HIPAA Notice of Privacy Practices

This notice applies to Blue Sky Mental Health Clinic, LLC and its workforce when handling your protected health information in connection with clinic services in Maryland and Washington, DC. Protected health information is identifiable information about your health, health care, or payment for health care, in any form.

The clinic’s privacy duties arise under the Health Insurance Portability and Accountability Act (HIPAA), its implementing regulations, and applicable state and District of Columbia confidentiality laws. When applicable law provides greater protection or requires additional consent, those requirements limit the uses and disclosures described below. This notice is not a blanket authorization to disclose your information.

Contact the clinic’s Privacy Contact, listed below, to exercise these rights and learn how to submit a request. The clinic may need to verify your identity or a representative’s authority. Do not send medical information through the public website form.

• Inspect or receive a copy: you may ask for an electronic or paper copy of medical and billing information in the designated record set. HIPAA generally requires action within 30 days; a permitted extension must be explained in writing. Any shorter applicable legal deadline applies. A reasonable, legally permitted cost-based fee may apply. Certain records, such as separately maintained psychotherapy notes, are excluded from the HIPAA access right. If access is denied, you will receive the explanation and any applicable review rights.
• Request a correction: you may ask in writing to amend information you believe is incorrect or incomplete and explain why. HIPAA generally requires action within 60 days, subject to a permitted extension. A denial must explain the reason and how to submit a statement of disagreement.
• Confidential communications: you may request contact in a particular way or at a different address. The clinic must accommodate reasonable requests.
• Request restrictions: you may ask to limit information used or disclosed for treatment, payment, health care operations, or to people involved in your care. The clinic is not generally required to agree, except as required by law. If you pay in full out of pocket for an item or service and request that its information not be disclosed to your health plan for payment or operations, the clinic must honor that restriction unless disclosure is required by law.
• Accounting of disclosures: you may request a list of certain disclosures made in the six years before your request. Treatment, payment, operations, authorized disclosures, and other legally excluded disclosures are generally not included. HIPAA generally requires action within 60 days, subject to a permitted extension. One accounting in a 12-month period is free; a legally permitted fee may apply to additional requests, with advance notice.
• A paper copy of this notice: you may request a paper copy at any time, even if you agreed to receive it electronically.
• A personal representative: a person legally authorized to act for you may exercise applicable rights after the clinic verifies that authority. Legal exceptions, including certain minor-consent, abuse, neglect, or endangerment situations, may limit a representative’s access.
• File a complaint: you may complain to the clinic or the U.S. Department of Health and Human Services Office for Civil Rights. The clinic may not retaliate against you for filing a complaint.

Subject to the additional confidentiality protections described in this notice, HIPAA permits certain uses and disclosures without a separate HIPAA authorization:

• Treatment: to provide or coordinate your care, such as discussing medication with a treating clinician or sending a prescription to a pharmacy.
• Payment: to obtain payment, verify benefits, or submit claims, such as sharing necessary billing information with your health plan.
• Health care operations: for activities such as quality review, care coordination, auditing, and practice administration. These activities are subject to applicable legal limits, including minimum-necessary requirements where they apply.
• Services on behalf of the clinic: when a service provider needs protected health information to perform an authorized function, applicable law requires appropriate confidentiality protections and, where required, a business associate agreement. This describes a legal requirement, not a certification of any website vendor.

The clinic may contact you about appointments, treatment alternatives, or health-related services as permitted by law and subject to your confidential-communication requests. A use allowed under HIPAA may still require consent or be prohibited under a more protective law.

Only when the legal conditions are met, and subject to more protective laws, information may be used or disclosed for:

• Public health reporting, product recalls, adverse drug reactions, and legally permitted reports of abuse, neglect, or domestic violence.
• Preventing or reducing a serious threat to health or safety, within the applicable legal standards.
• Health oversight, licensing, audits, and investigations authorized by law, including disclosures to HHS to determine compliance with HIPAA.
• Research only when the required authorization, waiver, or other legal conditions are satisfied; this is not a statement that the clinic conducts research.
• Workers’ compensation, certain law-enforcement requests, and authorized military, national-security, or correctional functions.
• Legally authorized organ or tissue donation activities, or disclosures to coroners, medical examiners, or funeral directors.
• Judicial or administrative proceedings when the applicable court-order, subpoena, authorization, notice, or protective-order requirements are satisfied.
• Other disclosures required by applicable law, limited to what that law requires.

A request from an insurer, employer, attorney, or law-enforcement agency does not by itself authorize disclosure. The additional protections for mental health records, psychotherapy notes, and substance use disorder records below apply to all categories above.

Where permitted by applicable law, you may agree or object to sharing relevant information with family, friends, or others involved in your care or payment, or for disaster relief. If you cannot express a preference, HIPAA may permit limited disclosure based on professional judgment and your best interests. More protective mental health confidentiality rules may require written consent instead.

Most uses and disclosures of separately maintained psychotherapy notes, marketing uses and disclosures requiring authorization, and disclosures constituting a sale of protected health information require your written authorization, subject to limited legal exceptions. Uses and disclosures not described in this notice also require authorization unless otherwise permitted or required by applicable law.

You may revoke an authorization in writing through the Privacy Contact, except to the extent the clinic has already acted in reliance on it or another legal exception applies. Revocation does not undo disclosures already made. If you receive a legally permitted fundraising communication, you have the right to opt out of further fundraising communications; treatment or payment cannot be conditioned on that choice. This does not state that the clinic conducts fundraising.

Information disclosed to a recipient may be redisclosed by that recipient and may no longer be protected by HIPAA. Other laws, including applicable mental health confidentiality and Part 2 rules, may continue to restrict disclosure.

Maryland: the Maryland Confidentiality of Medical Records Act, Health–General §§ 4-301 through 4-309, includes additional protections for mental health records. When mental health records are disclosed without authorization, only information relevant to the permitted disclosure may be released. Records involving group or family therapy, a provider’s separately maintained personal notes, and certain psychological testing materials have additional restrictions. General HIPAA permissions do not override these protections.

Washington, DC: the Mental Health Information Act, D.C. Code Title 7, Chapter 12, generally requires voluntary written authorization to disclose mental health information unless a specific statutory exception applies. It also restricts redisclosure and imposes requirements on the scope and duration of authorizations. The clinic must meet these requirements rather than relying solely on HIPAA’s general permissions.

Minors and specially protected information: laws governing minor consent and access, and certain categories of information such as HIV-related or genetic information, may require additional consent or restrict disclosure. A parent’s, guardian’s, or representative’s rights depend on applicable law and the circumstances. Where a more protective law applies, its limits govern.

If the clinic holds substance use disorder patient records protected by 42 U.S.C. § 290dd-2 and 42 CFR Part 2, additional federal protections apply. This does not mean that every mental health record is a Part 2 record or that the clinic is a federally assisted Part 2 treatment program.

Part 2 records, or testimony about their contents, cannot be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a qualifying court order issued after notice and an opportunity to be heard, together with a subpoena or other legal requirement compelling disclosure. This restriction applies even to the disclosure categories described elsewhere in this notice.

A legally valid Part 2 consent may authorize certain treatment, payment, and health care operations disclosures. A HIPAA-covered recipient may then be permitted to redisclose those records under HIPAA, subject to the continuing restriction on proceedings against you and any other applicable limits. Separately maintained substance use disorder counseling notes require the separate consent required by law.

If Part 2 information would be used for fundraising, you must first receive clear, conspicuous notice and a choice about receiving those communications. You may ask the Privacy Contact which protections apply to a particular record.

• Maintain the privacy and security of protected health information as required by applicable law.
• Provide this notice and follow the privacy practices and duties described in it.
• Notify affected individuals following a breach of unsecured protected health information when required by law.
• Use or disclose information only as described in this notice, as otherwise permitted or required by applicable law, or with a valid authorization.
• Apply the additional protections required by applicable federal, Maryland, and District of Columbia laws.

You may also complain directly to the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint, by calling 1-800-368-1019 (TDD: 1-800-537-7697), or by writing to HHS Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201. HHS complaints generally must be filed within 180 days after you learned of the issue; HHS may extend that period for good cause.

You do not need to complain to the clinic first. The clinic may not retaliate against you for exercising your rights or filing a complaint.

You may request a copy of this notice from the clinic at any time. The clinic must provide its notice as required at the start of care, make a good-faith effort to obtain an acknowledgment when required, and make the current notice available at its offices and on this website. An acknowledgment of receipt is not consent to otherwise unauthorized disclosures.

The clinic may revise this notice as permitted by law. Revised terms may apply to information already held as well as information received later. A revised notice must display its effective date and be made available through the office and website. Any additional notice required by applicable law must also be provided.