SUNNY DAYS^® SUNSHINE CENTER
HIPAA PRIVACY ACT NOTICE
EFFECTIVE DATE: 10/07/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Sunny Days^® Sunshine Center (“Sunny Days,” “we,” “us,” or “our”) provides Applied Behavior Analysis (ABA) and related developmental services. We are required by law to maintain the privacy of your (or your child’s) protected health information (“PHI”), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect. 

How We May Use and Disclose Your Health Information

We typically use or share PHI in the following ways, without requiring your separate written authorization: 

Treatment 
We may use and share your information with clinicians, behavior technicians, supervisors, and other professionals involved in providing ABA services, developing and updating treatment plans, and coordinating care with other providers (e.g. pediatricians, speech or occupational therapists, or schools, where authorized). 

Payment
We may use and share your information to bill and collect payment from health plans, insurers, or other payors, including sharing information needed to obtain authorization for services or to confirm medical necessity. 

Health Care Operations
We may use and share your information to run our practice, review the quality of care we provide, train and evaluate staff, conduct compliance and billing audits, and manage our business, including case supervision and clinical record review. 

Marketing 
Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service. The Privacy Rule carves out the following health-related activities from this definition of marketing:

• Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication;

• Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan’s enrollees that add value to, but are not part of, the benefits plan;

• Communications for treatment of the individual; and

• Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual.

Facility Directories
It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual’s informal permission to list in its facility directory the individual’s name, general condition, religious affiliation, and location in the provider’s facility. The provider may then disclose the individual’s condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation.

Other Permitted or Required Uses and Disclosures
We may also use or disclose PHI, generally without your written authorization, in the following circumstances, each of which is subject to applicable federal and state law: 

• As required by law, including reporting to state licensing or regulatory agencies.

• To report suspected abuse, neglect, or domestic violence to the appropriate authorities, as required by law.

• For public health activities, such as audits, investigations, or inspections by agencies that oversee our practice or government programs.

• In response to lawsuits, disputes, or legal proceedings, such as in response to a court order or subpoena.

• For law enforcement purposes, such as to report certain wounds or as required by law.

• To avert a serious threat to health or safety, when necessary to prevent or lessen a serious and imminent threat to a person or the public.

• For workers’ compensation, if applicable, to comply with workers’ compensation laws.

• With business associates who perform services on our behalf and who agree, in writing, to safeguard your PHI. 
  
  

Uses and Disclosures That Require Your Written Authorization

Other than as described above, we will not use or share your PHI without your written authorization. Examples include most uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI. If you provide us authorization to use or disclose your PHI, you may revoke that authorization in writing at any time, except to the extent we have already acted in reliance on it. 

Special Protections for Substance Use Disorder Records (42 C.F.R. Part 2)

To the extent Sunny Days maintains any patient records that are protected under the federal substance use disorder confidentiality regulations at 42 C.F.R. Part 2, those records receive additional protection. We will not disclose such records except with your written consent, or as otherwise permitted or required by 42 C.F.R. Part 2 and applicable law (for example, in a medical emergency, pursuant to a qualifying court order, or as part of an audit or evaluation). Federal law prohibits the use of such information to bring criminal charges against you unless authorized by a court order. Information disclosed under this protection may not be further disclosed or used to discriminate against you, except as permitted by 42 C.F.R. Part 2. 

Additional Protections Under State Law

Sunny Days provides services in California, New Jersey, and Oklahoma. Where a state law gives you greater privacy protection than HIPAA, we follow the more protective standard. Depending on where you receive services, the following state-law protections apply in addition to everything described above. 

California – Confidentiality of Medical Information Act (Civil Code § 56 et seq.)

• California’s CMIA is stricter than HIPAA in several respects. Where CMIA restricts a use or disclosure that HIPAA would otherwise permit, we follow CMIA.
• Any authorization you sign allowing us to disclose your medical information will meet CMIA’s specific requirements, including plain-language terms, the name of the recipient, the specific information to be disclosed, the purpose of the disclosure, and an expiration date or event.
• We will not disclose your place of birth or immigration status for immigration enforcement purposes without your specific written authorization, except as required by law.
• If a breach of unsecured medical information occurs, we will notify you in accordance with California’s breach notification timeline, which may require notice sooner than the federal HIPAA timeline. 

New Jersey – State Confidentiality Protections for Behavioral Health Records

• Behavioral health and mental health treatment records receive additional confidentiality protection under New Jersey law. Information we disclose under this Notice may not be further redisclosed by the recipient without your additional written consent, except as permitted by law.
• If your child is receiving certain behavioral health services and is old enough under New Jersey law to consent to that care independently, New Jersey law may give your child – rather than you as the parent or guardian – the right to control release of the related records, subject to limited exceptions (for example, a significant safety concern).
• Information related to HIV/AIDS status is subject to heightened confidentiality under New Jersey’s AIDS Assistance Act and will not be disclosed without your specific written authorization, except as permitted by law.
• Genetic information is protected under the New Jersey Genetic Privacy Act and will not be disclosed without your informed consent, except as permitted by law. 

Oklahoma – State Confidentiality Protections

• Information related to HIV/AIDS status is subject to heightened confidentiality under Oklahoma law (63 Okl. St. § 1-502.2) and will not be disclosed without your specific written consent, except as permitted by law.

• Mental health records we maintain receive additional confidentiality protection under Oklahoma’s Mental Health Law, beyond what HIPAA alone requires. 

If you have questions about which state-law protections apply to your (or your child’s) records, please contact our Privacy Officer using the information at the end of this Notice. 

Your Rights Regarding Your Health Information

You (or your personal representative) have the following rights with respect to PHI we maintain about you or your child: 

• Right to Get a Copy of Your Health and Billing Records: You may ask to see or get a copy of your health and billing records and other health information we have about you. We will provide a copy or a summary, usually within 30 days of your request, and we may charge a reasonable, cost-based fee.

• Right to Request Correction: You may ask us to correct health and billing records you believe are incorrect or incomplete. We may decline your request but will explain our reason in writing within 60 days.

• Right to Request Confidential Communications: You may ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address, and we will accommodate reasonable requests.

• Right to Request Restrictions: You may ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree, except where you paid out of pocket in full for a specific item or service and ask that we not share that information with your health plan, in which case we will agree unless disclosure is required by law.

• Right to Get a List of Those with Whom We’ve Shared Information: You may ask for a list (accounting) of certain disclosures we made of your health information for purposes other than treatment, payment, or health care operations, and other than disclosures you separately authorized, generally covering the six years prior to your request.

• Right to Get a Copy of This Notice: You may ask for a paper copy of this Notice at any time, even if you agree to receive it electronically.

• Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices about your health information.

• Right to File a Complaint if you Feel Your Rights Are Violated: See “Complaints” below. 
  
  

Our Responsibilities 

• We are required by law to maintain the privacy and security of your protected health information.

• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

• We must follow the duties and privacy practices described in this Notice and give you a copy of it.

• We will not use or share your information other than as described here unless you tell us, in writing, that we can. If you tell us we can, you may change your mind at any time by notifying us in writing. 
  
  

Changes to This Notice 

We can change the terms of this Notice, and any changes will apply to all information we already have about you, as well as any information we receive in the future. We will post a copy of the current Notice in our offices and on our website at sunnydayssunshinecenter.com. The Notice will also state the effective date on the first page. 

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, by mail, by phone at 1-800-368-1019, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint. 

If you have questions about this Notice or would like to exercise any of the rights described above, please contact: 

David Karlstein, Director of Operations
Sunny Days Sunshine Center
Phone: 732-761-0088
Website: sunnydayssunshinecenter.com
Email: complianceSSC@sdsunshinecenter.com