Practice Policy Notice
EFFECTIVE DATE OF THIS NOTICE This notice went into effect on [03/24/2025]
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Our Duty Regarding Your Health Information:
This Notice of Privacy Practices (this “Notice”) is provided by Yani Chu, PsyD., LMFT, owner of Inner Stride Individual and Family Therapy (the “Practice”).[1] Any questions related to this Notice may be directed to Dr. Chu.
With limited exceptions, information about you and your health is confidential. Confidential information includes all individually identifiable information, whether in electronic or physical form, that is in our possession or is derived from information you share in confidence with us regarding your past medical or mental health history, a current or potential future mental or physical health condition, your mental or physical health treatment or payment for treatment. More specifically, the health information we create and maintain in our possession is information that relates to your participation in outpatient treatment with a psychotherapist. All such information is “Confidential Information.” Your Confidential Information is sometimes referred to as “Protected Health Information” or “PHI.” We are committed to protecting the privacy of this information. This notice tells you about some of the ways in which we may use and disclose health information about you, as well as certain obligations we have regarding the use and disclosure of your health information. It also describes your rights regarding your health information.
Our Responsibilities:
It is our responsibility to safeguard your health information. We are also required to give you this Notice and to follow the terms of the Notice currently in effect. We will notify you if we become aware of an unauthorized access, use or disclosure of your health information.
Changes to this Notice:
We reserve the right to change this Notice at any time. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We are providing you with a copy of this Notice of Privacy Practices as part of your initial intake documentation which may be made available through our electronic record keeping system, SimplePractice.
How We Protect Your Confidential Information:
The Practice will protect your Health Information by:
· Treating all information about you that we collect as confidential. This means that with limited exceptions, as discussed below, we will not share your information with anyone without your consent or written authorization; and when we are either permitted or required to share your Confidential Information, whether with or without your written authorization, we will disclose only the minimum information necessary under the circumstances.
· Restricting access to your Health Information to those clinical staff only who have a
legitimate need for access in order for us to provide services to you;
· Only disclosing when required or permitted, that information which is necessary under the circumstances;
· Obtaining reasonable assurances in writing through a Business Associate Agreement
with any outside services or other business associates which we may use in order to provide you with services or conduct necessary business operations; and
· Maintaining physical, electronic, and procedural safeguards to comply with federal and state regulations guarding your Health Information. More specifically, the Practice maintains your health information using a HIPPA compliant electronic health record (“EHR”) provided through SimplePractice which complies with state and federal laws requiring the protection and security of patient information. These laws include California’s Confidentiality of Medical Information Act, and the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations including the federal privacy, security and enforcement rules, the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) and its implementing regulations including the Breach Notification Rule, and the HIPAA Omnibus Rule of 2013 requiring Business Associates to comply with the
Privacy and Security Rules, and making Business Associates liable for HIPAA violations. Business Associates are third parties who are not employees, contractors or volunteers of the Practice but who are otherwise involved in our provision of treatment or healthcare operations. “Business Associate” is explained more fully below
II. HOW I MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU:
The following categories describe different ways that I use and disclose health information. For each category of uses or disclosures I will explain what I mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways I am permitted to use and disclose information will fall within one of the categories.
Treatment:
Your Confidential Information may be disclosed to providers of health care,
health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment.[2] This means, for example, that your Confidential Information may be shared and discussed with trainees and interns of the Practice who are involved in your treatment, or if you have a treating psychiatrist or other involved physician, information may be shared with him or her in order to coordinate care. However, as a practical matter, we will request authorization from you in writing before we disclose your Confidential Information to any health care provider who is not associated with the Practice, or to any other third-party. We may also disclose your health information to a family member, other relative, domestic partner or a close personal friend, or any other person identified by you, if the information is directly relevant to that person’s involvement with your care or payment related to your care, after obtaining your consent or providing you with the opportunity to object to the disclosure and you express no objection.[3] Note that in the event of an emergency, we may disclose such information which we determine based
upon our professional judgment to be in your best interest without obtaining your consent or providing you with the opportunity to object.
For Treatment Payment, or Health Care Operations: Federal privacy rules (regulations) allow health care providers who have direct treatment relationship with the patient/client to use or disclose the patient/client’s personal health information without the patient’s written authorization, to carry out the health care provider’s own treatment, payment or health care operations. I may also disclose your protected health information for the treatment activities of any health care provider. This too can be done without your written authorization. For example, if a clinician were to consult with another licensed health care provider about your condition, we would be permitted to use and disclose your personal health information, which is otherwise confidential, in order to assist the clinician in diagnosis and treatment of your mental health condition.
Payment:
We may use and disclose your health information to bill for services and to
obtain payment, including, if necessary, the reporting of limited information necessary to pursue collection through a collection agency. With your consent, we may also disclose health information to your insurance company, health plan or other third-third party payer or guarantor. This may include the disclosure of health information to obtain prior authorization for treatment. Your health information may also be disclosed in response to requests from your insurer, health plan, employee benefit plan or any governmental authority responsible for paying for health care services provided to you, to the extent necessary to allow responsibility for payment to be determined. In such cases you have a right to be provided with a copy of the request in writing within 30 days of the requestor’s receipt of the information requested. Any information disclosed pursuant to this section will be limited to the minimum information necessary, and generally includes the nature of the services provided, the dates of services, the amount due and other relevant financial information.
You should be aware that should you choose to use your insurance company, health plan or other third-party payer or guarantor to reimburse you for services, certain personal health information may be shared with the Medical Insurance Bureau (“MIB”), which may make your information available through the use of codes to its member insurers. You may request a copy of your MIB file at:
https://www.mib.com/request_your_record.html
or by calling 1-866-692-6901.
Marketing.
The Practice will not use or disclose your health information for marketing
purposes or sell your health information for any reason.
III. CERTAIN USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION:
Generally, we are not permitted to use or disclose your health information without your
written authorization, except where disclosure is required or permitted by law. The
authorization must state what information can be released, to whom, and for what purpose. It must be dated. You have the right to refuse to consent to disclosure without fearing any kind of pressure or retaliation. If you authorize us to use or disclose health information about you, you may limit the information to be used and/or disclosed and you may revoke the authorization in writing at any time. You also have the right to revoke your written authorization by providing us with notice, except to the extent that we have already acted in reliance on your authorization.
Psychotherapy Notes.
Your psychotherapist may at their discretion keep Psychotherapy
Notes in addition to your treatment record. Psychotherapy Notes are the personal notes of your psychotherapist. Sometimes called “process notes”, Psychotherapy Notes means notes recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of your diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.[4] To be considered “psychotherapy notes”, the notes must be separate from the medical record. These notes may capture your therapist’s impressions about you, contain details of psychotherapy conversations considered to be inappropriate for the medical record, and are used by your psychotherapist for future sessions. It is because of the sensitivity of these notes that they are kept separate from your medical record and not included in records which may be sent to insurers for payment.
Psychotherapy Notes cannot be disclosed without your written authorization, including
disclosure for treatment purposes to a health care provider, except where used by (i) the originator of the psychotherapy notes for treatment; (ii) the Practice for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; (iii) the Practice to defend itself in a legal action or other proceeding brought by or on behalf of the patient; or (iv) where otherwise required by law.[5]
IV. CERTAIN USES AND DISCLOSURES DO NOT REQUIRE YOUR AUTHORIZATION.
When Disclosure Is Required by Law:
There are times when we are required by law to disclose certain Confidential Information about you whether we want to or not. Some of the circumstances where disclosure is required by law are:
Where we reasonably suspect neglect or physical, emotional or sexual abuse of a child, or neglect or physical, emotional, sexual or financial abuse of a dependent adult or person 65 or older. You should know that sexual abuse of a child includes the creation of or streaming, downloading, storing or transmitting electronic images sexually depicting a child. This law is implicated even when a minor creates, streams, stores or transmits images of themselves such as when sexting with a friend.
Where we have reason to believe that you may present a danger to others. If we believe that you are threatening serious bodily harm to another, we are required to take protective actions. These actions may include notifying the potential victim, contacting the police, or seeking hospitalization for you.
Where we have reason to believe that you present a danger to yourself. If you threaten to harm yourself, we may be obligated to seek hospitalization for you or to contact family members or others who can help provide you with protection.
For Workers Compensation to the extent necessary to comply with state workers compensation laws governing job-related injuries or illnesses.
Upon a request by certain legal representatives on your behalf such as a conservator who is authorized to access behavioral health records, or a person having durable powers of attorney for healthcare decisions under circumstances where you have been determined to lack capacity to make healthcare decisions. Legal representatives also include, upon your death, any personal representative (as statutorily defined), executor, or administrator of your estate or beneficiary potentially including any person who may have a present or future interest under a trust. Note that the Confidential Information of a deceased person ceases to be “PHI”, and loses its privacy protection 50 years from the date of a patient’s death.
When required by the Secretary of the Department of Health and Human Services or any of its offices, including the Office of Civil Rights to investigate or determine the Practice’s compliance with HIPAA or any of its implementing regulations.
In response to a lawfully executed search warrant from a law enforcement agency.
In response to a request by a medical examiner, forensic pathologist, or coroner when requested for the purpose of identifying you or locating your next of kin, or when investigating your death if it involves a public health concern, organ or tissue donation, child abuse, elder abuse, suicide, poisoning, or an otherwise unknown or suspicious death, or when otherwise authorized by the decedent’s representative.
When Disclosure May Be Required:
Some of the circumstances where disclosure may be required are:
Pursuant to a legal proceeding that is initiated by or brought against you. For example, if you place your mental status at issue in litigation, such as in a lawsuit seeking damages for severe emotional distress, the defendant may have the right to obtain your psychotherapy records and/or the testimony of your psychotherapist by issuing a subpoena. Your personal health information may then be shared with retained experts in the case and shared with other parties in the litigation. Potentially that information may even be shared with a jury or other fact finder. Please note that we will not release your protected health information in response to a subpoena without your written authorization, unless ordered to do so by a court order, except in cases where the records are sought for a workers’ comp determination or proceeding, and even then, such release of information shall be reasonably limited to only that information necessary for the determination or proceeding.
For certain specialized governmental functions related to the military, national security and intelligence.
For example, if you are a member of the military, the disclosure of patient communications may be compelled in proceedings brought under the Uniform Code of Military Justice, 1) if the communication is evidence of child abuse or neglect, or in a proceeding in which one spouse is merely charged with a crime against a child of either spouse; or 2) if the communication reflects your intent to commit a future fraud or crime or if the services of the psychotherapist are sought to enable or aid anyone to commit or plan to commit what the patient knows or reasonably should know is a crime or fraud; or 3) when necessary to ensure the safety and security of military personnel, military dependents, military property, classified information or the accomplishment of a military mission. The Practice is not under the jurisdiction of the military and therefore will not voluntarily disclose such information, although you should know that disclosure may be compelled in a military proceeding. If any of the exceptions in this paragraph are of concern to you, you should discuss them with your psychotherapist.
Health oversight activities. While California law is more protective of your right to
confidentiality than HIPAA, in that California law requires your written authorization for a licensing board to access your health records as part of any investigation into a complaint against a licensee, there may still be health oversight situations in which your information may be accessed without the need to first obtain your authorization. Health oversight agencies include federal, state and local government agencies authorized by law to oversee the public and private healthcare care system or government programs in which health
information is necessary for determining eligibility or compliance, or to enforce civil rights laws for which health information is relevant. Uses and disclosures for healthcare oversight must be limited to the minimum information necessary to accomplish the oversight objective.
For example, the Department of Managed Health Care (“DMHC”) in California is a health oversight agency authorized to oversee HMOs and certain other health plans within the state. HIPAA permits covered health plans to disclose private health information to the DMHC for oversight activities including audits, civil, administrative or criminal investigations, inspections, and other activities necessary for the oversight of the healthcare system, government benefit programs, compliance with governmental regulation or compliance with civil rights laws.
Health oversight investigators generally do not seek access to individual patient records, but instead review large numbers of records to determine whether a health care provider or organization may be violating the law. In the course of their efforts to protect the healthcare system, health oversight investigators may at times uncover evidence of wrongdoing unrelated to the health care system, such as evidence of criminal conduct by an individual who has sought health care. However, law enforcement may not use protected health information concerning an individual, discovered during the course of health oversight
activities, for unrelated civil, administrative, or criminal investigations, against that individual unless the public interest and the need for disclosure clearly outweigh the potential for injury to the patient, to the psychotherapist patient relationship, and to the treatment services.
Business Associates. Some services in our practice we obtain through contracts with business associates. For example, we may contract with outside companies to provide legal services, accounting services, or billing services. When we contract with a business associate, we may disclose health information to the business associate so it can do the job we have asked it to do. To protect your health information, we enter into “Business Associate” agreements with them to require them to appropriately safeguard your health information.
For Data Breach Notification Purposes. We may use limited Confidential Information such as your contact information to provide legally required notices of unauthorized acquisition, access or disclosure of your Confidential Information, if such were to occur. We may send notices directly to you or provide notice to the sponsor of a health plan through which you receive coverage.
Comply with the law. We may disclose health information about you if otherwise required by state or federal laws.
Minors in Therapy
The Practice does not typically treat minors. However, in the event that you are under 18 years of age, the law may grant your parents or guardians the right to obtain information about your treatment and/or examine your treatment records. It is our policy to request an agreement from your parents or guardians indicating that they consent to waive access to such information and/or access to your records. If they agree, we will provide them only with general information about our work together subject to your approval. If we feel it is important for them to know something to make sure that you and others around you are safe, we will encourage you to share the information with them during a family session, or
we will share the information with them with your permission in the context of a scheduled session. However, if we think it is clinically necessary, we will involve them even without your permission if we have reason to believe there is a risk of harm to yourself or others or if another is harming you in any way.
Emergencies
Confidential treatment information may also be disclosed in the rare event of a medical or psychological emergency, meaning a sudden change in condition that may result in physical or psychological harm to you if left untreated.
V. CERTAIN USES AND DISCLOSURES REQUIRE YOU TO HAVE THE OPPORTUNITY TO OBJECT.
Disclosures to family, friends, or others. I may provide your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.
VI. YOU HAVE THE FOLLOWING RIGHTS WITH RESPECT TO YOUR PHI:
You have the following rights regarding medical information we maintain about you:
· To obtain a copy of our Notice of Privacy Practices.
· To request a restriction on certain uses and disclosures of your information. This request must be in writing.
· To inspect and request a copy of your health record other than Psychotherapy Notes so long as the record is maintained.[6] Your request must be in writing and specify the records to be copied. Upon receipt of your request, together with a fee, if required, to defray the costs of producing the copy, the Practice shall ensure that the copies are transmitted within 15 days after receiving the request.[7] The following are some important exceptions:
The representative of a minor is not entitled to inspect or obtain copies of the minor’s patient records either i) with respect to which the minor has the right of inspection; or ii) where the health care provider determines that access to the patient records requested by the representative would have a detrimental effect on the provider’s professional relationship with the minor patient or the minor’s physical safety or psychological well- being.[8]
A health care provider may deny a request by a patient where the provider determines there is a substantial risk of significant adverse or detrimental consequences to the patient in seeing or receiving a copy of the mental health records requested by the patient. However, the health care provider shall (i) make a written record, to be included with the mental health records requested, noting the date of the request and explaining the health care provider’s reason for refusing to permit inspection or provide copies of the records, including a description of the specific adverse or detrimental consequences to the patient that the provider anticipates would occur if inspection or copying were permitted; and (ii) permit inspection by, or provide copies of the mental health records to, a licensed physician and surgeon, licensed psychologist, licensed marriage and family therapist, licensed clinical social worker, or licensed professional clinical counselor, designated by request of the patient.[9]
Your health care provider may confer with you in an attempt to clarify your purpose in obtaining a copy of your record and may choose to prepare a summary. If they choose to prepare a summary rather than allowing access to the entire record, they will make the summary available to you within 10 working days from the date of your request. If more time is needed, such as because of the length of the record or because you were discharged from a licensed health facility within the 10 days preceding your request, your provider will notify you that more time is needed and provide you with the date it will be completed. In no case may more than 30 days elapse between the date of your request and the delivery of the summary.[10]
· To request an amendment to your health record if you feel the information is incorrect
or incomplete. Your request must be made in writing and it must include a reason that
supports the request.
· To obtain an accounting of disclosures to others of your health information. The
accounting will provide information about disclosures made for purposes other than
treatment, payment, health care operations, disclosures required by law or those you have authorized.
· To request confidential communications. You have the right to request that we
communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we only contact you at work or by mail. Your request must be in writing and specify the exact changes you are requesting.
· To revoke your authorization. You have the right to revoke your authorization for the
use or disclosure of your health information except to the extent that action has already been taken.
· To choose someone to act for you. If you have given someone medical power of
attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
· Complain about any aspect of our health information practices to the United States
Department of Health and Human Services without fear of retaliation. Complaints should be in writing and may be directed to:
Yani Chu, PsyD., LMFT
yani@innerstridetherapy.com
(626) 410-0682
OR:
Office for Civil Rights, Region IX
U.S. Department of Health and Human Services
50 United Nations Plaza, Room 322
San Francisco, CA 94102
Voice Phone (415) 437-8310
Fax (415) 437-8329
TDD (415) 437-8311
Patient Acknowledgment of Receipt of Privacy Policy:
I have read and fully understand this entire document and have had the opportunity to
have any questions I have explained to me to my satisfaction, or if not, I agree to address any question I have with Therapist. By checking the box below, I am signing this consent electronically, with the intent that my electronic signature shall have the same force and effect as if signing by hand.
[1][1] We, Us, Our and similar variations refer to the Practice unless context establishes otherwise.
[2] Cal. Civil Code section 56.10(c)(1); 56.104(e).
[3] Cal. Civil Code section 56.1007.
[4] 45 CFR 501.164.
[5] 45 CFR 164.508(a)(2).
[6] 45 CFR 164.5249(a).
[7] Health & Saf. Code §123110(b).
[8] Health & Saf. Code §123115(a).
[9] Health & Saf. Code §123115(b).
[10] Health & Saf. Code §123130.
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By checking the box below, you are acknowledging that you have received a copy of HIPAA Notice of Privacy Practices.