Notice of Privacy Practices.

Pacific Mental Health Services (PMHS) is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, to maintain the privacy and security of your protected health information (PHI). We are required to provide you with this Notice of Privacy Practices and to abide by its terms.

When we use or disclose your PHI, we make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, except when providing treatment, when you have authorized the disclosure, or when otherwise required by law.

PMHS also complies with the California Confidentiality of Medical Information Act (CMIA), California Civil Code § 56 et seq., which provides additional protections for California patients beyond those required by federal law.

We reserve the right to change the terms of this Notice and to make the revised notice effective for PHI we already have about you, as well as any PHI we receive in the future. The current Notice will be posted on our website and is available upon request.

Protected Health Information (PHI) includes any information that identifies you and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or the past, present, or future payment for health care. This includes information in any form, written, electronic, or oral.

Examples of PHI include your name, date of birth, diagnosis, treatment notes, session dates, billing records, and any other information linked to your identity and health.

We use and disclose PHI for the following purposes without requiring your authorization:

We may use your PHI to provide, coordinate, and manage your mental health treatment. This includes sharing information with other treating providers involved in your care (e.g., your primary care physician, psychiatrist) with your consent.

We may use and disclose your PHI to obtain payment for services rendered, including submitting claims to your insurance company, verifying eligibility, and processing payments. This may require disclosure of your diagnosis, treatment dates, and CPT billing codes.

We may use your PHI for internal business activities including quality assessment, clinical supervision, training of associate clinicians, compliance reviews, and business planning. Disclosures for supervision purposes are made only as necessary and to licensed individuals who are bound by confidentiality obligations.

We may disclose your PHI when required to do so by law, including in response to a valid court order, subpoena, or as required by California mandatory reporting statutes.

We may disclose PHI to public health authorities for activities such as preventing or controlling disease, injury, or disability, or as required by law.

We may use or disclose PHI if we believe in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of another person or the public, consistent with California’s duty-to-protect laws (Tarasoff v. Regents of the University of California).

Except as described above, we will not use or disclose your PHI without your written authorization. Situations that require your authorization include:

• Most disclosures of PHI to third parties, including family members, employers, or other individuals not involved in your treatment.
• Marketing communications that use your PHI.
• Sale of your PHI.
• Psychotherapy notes, notes that document or analyze the contents of a counseling session, are given heightened protection under HIPAA and California law and require a separate specific authorization for release.
• Substance use disorder records, if applicable, are protected under 42 CFR Part 2 and require a specific authorization that complies with federal confidentiality regulations.

You may revoke any authorization you have given us at any time in writing, except to the extent that we have already taken action in reliance upon it.

You have the right to inspect and obtain a copy of your PHI that is contained in a designated record set, which typically includes your treatment records and billing information. Requests must be made in writing. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies. Certain records, such as psychotherapy notes or information compiled in anticipation of litigation, may be excluded. If your records are maintained electronically, you have the right to receive a copy in electronic form, and you may direct that an electronic copy be sent directly to a third party of your choosing.

You have the right to request that we amend PHI that you believe is inaccurate or incomplete. Requests must be submitted in writing with an explanation. We may deny your request if we determine that the information is accurate and complete. If denied, you have the right to submit a written statement of disagreement.

You have the right to request an accounting of certain disclosures of your PHI made in the six years prior to your request. This right does not apply to disclosures made for treatment, payment, or health care operations, or disclosures made with your authorization.

You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request, except in limited circumstances (e.g., if you pay out-of-pocket in full and request that we not disclose information to your health plan). Any agreement we make will be in writing.

You have the right to request that we communicate with you about your PHI in a specific way or at a specific location (e.g., only by email or at a particular phone number). We will accommodate reasonable requests.

You have the right to receive a paper copy of this Notice upon request. Please contact us using the information below.

You have the right to be notified following a breach of your unsecured PHI in accordance with HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414), the California Confidentiality of Medical Information Act (Civil Code § 56.36), and California's data breach notification law (Civil Code § 1798.82).

PMHS uses SimplePractice as our electronic health record (EHR) and practice management platform. SimplePractice is a HIPAA-compliant system that encrypts all stored and transmitted PHI. Our Business Associate Agreement (BAA) with SimplePractice is on file.

Telehealth sessions are conducted via Doxy.me, a HIPAA-compliant video platform that does not require session recording by default. Video sessions are encrypted end-to-end. No session is recorded without your explicit written consent.

Despite these safeguards, telehealth carries inherent risks including potential interception over unsecured networks and the presence of others in your physical environment. By participating in telehealth, you acknowledge these limitations.

California law provides specific protections for minors in certain circumstances. Under California Health & Safety Code § 124260 and Family Code § 6924, minors 12 years of age and older may consent to certain mental health services without parental consent, and in those circumstances, the minor’s records related to those services are confidential from parents or guardians.

PMHS will discuss the applicable limits of minor confidentiality at intake and document agreed-upon communication arrangements with the minor and their parent or guardian in the Informed Consent Agreement.

If you believe your privacy rights have been violated, you have the right to file a complaint with PMHS or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). You will not be penalized or retaliated against for filing a complaint.

For questions about this Notice or to exercise any of your rights described above, please contact:

This Notice is effective as of January 1, 2024 and supersedes all prior versions. PMHS is required to abide by the terms of the Notice currently in effect. We reserve the right to change this Notice and to make the changed Notice effective for PHI we already have, as well as any PHI we receive in the future. The most current version of this Notice will always be available on our website.