. For example, we may share PHI with skilled nurses, physical therapists, speech therapists, AFL residential providers, or your primary care physician to coordinate your wound care, medication administration, or daily living plans.
• For Payment: We may use and disclose your PHI so that the care, home health services, and residential placements you receive may be billed to and payment collected from you, an insurance company, or a third-party payer (such as Medicaid, Medicare, or VA programs).
• For Healthcare Operations: We may use and disclose your PHI to run our daily business operations, perform quality assessments, evaluate clinical outcomes, train staff, conduct quarterly 90-day care reviews, and fulfill administrative and licensing compliance requirements.
• As Required By Law: We will disclose PHI when required to do so by federal, state, or local law, including cooperating with public health authorities, health oversight agencies, law enforcement officials, judicial proceedings, or mandatory reporting requirements regarding abuse, neglect, or domestic violence.
  

 2.1 North Carolina State Law Preemption Clause: 

Interplay Between Federal HIPAA and North Carolina Law: Changing Seasons Healthcare complies with the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Where North Carolina privacy laws, medical record standards, or state statutes (including N.C.G.S. § 122C regarding mental health, developmental disabilities, and substance abuse records, or laws governing minor consent) afford greater protection or stricter privacy rights than HIPAA, Changing Seasons Healthcare strictly adheres to the more restrictive North Carolina legal standard.

Uses and Disclosures for Treatment, Payment, and Health Care Operations:
Changing Seasons Healthcare may use and disclose your Protected Health Information (PHI) without your explicit written authorization for the following primary purposes:
Treatment: Coordinating your in-home care with physicians, direct care providers, pharmacists, and field personnel involved in your care plan.
Payment: Submitting claims to private insurance, Medicaid, VA administrators, or designated billing agents to determine eligibility and process reimbursement for services rendered.
Healthcare Operations: Conducting quality assurance reviews, staff training, clinical audits, compliance checks, and agency operational assessments required by licensing bodies.

Your Privacy Rights:
You maintain the right to inspect, obtain a copy of, request amendments to, and demand restrictions on disclosures of your PHI. You may also request an accounting of disclosures or ask for confidential communications via preferred channels. To exercise any of these rights, submit a written request to our Privacy Officer.

Medical Record Retention Policy:
In accordance with North Carolina law and agency protocol, client clinical records are retained for a minimum of eleven (11) years following the date of discharge. For minor clients, records are retained for eleven (11) years or until the client reaches the age of twenty-eight (28), whichever is longer, after which records are securely destroyed in compliance with HIPAA sanitization guidelines.

You possess the following legal rights regarding the medical and billing information we maintain about you:

• Right to Inspect and Copy: You have the right to inspect and obtain a copy of your health and billing records. Requests must be submitted in writing to our Privacy Official. We may charge a reasonable, cost-based fee for supplies and postage.
• Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment, or healthcare operations. While we are not legally required to agree to all restriction requests, we must honor a request to restrict disclosures to a health plan if the disclosure is for payment or health care operations and pertains solely to a healthcare item or service for which you (or someone on your behalf other than the health plan) have paid us in full out-of-pocket.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a specific manner or at an alternative location (e.g., via a designated phone number, secure messaging, or a specific mailing address).
• Right to Amend: If you feel that the PHI we maintain about you is incorrect or incomplete, you have the right to ask us to amend the information. We may deny your request under certain circumstances (such as if the record was not created by us), but you retain the right to submit a written statement of disagreement.
• Right to an Accounting of Disclosures: You have the right to request a list (accounting) of certain non-routine disclosures we have made of your PHI, excluding disclosures made for treatment, payment, healthcare operations, or authorized directly by you.

• Breach Notification: In compliance with federal regulations, you have the right to be notified promptly following any breach of your unsecured Protected Health Information.
• Data Security: Changing Seasons Healthcare applies strict technical security controls—including TLS 1.3 data encryption in transit and AES-256 encryption for data at rest—to protect your electronic health records and website submissions on www.changingseasonshealthcare.com.
  

If you believe your privacy rights have been violated, you may file a formal complaint with Changing Seasons Healthcare or directly with the Secretary of the U.S. Department of Health and Human Services (HHS).
We will not penalize, discriminate against, or retaliate against you in any way for filing a complaint.
To file a complaint, exercise your rights, or ask questions regarding this Notice, please contact our designated Privacy Official:

• Agency: Changing Seasons Healthcare
• Website: www.changingseasonshealthcare.com
• Privacy Official Phone: 919-899-4482