Privacy Practices

Part 1 · Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This notice applies to Michelle Moses, LMFT, a California licensed marriage and family therapist (License #LMFT 163737). It follows the federal Health Insurance Portability and Accountability Act (HIPAA) and California law, including the Confidentiality of Medical Information Act. When California law gives you more protection than HIPAA, I follow California law.

My responsibilities

• I am required by law to keep your protected health information (PHI) private and secure.
• I must give you this notice and follow the version currently in effect.
• I will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• I will not use or share your information other than as described here unless you give me permission in writing. You can change your mind at any time by telling me in writing.

How your information is used and shared

For treatment

I use your information to provide your care. With your consent, I may also coordinate with other professionals involved in your care, such as a physician, psychiatrist, or another therapist.

For payment

I may share information with your health plan, or a billing service working for me, to get paid for your sessions. This can include dates of service, diagnosis, and the type of service provided.

For health care operations

I may use information to run the practice and improve care, for example for quality reviews, licensing and audit requirements, or consultation with another clinician. When I consult, I share as little identifying information as possible.

With business associates

Some services are provided by companies that work on my behalf, such as electronic health record, billing, telehealth, secure email, and secure fax providers. Each one signs a business associate agreement that requires it to protect your information.

With people involved in your care

If you agree, or don’t object when given the chance, I may share relevant information with a family member or other person you identify who is involved in your care.

When I need your written permission

I will ask for your written authorization before I:

• Share psychotherapy notes, which are any notes I keep separately from your record about the content of our sessions, except in the limited situations the law allows.
• Use your information for marketing.
• Sell your information. I never do this.
• Use or share your information for any purpose not described in this notice.

You may revoke an authorization in writing at any time. Revoking it stops future sharing but does not undo sharing that already happened while it was in effect.

When the law requires or allows sharing

In these situations I may share information without your authorization, and only as much as is necessary:

• Abuse or neglect. As a mandated reporter, I must report known or reasonably suspected abuse or neglect of a child, an elder, or a dependent adult.
• Serious threat to safety. If you communicate a serious threat of physical violence against a reasonably identifiable person, California law requires me to take steps to protect them, which may include warning them and notifying law enforcement. I may also share information to prevent a serious and imminent threat to your own safety.
• Courts and legal proceedings. I may share information in response to a court order. When I receive a subpoena without a court order, I will claim privilege on your behalf where the law allows and will not release records without your authorization or a legal requirement to do so.
• Health oversight. To agencies that oversee health care, such as the California Board of Behavioral Sciences, for audits, investigations, or licensing.
• Other legal requirements. To public health authorities, coroners, workers’ compensation programs, or law enforcement, and for specialized government functions, only when the law requires or permits it.

Minors and parents or guardians

Some minors age 12 and older may consent to their own outpatient mental health treatment under California law. When a minor consents to their own care, a parent or guardian generally may not access the minor’s records without the minor’s permission.

When a parent or guardian consents to a minor’s treatment, they generally have the right to access the minor’s records. I may deny that access when I determine it would harm my professional relationship with the minor or the minor’s physical safety or psychological well-being.

For children whose parents are separated or divorced, I follow the current custody order, and I ask for a copy before treatment begins.

Your rights

See and get a copy of your records

You may ask to see or get a copy of your health information, on paper or electronically. I will respond within the time frames California and federal law require, and I may charge a reasonable, cost-based fee for copies.

In rare cases, I may determine that seeing your records directly is not clinically safe, because it is reasonably likely to endanger your life or physical safety or someone else’s. If I make that decision, I will note it in your record, explain my reasons to you in writing, and you will have two options:

• Ask for a review. Another licensed health care professional who was not involved in my decision will review it, and I will follow their decision.
• Choose a professional to receive your records. You may name a licensed physician, psychologist, marriage and family therapist, clinical social worker, or professional clinical counselor, and I will send your records to them with your written authorization.

Ask me to correct your records

If you believe information in your record is incorrect or incomplete, you may ask me in writing to correct it. If I decline, I will explain why in writing, and you may submit a statement of disagreement to be added to your record. Under California law, you may also add a written addendum of up to 250 words for each item you believe is incorrect or incomplete, and it will become part of your record.

Ask for confidential communication

You may ask me to contact you in a particular way, such as only by phone or only at a certain address. I will agree to reasonable requests.

Ask me to limit what I use or share

You may ask me not to use or share certain information. I am not required to agree in most cases. However, if you pay for a service in full out of pocket, you may ask me not to share information about that service with your health plan, and I will agree unless the law requires me to share it.

Get a list of disclosures

You may ask for a list of the times I shared your information in the six years before your request, other than for treatment, payment, operations, and certain other purposes. One list per year is free.

Get a copy of this notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

Choose someone to act for you

If someone is your legal guardian or has a valid health care power of attorney, they may exercise your rights for you. I will confirm their authority first.

Telehealth, email and text messages

Sessions take place on a secure, HIPAA-compliant telehealth platform. Clinical records are kept in a secure electronic health record. I use HIPAA-compliant email and secure fax for clinical information.

Regular email and text messages are not fully secure. I use them only for scheduling and reminders, and only with your permission. Please don’t send clinical details or emergencies by text or regular email.

I accept clinical records and documents only by secure fax, HIPAA-compliant email, or the client portal. I do not accept clinical documents by postal mail.

Keeping records

As California law requires, I keep client records for at least seven years after treatment ends. For clients who were minors, I keep records for at least seven years after the client turns 18, whichever is later. Records are then destroyed securely.

Questions and complaints

If you believe your privacy rights have been violated, you may file a complaint with me using the contact information below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints or 1-877-696-6775.

Concerns about professional conduct may also be directed to the California Board of Behavioral Sciences.

You will not be penalized or retaliated against in any way for filing a complaint.

Changes to this notice

I may change this notice, and the changes will apply to all information I hold about you. The current notice is always posted on this page, and a copy is available on request.

Part 2 · Website privacy

What the website collects

• Information you choose to share, such as your name, email, phone number, and message when you request a consultation, book a time, or download a free guide.
• Basic technical information collected automatically by the website platform, such as browser type, device, pages visited, and cookies used to keep the site working and understand how it is used.

Contacting me through the website does not make you a client, and website forms are not part of your health record. Please don’t share detailed health information through website forms.

How it is used

• To respond to you, schedule consultations, and send resources you asked for.
• To send occasional updates if you sign up for them. Every email includes an unsubscribe link.
• To keep the website secure and improve it.

I do not sell, rent, or trade your personal information. Service providers that host the website, scheduling, and email tools process information only on my behalf.

Text messages

If you give your phone number and agree to receive texts, you may get messages about appointments, consultations, and resources you requested. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.

Your choices

• You may ask me to access, correct, or delete the personal information you submitted through the website. Clinical records follow the retention rules in Part 1.
• You can block or delete cookies in your browser settings. Some parts of the site may not work as well without them.
• This website is not directed to children under 13, and I do not knowingly collect their information online. If you believe a child has submitted information, please contact me and I will delete it.
• I use reasonable safeguards to protect information, but no method of sending information over the internet is completely secure.

Contact

If you are in crisis, call or text 988 (Suicide & Crisis Lifeline) or call 911. See the Terms & Conditions for the ground rules of using this website.