HIPAA Notice of Privacy Practices 
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND 
HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

This Notice of Privacy Practices describes how we may use and disclose your protected health 
information (PHI) to carry out treatment, payment, or mental health care operations and for other 
purposes that are permitted or required by law. It also describes your rights to access and control your 
protected health information. “Protected health information” or “PHI” is information about you, 
including demographic information, that may identify you and that relates to your past, present or 
future physical or mental health or condition and related health care services.  

We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of 
this Notice at any time. A new Notice will be effective for all PHI that we maintain at that time. Upon your 
request, we will provide you with any revised Notice of Privacy Practices. Copies of this Notice are 
available from us in person, by mail, or by accessing our website: www.wholeheartcc.org. 

1. Uses and Disclosures of Protected Health Information 

 
Your PHI may be used and disclosed without your prior authorization by any of the following: your therapist or coach; our  
office staff, and others outside our office that are involved in your care and treatment for the purpose of 
obtaining payment for your bills, and any other use required by law.  
Treatment: With your permission, we will use and disclose your PHI to provide, coordinate, or consult with 
your health care provider and any related services.  
Payment: Your PHI will be used, as needed, to obtain payment for your mental health care services, for 
example, if we bill your insurance. 
Operations: We may call you by first name in the waiting room. We may use or disclose your PHI, as 
necessary, to contact you to remind you of your appointment. 
Emergencies: We may need to use or disclose your PHI in an emergency treatment situation. If this 
happens, we will try to obtain your consent as soon as reasonably practicable after the delivery of 
treatment.  
Other Permitted and Required Uses and Disclosures That May Be Made Without Your Consent, 
Authorization, or Opportunity to Object:  We may disclose your PHI in the following situations without 
your consent or authorization:  
Required by Law: We may use or disclose your PHI to the extent that the use or disclosure is required by 
law. The use or disclosure will be made in compliance with the law and will be limited to the relevant 
requirements of the law.  
 
A: Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to 
receive reports of child abuse or neglect. In addition, we may disclose your PHI if you are a minor, 
someone over 65, or mentally disabled and I believe that you have been a victim of abuse, neglect, or 
domestic violence to the governmental entity or agency authorized to receive such information. In this 
case, the disclosure will be made consistent with the requirements of applicable federal and state laws. 
Legal Proceedings: We may disclose PHI in the course of a judicial or administrative proceeding, in 
response to an order of a court or administrative tribunal (to the extent such disclosure is expressly 
authorized), in certain conditions in response to a subpoena, discovery request, or other lawful process.  
Under the law, we must make disclosures to you, and when required by the Secretary of the Department 
of Health and Human Services, to investigate or determine our compliance with requirements of the 
Code of Federal Regulations, Part 45 Section 164.500 et seq.  
Other uses and disclosures of your PHI will be made only with your written authorization, unless 
otherwise permitted or required by law. You may revoke this authorization, at any time, in writing, 
except to the extent that your therapist has already taken an action in reliance on the use or disclosure 
indicated in the authorization.  
 

2. Your Rights.  

Following is a statement of your rights with respect to your PHI and a brief description of how 
you may exercise these rights: You have the right to inspect and copy your protected health 
information. This means you may inspect and obtain a copy of your PHI that is contained in a designated 
record set for so long as we maintain the PHI.  
 

You have a right to obtain a paper copy of this Notice from us, upon request, even if you have 
agreed to accept this Notice electronically. 

You have a right to receive notifications of a data breach. I 
am required to notify you upon a breach of any unsecured PHI. PHI is “unsecured” if it is not protected 
by a technology or methodology specified by this document. The notice must be made within 60 days 
from when we become aware of the breach. However, if we have insufficient contact with you, an 
alternative notice method (posting on website, broadcast media, etc.) may be used. 

 
3. Complaints.  

You may complain to us or to the Colorado Board of Professional Counselors Examiners, or the Texas Behavioral Health Executive Council if you believe 
your privacy rights have been violated by us. We will not retaliate against you for filing a complaint. We are 
required by law to maintain the privacy of PHI, to provide individuals with notice of our legal duties and 
privacy practices with respect to PHI, and to notify affected individuals following a breach of unsecured 
PHI. This notice was published and becomes effective on or before August 1, 2021. If you have any 
objections to this form, please speak with one of us via phone: 719-250-1563.