Privacy Policy & HIPAA Notice of Privacy Practices

12.1 Treatment, Payment, and Health Care Operations

HIPAA generally permits covered health care providers to use or disclose PHI for treatment, payment, and health care operations without a separate HIPAA authorization.
However, Mind by Design Counseling also follows any more restrictive federal or New Jersey confidentiality requirements that apply to the information.

Treatment
We may use your health information to provide, coordinate, or manage your mental health treatment.
For example, your therapist may review prior treatment information when preparing for a session or consult with an authorized clinical supervisor regarding appropriate interventions.
When coordination with another health care provider requires authorization under applicable law, we will obtain that authorization or identify another lawful basis before disclosure.

Payment
We may use or disclose information as permitted or required to obtain payment for services.
Examples include preparing billing statements, processing payments, verifying insurance benefits, submitting authorized insurance claims, or responding to appropriate payment inquiries.
Where stricter confidentiality rules apply, disclosures will be limited accordingly.

Health Care Operations
We may use certain information for legitimate administrative and clinical operations, such as quality assurance, compliance, professional training, clinical supervision, record management, and practice administration.
For example, an authorized clinical supervisor may review a supervised intern’s documentation to assess clinical work and provide appropriate oversight.
We limit access to authorized individuals and apply the minimum necessary standard when required by HIPAA.

12.2 Uses and Disclosures Requiring Special Authorization
(a) Psychotherapy Notes
Psychotherapy notes receive heightened protection under HIPAA.
For HIPAA purposes, psychotherapy notes are notes recorded by a mental health professional documenting or analyzing conversations during counseling sessions and kept separately from the rest of the medical record.
They are distinct from ordinary progress notes, treatment plans, diagnoses, medication information, session times, and summaries of treatment progress.
A separate, valid written authorization is generally required before psychotherapy notes may be used or disclosed.
This generally includes disclosure to another treatment provider, even when that provider is involved in your care.
HIPAA recognizes narrow exceptions that may allow the use or disclosure of psychotherapy notes without this authorization, including:

1. Use by the clinician who created the notes for treatment.
2. Use or disclosure by the Practice for its own supervised training programs in which students, trainees, or mental health practitioners learn or improve counseling skills.
3. Use or disclosure by the Practice to defend itself in a legal action or proceeding brought by the client.
4. Disclosures required by the Secretary of the U.S. Department of Health and Human Services for HIPAA compliance investigations or enforcement.
5. Disclosures required by law, limited to the requirements of that law.
6. Certain authorized health oversight activities involving the originator of the notes.
7. Certain disclosures to coroners or medical examiners as permitted under applicable law.
8. Disclosures necessary to prevent or lessen a serious and imminent threat to health or safety, when the legal requirements are met.

These exceptions do not eliminate more protective New Jersey confidentiality requirements.

When an authorization for psychotherapy notes is required, it generally must be separate from authorizations for other purposes.

(b) Marketing

We will obtain written authorization before using or disclosing PHI for marketing when HIPAA requires such authorization.

If applicable marketing involves financial remuneration from a third party, the authorization will disclose that arrangement.

We do not use psychotherapy notes or clinical records for targeted commercial advertising.

(c) Sale of Protected Health Information

Mind by Design Counseling does not sell protected health information.

Any future transaction constituting a sale of PHI under HIPAA would require authorization unless a legal exception applies.

(d) Other Uses and Disclosures

Uses or disclosures not described in this Notice, and not otherwise permitted or required by applicable law, will be made only with your valid written authorization.

You may revoke an authorization in writing at any time, except to the extent that we have already acted in reliance on it or another legal exception applies.

Revoking authorization does not retroactively invalidate a previously authorized disclosure.

12.3 Uses and Disclosures Permitted or Required by Law
In limited circumstances, we may use or disclose PHI without authorization when applicable law permits or requires us to do so.
These circumstances may include:
Required by law: Disclosures specifically required by federal or state law, within the limits of the legal requirement.
Public health: Certain disclosures to legally authorized public health authorities, when applicable.
Abuse, neglect, and domestic violence: Reports to authorized agencies when reporting is required or permitted by law, including applicable child abuse or vulnerable-person reporting requirements.
Health oversight: Authorized audits, investigations, inspections, professional licensing reviews, and other legally permitted oversight activities.
Judicial and administrative proceedings: Disclosures responding to legally valid court orders or other legal process, subject to applicable privilege and confidentiality requirements.
Law enforcement: Limited disclosures when specifically required or permitted by law and consistent with applicable mental health confidentiality protections.
Coroners, medical examiners, and funeral directors: Disclosures for legally authorized purposes, when applicable.
Organ and tissue donation: Limited disclosures when legally applicable and authorized.
Research: Disclosures for legally approved research purposes when applicable HIPAA and other confidentiality requirements are satisfied.
Serious threats to health or safety: Limited disclosures when necessary and legally permitted to prevent or lessen a serious and imminent threat.
Specialized government functions: Certain disclosures involving military, national security, correctional, or other functions when specifically authorized by law.
Workers’ compensation: Disclosures authorized by applicable workers’ compensation or similar laws.
These categories do not mean that every disclosure permitted generally under HIPAA is permitted under New Jersey law.
We review applicable restrictions before releasing mental health information and disclose only information authorized or required under the circumstances.

12.4 Family Members, Caregivers, and Others Involved in Your Care
We respect your preferences concerning the involvement of family members, caregivers, and other individuals in your treatment.
Where permitted by law, limited information may be shared with individuals involved in your care or payment for care, based on your agreement, opportunity to object, or other legally authorized circumstances.
However, New Jersey mental health confidentiality requirements may require written authorization before such disclosures.
We do not assume that a spouse, parent, partner, or other family member has automatic access to confidential treatment records.
For minors or individuals with legally authorized personal representatives, access and disclosure are determined by applicable law and the representative’s legal authority.

12.5 Redisclosure of Information
Information lawfully disclosed to another person or organization may, in some circumstances, be redisclosed by that recipient and may no longer be protected by HIPAA.
Other federal or state confidentiality restrictions may continue to apply, including protections governing certain mental health and substance use disorder records.
We limit disclosures and obtain authorization where required, but cannot control all subsequent actions of independent recipients.