HIPAA NOTICE OF PRIVACY PRACTICES

1. ADMINISTRATIVE CONTEXT STATEMENT

This page provides a factual notice regarding privacy practices for protected health information connected to clinical services provided by Rebecca S. de Vries, Ph.D., LPC. It is provided to support practice transparency, assist in administrative verification, and explain how protected health information may be used and disclosed.
The active clinical authority for all psychotherapeutic services described on this website is the Pennsylvania Licensed Professional Counselor (LPC) credential.
The Ph.D. reflects academic and research background. It does not indicate psychologist licensure and does not mean this practice provides psychological testing, psychological evaluations, school psychology services, forensic evaluations, disability evaluations, ADHD testing, autism testing, or educational assessment services.

1. PURPOSE OF THIS NOTICE

This notice describes how protected health information may be used and disclosed and how a client may access this information.
Protected health information means individually identifiable health information maintained or transmitted in connection with clinical care, payment, or health care operations.
This notice applies to clinical privacy practices. It is separate from the Website Privacy & Use Notice, which addresses public website use, cookies, analytics, and website-contact boundaries.

1. PRACTICE RESPONSIBILITIES

This practice is required to maintain the privacy of protected health information, provide notice of privacy practices, follow the terms of the notice currently in effect, and notify affected individuals when required by law if a breach compromises the privacy or security of protected health information.
This practice may update this notice when legally or operationally necessary. Any updated version applies to protected health information maintained by the practice.

1. USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

Protected health information may be used or disclosed for treatment, payment, and health care operations when permitted by applicable law.
Treatment may include use or disclosure of protected health information to provide, coordinate, or manage clinical care.
Payment may include use or disclosure of protected health information to bill for services, process insurance claims, determine benefits, obtain payment, or respond to payer-related administrative requirements.
Health care operations may include activities necessary to operate the practice, such as documentation, quality review, compliance, professional consultation, credentialing, billing administration, record maintenance, secure electronic health record operations, and other administrative functions permitted by law.

1. USES AND DISCLOSURES THAT MAY OCCUR WITHOUT WRITTEN AUTHORIZATION

Protected health information may be used or disclosed without written authorization when permitted or required by law.
Such uses or disclosures may include:

1. When required by law
2. For public health activities when applicable
3. To report abuse, neglect, or domestic violence when required or permitted by law
4. For health oversight activities
5. For judicial or administrative proceedings when legally required
6. For law-enforcement purposes when legally required or permitted
7. To prevent or reduce a serious and imminent threat to health or safety
8. For workers’ compensation or similar programs when applicable
9. For other uses or disclosures specifically permitted by federal or state law
10. CONFIDENTIALITY EXCEPTIONS

Clinical confidentiality has legal limits.
Protected health information may be disclosed when required or permitted by law, including circumstances involving:

1. Serious and imminent risk of harm to self
2. Serious and imminent risk of harm to another person
3. Suspected abuse, neglect, or exploitation when reporting is legally required or permitted
4. Court order, subpoena, or other legally enforceable process
5. Health oversight or licensing-board requirements
6. Other circumstances where disclosure is required by federal or Pennsylvania law
7. USES AND DISCLOSURES REQUIRING WRITTEN AUTHORIZATION

Uses or disclosures not otherwise permitted or required by law generally require written authorization.
Written authorization is generally required for:

1. Use or disclosure of psychotherapy notes when applicable, except in limited circumstances permitted by law
2. Marketing communications when authorization is required by law
3. Sale of protected health information when authorization is required by law
4. Release of records to a person or organization not otherwise authorized to receive them
5. Any other use or disclosure requiring authorization under HIPAA or applicable law

A written authorization may be revoked in writing, except to the extent that the practice has already acted in reliance on that authorization.

1. CLIENT RIGHTS REGARDING PROTECTED HEALTH INFORMATION

A client has privacy rights regarding protected health information, subject to legal requirements and limitations.
These rights may include:

1. The right to request access to inspect or obtain a copy of protected health information
2. The right to request an amendment to protected health information
3. The right to request an accounting of certain disclosures
4. The right to request restrictions on certain uses or disclosures
5. The right to request confidential communications by a specific method or at a specific location
6. The right to receive a copy of this Notice of Privacy Practices
7. The right to file a privacy complaint without retaliation
8. REQUESTS FOR RECORDS

Requests for records must be made through the practice’s designated administrative process.
Record access may be subject to legal limits, identity verification, timing requirements, and applicable administrative procedures. Some information may be treated differently under federal or state law, including psychotherapy notes where applicable.

1. REQUESTS TO AMEND RECORDS

A client may request that protected health information be amended if the client believes the information is incorrect or incomplete.
The practice may approve or deny an amendment request as permitted by law. If a request is denied, the client may have additional rights to submit a written statement of disagreement, subject to applicable legal requirements.

1. REQUESTS FOR RESTRICTIONS

A client may request restrictions on certain uses or disclosures of protected health information.
The practice is not required to agree to every requested restriction except where HIPAA requires agreement, such as certain restrictions related to disclosure to a health plan when the individual has paid out of pocket in full for the health care item or service and the disclosure is for payment or health care operations.

1. CONFIDENTIAL COMMUNICATIONS

A client may request that communications occur by a specific method or at a specific location.
The practice may require that the request be made in writing and may require information needed to carry out the request.

1. COMPLAINTS

A client may file a complaint if the client believes privacy rights have been violated.
Complaints may be submitted to the practice through the designated practice contact process. A complaint may also be submitted to the U.S. Department of Health and Human Services Office for Civil Rights.
The practice will not retaliate against a client for filing a privacy complaint.

1. TELEHEALTH AND ELECTRONIC HEALTH RECORD OPERATIONS

This practice uses TherapyNotes and TherapyPortal to support clinical documentation, administrative workflow, telehealth access, and payment-related workflow.
Electronic systems are used to support clinical and administrative operations. No technology system can guarantee absolute privacy or eliminate every risk.
Clients are responsible for participating in telehealth sessions from a private location and using reasonable steps to protect privacy on their own devices and networks.

1. WEBSITE PRIVACY SEPARATION

This HIPAA Notice of Privacy Practices applies to protected health information connected to clinical services.
It does not replace the Website Privacy & Use Notice.
The Website Privacy & Use Notice addresses public website use, general website contact, cookies, analytics, and the boundary that browsing the website or submitting a website form does not create a counselor-client relationship.

1. SCOPE AND SERVICE LIMITATIONS

This HIPAA privacy notice applies to protected health information connected to individual online outpatient psychotherapy provided to adults physically located in Pennsylvania at the time of service under the authority of the Pennsylvania Licensed Professional Counselor (LPC) license.
This practice does not provide:

1. In-person therapy
2. Walk-in appointments
3. Hybrid in-person and telehealth care
4. Therapy for children or adolescents under age 18
5. Couples therapy
6. Family therapy
7. Group therapy
8. Psychological testing
9. Psychological evaluations
10. Psychoeducational evaluations
11. ADHD assessments
12. Autism assessments
13. School psychology services
14. Educational evaluations
15. Forensic, custody, disability, or court-related evaluations or reports
16. Medication management
17. Psychiatric prescribing
18. Crisis response or emergency intervention services
19. Coaching or consulting services
20. Psychotherapy services for clients located outside Pennsylvania at the time of service
21. EXTERNAL INFORMATION LINK

General information about HIPAA privacy rights and Notices of Privacy Practices is available from the U.S. Department of Health and Human Services:
https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html

1. CLOSING ADMINISTRATIVE STATEMENT

This notice is provided for clinical privacy transparency. Current services remain limited to scheduled individual online outpatient psychotherapy for adults physically located in Pennsylvania, provided under the Pennsylvania Licensed Professional Counselor credential.