HIPAA Notice of Privacy Practices

This Notice describes how protected health information (PHI) about you and/or your child may be used and disclosed and how you can get access to this information. Please review it carefully.

Indiana Behavior Analysis Academy (IBAA) creates and maintains a record of the services we provide. This record includes information such as symptoms, diagnoses, assessment results, treatment services, progress, and plans for future treatment. We use and disclose PHI only as permitted or required by law, including for treatment, payment, and health care operations, and for other purposes described in this Notice. We are required by law to maintain the privacy of PHI, to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice that is currently in effect.

This Notice applies to all records containing PHI created or retained by IBAA. We reserve the right to revise this Notice. Any revision will be effective for PHI we maintain now and in the future. A current copy of this Notice will be available in our centers and upon request. You will receive a copy upon enrollment and may request another copy at any time.

How IBAA May Use and Disclose PHI

IBAA may use and disclose PHI for the following purposes. In some cases, we may use or disclose PHI without your prior written authorization. When an authorization is required, we will obtain it before using or disclosing PHI.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

For treatment: We may use and disclose PHI to coordinate care and to communicate with other health care providers involved in the client’s treatment. Example: We may disclose PHI to a physician, psychologist, or other provider to coordinate services.

For payment: We may use and disclose PHI to bill for services and to collect payment from health plans or other payers. Example: We may send PHI to the client’s insurance company to obtain payment for services provided.

For health care operations: We may use and disclose PHI for business and operational purposes that support quality and compliant service delivery. Examples include quality review, staff training and supervision, administrative activities, and compliance activities. We may also disclose PHI to our business associates (for example, billing support, data systems, consultants, attorneys, or accountants) who perform services on our behalf and are required to protect PHI.

Other Uses and Disclosures Permitted or Required by Law

Required by law: We may disclose PHI when required by federal, state, or local law; in response to a lawful court order; or as otherwise required by legal process.
To avert a serious threat: We may disclose PHI if we believe it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, as permitted by law.
Mandatory reporting: We may disclose PHI as required by law for reporting suspected abuse or neglect and other required reports.
Public health activities: We may disclose PHI for public health activities such as reporting required information to public health authorities, preventing or controlling disease, or responding to product recalls, as permitted or required by law.
Health oversight activities: We may disclose PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensure, and disciplinary actions.
Specific government functions: We may disclose PHI for certain specialized government functions as permitted by law (for example, for military or veterans’ activities in limited circumstances).
Appointment reminders and service information: We may contact you to provide appointment reminders or information about health-related benefits or services that may be of interest.

Disclosures Where You Have the Opportunity to Object

We may disclose PHI to a family member, friend, or other individual you identify as involved in the client’s treatment or responsible for payment, unless you object in whole or in part. If you are not present or it is an emergency, we may disclose PHI if we determine that it is in the client’s best interest.

Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before using or disclosing PHI for marketing purposes and for any other purpose not described in this Notice, except as otherwise permitted or required by law. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

IBAA does not use or disclose PHI for fundraising purposes.

Your Rights Regarding PHI

Parents/legal guardians generally act as the client’s personal representative and may exercise these rights on the client’s behalf, as permitted by law.

Right to inspect and obtain copies of PHI.

You have the right to inspect and obtain a copy of PHI that is maintained by IBAA. Requests must be made in writing. IBAA will respond to your request within 15 days and will provide access or copies as soon as reasonably practicable. You may request copies in electronic form when available and readily producible. Under certain circumstances, we may deny your request in whole or in part; if we do, we will provide a written explanation and information about any available review rights. If you request copies, we may charge a reasonable, cost-based fee, which will be disclosed at the time of request. Any fee will be limited to allowable, reasonable, cost-based charges (such as copying labor, supplies, and postage, when applicable). If you agree in advance, we may provide a summary or explanation of the requested information and the associated cost.

Right to request an amendment.

If you believe information in the record is incorrect or incomplete, you may request an amendment. Requests must be made in writing and include a reason. We will respond in writing within a reasonable timeframe. We may deny your request in certain circumstances (for example, if the information is accurate and complete, if it was not created by IBAA, or if it is not part of the record we maintain). If we deny your request, we will provide a written explanation and information about how you may submit a statement of disagreement.

Right to request restrictions.

You may request restrictions on certain uses and disclosures of PHI. We are not required to agree to all requested restrictions. If we agree, we will document the restriction in writing and follow it except in emergency situations. You have the right to request that we not disclose PHI to a health plan for a service if you (or a third party on your behalf) have paid for the service out-of-pocket and in full, as permitted by law.

Right to request confidential communications.

You may request that we communicate PHI to you in a certain way or at a certain location (for example, at an alternate address). We will accommodate reasonable requests when we can provide the information in the requested format and it is readily producible.

Right to receive an accounting of certain disclosures.

You may request an accounting of certain disclosures of PHI made by IBAA as permitted by law. The accounting will not include disclosures made for treatment, payment, or health care operations; disclosures made to you; disclosures you authorized; or certain other disclosures that are exempt under law. We will respond to an accounting request within 60 days unless an extension is permitted. The accounting may cover up to six years prior to the date of the request, unless you request a shorter timeframe. We will provide one accounting in a 12- month period at no charge; we may charge a reasonable, cost-based fee for additional requests, after providing notice of the fee.

Right to obtain a paper copy of this Notice.

You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Response to a Breach

You have the right to receive notice if there is a breach of your unsecured PHI. IBAA will provide notice without unreasonable delay and no later than 60 calendar days after discovery of a breach, as required by law. IBAA will also provide any required notifications to the U.S. Department of Health and Human Services and others as required.

For More Information or to Report a Problem

If you have questions about this Notice or would like additional information, you may contact our Compliance Monitor using the information below. If you believe your privacy rights have been violated, you may file a written complaint with IBAA’s Compliance Monitor and/or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

U.S. Department of Health and Human Services

Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free: 1-877-696-6775

Indiana Behavior Analysis Academy (IBAA)

Compliance Monitor
125 W Taylor St
Kokomo, IN 46901
Tel: 765-419-0411
Fax: 765-340-7486

Effective Date: 1/29/2026
Version: 2026 V1