1. Who This Notice Applies To

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Faith Haas Therapy (“Practice,” “we,” “our”). It applies to health information created or received in the course of providing mental health services to you, whether in person, by telephone, or via telehealth.

This Practice is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the HIPAA Privacy Rule (45 CFR Part 164). This Notice also reflects the requirements of California's Confidentiality of Medical Information Act (CMIA), California Welfare and Institutions Code Section 5328, and other applicable California law. Where California law provides greater privacy protection than HIPAA, California law governs.

2. Our Duties Under HIPAA

We are required by law to:

Maintain the privacy of your protected health information (PHI)
Provide you with this Notice of our legal duties and privacy practices
Abide by the terms of this Notice
Notify you in the event of a breach of your unsecured PHI
Not use or disclose your PHI in ways that are not described in this Notice, unless permitted or required by law

We reserve the right to change the terms of this Notice. Any revised Notice will apply to PHI we already hold as well as PHI we create or receive in the future. A copy of the current Notice is available at any time upon request and is posted on our website.

3. How We May Use and Disclose Your Health Information

A. Uses and Disclosures That Do Not Require Your Written Authorization

The following uses and disclosures are permitted by law without your written authorization:

Treatment. We may use and disclose your PHI to provide, coordinate, or manage your mental health treatment. For example, we may consult with another licensed health care professional about your care, or share relevant records with a specialist to whom you have been referred.

Payment. We may use and disclose your PHI to obtain payment for services. This may include submitting claims to your health insurance company, obtaining prior authorization, or verifying your benefits. If you are paying entirely out of pocket, your insurance company will not receive any information from us.

Health Care Operations. We may use and disclose your PHI for internal practice operations, including quality assessment, training, licensing compliance, and business management activities that are directly related to your care.

Appointment Reminders and Treatment Alternatives. We may contact you to confirm or remind you of an appointment, or to provide information about treatment options.

As Required by Law. We will disclose your PHI when required to do so by federal, state, or local law.

Health Oversight Activities. We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, or licensing proceedings.

Judicial and Administrative Proceedings. We may disclose PHI in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process, subject to applicable legal protections.

Law Enforcement. We may disclose PHI to law enforcement officials under specific circumstances defined by law.

Business Associates. We may share PHI with Business Associates (such as a billing service, electronic health records platform, or scheduling software) who perform services on our behalf. Business Associates are required by law to maintain the privacy of your information and are bound by written agreements to do so.

B. California-Specific Mandatory Disclosure Exceptions

California law requires or permits disclosure of your confidential information in the following circumstances, some of which are more protective than federal law and some of which impose additional disclosure obligations:

Mandatory Reporting – Child Abuse and Neglect. California law (Penal Code §11166) requires therapists to report immediately to child protective services or law enforcement if they know or reasonably suspect that a child has been or is in danger of being abused, neglected, or sexually exploited. This obligation applies regardless of the source of the information.

Mandatory Reporting – Elder and Dependent Adult Abuse. California law (Welfare and Institutions Code §15630) requires therapists to report known or reasonably suspected abuse, neglect, financial exploitation, or abandonment of any elder (65 or older) or dependent adult to Adult Protective Services or law enforcement.

Duty to Protect – Threat of Harm to Identifiable Third Party. Under California Civil Code §43.92, if you communicate a serious, credible threat of imminent harm against a reasonably identifiable person or persons, we are required to take reasonable steps to protect the potential victim(s). This may include warning the potential victim, notifying law enforcement, and/or seeking emergency psychiatric intervention.

Serious Threat of Harm to Self. If you present a serious and imminent threat to your own safety, we may disclose information to prevent harm, including emergency hospitalization or notification of emergency services, to the extent permitted by law.

Minors – Abuse Disclosure. When a minor is the patient, a parent or legal guardian generally has the right to access the minor's records. However, California law provides exceptions where the minor has a right to confidential treatment (such as certain outpatient mental health treatment, substance abuse treatment, or services related to sexual assault or domestic violence).

Licensing Board Proceedings. We may be required to produce records or testify in proceedings before the California Board of Behavioral Sciences.

Worker's Compensation. If you are being treated in connection with a worker's compensation claim and your mental or emotional condition is at issue, we may be required to disclose relevant PHI.

Court Order or Subpoena. We may be required to produce records pursuant to a valid court order, search warrant, or properly served subpoena. We will make reasonable efforts to notify you before disclosing, where legally permissible.

C. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures require your separate, written authorization before we will disclose your information:

Psychotherapy Notes. Notes recorded by your therapist documenting the content of private counseling sessions are subject to extra protections under both HIPAA and California law. We will not disclose psychotherapy notes without your written authorization, except as required by law (including mandatory reporting obligations described above).

Marketing Communications. We will not use your PHI to send you marketing materials without your authorization.

Sale of PHI. We will not sell your health information.

Other Uses and Disclosures Not Described Here. Any use or disclosure not described in this Notice requires your prior written authorization. You may revoke any authorization in writing at any time; however, revocation will not affect disclosures we already made in reliance on your authorization.

4. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to us using the contact information at the end of this Notice.

Right to Inspect and Copy. You have the right to request access to your PHI maintained in a designated record set, which typically includes your treatment records. We may charge a reasonable, cost-based fee for copies. Under California law, we may restrict access to psychotherapy notes in limited circumstances (see Welfare and Institutions Code §5328).

Right to Amend. You have the right to request that we amend PHI or a record about you if you believe it is inaccurate or incomplete. We may deny the request if we determine the PHI is accurate and complete, was not created by us, is not part of the information you are permitted to inspect and copy, or is not part of the records we maintain.

Right to an Accounting of Disclosures. You have the right to receive a list of certain disclosures we have made of your PHI during the six years prior to your request. This right does not apply to disclosures made for treatment, payment, or health care operations, or to disclosures you authorized.

Right to Request Restrictions. You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to restrictions, but if we do agree, we are bound by the restriction except in emergencies. However, if you pay entirely out of pocket for a service, you have the absolute right under HIPAA to request that we not disclose information about that service to your health plan.

Right to Request Confidential Communications. You have the right to request that we communicate with you in a specific way or at a specific location. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice at any time.

5. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

To file a complaint with us:

Faith Haas Therapy
Attn: Privacy Officer
PO BOX 2092
Orange, CA 92859
info@faithhaas.com

To file a complaint with the federal government:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-free: 1-877-696-6775
www.hhs.gov/ocr/privacy

You may also contact the California Department of Public Health or the California Medical Board for state-specific concerns.

6. Contact Information

For questions about this Notice or to exercise any of your rights described above, contact:

Faith Haas, LMFT
Privacy Officer, Faith Haas Therapy
info@faithhaas.com
(714) 257-5101