HIPAA Notice of Privacy Practices
Wingspan Neuro-Affirming Care, PLLC (the “Practice”) is committed to protecting your privacy. The Practice is required by federal law to maintain the privacy of Protected Health Information (“PHI”), which is information that identifies or could be used to identify you. The Practice is required to provide you with this Notice of Privacy Practices (this “Notice”), which explains the Practice's legal duties and privacy practices and your rights regarding PHI that we collect and maintain.
The law requires that I obtain your signature acknowledging that I have provided you with this; this has been requested of you in your client portal. If you had any questions, it was your right to ask before you signed this document.
Personal Health Information (PHI)
We understand that health information about you and your health care is personal. We are committed to protecting health information about you.
We create a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by this mental health care practice. This notice will tell you about the ways in which we may use and disclose health information about you. We also describe your rights to the health information we keep about you, and describe certain obligations we have regarding the use and disclosure of your health information. We are required by law to:
Make sure that PHI that identifies you is kept private.
Give you this notice of our legal duties and privacy practices with respect to PHI.
Follow the terms of the notice that is currently in effect.
Limits on Confidentiality
The law protects the privacy of all communication between a client and a therapist. In most situations, I can only release information about your treatment to others if you sign a release of information form. There are some situations where I am permitted or required to disclose information without either your consent or authorization. If such a situation arises, I will limit my disclosure to what is necessary. Reasons I may have to release your information without authorization:
1. If you are involved in a court proceeding and a request is made for information concerning your diagnosis and treatment, such information is protected by the therapist-patient privilege law. I cannot provide any information without your (or your legal representative's) written authorization or a court order, or if I receive a subpoena. If you are involved in or contemplating litigation, you should consult with an attorney to determine whether a court would be likely to order me to disclose information.
2. If a government agency is requesting the information for health oversight activities, within its appropriate legal authority, I may be required to provide it for them.
3. If a client files a complaint or lawsuit against me, I may disclose relevant information regarding that client in order to defend myself.
4. If a client files a worker's compensation claim, and I am providing necessary treatment related to that claim, I must, upon appropriate request, submit treatment reports to the appropriate parties, including the client’s employer, the insurance carrier or an authorized qualified rehabilitation provider.
5. I may disclose the minimum necessary health information to my business associates (e.g., Carepatron, Google Workspace, Doxy.Me, Spruce Health, etc.) that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. My business associates sign agreements to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
There are some situations in which I am legally obligated to take actions that I believe are necessary to attempt to protect others from harm, and I may have to reveal some information about a client’s treatment:
1. If I know, or have reason to suspect, that a child under 18 has been abused, abandoned, or neglected by a parent, legal guardian, caregiver, or any other person responsible for the child's welfare, the law requires that I file a report with the Virginia Department of Social Services. Once such a report is filed, I may be required to provide additional information.
2. If I know or have reasonable cause to suspect that a vulnerable adult has been abused, neglected, or exploited, the law requires that I file a report with the Virginia Department of Social Services. Once such a report is filed, I may be required to provide additional information.
3. If I believe that there is a clear and immediate probability of physical harm to the client, to other individuals, or to society, I may be required to disclose information to take protective action, including communicating the information to the potential victim and/or an appropriate family member and/or crisis services, and/or seek hospitalization of the client.
Your signed Informed Consent also outlines confidentiality and its limitations.
Client Rights and Therapist Duties
Use and Disclosure of Protected Health Information:
For Treatment – I use and disclose your health information internally in the course of your treatment. If I wish to provide information outside of my practice for your treatment by another health care provider, I will have you sign a release of information form. Furthermore, a release of information form is required for most uses and disclosures of psychotherapy notes.
For Payment – I may use and disclose your health information to obtain payment for services provided to you as delineated in the Client Financial Responsibility Form.
For Operations – I may use and disclose your health information as part of our internal operations. For example, this could mean a review of records to assure quality. I may also use your information to tell you about services, educational activities, programs, and other resources that I feel might be of interest to you.
Patient's Rights:
Right to Treatment – You have the right to ethical treatment without discrimination regarding race, ethnicity, gender identity, sexual orientation, religion, disability status, age, or any other protected category.
Right to Confidentiality – You have the right to have your health care information protected. If you pay for a service or health care item out-of-pocket in full, you can ask me not to share that information for the purpose of payment or our operations with your health insurer. I will agree to such unless a law requires me to share that information.
Right to Request Restrictions – You have the right to request restrictions on certain uses and disclosures of PHI about you. However, I am not required to agree to a restriction you request.
Right to Receive Confidential Communications by Alternative Means and at Alternative Locations – You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations.
Right to Inspect and Copy – You have the right to inspect or obtain a copy (or both) of PHI. Records must be requested in writing and a release of information form must be completed. This will follow what is outlined in the Requests of Records and Additional Documentation section of our Informed Consent. If I refuse your request for access to your records, you have a right of review, which I will discuss with you upon request.
Right to Amend – If you believe the information in your records is incorrect and/or missing important information, you can ask me to make certain changes, also known as amending, to your health information. You have to make this request in writing. You must tell me the reasons you want to make these changes, and I will decide if it can be changed. If I refuse to make changes, I will tell you why within 60 days.
Right to a Copy of This Notice – Since you received this paperwork electronically, you have a digital copy. An additional copy can be provided to you per your request at any time.
Right to an Accounting – You generally have the right to receive an accounting of disclosures of PHI regarding you. On your request, I will discuss with you the details of the accounting process.
Right to Choose Someone to Act for You – If someone is your legal guardian, that person can exercise your rights and make choices about your health information; I will make sure the person has this authority and can act for you before I take any action.
Right to Choose – You have the right to decide not to receive services with me. If you wish, I will provide you with names of other qualified professionals.
Right to Terminate – You have the right to terminate therapeutic services with me at any time without any legal or financial obligations other than those already accrued and in alignment with what is outlined in our Client Financial Responsibility Form. I ask that you discuss your decision with me in session before terminating or at least contact me to let me know you are terminating services, but you are not required to do so.
Right to Release Information with Written Consent – With your written consent, any part of your record can be released to any person or agency you designate. Together, we will discuss whether or not I think releasing the information in question to that person or agency might be harmful to you.
Therapist’s Duties:
I am required by law to maintain the privacy of PHI and to provide you with a notice of my legal duties and privacy practices with respect to PHI. I reserve the right to change the privacy policies and practices described in this notice. Unless I notify you of such changes, however, I am required to abide by the terms currently in effect. If I revise my policies and procedures, I will provide you with a revised notice, and/or I will post a revised notice in my office and/or on my website.
Complaints
If you are concerned that I have violated your privacy rights, or you disagree with a decision I made about access to your records, you may contact me, the Virginia Department of Health, or the Secretary of the U.S. Department of Health and Human Services at 1-877-696-6775 or by visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. I will not retaliate against you for filing a complaint.
Consent
Your signature on the electronic form in your portal indicated that you read this agreement and agreed to its terms and also served as an acknowledgement that you have received the HIPAA Notice of Privacy Practices described above.
For more information, please see: https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html. This notice was updated on July 7, 2025. If you have any questions, please contact Kat O’Donnell at kat@wingspan.care or (804) 534-2954.