I am required to provide you with this Notice that explains my privacy practices regarding your psychological and medical information. HIPAA refers to the Health Insurance Portability and Accountability Act, a federal law that provides privacy protections and patient rights regarding the use and disclosure of information created or noted by me that can be used to identify you (“Protected Health Information” or PHI). I am required by law to safeguard your PHI and ensure that it is kept private.

This Notice must explain when, why, and how I would use and/or disclose your PHI. Use of PHI means when I share, apply, utilize, examine, or analyze information within my practice. Disclosure of PHI is when I release, transfer, give, or otherwise reveal it to a third party outside my practice. Except as indicated below, I will use and disclose PHI only with your express written authorization. You may revoke such permission at any time by informing me in writing.

Uses & Disclosures Requiring Your Consent or Authorization

I will obtain an authorization from you before using or disclosing PHI in a way that is not described in this Notice.

Uses & Disclosures Not Requiring Your Consent or Authorization

For Health Care Operations: Health Care Operations refers to when I disclose your PHI to your health care service plan (for example, your health insurer) or to your other health care providers contracting with your plan, to enable them to administer the plan, such as for case management and care coordination. I may also provide your PHI to my accountants, attorneys, consultants, and others to ensure compliance with applicable laws.

To Obtain Payment for Treatment: I can use and disclose your PHI to bill and collect payment for the treatment and services provided. Examples of payment are when I disclose your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.

Other Disclosures for Treatment: I may also disclose your PHI to others without your consent in certain situations. Your consent is not required if you need emergency treatment, if I try to get consent after treatment is rendered, or if I try to obtain consent and you are unable to communicate. In addition, I may use or disclose PHI without your consent or authorization in the following circumstances:

Serious Threat to Health or Safety: If you communicate to me a serious threat of physical violence against an identifiable victim, I must make reasonable efforts to communicate that information to the potential victim and the police. If I have reasonable cause to believe that you are in such a condition as to be dangerous to yourself or others, I may release relevant information as necessary to prevent the threatened danger.

Child Abuse: Whenever I, in my professional capacity, have knowledge of or observe a child I know or reasonably suspect, has been the victim of child abuse or neglect, I must immediately report such to a police department or sheriff’s department, county probation department, or county welfare department. Also, if I have knowledge of or reasonably suspect that mental suffering has been inflicted upon a child or that his or her emotional well-being is endangered in any other way, I may report such to the above agencies.

Adult and Domestic Abuse: If I, in my professional capacity, have observed or have knowledge of an incident that reasonably appears to be physical abuse, abandonment, abduction, isolation, financial abuse or neglect of an elder or dependent adult, or if I are told by an elder or dependent adult that he or she has experienced these or if I reasonably suspect such, I must report the known or suspected abuse immediately to the local ombudsman or the local law enforcement agency. I do not have to report such an incident if:

1. 1. 1. 1. I have been told by an elder or dependent adult that he or she has experienced behavior constituting physical abuse, abandonment, abduction, isolation, financial abuse, or neglect; and
      2. I am not aware of any independent evidence that corroborates the statement that the abuse has occurred; and
      3. The elder or dependent adult has been diagnosed with a mental illness or dementia, or is the subject of a court-ordered conservatorship because of a mental illness or dementia; and
      4. In the exercise of clinical judgment, I reasonably believe that the abuse did not occur.

Health Oversight: If a complaint is filed against me with the California Board of Psychology, the Board has the authority to subpoena confidential mental health information from me relevant to that complaint.

Judicial or Administrative Proceedings: If you are involved in a court proceeding and a request is made about the professional services that I have provided you, I must not release your information without (1) your written authorization or the authorization of your attorney or personal representative; (2) a court order; or (3) a subpoena duces tecum (a subpoena to produce records) where the party seeking your records provides me with a showing that you or your attorney have been served with a copy of the subpoena, affidavit and the appropriate notice, and you have not notified me that you are bringing a motion in the court to quash (block) or modify the subpoena. The privilege does not apply when you are being evaluated for a third party or where the evaluation is court-ordered. I will inform you in advance if this is the case.

Worker’s Compensation: If you file a worker’s compensation claim, I must furnish a report to your employer, incorporating my findings about your injury and treatment, within five working days from the date of your initial examination, and at subsequent intervals as may be required by the administrative director of the Worker’s Compensation Commission to determine your eligibility for worker’s compensation.

Patient’s Rights

Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of PHI about you. However, I am not required to agree to a restriction you request.

Right to Receive Confidential Communications by Alternative Means and at Alternative Locations: You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. For example, you may not want a family member to know that you are seeing me. Upon your request, I will send your bills to another address.

Right to Inspect and Copy: You have the right to inspect or obtain a copy (or both) of PHI in my mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. I may deny your access to PHI under certain circumstances, but in some cases you may have this decision reviewed. On your request, I will discuss with you the details of the request and denial process.

Right to Amend: You have the right to request an amendment of PHI for as long as the PHI is maintained in the record. I may deny your request. On your request, I will discuss with you the details of the amendment process.

Right to an Accounting: You generally have the right to receive an accounting of disclosures of PHI for which you have neither provided consent nor authorization (as described under Uses & Disclosures Not Requiring Your Consent or Authorization in this Notice). On your request, I will discuss with you the details of the accounting process.

Right to a Paper Copy: You have the right to obtain a paper copy of the Notice from me upon request, even if you have agreed to receive the Notice electronically.

Right to Restrict Disclosures When You Have Paid for Your Care Out-of-Pocket: You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for my services.

Right to Be Notified if There is a Breach of Your Unsecured PHI: You have a right to be notified if there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI, that PHI has not been encrypted to government standards, and my risk assessment fails to determine that there is a low probability that your PHI has been compromised.

Breach Notification

When I become aware of or suspect a breach (the acquisition, access, use, or disclosure of PHI in violation of the HIPAA Privacy Rule), I will conduct a risk assessment to determine if PHI has been compromised and if notification is required. I will keep a written record of that risk assessment.

Unless I determine there is a low probability that PHI has been compromised, I will give you notice of the breach without unreasonable delay and within 60 days after discovery. “Discovery” is the first day that I know (or reasonably should have known) of the breach. Notice will include a brief description of the breach (including dates), a description of types of unsecured PHI involved, the steps you should take to protect against potential harm, a brief description of steps I have taken to investigate the incident, mitigate harm, and protect against further breaches, and my contact information.

The risk assessment can be done by a business associate if it was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, I will provide any required notice to patients and the U.S. Department of Health and Human Services (HHS). After any breach, particularly one that requires notice, I will reassess my privacy and security practices to determine what changes should be made to prevent the reoccurrence of such breaches.

Complaints

The Board of Behavioral Sciences (BBS) receives and responds to complaints regarding services provided within the scope of practice of Marriage and Family Therapists. You may contact the BBS online at http://www.bbs.ca.gov or by calling (916) 574-7830.

You may also submit a complaint to the U.S. Department of Health and Human Services by mail, fax, or email.

Office for Civil Rights
U.S. Department of Health & Human Services 
50 United Nations Plaza - Room 322 
San Francisco, CA 94102
fax: (415) 437-8329
email: OCRComplaint@hhs.gov
website: www.hhs.gov

I support your right to privacy and to receive ethical and legal care. I will not retaliate in any way if you choose to file a complaint.

Effective Date, Restrictions, & Changes to Privacy Policy

This Notice is in effect as of April 2, 2021. I reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that I maintain. I will provide you with a revised Notice via email unless you request otherwise due to internet security concerns.