Menu

Back to the home page

Notice of Privacy Practices

Please read this first

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Source: Code of Federal Regulations, 45 CFR 164.520(b)(1)(i), which requires that exact statement "as a header or otherwise prominently displayed."

What this page is

A Notice of Privacy Practices explains two things: how a health care provider may use and share information about your health, and what control you have over it. Federal law requires a provider to give you one, and requires a provider with a website to post it on that website.

Source: Code of Federal Regulations, 45 CFR 164.520(c)(3)(i) — a covered entity with a website that describes its services "must prominently post its notice on the web site."

When this takes effect

This notice is effective October 1, 2026.

What we keep about you

The notes your clinicians write, your diagnosis and treatment plan, what medicines you take, your insurance and billing records, and the practical details that let us reach you. It is kept in paper charts and, once Nexa starts using an electronic medical record — the secure computer system that holds client charts — in that as well.

When we may use or share it without asking you first

  • To treat you. Your care team talks to each other, and to a doctor or hospital you are referred to.
  • To get paid. Sending a claim to your health plan, checking your benefits, collecting what you owe.
  • To run the program. Quality checks, training, licensing, audits.
  • When the law requires it. Suspected abuse of a child, an elder or a dependent adult; a court order; a serious and immediate threat to someone's safety; certain public health reporting.

That last group is not our choice. A clinician who is told about a child being hurt has to report it, and saying so plainly here is fairer than letting you find out later.

When we must ask you in writing first

Most other sharing. In particular: psychotherapy notes, any use of your information for marketing, and any sale of your information. We do not sell your information. If you sign a permission and change your mind, you can take it back in writing, and it stops applying to anything that has not already happened.

Your rights over your own record

  • See it and get a copy, on paper or electronically.
  • Ask us to correct it if something in it is wrong.
  • Ask us to limit what we share. We do not have to agree to a request to limit what we share, with one exception: if you pay for something yourself in full and ask us not to share it with your health plan, we will agree.
  • Ask us to reach you a particular way — a different phone, a different address, no voicemail. You do not have to explain why.
  • Get a list of certain places we sent your information.
  • Get a paper copy of this notice, even if you already read it here.
  • Be told if your information is breached.

Mental health records get extra protection

California law protects mental health records more tightly than the federal rules alone. Separately, there is a federal rule — Part 2 of Title 42 of the Code of Federal Regulations (42 CFR Part 2) — that adds strong extra protection to substance use treatment records, including a rule that a program may not even confirm that a named person is a client.

Part 2 applies to a program that is "federally assisted." That mainly means one of three things: it bills Medicare, it holds a federal registration to prescribe controlled substances for addiction, or it receives federal money. Nexa is not in any of those categories today. If that changes, this page changes with it and the Part 2 notice is added.

Source: 42 CFR 2.11, 2.12(b), 2.13(c)(2) and 2.22.

What the law requires of Nexa

Nexa is required by law to maintain the privacy of your protected health information, to give you this notice of its legal duties and privacy practices, and to notify you if a breach of unsecured protected health information affects you. Nexa is required to abide by the terms of the notice currently in effect.

Source: 45 CFR 164.520(b)(1)(v)(A) and (B), which require a statement that the covered entity "is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices, and to notify affected individuals following a breach of unsecured protected health information," and that it "is required to abide by the terms of the notice currently in effect."

Questions, and if you think your privacy was violated

To ask a question about this notice or to complain, contact Nexa's Privacy Officer at (805) 210-2288. Telling us first often gets a problem fixed fastest, and we would rather hear it from you, but you do not have to.

You can also complain to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). File online at the OCR Complaint Portal, ocrportal.hhs.gov/ocr/smartscreen/main.jsf, or call toll-free (800) 368-1019 (TDD, a text telephone for people who are deaf or hard of hearing, toll-free (800) 537-7697). A complaint must be filed within 180 days of when you knew about the problem.

Nobody at Nexa will retaliate against you for complaining, to us or to HHS.

Source: 45 CFR 164.520(b)(1)(vi) and (vii); HHS Office for Civil Rights, "How to File a Health Information Privacy or Security Complaint" and "Contact the Office for Civil Rights (OCR)."

Changes to this notice

We can change this notice, and a change applies to information we already hold as well as to anything new. The current version will always be on this page, with its date, and a paper copy will be available where you check in.