Notice of Privacy Practices

Jennifer Kelly, PsyD · 68 Purchase Street, 3rd Floor, Rye, NY 10580

I. My pledge regarding health information

I understand that health information about you and your health care is personal, and I am committed to protecting it. I create a record of the care and services you receive from me, which I need to provide quality care and to comply with legal requirements. This notice applies to all records of your care generated by this practice. I am required by law to:

• Make sure that protected health information (“PHI”) that identifies you is kept private.
• Give you this notice of my legal duties and privacy practices with respect to health information.
• Follow the terms of the notice currently in effect.
• I can change the terms of this notice, and changes will apply to all information I have about you. The new notice will be available upon request, in my office, and on this website.

II. How I may use and disclose health information about you

Treatment, payment, or health care operations

Federal privacy rules allow health care providers who have a direct treatment relationship with a client to use or disclose the client’s health information without written authorization to carry out the provider’s own treatment, payment, or health care operations. I may also disclose your PHI for the treatment activities of any health care provider. For example, if I consult with another licensed health care provider about your condition, I may disclose information needed to assist in your diagnosis and treatment.

Disclosures for treatment purposes are not limited to the minimum-necessary standard, because providers need complete information to give quality care. “Treatment” includes coordinating care with third parties, consultations between providers, and referrals.

Lawsuits and disputes

If you are involved in a lawsuit, I may disclose health information in response to a court or administrative order. I may also disclose health information about your child in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information.

III. Uses and disclosures that require your authorization

Psychotherapy notes. I keep “psychotherapy notes” as defined in 45 CFR § 164.501. Any use or disclosure of these notes requires your authorization unless it is: (a) for my use in treating you; (b) for training or supervising mental health practitioners; (c) to defend myself in legal proceedings you bring; (d) for the Secretary of Health and Human Services to investigate my HIPAA compliance; (e) required by law and limited to that requirement; (f) required for certain health oversight activities; (g) required by a coroner performing authorized duties; or (h) needed to help avert a serious threat to the health and safety of others.

Marketing. I will not use or disclose your PHI for marketing purposes.

Sale of PHI. I will not sell your PHI.

IV. Uses and disclosures that do not require your authorization

Subject to certain limits in the law, I can use and disclose your PHI without your authorization:

• When required by state or federal law, limited to what that law requires.
• For public health activities, including reporting suspected child, elder, or dependent-adult abuse, or preventing or reducing a serious threat to anyone’s health or safety.
• For health oversight activities, including audits and investigations.
• For judicial and administrative proceedings, including responding to a court or administrative order, although I prefer to obtain your authorization first.
• For law enforcement purposes, including reporting crimes occurring on my premises.
• To coroners or medical examiners performing duties authorized by law.
• For research purposes, such as comparing outcomes of different forms of therapy for the same condition.
• For specialized government functions, including military missions, protection of the President, intelligence activities, and safety in correctional institutions.
• For workers’ compensation purposes, although I prefer to obtain your authorization.
• For appointment reminders and to tell you about treatment alternatives or other services I offer.

V. Uses and disclosures where you have the opportunity to object

Family, friends, or others. I may share your PHI with a family member, friend, or other person you indicate is involved in your care or payment for your care, unless you object in whole or in part. In an emergency, your consent may be obtained afterward.

VI. Your rights regarding your PHI

• Request limits on uses and disclosures. You may ask me not to use or disclose certain PHI for treatment, payment, or operations. I am not required to agree if I believe it would affect your care.
• Restrict disclosures for services you paid for in full. You may ask that I not disclose PHI to a health plan for payment or operations if it relates solely to a service you paid for out of pocket in full.
• Choose how I contact you. You may ask me to contact you in a specific way or at a different address, and I will agree to all reasonable requests.
• See and get copies of your PHI. Other than psychotherapy notes, you may get an electronic or paper copy of your record, or a summary if you agree, within 30 days of a written request. I may charge a reasonable, cost-based fee.
• Get a list of disclosures. You may request a list of disclosures made for purposes other than treatment, payment, operations, or those you authorized, covering up to six years. I will respond within 60 days. The first list each year is free.
• Correct or update your PHI. If you believe information is wrong or missing, you may ask me to correct or add to it. If I say no, I will explain why in writing within 60 days.
• Get a copy of this notice on paper or by email, at any time.

Complaints

If you believe your privacy rights have been violated, you may contact me at 646-775-8276, or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints. You will not be retaliated against for filing a complaint.

Effective date: [date]