This notice describes how medical and mental-health information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
Who this notice applies to
This notice applies to the private-practice services of Rocky (an associate therapist) at Rocky Ridge Counseling, practicing under the clinical supervision of [TODO_ROCKY_INPUT — supervisor full name + credentials, e.g. “Jane Doe, LMFT #12345”] in [TODO_ROCKY_INPUT — state and, if applicable, licensure board name, e.g. “the State of California, regulated by the California Board of Behavioral Sciences”].
The federal Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Part 164, requires that Protected Health Information (PHI) — information that could identify you and relates to your past, present, or future physical or mental health — be kept private.
How Rocky may use and disclose your health information
Rocky may use or disclose PHI about you, without your separate authorization, in the following categories:
- Treatment. Coordinating your care with other providers you authorize (prescriber, primary-care physician, previous therapist). This includes brief progress notes shared with the supervisor as part of Rocky’s pre-licensure clinical supervision, which is a required structural safeguard for associate-level practice.
- Payment. Processing payment for sessions — for example, providing a superbill you can submit to your insurer for reimbursement, or responding to your insurer’s coverage questions if you authorize out-of-network billing.
- Health-care operations. Activities needed to run the practice: scheduling, quality improvement, consultation with the clinical supervisor, contacting you about your own appointments.
- Required by law. When a law compels disclosure — for example, mandatory reporting of child abuse, elder abuse, or imminent threat of serious harm to self or others, or when a court issues a valid subpoena. The law requires these disclosures; Rocky does not choose them.
- Public-health activities. Reports to public-health authorities when required (e.g., reporting communicable disease).
- Health oversight. Audits or investigations by licensing bodies or federal/state health-oversight agencies.
- Business associates. Third-party services that handle PHI on Rocky’s behalf (e.g., practice-management software, electronic-intake-form vendor) are bound by Business Associate Agreements requiring them to protect PHI under the same rules. The public-facing website at rockyridgecounseling.com does not collect PHI and therefore does not invoke a BAA; clinical intake happens privately after the free consultation call.
Uses and disclosures beyond the categories above require your signed authorization. You may revoke that authorization at any time in writing, except to the extent Rocky has already relied on it.
Your rights
You have the following rights regarding your health information. To exercise any of them, put the request in writing and send it to the Contact address at the bottom of this page.
- Access. You may request to inspect and receive a copy of your clinical record. Rocky will respond within 30 days. Psychotherapy notes held separately from the medical record may be withheld per 45 CFR § 164.524(a)(1)(i).
- Amendment. If you believe something in your record is incorrect or incomplete, you may request an amendment. Rocky may deny the request for specific reasons defined in 45 CFR § 164.526; if denied, you may submit a statement of disagreement that becomes part of your record.
- Accounting of disclosures. You may request a list of disclosures Rocky has made of your PHI for purposes other than treatment, payment, or health-care operations, for up to the prior six years.
- Restrictions. You may request that Rocky restrict certain uses or disclosures. Rocky is not obligated to agree to every restriction but will consider each request in good faith. If you pay out-of-pocket in full for a service, Rocky must honor a request to not disclose that service to your health insurer.
- Confidential communications. You may request that communications about your care come through a specific channel (e.g., only by phone, never email) or at a specific location. Rocky will accommodate reasonable requests.
- Paper copy of this notice. You have the right to a paper copy of this notice on request, even if you already received it electronically.
- Complaints. If you believe your privacy rights have been violated, you may complain to Rocky directly at the contact below, or to the federal Department of Health & Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/. You will not be retaliated against for filing a complaint.
State-specific complaint routes may also be available through [TODO_ROCKY_INPUT — state licensing board name + website, e.g. “the California Board of Behavioral Sciences at www.bbs.ca.gov”].
Rocky’s duties
Rocky is required by law to:
- Maintain the privacy of your Protected Health Information.
- Provide you with this notice of his legal duties and privacy practices.
- Follow the terms of the current notice in effect.
- Notify you if a breach of your unsecured PHI occurs, per 45 CFR § 164.404.
Changes to this notice
Rocky reserves the right to change this notice and to make the revised terms effective for all PHI he already holds about you. The current notice always appears at rockyridgecounseling.com/hipaa-notice with the current Effective date and Last updated stamps below. Material changes are reviewed and approved by Rocky’s clinical supervisor before going live; you can verify the current version by the date stamps.
Contact for questions, requests, and complaints
Direct any question, request (access / amendment / accounting / restriction / confidential communication), or complaint about this notice or Rocky’s privacy practices to the email address at the bottom of this page. Rocky will respond within 30 days.
For federal complaints: U.S. Department of Health & Human Services, Office for Civil Rights — hhs.gov/ocr/privacy.