HIPAA POLICY

​This Notice describes how your health information may be used and disclosed, and how you can access this information. Please review it carefully.

​

Empowered Harmony Counseling, Psychiatry & Wellness Center (EHC) values your privacy and is committed to protecting your health information. We follow the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable state laws to ensure your information remains secure and confidential.

​

1. Our Legal Duty

EHC is required by law to:

• Maintain the privacy and security of your Protected Health Information (PHI).

• Provide you with this Notice that explains our legal duties and privacy practices.

• Notify you promptly if a breach occurs that may compromise your PHI.

• Follow the terms of this Notice currently in effect.

• Comply with all federal and state privacy laws, including HIPAA (45 CFR Parts 160 and 164).

​

2. How We Use and Disclose Health Information

EHC may use or disclose your health information for the following purposes:

a. Treatment
To provide, coordinate, or manage your care and related services.
Example: A therapist may consult with your psychiatrist to ensure continuity of care.

b. Payment
To bill and collect payment from insurance companies, payers, or you directly.
Example: We may submit necessary billing information to your insurance provider for reimbursement.

c. Health Care Operations
For administrative, quality assurance, compliance, training, and business functions necessary to support our services.
Example: Supervisors may review de-identified session notes for quality improvement.

d. Appointment Reminders & Service Updates
To contact you about upcoming sessions, reminders, or new services that may benefit your care.

e. As Required by Law
To comply with federal, state, or local laws, including reporting abuse, neglect, or threats to safety.

f. Public Health & Oversight Activities
To report information for oversight, compliance audits, or investigations required by authorized agencies.

g. Legal or Safety Exceptions
If disclosure is required to prevent a serious threat to health or safety.

h. Authorized Individuals
To family members or others involved in your care with your consent or as permitted by law.

​

3. Other Permitted Uses and Disclosures

We may also disclose PHI in the following legally allowed or required circumstances:

• Public health activities (disease reporting).

• Reporting abuse, neglect, or domestic violence.

• Health oversight agency audits or investigations.

• Legal proceedings (court orders, subpoenas).

• Law enforcement purposes (limited situations).

• Coroner, medical examiner, or funeral arrangements.

• Organ or tissue donation organizations.

• Workers’ compensation claims.

• Approved research with appropriate safeguards (e.g., IRB approval).

• National security and military purposes.

• Disaster relief efforts.

• De-identified data used internally for research or analytics.

​

4. Highly Confidential Information

Specific categories of PHI are protected by federal and state law. EHC will only disclose these with your explicit written authorization unless required by law:

• Mental health treatment records.

• Substance use disorder treatment (42 CFR Part 2).

• HIV/AIDS testing or status.

• Genetic testing results.

• Reproductive health services.

• Sexual assault or domestic violence records.

​

5. Business Associates

We may share PHI with third-party service providers, known as Business Associates, who assist us with billing, technology, or compliance.
All Business Associates sign legally binding agreements requiring them to protect your information in accordance with HIPAA regulations.

​

6. Electronic Communication & Telehealth

EHC uses HIPAA-compliant platforms to protect your privacy during telehealth sessions.

​

Communication Disclaimer:
If you choose to communicate via email, text, or video, EHC will take reasonable steps to safeguard your data. However, no system is completely secure. Please avoid sending Protected Health Information (PHI) via Google Voice, as it is not HIPAA-compliant.

​

Providers may offer alternative HIPAA-compliant communication options. By using these services, you acknowledge and accept inherent privacy risks.

​

7. Your Rights

You have the right to:

1. Access or Copy Your Record – Request paper or electronic copies. Written requests will be processed within 60 days (or 90 days with written notice of a delay). Providers may deny a release under certain conditions.

2. Request Corrections – Ask us to amend your record if you believe information is incorrect or incomplete. Denials will include a written explanation.

3. Request Confidential Communications – Ask us to contact you at a specific phone number, email, or mailing address.

4. Request Restrictions – Limit how we use or share your PHI. We are not required to agree, but we will consider reasonable requests.

5. Request an Accounting of Disclosures – Receive a list of disclosures made in the last six years.

6. Choose a Representative – Appoint a legal guardian or power of attorney to act on your behalf.

7. Receive Breach Notifications – Be informed promptly if your PHI is compromised.

8. File a Complaint – File a complaint without fear of retaliation if you believe your privacy rights have been violated.

 

To exercise your rights, contact the Privacy Officer at: support@empoweredharmony.com

​

8. Your Choices

You can choose whether to:

• Share information with family members or others involved in your care.

• Allow us to contact you for fundraising (EHC does not currently conduct fundraising).

• Determine how we send reminders (text, email, voicemail).

• Permit use of anonymized data for research or improvement purposes.

 

Provide preferences in writing to your provider or the Privacy Officer.

​

9. When We Need Written Authorization

EHC will not use or disclose your information for the following without your written authorization:

• Marketing purposes.

• Sale of information.

• Most uses of psychotherapy notes.

 

You may revoke authorization at any time by written request. The revocation will not affect disclosures made before the date it was received.

 

To authorize a disclosure beyond these listed purposes, you may request a HIPAA Authorization Form from our Privacy Officer.

 

10. Our Responsibilities

EHC is required by law to:

• Maintain the privacy and security of your PHI.

• Use or disclose PHI only as described in this Notice or required by law.

• Notify you in writing within 60 days if a breach occurs that may compromise your PHI.

• Comply with all state and federal confidentiality laws governing mental health, substance use, and medical information.

 

11. Record Retention and Disposal

EHC retains patient records in accordance with federal and state law, typically for a minimum of seven years after services end or after a minor patient turns 18.

Once the retention period expires, records are securely destroyed using approved physical and digital methods.

 

12. Multi-State and State-Specific Privacy Compliance

Because EHC operates across multiple states, we comply with both federal HIPAA standards and state laws.
If a state law provides greater privacy protection than HIPAA, EHC will follow the stricter standard to ensure your highest level of privacy.

 

13. Hybrid Entity Disclosure

EHC functions as a hybrid entity, contracting with independently licensed providers, clinicians, and wellness professionals.
Each contractor maintains their own clinical license, ethical responsibilities, and liability insurance.

EHC manages administrative systems, scheduling, billing, and compliance infrastructure, but does not supervise or control independent providers’ professional judgment or clinical care.

 

14. Changes to This Notice

EHC may update this Notice as needed to reflect changes in our practices or legal requirements.
The most current version will be posted on our website and available upon request.

If there are significant changes, we will notify you through the client portal or by email.
Continued use of services indicates acknowledgment and understanding of the updated Notice.

 

15. Questions or Complaints

If you have questions or wish to exercise your rights, contact:

Empowered Harmony Counseling, Psychiatry & Wellness Center
Email: support@empoweredharmony.com
Website: www.empoweredharmony.com

 

If you believe your privacy rights have been violated, you may also file a complaint with the:
U.S. Department of Health and Human Services, Office for Civil Rights
Website: www.hhs.gov/ocr/privacy/hipaa/complaints

There will be no retaliation for filing a complaint.

 

16. Acknowledgment of Receipt

You will be asked to sign a separate Acknowledgment of Receipt form at the start of services.
You may decline to sign, but EHC will document that this Notice was offered to you.

​

HIPAA Notice of Privacy Practices Acknowledgment

 

By using this website, you acknowledge that you have received and had the opportunity to review Empowered Harmony Counseling, Psychiatry & Wellness Center’s Health Insurance Portability and Accountability Act of 1996 (HIPAA) Notice of Privacy Practices.

 

This Notice describes how your health information may be used and disclosed, and how you can access this information. A complete copy of the Notice is available in the office in print form.

 

You understand that Empowered Harmony Counseling, Psychiatry & Wellness Center may update or revise its Notice of Privacy Practices at any time. You may contact the organization at any time to request the most current version.

 

Use of this website indicates your acknowledgment and understanding of these terms.

​