NOTICE OF PRIVACY PRACTICES (HIPAA)

This Notice describes how your health information (or the health information of your child, if your child is the client) may be used and disclosed and how you can access this information. Please review it carefully.

OUR LEGAL DUTY
We are required by law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice.

Protected Health Information (PHI) refers to information in a client’s health record that could identify that client.  Use of this information refers only to activities within my office such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you.  Disclosure of information refers to activities outside of my office such as releasing, transferring, or providing access to information about you to other parties.  Throughout this notice, the term “you” might refer to the individual who is the client, or the individual’s parent, legal guardian, or adult who has been legally determined to be responsible for the client.    

USES AND DISCLOSURES OF HEALTH INFORMATION

I may use or disclose information in your record for the purpose of treatment, payment, and healthcare operations, with your consent.  

Treatment
I may use and disclose your PHI to provide, coordinate, or manage your mental health care. For example, I may consult with another therapist, physician, or specialist involved in your care.

Payment
I may use or disclose certain protected health information (PHI) for the purposes of payment. This may include: generating invoices or receipts, creating superbills for insurance reimbursement (at your request), recording payment methods and transactions (e.g., credit card records), and/or communicating with you regarding billing or outstanding balances.  PHI used for payment may include your name, date(s) of service, diagnosis and procedure codes, and contact information. I take reasonable steps to safeguard this information at all times.

Health Care Operations
We may use your PHI for activities related to the operation of our practice, such as quality assessment, staff training, and licensing or accreditation.

USES AND DISCLOSURE REQUIRING AUTHORIZATION
Except as described in this Notice, I may not make any use or disclosure of information from your record for purposes outside of treatment, payment, and health care operations unless you give your written authorization.  You may revoke an authorization in writing at any time, except to the extent that action has already been taken based on it.
Marketing Purposes. As a psychotherapist, I will not use or disclose your PHI for marketing purposes.
Sale of PHI. As a psychotherapist, I will not sell your PHI in the regular course of my business.

USES AND DISCLOSURE WITHOUT CONSENT OR AUTHORIZATION
There are certain circumstances, listed below, in which I am allowed (or, in some cases, required) to use or disclose information from your record without your permission. 

When required by law 
If I know, or have reasonable cause to suspect that a child has been abused or neglected by a parent, legal custodian, caregiver, or other person responsible for the child’s welfare, the law requires that I report such knowledge or suspicion to the relevant child protective services agency (based on client’s location).  If I know, or have reasonable cause to suspect, that a non-caretaker has abused a child, the law also requires that I report to the relevant child protective services agency. 

If I know, or have reasonable cause to suspect that a vulnerable adult (disabled or elderly) has been or is being abused, neglected, or exploited, I am required by law to report such knowledge or suspicion to the appropriate department of social services (dependent upon client location) or other appropriate governmental agency. 

I may disclose your health information in response to a valid court order or in the context of a legal or administrative proceeding, but only to the extent required and permitted by law. When possible, I will notify you of such requests to allow you to object or seek legal protection. Psychotherapy notes are afforded special protection and will only be disclosed with your written consent or as ordered by a court.

To prevent a serious threat to health or safety
I may use or disclose your protected health information if I believe it is necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of another person. Such disclosures will only be made to individuals or agencies capable of helping prevent the threat, such as law enforcement, emergency services, or identified at-risk individuals.

These decisions will be made in accordance with both HIPAA regulations and applicable state laws, which may provide additional protections for mental health information.

For public health activities

I may disclose your protected health information to public health authorities or other appropriate government agencies authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability. This includes reporting of communicable diseases, child abuse or neglect, and adverse reactions to medications or medical devices.

To health oversight agencies

I may disclose your protected health information to health oversight agencies as required by law. These agencies may conduct audits, investigations, inspections, or licensure actions related to the health care system, government benefit programs, or compliance with professional standards

To coroners or medical examiners
I may disclose protected health information to a coroner or medical examiner for the purposes of identifying a deceased person, determining cause of death, or performing other duties authorized by law. These disclosures are permitted without your authorization when required for public health or legal investigations following a person’s death.

To comply with workers’ compensation laws
I may disclose your protected health information as authorized and to the extent necessary to comply with laws relating to workers’ compensation or similar programs established by law. These programs provide benefits for work-related injuries or illness.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have the right to:
Request Restrictions: You have the right to ask us to restrict how we use or disclose your protected health information (PHI) for treatment, payment, or health care operations. For example, you may request that I not share certain information with a family member or with your insurance company.  While I am not required to agree to your requested restrictions, I will consider your request carefully. If I do agree, I will comply with the restriction unless the information is needed to provide you emergency treatment. 
Important: If you pay out-of-pocket in full for a service or health care item, you have the right to request that I not disclose PHI about that service to your health plan for payment or health care operations. I must agree to this restriction.
To request a restriction, please submit your request in writing, specifying what information you want restricted and to whom the restriction applies.

Access Your PHI: You may request to see or get a copy of your records, with certain exceptions. Requests must be in writing. This may be subject to certain fees. 

Request Amendments: If you believe your PHI is incorrect or incomplete, you may request an amendment.  Your request must be in writing, and I may deny your request. 

Receive an Accounting of Disclosures: You may ask for a list of disclosures we made of your PHI, excluding those made for treatment, payment, and health care operations.

Request Confidential Communications: You may request that we communicate with you in a certain way (e.g., only by mail or at a certain address).

Receive a Paper Copy of This Notice: Even if you have received this Notice electronically, you are entitled to a paper copy.

PSYCHOLOGIST’S RESPONSIBILITIES
I am required by law to:
Maintain the privacy and security of your PHI
Notify you if a breach occurs that may have compromised your information
Follow the terms of this Notice
Provide you with a copy of this Notice

CHANGES TO THIS NOTICE
I reserve the right to change my privacy practices and this Notice at any time, and the new Notice will apply to all PHI we maintain. The revised Notice will be posted in our office. 

If I make significant changes to my policies and procedures that might affect the privacy of your protected health information, I will provide you with a copy of those revisions.  Updated Notices of my privacy policies will always be available for review upon request at my office.  

QUESTIONS AND COMPLAINTS
If you have questions about this Notice, disagree with a decision I make about access to your records, or have other concerns about your privacy rights, you may contact me at my office.  I recommend that such inquiries be done in writing.  

If you believe your privacy rights have been violated, you may file a complaint with me or with the U.S. Department of Health and Human Services. I will not retaliate against you for filing a complaint.

You may contact me with any concerns or questions at (203) 343-0732 or drmichelle@thrivinglittleminds.org

EFFECTIVE DATE
This Notice will go into effect on September 1, 2025.

RESTRICTIONS

Restriction for minor children: As the parent or legal guardian of a minor child receiving services, you generally have the right to access and control your child’s protected health information (PHI). However, under certain circumstances, the minor child may have specific privacy rights to restrict access to some of their health information, depending on state law and the nature of the services provided.

I respect the privacy of minor clients and will work with you and your child to balance your rights as a guardian with the minor’s rights to confidentiality. In some cases, particularly with older minors, certain mental health services may be provided confidentially without parental consent, and disclosures may be limited.

If your child requests a restriction on the use or disclosure of their PHI, or if you wish to request restrictions on behalf of your child, please submit your request in writing. I will consider such requests carefully and comply with applicable laws and ethical guidelines.

Please be aware that some disclosures of PHI related to minors may be required by law (such as reporting suspected abuse or imminent risk of harm) and cannot be restricted.