I. OUR PLEDGE REGARDING HEALTH INFORMATION

At Willow & Fox Psychotherapy, PLLC., we are committed to protecting the privacy and confidentiality of your medical, mental health, and substance use (SUD) information. Your privacy is protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 CFR Part 2 for SUD treatment records, the Texas Health and Safety Code (Chapter 611- Mental Health Records), the Texas Occupations Code, and applicable ethical standards, including those established by the American Psychological Association (APA) and the Texas Behavioral Health Executive Council (BHEC).

This Notice applies to all records of care and services provided by our practice. It explains how your Protected Health Information (PHI) may be used or disclosed, and how you can access this information.

We are required by law to:

• Maintain the privacy of your PHI;

• Provide you with this Notice of our legal duties and privacy practices; and

• Comply with the current terms of this Notice.

We reserve the right to revise this Notice. Any revisions will apply to both existing and future PHI. Updated Notices will be posted in our office and on our website and will be available upon request.

II. HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION

We may use or disclose your PHI for:

Treatment, Payment, and Health Care Operations (No Authorization Required)

• Treatment (e.g., coordinating care with another healthcare provider)

• Payment (e.g., submitting insurance claims)

• Healthcare Operations (e.g., internal administrative review).

Your psychologist may consult with other licensed professionals for treatment purposes.

In accordance with 22 Texas Administrative Code § 465.18, disclosures are limited to the minimum necessary information unless otherwise legally or ethically justified (e.g., coordination of care).

Legal Requests and Court Orders  Under Texas Health & Safety Code § 611.004, your mental health records are confidential but may be disclosed:

• With your written authorization;

• In response to a valid court order;

• If necessary to protect you or others from a serious and imminent threat;

• For professional oversight by licensing boards;

• As otherwise required by law or ethical standards.

Business Associates / Third-Party Services

We may share your PHI with trusted third-party vendors (e.g., electronic health records, billing services, or HIPAA-compliant telehealth platforms) who assist in our operations. These parties are required by law to safeguard your information through signed Business Associate Agreements (BAAs).

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

Federal law provides additional privacy protections for records related to the diagnosis, treatment, or referral for treatment of a substance use disorder under 42 C.F.R. Part 2 (“Part 2”).

If this practice creates, receives, or maintains substance use disorder (SUD) treatment records subject to Part 2, the following protections apply:

• SUD records are subject to more stringent confidentiality protections than other PHI.

• In many circumstances, your written consent is required before SUD records may be used or disclosed, including for treatment, payment, or healthcare operations, unless otherwise permitted by law (e.g., medical emergencies, court orders, or mandated reporting).

• SUD treatment records, or testimony about their content, may not be used in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a court order issued in accordance with Part 2.

• You have the right to request an accounting of certain disclosures of your SUD records, as permitted by law.

• Redisclosure: Information disclosed to others may no longer be protected under HIPAA or Part 2 once shared; recipients may be able to redisclose it.

• Fundraising: If SUD records are used for fundraising, you must be given a clear opportunity to opt out.

• Where federal or state laws provide more stringent privacy protections than HIPAA, this practice will follow the more protective requirements.

III. ELECTRONIC COMMUNICATION 

Willow & Fox Psychotherapy, PLLC. utilizes secure, HIPAA-compliant platforms (including a client portal) for electronic communication. However, all electronic communication, including email, portal messaging, and text, carries inherent privacy risks.

By choosing to communicate through electronic means, you acknowledge and accept these risks. PHI will not be transmitted electronically without your written consent when required by law. We encourage clients to limit electronic communications to administrative matters (e.g., scheduling) rather than clinical discussions.

IV. USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

We will obtain your written authorization before using or disclosing your PHI for:

• Use of Psychotherapy Notes (as defined under HIPAA, 45 CFR § 164.501);

• Marketing purposes;

• Sale of your PHI;

• Other uses not described in this Notice.

You may revoke your authorization at any time in writing, except to the extent that action has already been taken in reliance on that authorization.

V. USES AND DISCLOSURES NOT REQUIRING YOUR AUTHORIZATION

We may use or disclose your PHI without your written authorization when required or permitted by law, including:

• Reporting suspected abuse, neglect, or exploitation of a child, elderly person, or adult with a disability (Texas Family Code § 261.101);

• Preventing or reducing a serious threat to your health or public safety;

• Complying with health oversight activities (e.g., investigations or audits);

• Cooperating with law enforcement in limited circumstances;

• Processing workers' compensation claims;

• Participating in judicial or administrative proceedings as required.

For clients with SUD records, see Section II: Special Protections for Substance Use Disorder Records.

VI. MINOR SPECIFIC DISCLOSURES

For clients under age 18:

• Texas law requires written parental or guardian consent before outpatient mental health treatment for minors (Texas Health & Safety Code §32.004).

• Parents/guardians generally have the right to access their minor child’s mental health records unless limited by law.

• Any communication with third parties regarding a minor’s treatment, care, or records will require appropriate authorization under state and federal law unless an exception applies (such as risk of harm).

• If your psychologist believes the minor is in danger or may pose a danger to others, your psychologist will notify the parent/guardian immediately and other authorities if required.

VII. DISCLOSURES YOU MAY OBJECT TO

Unless you object, we may disclose PHI to a family member, friend, or other individual involved in your care or payment for your care. You may object verbally or in writing at any time.

In emergency situations, we may make these disclosures prior to obtaining your consent when necessary to protect your health or safety.

VIII. YOUR RIGHTS UNDER HIPAA, TEXAS LAW, AND ETHICAL GUIDELINES

Right to Request Restrictions:  You may request restrictions on certain uses or disclosures of your PHI. While we are not required to agree to all requested restrictions, we will comply with restrictions related to services paid entirely out-of-pocket (45 CFR § 164.522).

Right to Confidential Communications:  You may request that we communicate with you in a specific way or at a specific location. We will accommodate reasonable requests.

Right to Access and Copy Your PHI:  You may request a copy of your records, excluding psychotherapy notes. We will respond within 15 business days in accordance with Texas Health & Safety Code § 611.0045. A reasonable fee may apply.

Right to Amend PHI:  If you believe information in your record is inaccurate or incomplete, you may submit a written request for amendment. We will respond within 60 days.

Right to an Accounting of Disclosures:  You may request a list of certain disclosures of your PHI made without your authorization within the past six years, excluding disclosures for treatment, payment, or healthcare operations.

Right to Receive a Paper or Electronic Copy of This Notice:  You have the right to receive a paper or electronic copy of this Notice at any time, even if you previously agreed to receive it electronically.

IX. BREACH NOTIFICATION  In the event of a breach involving your unsecured PHI, we will notify you without unreasonable delay and in accordance with applicable federal and Texas breach notification laws (HIPAA §164.404; Texas Business & Commerce Code §521).

This notification will include:

• A description of what occurred;

• The types of information involved;

• Actions you should take to protect yourself;

• Actions to investigate and prevent future occurrences.

X. COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with:

• WILLOW & FOX PSYCHOTHERAPY, PLLC. (see contact information below)

• The Texas Behavioral Health Executive Council (BHEC):  https://www.bhec.texas.gov,

• The U.S. Department of Health and Human Services, Office for Civil Rights:  https://www.hhs.gov/ocr

You will not be retaliated against or penalized for filing a complaint.