Privacy Policy

1. Who we are and what this policy covers

This policy is from two related organizations:

• Comprehensive Mental Health Solutions LLC (“CMHS LLC”), which provides our therapy services and provides management, scheduling, billing, and administrative support to the psychiatry group.
• CMHS Psychiatry Group, PLLC, doing business as Comprehensive Mental Health Solutions, a physician-owned psychiatric practice that provides medication management and SPRAVATO® treatment.

In this policy, “we,” “us,” and “CMHS” mean both organizations.

We see patients in person at 51 Cherry Street, Milford, CT 06460 and 57 Plains Road, Milford, CT 06461, and by telehealth for patients located in Connecticut.

This policy explains how we handle information we collect through:

• our website, cmhsct.com
• our online intake and contact forms
• phone calls, text messages, and email with our office
• the patient portals we use: TherapyPortal for therapy clients and Osmind for psychiatry patients

Health information about our patients is governed by our Notice of Privacy Practices. That notice explains how we use and share your protected health information and what rights you have under HIPAA. If this policy and the Notice of Privacy Practices ever conflict about your health information, the Notice of Privacy Practices controls.

2. Information we collect

Information you give us through the intake form. When you request an appointment, we ask for:

• your name, date of birth, email, phone number, and address
• your current employer or the school you attend
• your insurance
• the type of care you want, whether you prefer in-person or telehealth visits, and the days and times that work for you
• answers to a short set of screening questions about your current health and treatment history, which help us make sure we are the right fit and get you to the right clinician safely
• how you heard about us

Information you give us in other ways. If you use our “Still have questions?” form, call, text, or email us, we receive your name, contact details, and whatever you choose to tell us.

Information collected automatically. When you visit our website, we and our service providers collect:

• device and browser information, such as browser type, operating system, and IP address
• usage information, such as the pages you view and how you arrived at our site
• cookies and similar technologies (see Section 4)
• advertising and campaign details in the web address. If you arrive by clicking one of our Google ads, the address includes a Google click identifier (called a “gclid”). If you arrive from a tagged link, it may include campaign labels (called “UTM parameters”). We save these and the page where you first landed on our site, and attach them to your intake form if you submit one.

3. How we use information

We use the information described above to:

• respond to your questions and requests
• review your intake form, check that our services fit your needs, and match you with a clinician
• schedule appointments and send reminders
• verify your insurance benefits
• provide treatment, coordinate your care, and bill for services
• run our practice, including quality review, staff training, and compliance
• keep our website working and secure
• understand which ads and referral sources bring people to us. We do this by comparing the ad click identifier saved with an intake form to whether that person later starts care with us. When we report results to Google Ads, we send only the click identifier, the date and time, and the type of result. We never send your name, contact details, screening answers, or anything about your health.

4. Cookies, analytics, and advertising

Our website uses these tools:

What we don’t do:

• We do not sell personal information or health information.
• We do not share health information with advertising platforms. Our website has no advertising pixels, such as the Meta (Facebook) pixel. Our intake and contact forms are hosted on a HIPAA-compliant form service and are separate from our analytics. Nothing you type into them is sent to Google Analytics or any ad platform.
• We do not use information from our website for targeted advertising and do not build ad audiences from people who visit our site.

Ads we run. We advertise on Google. When you click one of our ads, Google knows you clicked it, as it does for any ad. Google’s use of that information is covered by Google’s privacy policy, and you can manage how Google personalizes ads for you at My Ad Center.

5. How we protect information

• Our website and forms use SSL/TLS encryption, so information you submit is encrypted as it travels over the internet.
• Our intake and contact forms run on a HIPAA-compliant plan that stores submissions in encrypted form.
• Vendors that create, receive, store, or send protected health information for us sign business associate agreements, which require them to protect it as HIPAA requires.
• Only staff who need information to do their jobs can access it.

No system is perfectly secure, but we take these steps to keep your information safe and we review them regularly.

6. How We Comply with HIPAA and Privacy Laws

Both CMHS Psychiatry Group, PLLC and Comprehensive Mental Health Solutions LLC follow the HIPAA Privacy Rule and Security Rule for protected health information.

This means we:

• use and share your health information only as HIPAA allows and as described in our Notice of Privacy Practices
• protect health information with administrative, physical, and technical safeguards
• sign business associate agreements with vendors that handle health information for us, including our electronic health record systems, patient portals, telehealth, e-prescribing, secure messaging, scheduling, online forms, email, and claims processing
• train our staff on privacy and security
• have a Privacy Officer who oversees our privacy practices and handles questions and complaints
• notify you if your unsecured health information is involved in a breach, as the law requires

Once you submit our intake form or contact us about care, we treat the information you send as protected health information under our Notice of Privacy Practices.

Our Notice of Privacy Practices describes your rights to see and get a copy of your records, ask for corrections, get a list of certain disclosures, ask us to limit how we use or share your information, ask us to contact you in a particular way, and file a complaint. You can read it at cmhsct.com/notice-of-privacy-practices.

We also follow Connecticut law on health and mental health records, and the Connecticut Data Privacy Act for personal information that HIPAA does not cover (see Section 7).

7. Your Connecticut privacy rights

If you live in Connecticut, the Connecticut Data Privacy Act gives you rights over personal information we hold that HIPAA does not cover, such as website usage data or a message you sent us that is not about your care. You have the right to:

• Access: confirm whether we process your personal information and get a copy of it
• Correct: ask us to fix inaccurate information
• Delete: ask us to delete personal information you gave us or that we hold about you
• Portability: get your information in a format you can take elsewhere
• Opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We don’t sell personal information, use it for targeted advertising, or use it for that kind of profiling, but you can still submit an opt-out request.

Consumer health data. Connecticut law gives extra protection to “consumer health data,” meaning information that identifies a person’s physical or mental health condition or treatment. We do not sell consumer health data. We collect and use it only to respond to your requests and provide the care you ask for, and we limit access to staff who need it.

Health information covered by HIPAA is handled under our Notice of Privacy Practices, not this section. Requests about your medical records go through the process in that notice.

How to make a request. Email info@cmhsct.com with “Privacy Request” in the subject line, or call (203) 651-5117. We will need to verify your identity before we act on a request. You can name an authorized agent to make a request for you. We will respond within 45 days. If we need more time, we will tell you why, and we may extend that once by up to 45 more days. We won’t charge for a request unless it is clearly unfounded or excessive, or you make more than one request in a year.

How to appeal. If we deny your request, you can appeal by replying to our decision or emailing info@cmhsct.com with “Privacy Appeal” in the subject line. We will respond in writing within 60 days and explain our decision. If you disagree with the result, you can contact the Connecticut Attorney General at portal.ct.gov/ag.

8. Text messages and email

We use phone calls, text messages, and email to answer your questions, schedule and remind you of appointments, and follow up on your care. If you give us your phone number or email, you agree that we may contact you that way.

Regular email and text messages are not fully secure. They can be read by others or sent to the wrong person. For anything sensitive, please use the secure messaging in your patient portal or call us. If you email or text us anyway, we will understand that you accept that risk, and you can ask us at any time to stop using email or text with you.

To opt out: reply STOP to any text message from us, ask us to stop emailing you, or call (203) 651-5117. We may still contact you in other ways about care you are receiving. Message and data rates may apply. We send scheduling and care messages only. We do not send marketing texts or emails.

9. Children

We treat patients age 5 and older. For children and teens, a parent or guardian is involved in their care. Our website is meant for adults, including parents and guardians looking for care for a child. It is not directed to children under 13, and we do not knowingly collect information online from children under 13. If you believe a child under 13 has sent us information through our website, contact us and we will delete it.

10. How long we keep information

We keep medical and billing records for as long as Connecticut and federal law require. We keep other information, such as intake forms from people who do not become patients, website analytics data, and emails and text messages, only as long as we need it for the purposes described in this policy or as the law requires. After that, we delete it or remove the details that identify you.

11. Changes to this policy

We may update this policy when our practices or the law change. We will post the new version on this page and change the effective date at the top. If we make a significant change to how we use personal information, we will post a notice on our website before the change takes effect.

12. Contact us

For privacy questions or requests, contact our Privacy Officer:

Elizabeth Laliberte, Compliance Manager and Privacy Officer

CMHS Psychiatry Group, PLLC and Comprehensive Mental Health Solutions LLC

51 Cherry Street, Milford, CT 06460

Phone: (203) 651-5117

Email: info@cmhsct.com

If you are in crisis or thinking about harming yourself, do not use email or our website forms. Call or text 988, the Suicide & Crisis Lifeline, available 24/7. In an emergency, call 911.