THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Your health information is personal. This notice explains your rights, the practice’s legal duties, and the uses and disclosures permitted by HIPAA. Where New York or other applicable law gives your information stronger protection, the practice follows that law. This notice does not authorize a disclosure that another law prohibits.
Your rights
Inspect or obtain a copy of your records
You may request inspection or an electronic or paper copy of health and billing records in the designated record set used to make decisions about you. The practice generally acts within 30 days under HIPAA, or sooner when applicable law requires. If an extension is permitted, you will receive a written explanation and completion date. A reasonable, cost-based fee may apply where allowed. Some information, including separately maintained psychotherapy notes, is excluded from HIPAA’s access right. Psychotherapy notes have a narrow legal definition; ordinary progress notes are not excluded simply because they document therapy. Records are not withheld solely because treatment fees are unpaid. If access is denied, you will receive the reason and information about any review rights.
Ask for a correction
You may request an amendment to information you believe is incorrect or incomplete and explain why. A request may be denied when legally permitted, for example when the record is accurate and complete. The practice generally responds within 60 days; a permitted extension will be explained in writing. A denial includes information about submitting a statement of disagreement.
Request confidential communications
You may ask to be contacted in a specific way or at a particular location, such as a different telephone number or mailing address. The practice accommodates reasonable requests. Tell the practice how to contact you safely; you do not have to explain the reason for the request.
Ask to limit uses or disclosures
You may request restrictions on uses or disclosures for treatment, payment, or health care operations, or to people involved in your care. The practice is not required to agree to most restrictions. It must agree to restrict disclosure to a health plan for payment or operations when the information relates solely to a service you or someone other than the plan paid for in full out of pocket, unless disclosure is required by law.
Receive an accounting of disclosures
You may request a list of certain disclosures made during the six years before your request. The accounting excludes categories such as treatment, payment, health care operations, disclosures to you, and disclosures you authorized. The first accounting in a 12-month period is free; a reasonable fee may apply to additional requests after you are told the cost and offered a chance to withdraw or modify the request.
Receive a copy of this notice
You may request a paper copy at any time, even if you agreed to receive it electronically. This notice is available on the website and from the practice.
Act through a personal representative
A person legally authorized to act for you may exercise your privacy rights, subject to applicable law and exceptions. The practice verifies the person’s authority before acting on a request.
File a complaint without retaliation
You may complain to Salman Hafeez, the practice privacy contact, using the details below, or to the U.S. Department of Health and Human Services Office for Civil Rights. The practice will not retaliate against you for a complaint or exercising your privacy rights.
Uses and disclosures for care and practice operations
Subject to applicable confidentiality protections, the practice may use or disclose health information without a separate HIPAA authorization for:
- Treatment: Providing counseling, coordinating care, or consulting with another treating professional. For example, relevant information may be shared with a clinician involved in your care when legally permitted.
- Payment: Managing fees, providing billing records or a superbill, or obtaining payment. A superbill you choose to submit to an insurer includes health information. Restrictions and other legal requirements still apply.
- Health care operations: Necessary practice administration, quality review, professional consultation, audits, or legal and compliance work. Service providers handling protected information on the practice’s behalf must have required safeguards and agreements.
The practice may contact you about appointments or relevant treatment alternatives and health-related services as allowed by law. Uses or disclosures are limited to the minimum necessary when that HIPAA standard applies; additional protections apply to psychotherapy notes and other specially protected records.
Other uses and disclosures allowed or required by law
The following are examples, not blanket permission to release counseling records. Each disclosure must satisfy the applicable legal requirements and any stricter confidentiality protections:
- Required by law: A disclosure specifically required by a federal or state law.
- Public health and safety: Legally authorized public-health reporting, certain reports of suspected abuse or neglect, and disclosures allowed to prevent or lessen a serious and imminent threat to health or safety.
- Health oversight: Lawfully authorized audits, investigations, inspections, or licensure activities.
- Legal proceedings and law enforcement: Disclosures meeting the requirements for a court order, qualifying legal process, or a specifically permitted law-enforcement purpose. A request or subpoena alone does not automatically permit disclosure of every record.
- Coroners, medical examiners, funeral directors, and organ donation: Disclosures for authorized duties or donation purposes when applicable.
- Research: Only when applicable authorization or an approved legal waiver and required protections are in place.
- Special government functions and workers’ compensation: Disclosures allowed for qualifying military, national-security, correctional, or workers’ compensation purposes.
- Compliance with HIPAA: Disclosure to the Secretary of Health and Human Services when required to investigate or determine compliance.
People involved in your care
When law permits, the practice may share information directly relevant to a family member’s, friend’s, or other person’s involvement in your care or payment if you agree, are given a chance to object and do not, or your agreement can reasonably be inferred. If you are unavailable or incapacitated, a limited disclosure may be made based on professional judgment in your best interest. Additional New York confidentiality rules may require consent. You can discuss your preferences with the practice.
Uses requiring your written authorization
Uses and disclosures not described in this notice require your written authorization unless another legal exception applies. Most uses or disclosures of separately maintained psychotherapy notes require authorization, with limited legal exceptions. Marketing uses and disclosures and any sale of protected health information require authorization except where HIPAA specifically provides otherwise. The practice does not sell protected health information or use it for third-party marketing.
You may revoke an authorization in writing at any time. Revocation does not undo actions already taken in reliance on it, or other legally permitted reliance, such as an insurer’s rights where applicable.
Redisclosure of information
Information disclosed as permitted by HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA. Other laws, including applicable New York confidentiality rules and 42 CFR Part 2, may still protect it. This possibility does not authorize the practice to disclose information contrary to those laws.
Additional protections for sensitive information
New York law may place additional restrictions on mental-health information and other sensitive records, including HIV-related information and certain substance-use records. The practice follows those protections when they apply.
This practice is not a federally assisted substance-use treatment program covered by 42 CFR Part 2. If the practice receives records protected by Part 2, those records remain subject to applicable special protections. Such records, or testimony conveying their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a qualifying court order and a subpoena or similar legal mandate. A consent for treatment, payment, or operations alone does not authorize that use.
The practice’s responsibilities
- Maintain the privacy and security of protected health information and comply with applicable privacy law.
- Provide this notice explaining legal duties and privacy practices and follow the notice currently in effect.
- Notify you following a breach of unsecured protected health information when notification is required by law.
- Obtain required authorizations rather than use or share information for purposes not legally permitted without them.
The practice may revise this notice and make the revised terms apply to information already maintained as well as information received later. A revised notice will be posted on the website and available on request with its effective date. Receiving or acknowledging this notice is not a waiver of your rights or an authorization to disclose information.
Contact and complaint information
For questions, requests, or complaints, contact Salman Hafeez, LMHC, the privacy contact for Salman Listens, LMHC, at (315) 308-0827 or hello@salmanlistens.com. Ask for an appropriate secure method before sending records or identity documents. Written requests may be needed to document and process your rights.
You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: www.hhs.gov/ocr/complaints, 1-800-368-1019, or 200 Independence Avenue SW, Washington, DC 20201. OCR complaints are generally due within 180 days of learning of the issue; OCR may extend that period for good cause.