HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL/MENTAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Introduction

I take the privacy of your health and personal information extremely seriously. Almost every contact you have with a medical or mental-health professional involves communicating information related to your health. This might be something you describe, a diagnostic impression, or even just your phone number. I need to record this information to provide you with good care, and it is my responsibility to keep it private and confidential.

All of your information is protected under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other laws. Like most other mental-health professionals, I maintain even stricter standards of privacy than these laws require. This notice describes ways in which I may use your information, circumstances under which I may disclose it, what my obligations are in handling it, and what your rights are. My most current policy is always available on my Web site at www.drstuartandrews.com. If at any time you want a paper copy of this policy, please tell me and I will provide it for you.

In addition to keeping your information confidential, I have a responsibility to communicate with you in ways that maintain your privacy. Please be sure to tell me if there are addresses, phone numbers, or e-mail addresses you have provided to me that you do not want me to use for conversations, messages, etc.

Because mental-health treatment involves information that is often more personal and sensitive than general medical information, psychotherapy notes are kept separate from the medical record and receive an even higher level of privacy protection under HIPAA. The medical record includes information such as the initial evaluation, subsequent information about symptoms and functioning, and information (as applicable) about medical problems, medications, and side effects. It also includes information about life circumstances as they relate to any of those matters. The psychotherapy notes include information beyond what is necessary in the medical record, including feelings, thoughts, worries, and more intimate details of personal circumstances.

How I Use and Disclose Your Health Information

I routinely use your health information for the following purposes: 1) Treatment: I use your health information for diagnosis, treatment planning, and the treatment itself. As part of that process, I may provide information to other professionals and their staff, e.g., mental health professionals who cover for me when I am on vacation, and any person or organization with whom I share your information is also bound by the terms of HIPAA; 2) Health Care Operations: I use your information for administrative purposes, e.g., to contact you about appointment scheduling; 3) Payment: I use your information for billing and collection of payment for the services I provide you. If you wish to use insurance, you will need to sign a consent form that permits me to share any necessary information with my billing service and your insurance provider(s), all of whom are also bound by the terms of HIPAA. This information generally includes a diagnosis code, and may include information about symptoms, functional status, risk behaviors, etc.

Subject to professional judgment, I may also use or disclose a patient’s information in the following exceptional circumstances, without additional authorization: 1) In an emergency, I will disclose information when necessary to prevent a serious threat to a patient’s health and safety, or the health and safety of the public or another person; 2) I can disclose information, subject to all applicable legal requirements, when required by law, subpoena, court order, etc. — for example, as a psychologist, I am a mandated reporter of child abuse; 3) I can use a patient’s information to defend myself in the event of legal proceedings against me brought by that patient. In all of the above situations, I will try to disclose the minimum amount of information necessary to the situation at hand. Every other use of your health information requires a specific authorization, signed by you. After you give such an authorization, you can prevent further disclosures at any time by giving me a written request revoking the authorization. The revocation does not affect any action taken prior to its receipt.

Your Rights Regarding Your Health Information

Under HIPAA, you have the following rights regarding health information I maintain about you:

Right to Inspect and Copy: You have the right to inspect and copy your health information, such as medical and billing records. You do not have the right to inspect and copy psychotherapy notes, though I will attempt to accommodate such a request subject to my professional judgment. You do not have the right to inspect or copy information compiled by me in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

Right to an Accounting of Disclosures: You have the right to a list of the disclosures I have made of clinical information about you for purposes other than treatment, payment, and health-care operations.

Right to Request Restrictions: You have the right to request a restriction or limitation on the health information I use or disclose about you for treatment, payment, or health-care operations. You also have the right to request a limit on the health information I disclose about you to someone who is involved in your care or the payment for it. Although I am not required under HIPAA to agree to all such requests, I am generally able to do so, except in cases where emergency treatment demands otherwise.

Right to Amend: If you believe that clinical or billing information I have about you is incorrect or incomplete, you can request that I change the information. If I accept the request, I will make reasonable efforts to inform others of the correction, as appropriate. If I deny the request, I will provide you with an explanation, and you may respond with a statement of disagreement that will be added to the information you wanted changed.

Electronic Communication

E-mail and Text

I recommend that we communicate in-person or via telephone, because e-mail and text communication are inherently insecure. At the same time, HIPAA requires me to make your health information available to you (see "Right to Inspect and Copy" under "Your Rights Regarding Your Health Information," above). Therefore, if you request, I may be willing to communicate with you via e-mail or text, after you have read the following regarding the risks and have given your informed consent:

You should not use an e-mail account or a phone provided by your employer to communicate with me. The employer has complete rights to all communications sent through such employer-provided services. Even appointment scheduling may be sensitive: You may not want everyone who has access to the employer's e-mail and phone systems to know you are seeing a therapist.
When using your own private e-mail or text-capable phone, be aware that it's possible those messages could be accessed by people working for the e-mail or phone company; they could be accidentally misdirected or forwarded to the wrong person, including by automated methods (e.g., an incorrectly configured forwarding rule); they may be seen by anyone with access to your e-mail account (e.g., a spouse); they may be stored for an extended period of time on computers owned by the e-mail service provider or by any Internet service providers involved in messages transmitted between you and me; they could be accessed by hackers (especially when using public WiFi, such as provided at cafés, or when a hacker steals or guesses your account password). Someone could see the message on your screen over your shoulder or when you step away from the device, or see a notification displayed on your phone's lock screen. Anyone who uses your phone or computer might see it.
E-mails and texts may be considered part of your health records, and I may store them as such.
While I will endeavor to respond promptly, it may take up to 48 business hours (Monday–Friday excluding holidays) for me to reply to an e-mail or text message. For urgent matters, a phone call is preferred. My time spent on electronic communications is subject to the same fees as telephone communications.

Social Media

I do not communicate with or about clients or former clients using social media, including via direct messaging (txt or sms), nor do I accept "friend" or "connection" requests. It is very difficult, perhaps impossible, to ensure that such communications won't be seen by unwanted readers, and it may raise privacy concerns for other potential or actual clients. Some business review sites allow anyone to create a page or post about a business or service provider. While I cannot control such posts, I recommend that any clients wishing to post public reviews of therapists do so anonymously.

Information Collected via This Web Site

Personally identifiable information is collected by this Web site whenever a user submits such information via the Contact form on the home page. The information provided using that form, is sent to me via e-mail, which is not a secure method of transmitting personal health information. That form and my e-mail address are intended for use only by people interested in beginning a therapeutic relationship with me; to protect confidentiality, e-mail should not be used by present or past clients, who are encouraged to contact me via telephone instead. The service hosting this Web site, Wix, collects non-personally-identifiable information such as the type of browser and computer being used to access the site, in order to provide its services (for example, to send a version of the Web site that will work well on the particular device being used to view it). This site is intended for use in the United States only.

If you have any questions, comments, or concerns about my privacy practices, please speak to me, or contact me by mail, telephone, or e-mail as listed below, or via the contact form on the home page of this Web site. If you are not satisfied by my response to a complaint, you can also contact the Department of Health and Human Services (www.hhs.gov/ocr). HIPAA specifically forbids any sort of penalty for filing a complaint.

Updated September 15, 2018