This Notice of Privacy Practices (this “Notice”) is provided by Connor Adams, PsyD, owner of Palim Health (the “Practice,” Full Corporate Name: Inner Reflections, A Psychology Corporation) and your individual provider. Any questions related to this Notice may be directed to your provider.
My Duty Regarding Your Health Information: With limited exceptions, information about you and your health is confidential. Confidential information includes all individually identifiable information, whether in electronic or physical form, that is in the Practice’s possession or is derived from information you share in confidence with your provider regarding your past medical or mental health history, a current or potential future mental or physical health condition, your mental or physical health treatment, or payment for treatment. More specifically, the health information created and maintained by your provider relates to your participation in outpatient psychological treatment. All such information is “Confidential Information.” Your Confidential Information is sometimes referred to as “Protected Health Information” or “PHI.” Know that your provider is committed to protecting the privacy of this information. This notice tells you about some of the ways in which your provider may use and disclose health information about you, as well as certain obligations that your provider has regarding the use and disclosure of your health information. It also describes your rights regarding your health information.
Provider Responsibilities: Your provider’s responsible for safeguarding your health information. They are also required to give you this Notice and to follow the terms of the Notice that is currently in effect. Your provider will notify you if they become aware of any unauthorized access, use, or disclosure of your health information.
Changes to this Notice: Your provider reserves the right to change this Notice at any time and to make the revised or changed Notice effective for health information they already have about you, as well as any information they receive in the future. They are providing you with a copy of this Notice of Privacy Practices as part of your initial intake documentation, which may be made available through the Practice’s electronic record-keeping system.
How Your Provider Protects Your Confidential Information: The Practice will protect your Health Information by:
Treating all information about you that is collected as confidential. This means that with limited exceptions, as discussed below, your provider will not share your information with anyone without your consent or written authorization, and when they are either permitted or required to share your Confidential Information, whether with or without your written authorization, they will disclose only the minimum information necessary under the circumstances;
Restricting access to your Health Information to only those clinical staff (if any) who have a legitimate need for access in order for your provider to provide services to you;
Only disclosing when required or permitted, that information which is necessary under the circumstances;
Obtaining reasonable assurances in writing through a Business Associate Agreement with any outside services or other business associates that your provider may use to provide you with services or conduct necessary business operations; and
Maintaining physical, electronic, and procedural safeguards to comply with federal and state regulations guarding your Health Information. More specifically, the Practice maintains your health information in a HIPAA-compliant electronic health record (“EHR”) and is obligated to comply with state and federal laws that require the protection and security of patient information. These laws include California’s Confidentiality of Medical Information Act (“CMIA”), and the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations including the federal privacy, security and enforcement rules, the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) and its implementing regulations including the Breach Notification Rule, and the HIPAA Omnibus Rule of 2013 requiring Business Associates to comply with the Privacy and Security Rules, and making Business Associates liable for HIPAA violations. Business Associates are third parties who are not employees, contractors, or volunteers of the Practice but who are otherwise involved in the Practice’s provision of treatment or healthcare operations. “Business Associate” is explained more fully below.
How Your Provider May Use and Disclose Health Information About You: The following categories describe different ways in which your provider may use your health information or disclose your health information to other persons and entities. Not every use or disclosure in a category is listed. However, all of the ways in which they are permitted to use or disclose your health information fall within one of the following categories. If you have any specific concerns, please bring them to your provider’s attention, and they will be happy to discuss them with you.
Treatment: Your Confidential Information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment (1) This means, for example, that your Confidential Information may be shared and discussed with trainees and interns of the Practice (if any) who are involved in your treatment, or if you have a treating psychiatrist or other involved physician, information may be shared with them to coordinate care. However, as a practical matter, your provider will request an authorization from you in writing before disclosing your Confidential Information to any health care provider who is not associated with the Practice, or to any other third party, except as otherwise specified in this Notice. They may also disclose your health information to a family member, other relative, domestic partner or a close personal friend, or any other person identified by you, if the information is directly relevant to that person’s involvement with your care or payment related to your care, after obtaining your consent or providing you with the opportunity to object to the disclosure and you express no objection (2). Note that in the event of an emergency, your provider may disclose such information as they determine, based upon their professional judgment, to be in your best interest without obtaining your consent or providing you with the opportunity to object.
Payment: Your provider may use and disclose your health information to bill for services and to obtain payment, including, if necessary, reporting limited information to pursue collection through a collection agency. This means that if you direct them to bill an insurer or health plan (whether in- or out-of-network), or another third-party payer or guarantor, they may disclose the health information necessary to obtain payment. This may also include disclosing health information to obtain prior authorization for treatment. Your health information may also be disclosed in response to requests from your insurer, health plan, employee benefit plan, or any governmental authority responsible for paying for health care services provided to you, to the extent necessary to allow responsibility for payment to be determined. In such cases, you have a right to be provided with a copy of the request in writing within 30 days of the requester’s receipt of the information requested. Any information disclosed pursuant to this section will be limited to the minimum information necessary and generally includes the nature of the services provided, the dates of services, the amount due, and other relevant financial information. You should be aware that, should you choose to use your insurance company, health plan, or other third-party payer or guarantor to reimburse you for services, certain personal health information may be shared by them with the Medical Insurance Bureau (“MIB”), which may make your information available through the use of codes to its member insurers. You may request a copy of your MIB file at: https://www.mib.com/request_your_record.html or by calling 1-866-692-6901.
For Health Care Operations: Your provider may use or disclose your health information for health care operations. For example, they may use a billing service, technology support, document management services, storage providers, or other essential services. These uses and disclosures are necessary for the internal operation of the practice. When these operations involve third parties who are not employees of the Practice, they are called “Business Associates” (as discussed below), and the Practice enters into enforceable written agreements with them to protect your confidentiality.
Marketing. The Practice will not use or disclose your health information for marketing purposes or sell your health information for any reason.
Written Authorization Required: Generally, your provider is not permitted to use or disclose your health information without your written authorization, except where disclosure is required or permitted by law. The authorization must state what information can be released, to whom, and for what purpose. It must be dated. You have the right to refuse to consent to disclosure without fear of any pressure or retaliation. If you authorize your provider to use or disclose health information about you, you may limit the information to be used and/or disclosed, and you may revoke the authorization in writing at any time. You also have the right to revoke your written authorization by providing your provider with notice, except to the extent that they have already acted in reliance on your authorization.
Psychotherapy Notes. At your provider’s discretion, they may choose to keep psychotherapy notes in addition to your treatment record. Sometimes called “process notes”, psychotherapy notes refer to notes that are recorded (in any medium) by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of your diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date (3). To be considered “psychotherapy notes”, the notes must be kept separate from the treatment record. These notes are the personal notes of your provider and may capture their impressions about you, contain details of psychotherapy conversations considered to be inappropriate for the treatment record, and may be used by your provider for future sessions. It is because of the sensitivity of these notes that they are kept separate from your treatment record and not included in records that may be sent to insurers for payment.
Psychotherapy notes (if maintained) cannot be disclosed without your specific written authorization, including disclosure for treatment purposes to a health care provider, except where used by (i) the originator of the psychotherapy notes for treatment; (ii) the Practice for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; (iii) the Practice to defend itself in a legal action or other proceeding brought by or on behalf of the patient; or (iv) where otherwise required by law (4)
When Disclosure Is Required by Law: There are times when your provider is required by law to disclose certain Confidential Information about you, whether they want to or not. Some of the circumstances where disclosure is required by law are:
Where they reasonably suspect neglect or physical, emotional, or sexual abuse of a child, or neglect or physical, emotional, sexual, or financial abuse of a dependent adult or person 65 or older. You should know that sexual abuse of a child includes the creation of or streaming, downloading, storing, or transmitting electronic images sexually depicting a child. This law is implicated even when a minor creates, streams, stores, or transmits images of themselves, such as when sexting with a friend.
Where they have reason to suspect that you may present a danger to others. If they have reason to suspect that you are threatening serious bodily harm to another, they are required to take protective actions. These actions may include notifying the potential victim, contacting the police, or seeking hospitalization for you.
Where they have reason to suspect that you present a danger to yourself. If you threaten to harm yourself, they may be obligated to seek hospitalization for you or to contact family members or others who can help provide you with protection.
For Workers' Compensation to the extent necessary to comply with state workers' compensation laws governing job-related injuries or illnesses.
Upon a request by certain legal representatives on your behalf, such as a conservator who is authorized to access behavioral health records, or a person having durable powers of attorney for healthcare decisions under circumstances where you have been determined to lack the capacity to make healthcare decisions. Legal representatives also include, upon your death, any personal representative (as statutorily defined), executor, or administrator of your estate, or beneficiary, potentially including any person who may have a present or future interest under a trust. Note that the Confidential Information of a deceased person ceases to be “PHI” and loses its privacy protection 50 years from the date of a patient’s death.
When required by the Secretary of the Department of Health and Human Services or any of its offices, including the Office of Civil Rights, to investigate or determine the Practice’s compliance with HIPAA or any of its implementing regulations.
In response to a lawfully executed search warrant from a law enforcement agency.
In response to a request by a medical examiner, forensic pathologist, or coroner when requested for the purpose of identifying you or locating your next of kin, or when investigating your death if it involves a public health concern, organ or tissue donation, child abuse, elder abuse, suicide, poisoning, or an otherwise unknown or suspicious death, or when otherwise authorized by the decedent’s representative.
When Disclosure May Be Required: Some of the circumstances where disclosure may be required are:
Pursuant to a legal proceeding that is initiated by or brought against you. For example, if you place your mental status at issue in litigation, such as in a lawsuit seeking damages for severe emotional distress, the defendant may have the right to obtain your psychotherapy records and/or the testimony of your psychotherapist by issuing a subpoena. Your personal health information may then be shared with retained experts in the case and with other parties in the litigation. Potentially, that information may even be shared with a jury or other fact finder. Your provider will not release your protected health information in response to a subpoena without your written authorization, unless ordered to do so by a court order, except in cases where the records are sought for a workers’ comp determination or proceeding, and even then, such release of information shall be reasonably limited to only that information necessary for the determination or proceeding.
Certain proceedings follow the death of a patient. While a psychotherapist has a legal duty to protect PHI from disclosure by asserting the Psychotherapist-Patient privilege whenever the psychotherapist is present and a patient communication or other PHI is sought to be disclosed, (5) the privilege ceases to exist when the communication is relevant to an issue concerning the intention of a patient once deceased, with respect to legal proceedings pertaining to will or other writing executed by the patient, purporting to affect an interest in property,(6) or the validity of such a document, (7) or relevant to any issue being disputed between parties who claim a legal interest through the deceased patient such as through probate proceedings, or a challenge to a trust or will. (8)
For certain specialized governmental functions related to the military, national security, and intelligence. For example, if you are a member of the military, the disclosure of patient communications may be compelled in proceedings brought under the Uniform Code of Military Justice, 1) if the communication is evidence of child abuse or neglect, or in a proceeding in which one spouse is merely charged with a crime against a child of either spouse; or 2) if the communication reflects your intent to commit a future fraud or crime or if the services of the psychotherapist are sought to enable or aid anyone to commit or plan to commit what the patient knows or reasonably should know is a crime or fraud; or 3) when necessary to ensure the safety and security of military personnel, military dependents, military property, classified information or the accomplishment of a military mission. The Practice is not under the jurisdiction of the military and therefore will not voluntarily disclose such information, although you should know that disclosure may be compelled in a military proceeding. If any of the exceptions in this paragraph are of concern to you, you should discuss them with your provider.
Health oversight activities. While California law is more protective of your right to confidentiality than HIPAA, in that California law requires your written authorization for a licensing board to access your health records as part of any investigation into a complaint against a licensee, there may still be health oversight situations in which your information may be accessed without the need to first obtain your authorization. Health oversight agencies include federal, state, and local government agencies authorized by law to oversee the public and private healthcare systems or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant. Uses and disclosures for healthcare oversight must be limited to the minimum information necessary to accomplish the oversight objective. For example, the Department of Managed Health Care (“DMHC”) in California is a health oversight agency authorized to oversee HMOs and certain other health plans within the state. HIPAA permits covered health plans to disclose private health information to the DMHC for oversight activities including audits, civil, administrative or criminal investigations, inspections, and other activities necessary for the oversight of the healthcare system, government benefit programs, compliance with governmental regulation or compliance with civil rights laws. Health oversight investigators generally do not seek access to individual patient records, but instead review large numbers of records to determine whether a health care provider or organization may be violating the law. In the course of their efforts to protect the healthcare system, health oversight investigators may at times uncover evidence of wrongdoing unrelated to the healthcare system, such as evidence of criminal conduct by an individual who has sought health care. However, law enforcement may not use protected health information concerning an individual, discovered during the course of health oversight activities, for unrelated civil, administrative, or criminal investigations against that individual, unless the public interest and the need for disclosure clearly outweigh the potential for injury to the patient, to the psychotherapist-patient relationship, and to the treatment services.
Business Associates. Some Practice-related services are obtained through contracts with business associates. For example, your provider may contract with outside companies to provide legal, accounting, or billing services. When they contract with a business associate, they may disclose the health information necessary for the business associate to do the job they have asked it to do. To protect your health information, your provider will enter into “Business Associate” agreements with them to require them to appropriately safeguard your health information.
For Data Breach Notification Purposes. Your provider may use limited Confidential Information, such as your contact information, to provide legally required notices of unauthorized acquisition, access, or disclosure of your Confidential Information, if such were to occur. They may send notices directly to you or provide notice to the sponsor of a health plan through which you receive coverage.
Comply with the law. Your provider may disclose health information about you if otherwise required by state or federal laws.
Minors in Therapy: In the event that you are under 18 years of age, the law may grant your parents or guardians the right to obtain information about your treatment and/or examine your treatment records. It is the practice policy to request an agreement from your parents or guardians indicating that they consent to a waiver of access to such information and/or access to your records. If they agree, your provider will share only general information about your work together with them, subject to your approval. If your provider feels it is important for them to know something to ensure your safety and that of those around you, they will encourage you to share the information during a family session, or, with your permission, share it in the context of a scheduled session. However, if they think it is clinically necessary, your provider will involve them even without your permission if they have reason to believe that there is a risk of harm to you or others or if another is harming you in any way.
Emergencies: Confidential treatment information may also be disclosed in the rare event of a medical or psychological emergency, meaning a sudden change in condition that may result in physical or psychological harm to you if left untreated.
Your Rights Regarding Medical Information About You: You have the following rights regarding medical information that the practice maintains about you:
To obtain a copy of the Notice of Privacy Practices.
To request a restriction on certain uses and disclosures of your information. This request must be in writing.
To inspect and request a copy of your health record, other than psychotherapy notes, so long as the record is maintained (9). Your request must be in writing and specify the records to be copied. Upon receipt of your request, together with any required fee to defray the costs of producing the copies, your provider must ensure that the copies are transmitted within 15 days of receiving the request (10). The following are some important exceptions:
1) The representative of a minor is not entitled to inspect or obtain copies of the minor’s patient records either i) with respect to which the minor has the right of inspection; or ii) where the health care provider determines that access to the patient records requested by the representative would have a detrimental effect on the provider’s professional relationship with the minor patient or the minor’s physical safety or psychological well-being (11).
2) A health care provider may deny a request by a patient where the provider determines there is a substantial risk of significant adverse or detrimental consequences to the patient in seeing or receiving a copy of the mental health records requested by the patient. However, the health care provider shall (i) make a written record, to be included with the mental health records requested, noting the date of the request and explaining the health care provider’s reason for refusing to permit inspection or provide copies of the records, including a description of the specific adverse or detrimental consequences to the patient that the provider anticipates would occur if inspection or copying were permitted; and (ii) permit inspection by, or provide copies of the mental health records to, a licensed physician and surgeon, licensed psychologist, licensed marriage and family therapist, licensed clinical social worker, or licensed professional clinical counselor, designated by request of the patient (12).
3) Your health care provider may confer with you in an attempt to clarify your purpose in obtaining a copy of your record and may choose to prepare a summary. If they choose to prepare a summary rather than allow access to the entire record, they will make the summary available to you within 10 working days of your request. If more time is needed, such as because of the length of the record or because you were discharged from a licensed health facility within the 10 days preceding your request, your provider will notify you and provide the date it will be completed. In no case may more than 30 days elapse between the date of your request and the delivery of the summary (13).
To request an amendment to your health record if you feel the information is incorrect or incomplete. Your request must be made in writing, and it must include a reason that supports the request.
To obtain an accounting of disclosures to others of your health information. The accounting will provide information about disclosures made for purposes other than treatment, payment, health care operations, disclosures required by law, or those you have authorized.
To request confidential communications. You have the right to request that your provider communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that they contact you only at work or via a specific email address. Your request must be in writing and specify the exact changes you are requesting.
To revoke your authorization. You have the right to revoke your authorization for the use or disclosure of your health information, except to the extent that action has already been taken.
To choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. Your provider will make sure the person has this authority and can act for you before they take any action.
Complain about any aspect of my health information practices to the United States Department of Health and Human Services without fear of retaliation. Complaints should be in writing and may be directed to: Connor Adams, PsyD 650-629-1989 connoradams@palimhealth.com OR: Office for Civil Rights, Region IX U.S. Department of Health and Human Services 90 7th St., Ste. 4-100 San Francisco, CA 94103 (Physical) Customer Response Center: (800) 368-1019 Fax: (202) 619-3818 TDD: (800) 537-7697 Email: ocrmail@hhs.gov
1 Cal. Civil Code section 56.10(c)(1); 56.104(e)
2 Cal. Civil Code section 56.1007
3 45 CFR 501.164.
4 45 CFR 164.508(a)(2).
5 Cal. Evid. Code § 1015.
6 Cal. Evid. Code § 1021.
7 Cal. Evid. Code § 1022
8 Cal. Evid. Code § 1019
9 45 CFR 164.5249(a).
10 Health & Saf. Code §123110(b)
11 Health & Saf. Code §123115(a).
12 Health & Saf. Code §123115(b).
13 Health & Saf. Code §123130.