Privacy Policy

HIPAA Notice of Privacy Practices

This notice describes how psychological and medical information about you may be used and disclosed and how you can get access to this information.

Please review the below carefully and completely.

I. Uses and Disclosures Not Requiring Your Authorization
Your Provider may use or disclose your protected health information (PHI) for certain treatment, payment, and operational purposes without your consent or authorization.  Your Provider can only do so when the person or business requesting your PHI gives the Provider a written request that includes certain promises regarding protecting the confidentiality of you PHI.  To help clarify these terms, please refer to the following definitions:

  • PHI refers to information in your health record that could identify you. For example, PHI may include your name, your home or email address, the fact that you are receiving treatment, and other basic information pertaining to your treatment.
  • Use refers to the usage of PHI in activities within your Provider’s physical place of business and practice group, such as when your Provider gives one of his or her employees access to your PHI for administrative or record keeping purposes. (Provided the employee is first trained on how to handle and maintain the confidentiality of such PHI).
  • Disclosure refers to the usage of PHI in activities outside of your Provider’s place of business and practice group, such as the releasing, transferring or providing third party access to information about you and your PHI.
  • Authorization is your written permission to disclose confidential health information. All authorizations to disclose must be made on a specific and required form prescribed by law.
  • Treatment is when your Provider provides, coordinates, or manages your health or mental care and any other services related to your health care. For example, with your written authorization your Provider may share your information with your physician to ensure the physician has the necessary information to diagnose or treat you.
  • Payment refers to when your PHI may be used, as necessary, in activities related to obtaining payment for you health care services. This may include use of a billing service or providing you with documentation of your care so that you may obtain reimbursement from your insurer.
  • Health Care Operations are activities that relate to the performance and operation of your Provider’s professional practice. Your Provider may use or disclose, as needed, your PHI in support of business activities.  For example, when you Provider reviews an administrative assistance’s performance, your Provider may need to review what the employee has documented in your record.

II. Uses and Disclosures Requiring Your Authorization
Your Provider may use or disclose PHI for purposes outside of treatment, payment and health care operations when your appropriate authorization is obtained.  Additionally, certain categories of information have extra protections by law and thus require special written authorization for disclosure.

  • Psychological Notes – Your Provider must obtain a special authorization before releasing your psychotherapy notes. “Psychotherapy Notes” are notes your Provider has made about your conversations during a private, group, joint, or family counseling session, and which your Provider has kept separate from the rest of your record.  These notes are given a greater degree of protection than other records, in part because they generally contain your Provider’s informal, unfiltered, and unrevised thoughts and impressions.
  • HIV Information – Special legal protections apply to HIV/AIDS related information. Your Provider must obtain a special written authorization from you before releasing information related to HIV/AIDS.
  • Alcohol and Drug Use Information – Special legal protections apply to information related to alcohol and drug use and treatment. Your Provider must obtain a special written authorization from you before releasing information related to alcohol and/or drug use/treatment.

In those instances when your Provider asks for information for purposes outside of treatment, payment, or health care operations, Your Provider must obtain an authorization from you before releasing that information.  You may revoke or modify all such authorization at any time provided each revocation is in writing and signed by you.  However, such revocation or modification will not go into effect until your Provider sees it.

III. Uses and Disclosures Requiring Neither Your Consent Nor Authorization.

Your Provider may use or disclose PHI without you consent or authorization in the following circumstances:

  • Child Abuse – Whenever your Provider, in his or her professional opinion and capacity, obtains knowledge of or observes a child your Provider knows or reasonably suspects has been the victim of child abuse or neglect, you Provider must immediately report such incidence to a police department or sheriff’s department, or where pertinent, a county probation department or county welfare department. Also, if your Provider has knowledge of or reasonably suspects that mental suffering has been inflicted upon a child or that the child’s emotional well-being is endangered in any way, your Provider may report such to the relevant authorities also.
  • Adult and Domestic Abuse – If your Provider, in his or her professional opinion and capacity, obtains knowledge of or observes an incident that reasonably appears to be physical abuse, abandonment, abduction, isolation, financial abuse, or neglect of an elder or dependent adult, or if your Provider is told by an elder or dependent adult that he or she has experienced these or if your Provider reasonable suspects such, your Provider must report the known or suspected abuse immediately to the appropriate law enforcement agencies. However, your Provider does not have to report such incidents when ALL of the following conditions are met:
    • Your Provider has been told by an elder or dependent adult that he or she has experienced behavior constituting physical abuse, abandonment, abduction, isolation, financial abuse or neglect; AND
    • Your Provider is not aware of any independent evidence that corroborates the statement that abuse has occurred; AND
    • The elder or dependent adult has been diagnosed with a mental illness or dementia, or is subject of a court-ordered conservatorship because of a mental illness or dementia; AND
    • In the exercise of your Provider’s clinical judgment the Provider reasonably believes that the abuse did not occur.
  • Health Oversight – If a complaint is filed against your Provider with a regulatory authority, and that authority has the authority to subpoena confidential mental health information from you Provider.
  • Judicial or Administrative Proceedings – If you are involved in a court proceeding and a request is made about the professional services your Provider has rendered to you, Your Provider must not release your information without:
    • Your written authorization or the authorization of your attorney or personal representative; or
    • A court order; or
    • A subpoena duces tecum (a subpoena to produce records) where the party seeking your records provides your Provider with a showing that you or your attorney has been served with a copy of the subpoena, affidavit, and the appropriate notice, and you have not notified your Provider that you are bringing a motion in the court to quash (block) or modify the subpoena. The privilege does not apply when you are being evaluated for a third party or where the evaluation is court-ordered, in which case Your Provider will inform you in advance of such production.
  • Serious Threat to Health or Safety – If your Provider believes that you present an imminent, serious risk of injury or death to yourself, your Provider may make disclosures the Provider considers necessary to protect you from harm. If you communicate a specific threat of imminent harm against another individual or if your Provider believes that there is clear, imminent risk of injury being inflicted against another individual, your Provider may make disclosures the Provider believes are necessary to protect that individual from harm.
  • Worker’s Compensation – Your Provider may disclose PHI as authorized by, and to the extent necessary to comply with, laws relating to worker’s compensation or other similar programs, that provide benefits for work related injuries or illness without regard to fault.

IV. Patient’s Rights and Provider’s Duties.
Patient’s Rights:

  • Right to Request Restrictions – You have the right to request restrictions on certain uses/disclosures of PHI. However, You Provider is not required to comply with your request under circumstances where such use and disclosure is permitted as described herein.
  • Right to receive Confidential Communications by Alternative Means and at Alternative Locations – You have the right to request and receive confidential communications by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeking treatment.  On your request, Your Provider will send your bills to another address.)
  • Right to Inspect and Copy – You have the right to inspect or obtain a copy (or both) of PHI in Your Provider’s mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. Your Provider may deny your access to PHI under certain circumstancs, but in some cases you may this decision reviewed.  On your request, Your Provider will discuss with you the details of the request and denial process.
  • Right to Amend – Your have the right request an amendment of PHI for as long as it is maintained in your record. I may deny your request.  On your request, your Provider will discuss with you the details of the amendment process.
  • Right to an Accounting – You generally have the right to receive an accounting of all disclosures of PHI for which you have neither provided consent nor authorization (as described in Section III of this notice). On your request, your Provider will discuss with you the details of the accounting process.
  • Right to a Paper Copy – You have the right to obtain a paper copy of the HIPAA Notice of Privacy Practices from your Provider upon request.

Provider’s Duties:

  • Your Provider is required by law to maintain the privacy of PHI and to provide you with a notice of your Provider’s legal duties and privacy practices with respect to PHI.
  • Your Provider reserves the right to change his or her privacy practices described in this notice. Unless your Provider notifies you of such changes, however, your Provider is required to abide by the terms currently in effect.
  • If your Provider revises his or her policies and procedures, Your Provider must notify you at Your next session or by some other authorized mode of communication (such as by mail to an approved address or by encrypted email to an authorized email address).

V.Questions and Complaints.
If you have any questions about this notice, disagree with a decision your Provider makes about access to your records, or have other concerns about your privacy rights, please contact your Provider directly using the contact information provided in your Provider’s Provider Profile.

If you believe that your health rights have been violated, you may file a complaint with the US Department of Human Services (HSS).  Complaints can be submitted in writing or electronically.

Complaints may be submitted by mail, addressed as follows:

Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201

Or electronically, either by email (OCRComplaint@hhs.gov) or the through the Office of Civil Rights Complaint Web Portal (https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf).

Additional information regarding the filing of complaints may be obtained on the HSS website (https://www.hhs.gov/hipaa/filing-a-complaint/index.html)

Your Provider may not retaliate against you for exercising your right to file a complaint. 

VI. Effective Date, Restrictions, and Changes to Privacy Practices.
This notice will go into effect on October XX, 2017.  Your Provider reserves the right to chane the terms of this notice and to make new notice provisions effective for all PHI that he or she maintains.  Should this occur, your Provider must notify you of such changes, and offer to provide you with a paper copy of the revised notice, before the changes take effect.