Notice of Privacy Practices

Who this notice is from — and an important distinction

This notice is provided in the spirit of full transparency. It explains what Protected Health Information (PHI) flows through our platform, how it may be used and disclosed, and what rights the law gives you.

What is Protected Health Information?

Protected Health Information (PHI) is any individually identifiable information that relates to your past, present, or future physical or mental health condition, the health care you receive, or the payment for that care. On TrustedPsych's platform, PHI stored by therapists typically includes:

• Your name, date of birth, address, email address, and phone number.
• Your diagnosis codes and clinical impressions.
• Session notes, SOAP/DAP/BIRP notes, and clinical assessments.
• Session dates, times, duration, and modality (in-person or telehealth).
• Billing records, invoice amounts, CPT codes, and superbills.
• Signed intake forms, consents, and releases of information.
• Intake screener responses.

All PHI stored in TrustedPsych is encrypted at rest using AES-256-GCM before it is written to our database. Decryption occurs server-side only — plaintext PHI does not pass through your browser in list views.

How your therapist may use and disclose your health information

Your therapist, as the Covered Entity, is the one who decides how your PHI is used and disclosed. HIPAA permits them to use and share your information in certain ways without requiring your separate written authorization. The most common situations are:

Treatment

Your therapist may use your health information to provide, coordinate, or manage your care. They may share relevant information with other providers involved in your treatment — for example, a psychiatrist who co-manages your medications — with your knowledge and, where required, your consent.

Payment

Your therapist may use and disclose your information to collect payment for services. This includes generating and transmitting superbills, processing insurance claims (if applicable), and charging a card on file. TrustedPsych supports these functions.

Healthcare operations

Your therapist may use your information for their own practice operations: quality review, supervision, staff training, or legal and compliance activities. TrustedPsych's audit logging supports accurate records of who accessed what and when.

Required by law

Your therapist may disclose your information when required to do so by federal, state, or local law — for example, in response to a valid court order or subpoena. They are required to tell you about such disclosures, except where the law prohibits it.

Public health activities

Your information may be shared with public health authorities for activities like disease surveillance, reporting vital statistics, or reporting adverse events to the FDA. These disclosures are authorized by law and are uncommon in a mental health private practice context.

Reporting abuse or neglect

All therapists are mandatory reporters. If your therapist has reasonable cause to believe that a child, elderly person, or dependent adult is being abused or neglected, they are required by law to report it to the appropriate authority. This is a disclosure your therapist makes independently of TrustedPsych.

Legal proceedings

Your information may be disclosed in the course of legal or administrative proceedings, in response to a court order, subpoena, or discovery request, subject to applicable legal protections for psychotherapy notes and mental health records.

Law enforcement

Under certain limited circumstances defined by law, your therapist may disclose information to law enforcement — for example, to report a crime on the therapist's premises or to comply with a warrant. These situations are rare and narrowly defined.

Research

If your therapist participates in research, they may share de-identified information (information from which all identifying details have been removed) with researchers. PHI is only shared in research contexts where HIPAA-compliant safeguards — such as an IRB waiver or your written authorization — are in place.

To avert a serious threat to health or safety

If your therapist believes, in good faith, that using or disclosing your information is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person, they may disclose that information to people reasonably able to prevent or lessen the threat. This is commonly referred to as the “duty to warn” obligation.

Uses and disclosures that require your written authorization

Most other uses of your PHI require your written authorization before they can happen. You have the right to revoke that authorization at any time, in writing. Revoking it does not undo disclosures already made in reliance on your earlier authorization.

Uses and disclosures that always require your authorization include:

• Marketing. Your therapist may not use your information for marketing purposes without your written consent. TrustedPsych does not use client health information for any marketing purpose, ever.
• Sale of PHI. Your health information cannot be sold without your written authorization. TrustedPsych does not sell health information to any third party.
• Psychotherapy notes. Notes your therapist keeps in a separate record for their own use — sometimes called process notes or psychotherapy notes under HIPAA — receive extra protection. They may not be used or disclosed without your written authorization, except in a small number of situations defined by law (e.g., the therapist's own treatment use, or mandatory reporting).

Your rights regarding your health information

HIPAA gives you the following rights. To exercise them, contact your therapist directly. If you need TrustedPsych's help fulfilling a request (for example, to produce a complete record export), your therapist can request that from us.

Right to access your records

You have the right to inspect and receive a copy of your health information, including medical and billing records, that your therapist uses to make decisions about your care. There are some narrow exceptions (e.g., psychotherapy notes as defined by HIPAA, or information compiled for legal proceedings). Your therapist must fulfill your request within 30 days (one 30-day extension is permitted). They may charge a reasonable cost-based fee for copies.

Right to amend your records

If you believe that information in your record is incorrect or incomplete, you can ask your therapist to amend it. They may deny the request if the information was not created by them, is not part of the records they maintain, or if they believe the record is accurate and complete. If they deny your request, they must explain why and give you the opportunity to submit a statement of disagreement.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures of your health information that your therapist (or their Business Associates, including TrustedPsych) have made in the six years prior to your request. This list does not include disclosures made for treatment, payment, or healthcare operations, or disclosures you authorized in writing. Contact your therapist to request this list; we can produce a report from our audit logs to help them respond.

Right to request restrictions

You have the right to request that your therapist restrict how they use or disclose your health information for treatment, payment, or healthcare operations. They are not required to agree to your request — but if they do, they must honor it. One exception: if you pay for a service entirely out of pocket and ask your therapist not to share information about that service with your health plan, they must honor that restriction.

Right to request confidential communications

You have the right to ask your therapist to contact you in a specific way or at a specific location. For example, you might ask that appointment reminders be sent to a different email address. Your therapist must accommodate reasonable requests. You do not need to explain why.

Right to a paper copy of this notice

You have the right to a paper copy of this notice at any time. Contact your therapist or print this page. You can also request a copy from TrustedPsych at [email protected].

Your therapist's duties

As the Covered Entity, your therapist is required by law to:

• Maintain the privacy of your health information.
• Provide you with a copy of their own Notice of Privacy Practices.
• Follow the terms of the notice currently in effect.
• Notify you if your unsecured health information is breached — promptly, and no later than 60 days after they discover the breach. If a breach affects 500 or more individuals, they must also notify the HHS Office for Civil Rights.
• Not use or disclose your information in ways that are not described in their notice without your written authorization.

TrustedPsych's own breach notification obligation runs to your therapist (not to you directly), because TrustedPsych is the Business Associate and your therapist is the Covered Entity. We are required to notify your therapist within 60 days of discovering a breach so they can notify you. We will cooperate fully in any breach investigation and notification process.

Changes to this notice

TrustedPsych reserves the right to change this notice and to make the revised notice effective for health information we already hold. We will post the updated notice here and will notify therapists using our platform of material changes at least 30 days before they take effect. The effective date at the top of this page always reflects the most current version.

Your therapist may maintain their own Notice of Privacy Practices for their practice. If their notice and this one differ on a point, your therapist's notice governs your relationship with them; this notice governs TrustedPsych's role as their Business Associate.

How to file a complaint

If you believe your privacy rights have been violated, you have the right to file a complaint — and you will not face retaliation for doing so.

File a complaint with your therapist

Start by contacting your therapist directly. Most concerns can be resolved at that level, and your therapist is required to take your complaint seriously.

File a complaint with TrustedPsych

If your concern involves TrustedPsych's handling of your information as a Business Associate, you can contact us at:

TrustedPsych, LLC — Privacy
[email protected]

File a complaint with the U.S. Department of Health & Human Services

You also have the right to file a complaint directly with the HHS Office for Civil Rights (OCR), which enforces HIPAA:

• Online: www.hhs.gov/ocr/complaints
• Phone: 1-800-368-1019 (TDD: 1-800-537-7697)
• Mail: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201

Filing a complaint with HHS OCR will not affect your care or your relationship with your therapist in any way. You will not be penalized or retaliated against for exercising this right.

Contact

For questions about this notice or TrustedPsych's privacy practices, contact us at:

TrustedPsych, LLC
Flagstaff, Arizona, USA
[email protected]

To exercise your HIPAA rights, contact your therapist directly. They are the Covered Entity responsible for your health records.