NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL AND/OR HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED BY ALLIE KESSEL THERAPY (“COMPANY”) AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

What is “medical information”?

The term “medical information” is synonymous with the term “protected health information” or “PHI” for purposes of this Notice. It essentially means any individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. This includes information that is oral or recorded in any form or medium, information that is created or received by a healthcare provider, health plan, or others, and information that relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual. This applies to all of the records of your care generated by Company as well. 

Within the scope of services offered, Company may create and maintains treatment records or notes that contain individually identifiable health information about clients. These records are generally referred to as “medical records” and this Notice concerns the privacy and confidentiality of those records and the information contained therein.

Uses and Disclosures Without Your Authorization – For Treatment, Payment, or Health Care Operations

Federal privacy rules and regulations allow healthcare providers who have a direct treatment relationship with the patient to use or disclose the patient’s PHI, without the patient’s written authorization, to carry out the healthcare provider’s treatment, payment, or healthcare operations. PHI may also be disclosed, without your written authorization, for the treatment activities of any other healthcare provider involved in your treatment plan.

Use or Disclosure for Treatment Purposes

Federal privacy rules allow health care providers who have a direct treatment relationship to use or disclose the client’s PHI without patient or client written authorization, to carry out the Company’s own treatment, payment, or healthcare operations. For example, if a therapist within Company decides to consult with another licensed healthcare provider about an individual’s condition, the therapist of Company may use and disclose PHI, which is otherwise confidential, in order to assist in the diagnosis or treatment of a mental health condition. Disclosures for treatment purposes are not limited to the minimum necessary standard to ensure that healthcare professionals provide quality care. The word “treatment” includes the provision, coordination, or management of healthcare and related services by one or more healthcare providers, including the coordination or management of healthcare by a healthcare provider with a third party; consultation between healthcare providers relating to a patient; or the referral of a patient for healthcare from one healthcare provider to another. This includes appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to patients. Prior written authorization is not required for such contact. 

Use or Disclosure for Payment Purposes

If a health plan requests a copy of individual health records, or a portion thereof, in order to determine whether payment is warranted under the terms of the patient’s insurance policy, Company is permitted to use and disclose PHI to the health plan.

Use or Disclosure for Healthcare Operations Purposes

If a health plan decides to audit Company in order to review its competence and performance, or to detect possible fraud or abuse, PHI may be used or disclosed for those purposes.

Other Permitted Uses or Disclosures Without Authorization

The following circumstances either require or permit Company to disclose PHI without written authorization:

• If disclosure is compelled by a court pursuant to an order of that court;
• If disclosure is compelled by a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority;
• If disclosure is compelled by a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear, or any provision authorizing discovery in a proceeding before a court or administrative agency;
• If disclosure is compelled by a board, commission, or administrative agency pursuant to an investigative subpoena issued pursuant to its lawful authority;
• If disclosure is compelled by an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel;
• If disclosure is compelled by a search warrant lawfully issued to a governmental law enforcement agency;
• If disclosure is compelled by the patient or the patient’s representative, or by corresponding federal statutes or regulations;
• If disclosure is compelled based upon belief of child or elder abuse.
• If disclosure is compelled or permitted, in the event of the patient’s death, to the coroner or medical examiner to determine the cause of death, or to a funeral director;
• If disclosure is required or permitted to a health oversight agency for oversight activities authorized by law, including but not limited to, audits, criminal or civil investigations, or licensure or disciplinary actions;
• If disclosure is compelled by the U.S. Secretary of Health and Human Services to investigate or determine Company’s compliance with privacy requirements under the federal regulations;
• If disclosure is otherwise specifically required by law.

This is not an exhaustive list but informs patients of most circumstances when disclosures without written authorization may be made. Other uses and disclosures will generally (but not always) be made only with your written authorization, even though federal privacy regulations or state law may allow additional uses or disclosures without written authorization. Uses or disclosures made with written authorization will be limited in scope to the information specified in the authorization form. Patients may revoke written authorization at any time, provided that the revocation is in writing and except to the extent that Company has taken action in reliance on the written authorization. The right to revoke authorization is also limited if the authorization was obtained as a condition of obtaining insurance coverage.

If state law affords more protection to the patient’s confidentiality or privacy than does the federal Privacy Rule, or if state law gives the patient greater rights than the federal rule does with respect to access to medical records, state law shall govern. In general, uses or disclosures by Company of PHI (without authorization) will be limited to the minimum necessary to accomplish the intended purpose of the use or disclosure. Similarly, when Company requests PHI from another healthcare provider, health plan, or healthcare clearinghouse, it will make an effort to limit the information requested to the minimum necessary to accomplish the intended purpose of the request, aside from treatment purposes as described above.

Uses and Disclosures of PHI that Require Your Authorization

Company may keep psychotherapy notes as defined in 45 CFR section 164.501 and any use or disclosure of such notes requires your authorization, unless such use or disclosure is (a) for Company’s use in treating a client, (b) for Company use in training or supervising practitioners in helping them improve their skills, (c) for Company use in connection with defending itself in legal proceedings filed by client, (d) for use in investigating compliance with HIPAA or as required by law (e) in order to help thwart or avert a serious threat to the health and safety of others. 

OTHER WAYS WE USE OR SHARE YOUR PHI

We are allowed or required to share your PHI in other ways listed below. We are required by law to meet certain conditions before we share your PHI for these purposes. For more information, see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html. 

Public Health and Safety Issues

We can share your PHI in certain situations such as:

• Preventing disease;
• Helping with product recalls;
• Reporting adverse reactions to medications;
• Reporting suspected abuse, neglect, or domestic violence;
• Preventing or reducing a serious threat to anyone’s health or safety.

Research Purposes

We can use or share your PHI to contribute to public health research.

Donor Requests

We can share your PHI with organ procurement organizations.

Workers’ Compensation, Law Enforcement, and Other Government Requests

We can use or share your PHI:

• For workers’ compensation claims;
• For law enforcement purposes;
• With a law enforcement official;
• With health oversight agencies for activities authorized by law;
• For special government functions such as military, national security, and presidential protective services.

YOUR RIGHTS

You have the right to request restrictions on certain uses and disclosures of PHI about you, such as those necessary to carry out treatment, payment, or healthcare operations. Company is not required to agree to the requested restrictions. If Company does agree, a written record of the agreed upon restriction will be maintained. If you pay for a service or healthcare item out-of-pocket in full, you can ask Company not to share that information for the purpose of payment or operations with your health insurer.

You have the right to receive confidential communications of PHI from Company by alternative means or at alternative locations.

You have the right to inspect and copy PHI about you by making a specific request to do so in writing. This right to inspect and copy is not absolute; Company is permitted to deny access for specified reasons. 

You have the right to amend PHI in your medical records by making a request to do so in a writing that provides a reason to support the requested amendment. The right to amend is not absolute; Company is permitted to deny the requested amendment for specified reasons via written notice within 60 days of the request. You also have the right, subject to limitations, to provide Company with a written addendum with respect to any item or statement in your records that you believe to be incorrect or incomplete and to have the addendum become part of your record.

You have the right to receive an accounting from Company of the disclosures of PHI made in the six years prior to the date on which the accounting is requested. This right is not absolute; Company is permitted to deny the request for specified reasons. For example, Company does not have to account for disclosures made in order to carry out treatment, payment, or healthcare operations. Company also does not have to account for disclosures of PHI that are made with your written authorization, since you have a right to receive a copy of any such disclosures under the authorization you sign. Upon request, one accounting per year will be provided for free. Any additional requests within a 12-month period will be provided at a reasonable, cost-based fee.

You have the right to obtain a paper copy of this Notice from Company upon request. 

You have the right to choose someone to act for you. If you have given another person medical power of attorney or if another person is your legal guardian, that person can exercise your rights and make choices about your PHI.

You have the right to file a complaint through the process explained under “Company Duties” if you believe your privacy rights have been violated. Company will not retaliate against you for filing a complaint.

If you wish to exercise any of the rights enumerated above, please put your request in writing and deliver or send the writing to Company. If you wish to learn more detailed information about any of the above rights, or their limitations, please let Company know.

YOUR CHOICES

For certain PHI, you can tell Company your choices about what your nutritionist shares. If you have a clear preference for how Company shares your information in the situations described below, talk to those within Company. Tell them what you’d like them to do, and they will follow your instructions.

In these cases, you have both the right and the choice to tell us to:

• Share information with your family, close friends, or others involved in your care;
• Share information in a disaster relief situation;
• Include your information in a hospital directory

If you are not able to tell us your preference (i.e. – if you are unconscious), we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases we never share your information unless you give us written permission:

• Marketing purposes;
• Sale of your information;
• Most sharing of psychotherapy notes

In the case of fundraising, we may contact you for fundraising efforts, but you can tell us not to contact you again.

COMPANY DUTIES

Company is required by law to maintain the privacy and security of PHI. This Notice is intended to let you know of Company’s legal duties, your rights, and privacy practices with respect to such information. You will be promptly informed if a breach occurs that may have compromised the privacy or security of your PHI. Company is required to abide by the terms of this Notice currently in effect and provide you a copy of said Notice. Company reserves the right to change the terms of this Notice and/or its privacy practices and to make the changes effective for all PHI that is maintained by Company, even if it was created or received prior to the effective date of the Notice revision. If Company makes a revision to this Notice, they will make the Notice available at their office upon request on or after the effective date of the revision and Company will post the revised Notice in a clear and prominent location.

As the Privacy Officer of this practice, Company has a duty to develop, implement, and adopt clear privacy policies and procedures for their practice. The Privacy Officer can be reached at alliekessellcsw@gmail.com and 949-257-8999. Allie Kessel (“Responsible Party”) is the individual who is responsible for assuring that these privacy policies and procedures are followed not only by him or herself, but by any employees or therapists that work for Company or that may work for Company in the future. Responsible Party has trained or will train any employees that may work for Company so that they fully understand the privacy policies and procedures. Patient records and PHI are treated as confidential in this practice and are not released without written authorization by the patient, except as indicated in this Notice or except as may be otherwise permitted by law. Patient records are kept secure to ensure confidentiality. We will not use or share your PHI other than as described here unless you tell us we may do so in writing. If you give us permission to do so, you may change your mind at any time by submitting that change in writing. 

For more information, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html. 

Because Responsible Party is the primary point of contact for this practice, you may complain to him/her and/or the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights may have been violated either by Responsible Party or by those who are employed by Company. You may file a complaint with Company by simply providing a writing that specifies the manner in which you believe the violation occurred, the approximate date of such occurrence, and any details that you believe will be helpful. Company telephone number is 949-257-8999. Company will not retaliate against you in any way for filing a complaint with them or the Secretary. Complaints to the Secretary must be filed in writing. A complaint to the Secretary can be sent to the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue SW, Washington, D.C. 20201, calling 1-800-368-1019, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. 

If you need further information or have questions related to this Notice or its contents, please contact Responsible Party. As the primary point of contact for Company, Responsible Party will answer your questions and provide you with additional information.

CHANGES TO THE TERMS OF THIS NOTICE

Should Company implement changes to the terms of this Notice, the changes will apply to all information they have about you. The new Notice shall be made available upon request, in the office, and on the website.

This Notice is effective January 30, 2024.