NOTICE OF PRIVACY PRACTICES

Garcia Psychiatry & Wellness, PLLC, doing business as TESSERA Psychiatry

Effective date: October 4, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.


About this Notice and our Practice

This Notice applies to TESSERA Psychiatry, including Lissa Garcia Segui, MD, and its authorized workforce. We are a private-pay, fully virtual outpatient psychiatry practice serving children, adolescents, and adults across the lifespan. We provide telepsychiatry only when the patient is physically located in Texas or Florida at the time of the visit. This Notice describes our privacy practices for protected health information (PHI), including electronic records, and explains your rights.

Our clinical services and policies, including our policy not to prescribe controlled substances, are explained separately in practice materials. These service policies do not reduce the privacy rights described here.


1. Your Rights

You have the following rights regarding health information we maintain about you, subject to applicable federal and state laws:

• Access and copies. You may request to inspect or obtain an electronic or paper copy of medical and billing records in our designated record set. We generally respond within 30 days under HIPAA, or sooner if required by law. Proper requests governed by Texas physician records rules generally require response within 15 business days. We may charge only fees allowed by law. A narrow exception may apply to separately maintained psychotherapy notes or other information excluded from the HIPAA right of access.
• Amendment. You may ask us to correct information you believe is inaccurate or incomplete. We may deny a request as permitted by law, but will explain our decision in writing and describe applicable options.
• Confidential communications. You may ask us to contact you through a particular channel or at another location or phone number. We will accommodate reasonable requests.
• Restrictions. You may request limits on certain uses or disclosures for treatment, payment, or health care operations. We do not have to agree to most requests. If you pay out of pocket in full for a service and request that we not disclose that service to a health plan for payment or operations, we must honor that request unless disclosure is required by law.
• Accounting of disclosures. You may request an accounting of certain disclosures made during the prior six years. Many treatment, payment, operations, and authorized disclosures are excluded under HIPAA. One accounting in a 12-month period is free; a lawful, reasonable cost-based fee may apply to additional requests.
• Copy of this Notice. You may request a paper or electronic copy at any time, even if you agreed to receive it electronically.
• Personal representative. A legally authorized representative may act for you as permitted by law. We may verify that person’s identity and authority before providing access or accepting instructions.
• Complaint and breach notice. You may file a privacy complaint without retaliation. We will notify affected individuals of breaches of unsecured PHI as required by law.

2. Your Choices and Written Authorizations

You may tell us whether we should share relevant information with family members, caregivers, close friends, or others involved in your care or payment. When you cannot express a preference, we may share limited information if permitted by law and in your best interests, or to lessen a serious and imminent threat. We may also share limited information for authorized disaster-relief purposes.

Your written authorization is generally required for uses and disclosures not otherwise permitted by law, including most disclosures of separately maintained psychotherapy notes, marketing uses requiring authorization, and any sale of PHI. TESSERA does not sell patient information or use patient PHI for fundraising. You may revoke an authorization in writing, except to the extent we have already relied on it.


3. How We Use and Disclose Health Information

We may use or disclose PHI without your separate authorization for the following purposes when permitted by applicable law:

• Treatment. We use information to evaluate symptoms, document diagnoses, plan and deliver care, and coordinate with other treating professionals. Example: with appropriate legal permissions, we send relevant medication information to a pharmacy or coordinate treatment with your primary care clinician or therapist.
• Payment. We use limited information to collect private-pay fees, process payments, issue receipts and Good Faith Estimates, respond to billing questions, and prepare a superbill when requested. We do not routinely submit insurance claims, but may make permitted or authorized disclosures to a health plan when appropriate.
• Health care operations. We may use information for appointment scheduling, quality improvement, training, practice administration, technology security, compliance, auditing, and communications necessary to operate TESSERA. Example: we review appointment records to coordinate services.
Other uses or disclosures may be permitted or required by law, subject to applicable conditions and restrictions, including:

• Public health activities, adverse event reporting, or other legally authorized health and safety functions.
• Reporting suspected child abuse, neglect, exploitation, or other situations subject to mandatory reporting laws.
• Preventing or reducing a serious and imminent threat to a person or the public, when legally permitted.
• Health oversight, licensing, audits, and requests from the U.S. Department of Health and Human Services to demonstrate compliance.
• Workers’ compensation, authorized research, organ and tissue donation, and disclosures to coroners, medical examiners, or funeral directors where applicable.
• Certain law-enforcement requests, judicial or administrative proceedings, court orders, subpoenas, and specialized government functions, only to the extent applicable laws permit or require disclosure.
Additional Texas, Florida, federal mental health, and substance-use confidentiality rules may limit disclosures that HIPAA would otherwise allow. We apply the more protective rule when required. We use the minimum necessary amount of PHI when that standard applies.


4. Special Protections for Mental Health and Substance Use Records

Psychiatric and psychotherapy information. Psychiatric records, communications with mental health professionals, and certain other sensitive information may receive additional protections under Texas or Florida law. We disclose this information only when permitted or required by applicable law. Separately maintained HIPAA-defined psychotherapy notes generally require special written authorization for use or disclosure, with limited legal exceptions. Routine progress notes, medication-management records, diagnoses, and treatment plans are not automatically psychotherapy notes for this purpose.

Records subject to 42 CFR Part 2. Some substance use disorder (SUD) records created or received by TESSERA may be subject to special federal confidentiality rules known as 42 CFR Part 2. When Part 2 applies, we honor its special consent, use, disclosure, and breach requirements. For treatment, payment, and health care operations, certain disclosures may be permitted under an appropriate Part 2 consent, and recipients may be permitted to redisclose information under HIPAA and Part 2 rules. We will not use or disclose Part 2 records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or an applicable Part 2-compliant court order accompanied by the legally required process, such as a subpoena. We do not use Part 2 records to solicit fundraising.

Other sensitive information. HIV-related, genetic, reproductive-health, and other information may receive additional protections under applicable law. We follow those rules when they apply.


5. Children, Adolescents, Parents, and Guardians

For patients under age 18, a parent, managing conservator, guardian, or other legally authorized person generally may exercise privacy rights and obtain relevant records when permitted by law. However, a minor may have independent confidentiality rights in particular circumstances, such as when the minor lawfully consents to certain care, or when a court order or other federal or state law restricts parental access. The rules are different in Texas and Florida and depend on the type of service and legal authority. We verify applicable consent, custody, guardianship, and access restrictions before sharing information or giving portal access. We cannot promise that all adolescent communications will be confidential from parents or guardians.


6. Telehealth, Patient Portal, and Electronic Communications

TESSERA provides care through electronic health records, virtual visits, secure patient-portal functions, e-prescribing, payment and administrative systems, and telephone services. We use reasonable safeguards and work with vendors and business associates that must protect PHI under applicable laws and agreements.

At telehealth appointments, we may verify the patient’s identity, confirm that the patient is physically located in Texas or Florida, and obtain callback and emergency location information. We encourage patients to use the secure SimplePractice portal or another approved secure channel for clinical messages and sensitive documents. Ordinary email and voicemail may carry privacy risks; callers should avoid including sensitive clinical details in general inquiries. We will address reasonable requests for confidential communications. We do not routinely record visits; any recording would require appropriate permission and compliance with applicable law.


7. Our Legal Responsibilities and Changes to This Notice

We are required to maintain the privacy and security of PHI; provide this Notice of our legal duties and privacy practices; notify individuals of reportable breaches; and follow the terms of the Notice currently in effect. We will not use or disclose PHI outside this Notice unless permitted or required by law or authorized by you in writing.

We may revise this Notice and apply the revised terms to PHI we already maintain as well as information received later, as permitted by law. If we make material changes, we will make the updated Notice available upon request and post the current version prominently on our website. The current Notice may also be accessed through patient onboarding materials.


8. Contact and Privacy Complaints

Privacy Officer: Lissa Garcia Segui, MD | TESSERA Psychiatry | Garcia Psychiatry & Wellness, PLLC

Public telephone: 713-364-8171  |  Fax: 713-565-8462
Email: contact@tesserapsychiatry.com  |  Website: www.tesserapsychiatry.com

To exercise a privacy right, request a copy of this Notice, ask a question, or submit a complaint, contact the Privacy Officer. For private clinical or records requests, please ask for instructions on using the secure patient portal or an approved secure delivery method. We will not retaliate if you raise a concern.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/hipaa/filing-a-complaint/; by telephone at 1-877-696-6775; or by mail at 200 Independence Avenue, SW, Washington, DC 20201.