Notice of Privacy Practices

    Kudos Autism — Effective Date: 12/01/25

    This Notice describes how medical and behavioral health information about your child may be used and disclosed, and how you can access this information. Please review it carefully.

    Our Commitment to Your Privacy

    Kudos Autism ("we," "our," "us") is committed to protecting your child's health information. We are legally required to:

    • Maintain the privacy of Protected Health Information ("PHI")
    • Provide you with this Notice of our privacy practices
    • Follow the terms of this Notice currently in effect
    • Notify you if a breach occurs involving your child's unsecured health information

    What Counts as Protected Health Information (PHI)?

    PHI includes information that identifies your child and relates to:

    • Diagnosis
    • Treatment or assessments
    • Progress notes and behavior data
    • Insurance information
    • Scheduling and service history
    • Any information used to provide ABA services

    How We May Use and Disclose PHI Without Your Written Permission

    HIPAA allows us to use and share PHI for specific purposes. Below are the most common situations in ABA therapy.

    1. Treatment

    We may use and share PHI to provide, coordinate, or manage your child's ABA services.

    Examples:

    • Sharing information between your BCBA, RBTs, clinical supervisors
    • Consulting with other healthcare providers (with proper authorization when required)
    • Developing treatment plans

    2. Payment

    We may use or disclose PHI to bill and receive payment for services.

    Examples:

    • TRICARE authorizations
    • Billing claims
    • Insurance audits or reviews
    • Verifying coverage

    3. Healthcare Operations

    We use PHI to run and improve our organization.

    Examples:

    • Quality assurance and supervision
    • Staff training
    • Compliance monitoring
    • Accreditation activities
    • Reviewing treatment effectiveness

    Other Uses and Disclosures Allowed or Required by Law

    We may disclose PHI without your consent when required by federal or state law, including:

    Abuse or Neglect Reporting

    If we suspect child abuse or neglect, we must report it.

    Public Health Activities

    Preventing or controlling disease, injury, or disability.

    Legal and Administrative Requests

    Responding to a court order, subpoena, or government investigation.

    Law Enforcement

    Limited information for law enforcement purposes when legally required.

    Workers' Compensation

    If applicable for injury claims.

    Serious Threat to Health or Safety

    To prevent or lessen a serious and immediate threat.

    Appointment Reminders & Scheduling

    We may contact you about appointments, schedule changes, or treatment updates.

    Business Associates

    Vendors who help us provide services (billing, EHRs, scheduling, secure messaging, etc.) All Business Associates must sign a HIPAA-compliant agreement and protect PHI.

    Uses and Disclosures Requiring Your Written Authorization

    We will not use or disclose PHI for the following without your written consent:

    • Marketing
    • Release of psychotherapy notes
    • Release of information to schools or outside providers (unless allowed by law)
    • Sharing PHI for purposes not covered in this Notice

    You may revoke an authorization at any time in writing.

    Your Rights Regarding Your Child's PHI

    Under HIPAA, you have the right to:

    1. Access Your Child's Records

    You may request a copy of treatment notes, assessments, or billing records. We must provide this within the time required by law.

    2. Request Corrections

    If you believe information is incorrect or incomplete, you may ask us to fix it.

    3. Request Confidential Communications

    You may request that we contact you using a different method or location.

    4. Request Restrictions

    You may ask us to limit how we use or share PHI. We are not required to agree, except when the restriction involves self-pay services under HIPAA rules.

    5. Receive a List of Disclosures

    You may request an accounting of when PHI was shared for purposes other than treatment, payment, or operations.

    6. Receive a Paper Copy of This Notice

    Even if you receive this electronically.

    Our Responsibilities

    We must:

    • Maintain the privacy of your child's PHI
    • Provide you with this Notice of Privacy Practices
    • Notify you if a breach occurs involving unsecured PHI
    • Follow the terms of this Notice

    We may change this Notice at any time. The updated Notice will apply to all PHI we maintain and will be posted on our website.

    How We Protect Your Information

    We use a combination of administrative, technical, and physical safeguards to protect PHI, including:

    • Secure servers and HIPAA-compliant software
    • Password-protected systems with access controls
    • Staff training in confidentiality
    • Encryption of data when required

    Filing a Complaint

    If you believe your privacy rights have been violated, you may file a complaint with:

    Kudos Autism Privacy Officer

    Email: privacy@kudosautism.com

    Or with the U.S. Department of Health and Human Services, Office for Civil Rights.

    You will not be penalized for filing a complaint.

    Contact Us

    If you have questions about this Notice or your rights, contact:

    Kudos Autism

    Email: support@kudosautism.com