Introduction

​

Your health record contains personal information about you and your health. This information may identify you and relates to your past, present, or future physical or mental health condition and related health care services. This information is referred to as Protected Health Information (PHI).

​

This Notice of Privacy Practices (“Notice”) describes how I may use and disclose your PHI in accordance with applicable law, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy, Security, and Breach Notification Rules, 42 CFR Part 2 (where applicable), the NASW Code of Ethics, APA-aligned professional standards, and Massachusetts statutes and regulations. It also describes your rights regarding your PHI.

I am required by law to maintain the privacy of your PHI, to provide you with notice of my legal duties and privacy practices, and to follow the terms of this Notice. I reserve the right to change this Notice at any time. Any revised Notice will apply to all PHI I maintain and will be made available to you through my HIPAA-compliant electronic health record (EHR) system or upon request.

​

PHI is retained for the period required by federal and Massachusetts law.

​

​

I. Uses and Disclosures for Treatment, Payment, and Health Care Operations

​

HIPAA generally permits the use and disclosure of PHI for treatment, payment, and health care operations without written authorization.

​

Treatment

Your PHI may be used and disclosed to provide, coordinate, or manage your mental health care and related services. This may include consultation with other health care providers involved in your treatment (such as primary care physicians, psychiatrists, or other therapists), consistent with professional standards of care.

​

Payment

Your PHI may be used and disclosed to obtain payment for services provided to you. This may include determining insurance eligibility or coverage, submitting claims, reviewing services for medical necessity, conducting utilization review, or collecting payment.

​

Health Care Operations

Your PHI may be used or disclosed for health care operations, including quality assessment, audits, administrative activities, compliance reviews, and business operations. PHI may be shared with business associates (such as billing services or EHR vendors) pursuant to written agreements requiring them to safeguard your PHI.

All uses and disclosures under this section are limited to the minimum necessary, except for disclosures made for treatment or as otherwise required by law.

​

II. Uses and Disclosures Requiring Written Authorization

Uses and disclosures of PHI not otherwise permitted by law will be made only with your written authorization. You may revoke an authorization at any time in writing, except to the extent that action has already been taken based on your authorization.

Written authorization is required for:

• Most uses and disclosures of psychotherapy notes, which are kept separate from the general medical record

• Uses and disclosures not described in this Notice

• Certain disclosures of Substance Use Disorder (SUD) records protected under 42 CFR Part 2

 

III. Uses and Disclosures Without Authorization

I may use or disclose PHI without your authorization in the following circumstances, as permitted or required by law:

​

Abuse, Neglect, or Domestic Violence

• Child Abuse or Neglect: Reports to the Massachusetts Department of Children and Families

• Elder Abuse: Reports to the Massachusetts Executive Office of Elder Affairs

• Abuse of a Disabled Person: Reports to the Massachusetts Disabled Persons Protection Commission
   

Health Oversight Activities

PHI may be disclosed to health oversight agencies authorized by law for audits, investigations, inspections, licensure, or disciplinary actions. This includes disclosures to licensing boards such as the Massachusetts Board of Registration of Social Workers.

​

Judicial and Administrative Proceedings

PHI may be disclosed in response to a valid court order, subpoena, or other lawful process. Mental health records are generally protected by state and federal privilege laws and will not be disclosed without your written authorization or a court order. Privilege does not apply to court-ordered services or third-party evaluations, and you will be informed if this applies.

​

Serious Threat to Health or Safety

If you communicate a credible threat of serious harm to yourself or an identifiable person, and I believe you have the intent and ability to carry out that threat, I may take reasonable steps to protect you or others. These steps may include notifying law enforcement, warning potential victims, arranging hospitalization, or contacting family members or others who may assist in preventing harm.

​

Workers’ Compensation

If you file a workers’ compensation claim, PHI relevant to that claim may be disclosed to employers, insurers, or the Massachusetts Division of Workers’ Compensation as required by law.

 

Public Health Activities

PHI may be disclosed to public health authorities for purposes such as preventing or controlling disease, injury, or disability, or for public health surveillance and investigations, as required by law.

​

Specialized Government Functions

PHI may be disclosed to U.S. military command authorities, authorized officials for national security or intelligence activities, or the Department of State for medical suitability determinations, as permitted by law.

​

Law Enforcement

PHI may be disclosed to law enforcement officials as required by law or in response to lawful requests related to criminal activity, court orders, or threats to safety.

​

IV. Substance Use Disorder Records (42 CFR Part 2)

If your records include information related to Substance Use Disorder (SUD) services protected under 42 CFR Part 2:

• SUD records may be used and disclosed for treatment, payment, and health care operations as permitted by HIPAA and Part 2.

• Any other use or disclosure requires your specific written consent or a qualifying court order.

• SUD records may not be used in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order that meets Part 2 requirements.

Redisclosure Notice:
PHI disclosed pursuant to HIPAA or 42 CFR Part 2 may be subject to redisclosure by the recipient and may no longer be protected by federal or state privacy laws. However, redisclosure of SUD records remains restricted under 42 CFR Part 2 unless expressly permitted by your written consent or a qualifying court order.

​

V. Your Rights

You have the following rights regarding your PHI:

• Access: Inspect or obtain a copy of PHI used to make decisions about you, except psychotherapy notes

• Psychotherapy Notes: Psychotherapy notes are excluded from the right of access and may only be disclosed with your specific written authorization, except as permitted by law

• Electronic Access: Request PHI in electronic form through secure portals or other agreed-upon methods

• Amendment: Request corrections to your PHI

• Accounting of Disclosures: Request a list of certain disclosures

• Restrictions: Request limits on PHI use or disclosure, including required restrictions for self-paid services

• Confidential Communications: Request alternative methods or locations for communications

• Breach Notification: Receive notice of any breach of unsecured PHI

• Paper Copy: Request a paper copy of this Notice at any time
   

VI. Complaints and Contact Information

If you have questions about this Notice or believe your privacy rights have been violated, you may contact me directly.

You may also file a complaint with:
Secretary of the U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: (202) 619-0257

You will not be retaliated against for filing a complaint.
 

VII. Acknowledgment

By signing or electronically acknowledging this Notice, you confirm that you have received and reviewed this Notice of Privacy Practices.