Heart & Hope Counseling, LLC – Notice of Privacy Practices (NPP)

​

1. Purpose of This Notice

This notice explains how your protected health information (PHI) may be used or disclosed, your rights regarding that information, and my legal obligations under the Health Insurance Portability and Accountability Act (HIPAA) and Ohio law. Please review it carefully.

Protected Health Information (PHI) includes any information that identifies you and relates to:

• Your mental or physical health

• Services you receive

• Payment for services

PHI may exist in: written records, electronic records, or verbal communication.

2. My Commitment to Your Privacy

I am committed to protecting the confidentiality of your health information. I create and maintain records of the care and services you receive to provide quality care and meet legal requirements.

I am required by law to:

• Keep PHI that identifies you private.

• Provide you with this notice describing my legal duties and privacy practices.

• Follow the terms of the notice currently in effect.

I may update this notice. Any changes will apply to all PHI I maintain. Updated versions will be available upon request, in my office, and on my website.

3. How PHI May Be Used and Disclosed Without Your Authorization

A. Treatment, Payment, and Health Care Operations

Treatment: I may share PHI with other licensed providers involved in your care for coordination, consultation, or referral purposes. For example, consultation with another clinician about your condition to ensure quality care. Disclosures for treatment purposes are not limited to the minimum necessary standard because clinicians need full information to provide effective care.

Payment: PHI may be used to process billing, receive payment, or provide receipts/superbills for out-of-network insurance reimbursement.

Health Care Operations: PHI may be used for administrative, quality improvement, training, supervision, or practice management purposes.

B. Legal and Administrative Disclosures

PHI may be disclosed without your authorization when required or permitted by law:

• Lawsuits or legal proceedings: Court orders, subpoenas, or lawful processes (efforts made to notify you or obtain protective orders when possible).

• Public health activities: Reporting suspected child, elder, or vulnerable adult abuse; preventing or reducing serious threats to health or safety.

• Health oversight activities: Regulatory audits, inspections, or investigations.

• Law enforcement: Crimes on premises, court orders, or legal requirements.

• Coroners and medical examiners: Duties authorized by law.

• Specialized government functions: Military, intelligence, national security, or correctional institution safety.

• Workers’ compensation: As required by state law.

Appointment reminders and health-related benefits or services: PHI may be used to remind you of upcoming appointments or inform you of alternative treatment options or health services I offer.

4. Uses and Disclosures Requiring Your Written Authorization

I will obtain your written authorization for:

• Release of PHI to providers not involved in your care

• Sharing information with family members (unless otherwise legally permitted)

• Marketing or research purposes

• Release of psychotherapy notes

Psychotherapy Notes: These are maintained separately from your standard clinical record and may only be disclosed with a special authorization unless:

a. For my use in treating you
b. For training or supervision of mental health practitioners
c. To defend myself in legal proceedings initiated by you
d. Required by the Secretary of HHS to investigate HIPAA compliance
e. Required by law with limited scope
f. Required for certain health oversight activities
g. Required by coroners performing authorized duties
h. Necessary to prevent serious threats to health or safety

You may revoke authorization at any time in writing, except where action has already been taken in reliance on it.

5. Uses and Disclosures Where You May Object

I may share PHI with a family member, friend, or other individual involved in your care or payment unless you object in whole or in part. Retroactive consent may occur in emergencies.

6. Your Rights Regarding PHI

You have the right to:

1. Request limits on uses/disclosures: I may say no if it affects your care.

2. Request restrictions for out-of-pocket payments: If services were paid in full, you may limit disclosures to health plans.

3. Choose how PHI is communicated: E.g., email, phone, alternative address.

4. Access PHI: Review and obtain electronic or paper copies, excluding psychotherapy notes. I may provide summaries instead.

5. Amend PHI: Request corrections or additions; I will respond within 60 days in writing.

6. Accounting of disclosures: Request a list of PHI disclosures in the last six years, excluding TPO (treatment, payment, operations).

7. Paper copy of this notice: You may receive a printed copy at any time.

8. File a complaint: With me or the U.S. Department of Health & Human Services Office for Civil Rights without retaliation.

9. Revoke authorization: Withdraw permission for disclosures at any time in writing.

7. Telehealth Privacy

Telehealth is conducted using HIPAA-compliant platforms. While secure, risks include:

• Technology interruptions or failures

• Unauthorized access if devices are insecure

• Internet vulnerabilities

Client responsibilities:

• Attend sessions in private locations

• Use secure internet connections and personal devices

• Provide current physical location and emergency contact at the start of each session

Telehealth is not for emergencies. If you are in crisis, call 911, or use 988 (Suicide & Crisis Lifeline) or 741741 (Crisis Text Line).

8. Safeguards and Security

I use administrative, physical, and technical safeguards:

• Encrypted electronic records

• Password-protected systems

• Locked storage for paper records

• Limited staff access

• Secure disposal procedures

• Records retained per professional and state guidelines

If a breach occurs:

• I will investigate promptly

• Notify affected clients as required

• Take corrective action and document the incident

• Prevent future breaches

9. Changes to This Notice

I may revise privacy practices. Updated notices will be posted in the office and on my website.