MoodRx
Patient Portal

Legal

HIPAA Notice of Privacy Practices

Effective October 23, 2026 · MoodRx LLC

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Duties and the Scope of This Notice

MoodRx LLC ("MoodRx") provides outpatient mental health therapy, including telehealth care, to eligible patients in Pennsylvania. When MoodRx is acting as a health care provider subject to the Health Insurance Portability and Accountability Act (HIPAA), we must protect the privacy of protected health information (PHI), explain our privacy practices and your rights, notify affected individuals following a breach of unsecured PHI as required by law, and follow the terms of this Notice while it is in effect. We also comply with applicable Pennsylvania mental health confidentiality laws and other federal and state protections that are more stringent than HIPAA.

This Notice applies to PHI maintained by MoodRx and those acting on its behalf in connection with our practice. It does not make a separate affiliated practice a part of MoodRx or automatically authorize sharing of patient records with an affiliated entity.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

Treatment. We may use and disclose PHI as legally permitted to assess, provide, coordinate, or manage your therapy. For example, a treating clinician may coordinate with another treating professional when authorized or otherwise legally permitted. Separately maintained psychotherapy notes and records subject to additional confidentiality protections have special rules described below.

Payment. We may use and disclose PHI as legally permitted to confirm insurance eligibility, submit and respond to claims, receive payment, and resolve claim questions. For example, we may send information about a covered session to the applicable insurer or our billing service.

Health care operations. We may use and disclose PHI as legally permitted to operate and improve the practice, including reviewing quality of care, supervising and credentialing clinicians, conducting compliance and security activities, and performing billing audits. For example, authorized staff may review records to verify documentation and claim accuracy.

We use reasonable safeguards and apply the HIPAA minimum necessary standard when it applies. Other applicable laws may require additional consent or restrictions.

Other Uses and Disclosures Without Written Authorization

As permitted or required by HIPAA and more protective applicable law, disclosures may be made for legally mandated reporting, such as reporting suspected child abuse or other abuse or neglect where reporting is required; public health and health oversight activities; lawful investigations and proceedings, including qualifying court orders; workers' compensation requirements; limited law enforcement purposes; and other disclosures specifically permitted or required by law. We may disclose information when legally permitted and necessary to prevent or lessen a serious and imminent threat to health or safety. A subpoena or other request does not automatically override applicable patient confidentiality protections.

Information may be shared with family members or others involved in your care only as permitted by applicable law and consistent with the relevant consent, objection, or emergency rules. Additional restrictions may apply to minors' mental health records and to substance use disorder treatment records.

We may use service providers, such as an electronic health record, secure video, communications, and billing company, to perform functions on our behalf. We enter into HIPAA business associate agreements when required and require appropriate safeguards for PHI. This does not authorize vendors to use PHI for their own advertising purposes.

Uses and Disclosures That Require Authorization

We obtain a valid written authorization when required for uses or disclosures not otherwise permitted by law, including most uses or disclosures of separately maintained psychotherapy notes, certain marketing activities, and sales of PHI. Psychotherapy notes as defined by HIPAA do not include routine treatment plans, diagnoses, progress notes, or other information maintained in the regular clinical record. HIPAA allows limited exceptions to the separate authorization requirement for psychotherapy notes, including use by the clinician who created them for treatment and certain legally authorized purposes.

You may revoke a written authorization in writing, except to the extent we have already acted in reliance on it. Revocation does not undo disclosures already lawfully made.

Additional Protections for Substance Use Disorder Records

Some substance use disorder (SUD) records are subject to 42 CFR Part 2. When MoodRx creates, receives, or maintains records subject to Part 2, we apply the additional consent and confidentiality requirements that govern those records. In particular, Part 2-protected records, or testimony about their contents, generally cannot be used or disclosed in a civil, criminal, administrative, or legislative proceeding against the patient without the patient's written consent or a qualifying court order following the procedures required by Part 2. A court order must be accompanied by any subpoena or other legal process required for the disclosure. When Part 2 applies, stricter restrictions on redisclosure, consent, and use of SUD counseling notes may apply. Any use of Part 2 records for fundraising, if undertaken, would be subject to the notice and opt-out rights required by law.

Your Rights

Subject to the limits and procedures established by applicable law, you have the following rights:

  • Access and copies. Request to inspect or receive copies of PHI in our designated record set, including available electronic copies. Limited legal exceptions apply, including to separately maintained psychotherapy notes. Fees, if any, are limited as required by law.
  • Amendment. Request correction of information in the designated record set that you believe is inaccurate or incomplete. If we deny a request, we will explain your rights to disagree as required by law.
  • Confidential communications. Request reasonable alternative methods or locations for communications, such as a particular telephone number or mailing address.
  • Restrictions. Ask us to restrict certain uses or disclosures. We are not always required to agree, but, when legally required, we will honor a restriction on disclosure to a health plan for payment or operations for a service you paid for entirely out of pocket, unless the disclosure is required by law.
  • Accounting. Request an accounting of certain disclosures made during the applicable period, generally up to six years, subject to legal exceptions and permitted fees.
  • Paper copy. Obtain a paper copy of this Notice, even if you have agreed to receive it electronically.
  • Breach notice. Receive notification of a breach of unsecured PHI when required by law.
  • Authorization. Withdraw a HIPAA authorization prospectively as described above.

If the patient is a minor, rights to consent, access records, and authorize disclosures are determined under applicable Pennsylvania and federal law. These rights may belong to the minor in circumstances specified by law; they do not automatically belong to every parent or guardian in all situations.

Questions, Requests, and Complaints

To make a privacy request or complaint or ask for a paper copy, contact:

MoodRx LLC, Attention: Privacy Officer
7901 4th St N, Ste 300
St Petersburg, FL 33702

You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), through hhs.gov/hipaa/filing-a-complaint or other current OCR complaint channels. We will not retaliate against you for filing a complaint.

Changes to This Notice

We may change our practices and this Notice as legally permitted, and we reserve the right to apply revised privacy practices to PHI we already hold, consistent with applicable law. A revised Notice will state its effective date and be available on our website and upon request. We will provide additional notice when required.