HIPAA Notice of Privacy Practices
This notice is a summary how mental health records and information about you may be used and disclosed and how you can get access to this information. Your rights are established pursuant to HIPAA, the Illinois Mental Health and Developmental Disabilities Confidentiality Act, state and federal alcohol and substance abuse privacy laws and the exceptions provided therein. Please review it carefully.
I. MY RESPONSIBILITIES
By law I am required to insure that your PHI is kept private. The PHI constitutes information created or noted by me that can be used to identify you. It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care. I am required to provide you with this Notice about my privacy procedures. This Notice must explain when, why, and how I would use and/ or disclose your PHI. Use of PHI means when I share, apply, utilize, examine, or analyze information within my practice; PHI is disclosed when I release, transfer, give, or otherwise reveal it to a third party outside my practice. With some exceptions, I may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, I am always legally required to follow the privacy practices described in this Notice.
Please note that I reserve the right to change the terms of this Notice and my privacy policies at any time as permitted by law. Any changes will apply to PHI already on file with us. Before Imake any important changes to my policies, Iwill immediately change this Notice and post a new copy of it in my office and on my website www.jennifer-wolff.com. You may also request a copy of this Notice from us, or you can view a copy of it in my office or on my website.
II. HOW I WILL USE AND DISCLOSE YOUR PHI.
I will use and disclose your PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of my uses and disclosures, with some examples.
A. Uses and Disclosures of PHI that Do Not Require Your Prior Written Consent.
In order to effectively provide client care, there are time when I will need to share confidential information with others beyond my agency. This includes:
1. For treatment. I can use your PHI within my practice to provide you with mental health treatment, including discussing or sharing your PHI with my trainees and interns. I may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care. Example: If a psychiatrist is treating you, I may disclose your PHI to her/him in order to coordinate your care.
2. For health care operations. I may disclose your PHI to facilitate the efficient and correct operation of my practice. This may include reviewing treatment care, training staff, accreditation surveys, consulting with attorneys or accountants to make sure I am in compliance with applicable laws.
3. To obtain payment for treatment. I may use and disclose your PHI to bill and collect payment for the treatment and services I provided you. This may include contacting the client’s guarantor, a third party collection agency, or health insurance company for prior approval of planned treatment, insurance verification, or for billing purposes.
4. To my business associates. I may contract with business associates to do work directly for me related to your treatment; this may include billing, consultation, legal, and related business practices. In such circumstances, the business associate will be subject to a Business Associate Agreement which obligates any such associates to maintain privacy consistent with the state and federal requirements outlined herein.
5. Other disclosures. Under state and federal law, information about clients may be disclosed without client consent in the following circumstances:
• Emergencies. Sufficient information may be shared to address the immediate emergency you are facing.
• Follow-up appointment/care. I may be contacting you to remind you of future appointments or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
• As required by law. This would include situation where I have a subpoena, court order, or are mandated to provide public health information, such as communicable diseases or suspected abuse, neglect, or domestic violence.
• Coroners. I am required to disclose information about the circumstances of a client’s death to a coroner who is investigating it.
• Governmental requirements. I may disclose information to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure. There also might be a need to share information with the Food and Drug Administration related to adverse events or product defects. I am also required to share information, if requested, with the Department of Health and Human Services to determine my compliance with federal laws related to health care.
• Criminal activity or danger to others. If a crime is committed on my premises or against my personnel, I may share information with law enforcement to apprehend the criminal. I also have the right to involve law enforcement when I believe someone is in imminent danger.
• If disclosure is otherwise specifically required by law.
B. Certain Uses and Disclosures Require You to Have the Opportunity to Object.
1. Disclosures to family, friends, or others. I may provide your PHI to a family member, friend, or other individual who you indicate is involved in your care or responsible for the payment for your health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.
C. Other Uses and Disclosures Require Your Prior Written Authorization.
In any other situation not described in Sections IIA or IIB above, I will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization, in writing, to stop any future uses and disclosures (assuming that I haven't taken any action subsequent to the original authorization) of your PHI by us.
III. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
A. Copies of Records. In general, you have the right to see your PHI that is in my possession, or to get copies of it; however, you must request it in writing. If I do not have your PHI, but I know who does, Iwill advise you how you can get it. You will receive a response from me within 30 days of my receiving your written request. Under certain circumstances, I may feel I must deny your request, but if I do, I will give you, in writing, the reasons for the denial. I will also explain your right to have my denial reviewed. If you ask for copies of your PHI, I will charge you not more than $.25 per page. I may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.
B. Restriction on Record. You have the right to ask that I limit how I use and disclose your PHI. While I will consider your request, I am not legally bound to agree. If I do agree to your request, I will put those limits in writing and abide by them except in emergency situations. You do not have the right to limit the uses and disclosures that I am legally required or permitted to make.
C. Contacting Options. It is your right to ask that your PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via e-mail instead of by regular mail). I am obliged to agree to your request providing that I can give you the PHI, in the format you requested, without undue inconvenience. I may not require an explanation from you as to the basis of your request as a condition of providing communications on a confidential basis. You may also request at any time to be removed from mailing lists, including, but not limited to, newsletters, educational information, and donor requests, by emailing jennifer@jennifer-wolff.com.
D. Accounting for Disclosures. You are entitled to a list of disclosures of your PHI that I have made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel. All disclosure records will be held for six years. I will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list I give you will include disclosures made in the previous six years unless you indicate a shorter
period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. I will provide the list to you at no cost, unless you make more than one request in the same year, in which case I will charge you a reasonable sum based on a set fee for each additional request.
E. Amending Your PHI. If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that I correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of my receipt of your request. I may deny your request, in writing, if I find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of my records, or (d) written by someone other than Jennifer Wolff, LMFT. Our denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and my denial be attached to any future disclosures of your PHI. If I approve your request, I will make the change(s) to your PHI. Additionally, I will tell you that the changes have been made, and I will advise all others who need to know about the change(s) to your PHI.
F. Notification of Breach. You have a right to be notified if there is a breach of your unsecured PHI. This would include information that could lead to identity theft. You will be notified if there is a breach or a violation of the HIPAA Privacy Rule and there is an assessment that the PHI may be compromised.
G. Filing Complaints. If, in your opinion, I may have violated your privacy rights, or if you object to a decision I made about access to your PHI, you are entitled to file a complaint with the person listed in Section IV below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about my privacy practices, I will take no retaliatory action against you.
IV. CONTACT PERSON FOR INFORMATION IN THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
If you have any questions about this notice or any complaints about my privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact me at:
Jennifer Wolff, LMFT
2530 Crawford Avenue
Suite 308
Evanston, IL 60201
847.962.6408
jennifer@jennifer-wolff.com
X. EFFECTIVE DATE OF THIS NOTICE
This notice went into effect on February 1, 2025.