Notice of Privacy Practices (NPP)

Notice of Privacy Practices (NPP)

Oris Counseling, LLC
Yulia Tsarenko-Carey, LPC
Phone: 971-238-4194
Email: oriscounseling(at)gmail.com

THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOU MAY HAVE ADDITIONAL RIGHTS UNDER STATE AND LOCAL LAW. PLEASE SEEK LEGAL COUNSEL FROM AN ATTORNEY LICENSED IN YOUR STATE IF YOU HAVE QUESTIONS REGARDING YOUR RIGHTS TO HEALTH CARE INFORMATION.

EFFECTIVE DATE OF THIS NOTICE

This notice went into effect on October 01, 2025.

ACKNOWLEDGEMENT OF RECEIPT OF PRIVACY NOTICE

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information (PHI).

I. MY PLEDGE REGARDING HEALTH INFORMATION

I understand that health information about you and your health care is personal. I am committed to protecting health information about you. I create a record of the care and services you receive from me. I need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by this mental health care practice.

This notice will tell you about the ways in which I may use and disclose health information about you. I also describe your rights to the health information I keep about you, and describe certain obligations I have regarding the use and disclosure of your health information.

I am required by law to:

  • Make sure that PHI that identifies you is kept private
  • Give you this notice of my legal duties and privacy practices with respect to health information
  • Follow the terms of the notice that is currently in effect
  • Notify you if a breach of your unsecured PHI occurs

I can change the terms of this Notice, and such changes will apply to all the information I have about you. The new Notice will be available upon request, in my office, and on my website.

II. WHAT I MEAN BY YOUR PROTECTED HEALTH INFORMATION

Each time you visit me, information is collected about you and your mental health. This information may include:

  • Your history: Things that happened to you as a child; your school and work experiences; your relationships and other personal history
  • Your medical and mental health history of problems and treatments
  • Reasons you came for treatment: Your problems, complaints, symptoms, or needs
  • Diagnoses: These are the clinical terms for your problems or symptoms
  • A treatment plan: This is a list of the treatments and other services that I think will best help you
  • Progress notes: Each time you come in, I write down information about your session, how you are doing, what I notice about you, and what you tell me
  • Records I get from others who treated you or evaluated you
  • Test scores and other evaluations and reports
  • Information about medications you took or are taking
  • Legal matters
  • Billing and insurance information

III. HOW I MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following categories describe different ways that I use and disclose health information. For each category of uses or disclosures, I will explain what I mean and provide examples. Not every use or disclosure in a category will be listed. However, all of the ways I am permitted to use and disclose information will fall within one of the categories.

A. For Treatment, Payment, or Health Care Operations

Federal privacy rules allow health care providers who have a direct treatment relationship with the patient/client to use or disclose the patient/client’s PHI without the patient’s written authorization to carry out the health care provider’s own treatment, payment, or health care operations.

For Treatment: I may use your PHI to provide you with treatments or services. These might include individual therapy, assessment, treatment planning, or measuring the benefits of my services

For Payment: When you request it, I will use your information to provide you with a superbill (detailed receipt) that you may use to seek partial reimbursement for our sessions from your insurance company. The superbill will include information about your diagnoses and the dates of treatment you have received. Your insurance company may contact me to find out about the treatment I expect to provide or the progress you are making. Insurers may also request to review a few of my patient records to evaluate the completeness of my record-keeping.

For Health Care Operations: I may use your PHI for operations purposes, including:

  • Sending you appointment reminders
  • Billing invoices and other documentation
  • Quality improvement activities
  • Training and supervision purposes (with all identifying information removed)
  • Business planning and management

B. Uses and Disclosures That Require Your Authorization

In most situations other than those described above, I will ask for your written authorization before using or disclosing your health information. Examples include:

1. Psychotherapy Notes: I do keep “psychotherapy notes” as that term is defined in HIPAA regulations. These are my personal notes kept separate from your clinical record. Any use or disclosure of such notes requires your written authorization unless the use or disclosure is:

  • For my use in treating you
  • For my use in training or supervising mental health practitioners
  • For my use in defending myself in legal proceedings instituted by you
  • For use by the Secretary of Health and Human Services to investigate my compliance with HIPAA
  • Required by law and limited to the requirements of such law
  • Required for certain health oversight activities
  • Required by a coroner performing duties authorized by law
  • Required to help avert a serious threat to health and safety of others

2. Marketing Purposes: I will not use or disclose your PHI for marketing purposes.

3. Sale of PHI: I will not sell your PHI under any circumstances.

4. Other Uses: Any other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke such authorization at any time by providing written notice to me. The revocation will not affect disclosures I have already made based on your authorization.

C. Uses and Disclosures That Do Not Require Your Authorization

Subject to certain limitations in the law, I can use and disclose your PHI without your authorization for the following reasons:

1. When Required by Law: I may disclose your PHI when required by federal, state, or local law. Examples include:

  • Suspected Abuse or Neglect: If I have reasonable cause to believe that a child, elder, or dependent adult has been abused or neglected, I am required by law to report this to the Department of Human Services (DHS) or other appropriate authorities.
  • Judicial and Administrative Proceedings: If you are involved in a lawsuit or legal proceeding, I may disclose PHI in response to a court or administrative order. I may also disclose PHI in response to a subpoena, discovery request, or other lawful process, although my preference is to obtain your authorization before doing so.
  • Health Oversight Activities: I may disclose PHI to agencies responsible for oversight of the health care system, including audits, investigations, inspections, and licensure activities conducted by the Oregon Board of Licensed Professional Counselors and Therapists.

2. To Avert a Serious Threat to Health or Safety: If I believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person or the public, I may disclose PHI to those persons who are reasonably able to prevent or lessen the threat. This is sometimes referred to as the “duty to warn.”

3. For Public Health Activities: I may disclose PHI to public health authorities for purposes such as preventing or controlling disease, injury, or disability.

4. For Law Enforcement Purposes: I may disclose PHI for law enforcement purposes, including reporting crimes occurring on my premises or in response to a law enforcement official’s request for information about a crime victim or suspected criminal activity.

5. To Coroners, Medical Examiners, and Funeral Directors: I may disclose PHI to coroners, medical examiners, and funeral directors as necessary to carry out their duties.

6. For Workers’ Compensation: I may disclose PHI to comply with workers’ compensation laws and other similar programs, although my preference is to obtain your authorization first.

7. For Specialized Government Functions: I may disclose PHI for military and veterans’ activities, national security and intelligence activities, protective services for the President and others, medical suitability determinations, correctional institutions, and other law enforcement custodial situations.

8. Appointment Reminders and Health-Related Benefits: I may use and disclose your PHI to contact you to remind you that you have an appointment with me. I may also use and disclose your PHI to tell you about treatment alternatives or other health care services or benefits that I offer.

D. Disclosures to Family, Friends, or Others Involved in Your Care

With your agreement, I may disclose PHI to a family member, friend, or other person whom you indicate is involved in your care or payment for your health care. If you are present and able to agree or object, I will give you the opportunity to object before making these disclosures, although I may disclose this information in an emergency if you are unable to agree or object.

For Minors (Ages 14-17): Under Oregon law, minors aged 14 and older may consent to mental health treatment without parental consent. However, Oregon law also provides that both parents have equal access to their child’s medical and mental health records, regardless of who has custody, unless parental rights have been revoked by the court. A primary goal of treatment for minors is to involve parents before treatment ends, unless there are clear clinical reasons arguing against that involvement (such as abuse or emancipation). If you are a minor, I will use my best professional judgment to determine whether and when to involve your parents in your treatment.

IV. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

You have the following rights with respect to your PHI:

1. The Right to Request Limits on Uses and Disclosures: You have the right to ask me not to use or disclose certain PHI for treatment, payment, or health care operations purposes. I am not required to agree to your request, and I may decline if I believe it would affect your health care.

2. The Right to Request Restrictions for Out-of-Pocket Expenses Paid in Full: You have the right to request restrictions on the disclosure of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or service that you have paid for out-of-pocket in full.

3. The Right to Choose How I Communicate With You: You have the right to ask me to contact you in a specific way (for example, home or cell phone, or at work) or to send mail to a different address. I will agree to all reasonable requests. Please make this request in writing.

4. The Right to Inspect and Obtain a Copy of Your PHI: You have the right to inspect and obtain a copy of your PHI contained in your clinical record. To inspect or obtain a copy of your PHI, you must submit a written request. I may charge a reasonable, cost-based fee for copying and mailing your records. I will respond to your request within 30 days. In certain limited circumstances, I may deny your request, and you may have the right to have the denial reviewed.

5. The Right to Request an Amendment: If you believe that there is a mistake or missing information in your PHI, you have the right to request that I correct or add to your record. You must make this request in writing and provide a reason for the request. I may deny your request if:

  • The information was not created by me
  • The information is not part of the records I keep
  • The information is not permitted to be disclosed
  • The information is accurate and complete

If I deny your request, you may submit a written statement of disagreement, and I will include your statement in your record.

6. The Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures I have made of your PHI. This list will not include disclosures made for treatment, payment, or health care operations, disclosures made to you, disclosures you authorized. You must submit a written request specifying the time period (which may not be longer than seven years). I will respond to your request within 60 days. The first accounting in a 12-month period is free; I may charge a reasonable fee for subsequent requests.

7. The Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice even if you have agreed to receive it electronically. You may request a copy at any time.

8. The Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.

9. The Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with me or with the U.S. Department of Health and Human Services (HHS). To file a complaint with me, contact me using the information at the top of this notice. To file a complaint with HHS, contact:

Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue SW, Washington, DC 20201
Phone: (877) 696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be penalized or retaliated against for filing a complaint.

V. ELECTRONIC COMMUNICATIONS AND TECHNOLOGY

Email and Text Messaging: I may use email or text messaging for appointment reminders and brief administrative communications. Please be aware that email and text messaging are not completely secure or confidential forms of communication. There is a risk that PHI in emails or texts could be read by third parties. I will not send sensitive clinical information via email or text. By providing your email address and/or phone number, you consent to receive appointment reminders and administrative communications via these methods. Anything you send me electronically becomes part of your legal record.

Telehealth Services: I offer telehealth services using Simple Practice, a HIPAA-compliant video platform. When using telehealth services:

  • Please ensure you are in a private location during sessions
  • Use a secure internet connection
  • Be aware that no technology is 100% secure, and there are potential risks to confidentiality

Electronic Health Records: I maintain electronic health records using Simple Practice, a HIPAA-compliant electronic health record system.