Notice of Privacy Practices

THIS NOTICE IS REQUIRED BY THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) AND 42 CFR PART 2

Practice Name: Washington Psychological Wellness
Contact: info@washington-psychwellness.com
Website: https://washington-psychwellness.com/
Effective Date of Notice: 3/10/2026

This Notice describes how we may use and disclose your health information and your rights to access it under federal and Maryland law.

PART I: YOUR INFORMATION, RIGHTS, AND
RESPONSIBILITIES OF THE PRACTICE.

HOW WE USE AND SHARE YOUR INFORMATION

We require your written authorization before using or disclosing your health information, except when required by law, court order, or necessary for treatment. Specific uses and disclosures:

Family/friends involved in your care (with written authorization only)
Assist in disaster relief efforts – only as required or permitted by law
Treatment and care coordination
Marketing (with written authorization; we never sell your information)
Billing and insurance claims (with authorization or as necessary for payment)
Operations and quality improvement (no external sharing without authorization unless required by law)
Public health and safety reporting (when required by law, including mandatory abuse/neglect reporting)
Participate in approved health research – only with your signed written authorization or as otherwise permitted by law
Legal compliance (when required by law)
Cooperate with a medical examiner, coroner, or funeral director – only when required by law
Prevent serious and imminent threats to health or safety (as permitted by law and professional ethics)
Workers’ compensation, law enforcement, and government requests (when compelled by law or court order)
Court orders and subpoenas (only as compelled by law; we will notify you when permitted)

YOUR RIGHTS

You have the following rights regarding your health information. Contact us with questions using the information on page 1.

1. Receive a Copy of Your Medical Record, Including the Right to Direct Us to Transmit a Copy to a Third Party You Designate.

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you in the format you request if it is readily producible in that format. You may also direct us to transmit your health information directly to another person or entity you designate. Ask us how to do this.

We will provide a copy or summary of your health information within 21 working days of your request, as required by Maryland law. We may charge a reasonable, cost-based fee limited to: (a) labor costs for copying (paper or electronic), (b) supplies for creating the copy or electronic media, and (c) postage if you request mailing. We cannot charge retrieval fees or other administrative costs. Under Maryland law, we may not refuse to disclose a medical record because of a patient’s failure to pay for health care we have provided.

2. Ask Us to Correct Your Medical Record.

You have the right to ask us to amend (correct or add to) health information about you that you believe is incorrect or incomplete. Your request must be in writing and must include the reason you are requesting the amendment. Under Maryland law, you may request additions to or corrections of your medical record, but you may not have information deleted from your record.

We will act on your request within 60 days. If we need additional time, we may extend this period by up to 30 days, provided we give you a written explanation of the delay and the date by which we will respond. We may deny your request if we determine that the information: (a) was not created by us (unless the originator is no longer available to act on the request); (b) is not part of the records we maintain for making decisions about you; (c) is not available for your inspection (e.g., psychotherapy notes); or (d) is accurate and complete. If we deny your request, in whole or in part, we will provide you with a written denial that explains the basis for the denial, your right to submit a written statement of disagreement, and how to file a complaint with us or with the U.S. Department of Health and Human Services. If you submit a statement of disagreement, we will append it to your record, and we will include it (or a summary) with any future disclosure of the disputed information. Even if you do not submit a statement of disagreement, you may ask us to include your original amendment request and our denial with any future disclosures. Under Maryland law, if we refuse to make the requested change, we must also notify you of any internal review procedures we have established. We are required to provide notice of any change we make – or a copy of your statement of disagreement – to anyone you designate and to anyone to whom we disclosed the inaccurate, incomplete, or disputed information within the previous six months. If we disclose the amended record in the future, we must include a copy of any amendment, correction, or statement of disagreement.

3. Request Confidential Communications.

You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may ask us to contact you only at a particular phone number, to use a specific email address, to send correspondence to a mailing address other than your home, or to communicate with you only through a specific method (such as by mail rather than by phone). This right is especially important if you believe that receiving communications through normal channels could put you at risk. You do not need to explain the reason for your request.

We are required to accommodate all reasonable requests. We will not ask you to explain why you are making the request. We may ask you to specify an alternative address or method of contact and, when appropriate, to provide information about how payment will be handled. We will not condition accommodation on payment of any outstanding balance. Your request should be made in writing, and we will respond promptly.

4. Ask Us to Limit What We Use or Share.

You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree, and we may say “no” if, for example, the restriction could affect your care. Even if we agree, we may still share your information if you need emergency treatment.

If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information with your health insurer for payment or operational purposes. We must agree unless a law requires us to share that information. If you have substance use disorder records subject to 42 CFR Part 2, you have the same right to restrict disclosures of those records to your health plan for services you have paid for in full.

5. Get a List of Those with Whom We’ve Shared Information.

You can ask for a list (accounting) of the times we have shared your health information during the six years prior to the date of your request, including who received it and why. If you have substance use disorder records protected by 42 CFR Part 2, you also have the right to: (a) an accounting of electronic record disclosures for the past 3 years (per 42 CFR 2.25); (b) an accounting of all other disclosures made with consent that meets the requirements of 45 CFR 164.528(a)(2) and (b) through (d); and (c) a list of disclosures made by any intermediary for the past 3 years (per 42 CFR 2.24).

The accounting will include all disclosures except those made for treatment, payment, and health care operations, and certain other disclosures (such as disclosures you requested, disclosures incident to otherwise permitted uses, disclosures to persons involved in your care, and disclosures for national security, to correctional institutions or law enforcement, or as part of a limited data set). We will provide one accounting per year at no charge. If you request an additional accounting within 12 months, we may charge a reasonable, cost-based fee.

6. Get a Copy of this Notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

7. Choose Someone to Act for You.

If someone has legal authority to make health care decisions on your behalf, that person is your “personal representative” and may exercise your rights regarding your health information. Personal representatives may include: (a) a health care agent under a power of attorney or advance directive; (b) a court-appointed guardian; (c) the executor or administrator of a deceased patient’s estate; or (d) a parent or guardian of a minor child, except where Maryland law permits the minor to consent to treatment independently (e.g., under Health-General 20-104, a minor age 12 or older may consent to outpatient mental health treatment without parental involvement). Under Maryland law, a “person in interest” may also exercise certain rights with respect to medical records. For substance use disorder records subject to 42 CFR Part 2, a personal representative’s authority is limited to records relevant to their representation.

We will verify a personal representative’s identity and legal authority before acting on their requests, and may require supporting documentation (e.g., power of attorney, court order, letters of administration). We may refuse to recognize a personal representative if we reasonably believe the person has subjected you to abuse, neglect, or domestic violence, or that recognizing them could endanger you, and we determine in our professional judgment that it is not in your best interest.

8. File a Complaint if You Believe Your Rights Have Been Violated.

If you believe your privacy rights have been violated, you may file a complaint directly with our practice using the contact information provided on page 1 of this Notice.

You may also file a complaint with: (a) the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting
www.hhs.gov/hipaa/filing-a-complaint (complaints must be filed within 180 days of when you knew or should have known of the alleged violation); or (b) the Maryland licensing board that oversees your provider’s professional license, using the contact information available on the Maryland Department of Health website.

We will not retaliate against you in any way for filing a complaint, whether with our practice, a state or federal agency, or a licensing board.

YOUR CHOICES ABOUT HOW WE USE AND SHARE YOUR HEALTH INFORMATION.

Releases that Require Your Authorization. We take your privacy seriously. As a general rule, we will not share your mental health records with anyone unless you give us written permission to do so, or the law requires or permits us to share them. If we do need your written permission, we will ask you to sign an authorization form. That form will explain: (a) what information we would share; (b) who would receive it; (c) why it is being shared; and (d) when the permission expires. You can revoke your consent and authorization at any time by letting us know in writing. We will never require you to sign an authorization as a condition of receiving treatment.

Family, Friends, and Caregivers: You may designate which individuals involved in your care or payment for your care may receive your information, specify what may be shared, and limit or revoke this permission at any time.

Disaster Relief: We may share limited information with authorized disaster relief organizations (such as the American Red Cross) so that your family or others responsible for your care can be notified of your condition, status, and location.

Marketing: We will not use or disclose your information for marketing purposes without your written authorization. You may refuse, and your treatment will not be affected.

Psychotherapy and Treatment Notes: We will not disclose psychotherapy notes without both your written authorization and the therapist’s consent. Psychotherapy notes are a therapist’s personal notes about counseling sessions, kept separately from your clinical file. They are distinct from treatment notes (e.g., diagnosis, treatment plan, progress notes, session dates, and medications), which are part of your clinical record and subject to the access, amendment, and disclosure rules described elsewhere in this Notice.

SUD Counseling Notes: Under 42 CFR Part 2, we will not use or disclose substance use disorder (SUD) counseling notes without your specific written consent. Your treatment will not be conditioned on signing such consent.

Research: We will not use or disclose your identifiable health information for research purposes without your written authorization, unless an exception under federal law applies.

IMPORTANT DISCLOSURES AND INFORMATION ABOUT YOUR HEALTH INFORMATION.

1. Prohibited Uses and Disclosures. There are certain things we will never do with your information, no matter what the circumstances.

• Sale of Information: We will never sell your health information to anyone, for any reason. This is true even if you were to give us written permission to do so – we would not honor such a request.
• Reproductive Health Protections: Federal law prohibits us from sharing your information to investigate or punish anyone for seeking, obtaining, providing, or helping someone access lawful reproductive health care. For example, we cannot share your records with law enforcement or any other person or agency that wants to use them to identify or take action against someone for obtaining a lawful reproductive health procedure. If we receive a request for your records that could relate to reproductive health care, for example, for health oversight, a legal proceeding, law enforcement, or a government function, we will require the requester to provide a signed attestation confirming the request is not for a prohibited purpose before we disclose any information.

2. What Happens After We Share Your Information.

• Redisclosure: Once we share your information with someone else, that person may be allowed to share it again, and it may no longer be protected by federal privacy law. However, if your records relate to substance use disorder treatment, federal law continues to restrict how those records can be shared. More detail on these protections is in Part 3 of this Notice.
• Protection in Legal Proceedings: If you have substance use disorder treatment records, those records – and any testimony about what is in them – cannot be used against you in any court case, criminal proceeding, or government action unless you give written consent or a court issues a special order that meets strict federal requirements (42 CFR Part 2, Section 2.64). More information about these protections is in Part 3 of this Notice.

3. Disclosures We May Make Without Your Express Direction.

• Incapacity or Absence: If you are unable to tell us your wishes – for example, because you are unconscious or in a medical emergency – we may use our professional judgment to share information about your care, condition, or location with a family member, close friend, or someone else involved in your care or payment for your care, but only if we believe it is in your best interest. We will share only what is directly relevant to that person’s involvement.
• Serious Threat to Health or Safety: Serious Threat to Health or Safety: If you are a danger to yourself or to other people, we may share your information with someone who can help prevent harm. We are allowed to do this under the law and our professional ethics rules. If you tell us that you plan to harm a specific person, we may be required to warn that person and/or contact law enforcement to prevent the harm. We will only share the minimum information necessary. In rare cases, we may also share limited information with law enforcement to help find someone who has admitted to a violent crime that caused serious physical harm or who has escaped from custody. However, we will never share information with law enforcement if you tell us about the crime during therapy or while seeking treatment.
• Substance Use Disorder Records in Medical Emergencies: If you have substance use disorder records protected by federal law (42 CFR Part 2), those records may be shared without your consent in a genuine medical emergency – specifically, when medical personnel need the information to treat a condition that poses an immediate threat to your health, or during a declared state of emergency when our program is closed and we cannot reach you for consent. After any such emergency disclosure, we will document it in your records, including who received the information, when, and the nature of the emergency.

USES AND DISCLOSURES.

The following describes the specific ways in which we may use or share your health information. Please read each category carefully, as different rules may apply depending on the type of information and the purpose of the disclosure. If you have questions about any use or disclosure described below, please contact us using the information provided at the beginning of this Notice.

1. How We May Share Your Health Information.

Substance use disorder records subject to 42 CFR Part 2 are subject to additional restrictions described in Part 3. For disclosures other than treatment, we will generally share only the minimum information necessary to accomplish the purpose. As a mental health practice, all disclosures of your mental health records are also subject to Maryland law, which provides that: (a) disclosures without your authorization – including for treatment – are limited to information relevant to the purpose of the disclosure; (b) standard exceptions permitting disclosure of medical records to family members without authorization do not apply to mental health records; and (c) records identifying more than one individual in group or family therapy require authorization from a person in interest for each identified individual.

• Treatment: We may use and share your health information with professionals involved in your treatment. Under HIPAA, treatment disclosures are not subject to the minimum necessary standard; however, Maryland law (Health-General 4-307(c), 4-305(b)(4)) requires that disclosures of mental health records – even for treatment – be limited to information relevant to the purpose of the disclosure and made solely for the purpose of treating you.
• Health Care Operations: We may use your health information to run our practice, improve the quality of your care, and contact you as needed. We will not share your information outside our practice for these purposes without your written authorization, unless required by law.
• Payment and Billing: We may use and share your health information to bill for your services and obtain payment from health plans or other entities. For example, we provide information about your services to your health insurance plan so it can process payment.
• Public Health and Safety: We may share your health information without your authorization to prevent disease, assist with product recalls, report adverse medication reactions, report suspected abuse or neglect, and prevent or reduce a serious and imminent threat to health or safety. Maryland law permits these disclosures, including mandatory reporting of suspected child abuse or neglect and suspected abuse or exploitation of vulnerable adults and the elderly. Any such disclosure will be limited to information relevant to its purpose.
• Research: We may use or share your information for approved health research – for example, when an Institutional Review Board has approved the study or when the research involves only decedents’ information. We will generally obtain your written authorization before disclosing identifiable health information for research unless a federal exception applies. Maryland law also permits research disclosures subject to IRB oversight; for mental health records, only information relevant to the research may be disclosed.
• Legal Compliance: We will share your information when required by state or federal law, including with the U.S. Department of Health and Human Services to demonstrate HIPAA compliance, and with other government agencies for lawful oversight, auditing, or enforcement purposes. For mental health records, we will share only information relevant to the disclosure purpose.
• Medical Examiners and Funeral Directors: We can share health information with a coroner, medical examiner, or funeral director as necessary to carry out their duties consistent with applicable law, including prior to and in reasonable anticipation of death.
• Workers’ Compensation: We may use or share your health information as authorized by and to the extent necessary to comply with workers’ compensation or similar programs established by law.
• Law Enforcement: Maryland law imposes stricter requirements than federal law on disclosures to law enforcement, and we follow the stricter standard. We will disclose your mental health records to law enforcement only: (a) when required by a court order (a subpoena alone is generally insufficient); (b) when otherwise required by law (e.g., mandatory reporting of abuse, neglect, or certain wounds/injuries); or (c) to prevent or reduce a serious and imminent threat to health or safety. When we disclose: (1) we share only information relevant to the stated purpose – never your entire record; (2) the receiving agency must have written procedures protecting confidentiality; (3) your mental health records may not be used in any proceeding against you, except proceedings relating to payment for care; and (4) we retain the right to file motions to quash or for protective orders to oppose unauthorized disclosures or protect your rights.
• Health Oversight: We may share your information with health oversight agencies for activities authorized by law.
• Special Government Functions: We may share your health information for purposes such as military command authorities, national security and intelligence activities, protective services for the President and others, medical suitability determinations for U.S. State Department employees, correctional institutions, and other law enforcement custodial situations.
• Lawsuits and Legal Actions: We can share information in response to a court or administrative order. We may also respond to a subpoena, discovery request, or other lawful process not accompanied by a court order if we receive satisfactory assurance that reasonable efforts have been made to notify you or to secure a qualified protective order meeting federal privacy law requirements.

2. Our Responsibilities.

• We are required by law to maintain the privacy and security of your protected health information through appropriate administrative, physical, and technical safeguards. We train all workforce members on our privacy and security policies as required by law. These safeguards are regularly reviewed and updated to address evolving threats, technological changes, and changes to federal and state requirements.
• We will notify you without unreasonable delay and no later than 60 calendar days after discovering a breach of your unsecured protected health information, or within 45 days where required by Maryland law (Md. Code, Com. Law 14-3504). Our notice will describe what happened, the information involved, steps you should take, what we are doing to investigate and prevent future breaches, and how to contact us. Where required by Maryland law, we will notify the Maryland Attorney General before notifying affected individuals.
• For breaches affecting 500 or more residents of a State or jurisdiction, we will also notify the media and HHS. Breach notification for substance use disorder records protected by 42 CFR Part 2 follows the same HIPAA requirements, as aligned by the 2024 amendments.
• We are required to follow the duties and privacy practices described in this Notice and to provide you with a copy. We will not use or disclose your protected health information in any way not described in this Notice without first obtaining your written authorization. If we become aware of a use or disclosure in violation of our policies or legal requirements, we will take reasonable steps to mitigate any harmful effects to the extent practicable.
• For more information, please visit: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

PART II: FEDERAL SUBSTANCE USE DISORDER RECORDS DISCLOSURE (42 CFR PART 2).

RECORDS SUBJECT TO ADDITIONAL FEDERAL PROTECTIONS.

1. Substance Use Disorder Records We Receive From Other Providers.

• We may receive records from other providers that are protected by 42 CFR Part 2. This federal law applies to substance use disorder treatment records and was significantly updated in 2024 and 2025 to make it easier for providers to share your information for treatment, billing, and operations – while still protecting your privacy. Key points:
• Federal law prohibits discrimination based on information in your substance use disorder records.
• If we share your records with a non-HIPAA covered entity, they must sign a written agreement to follow the same federal privacy rules that apply to us.
• If you believe your substance use disorder records have been improperly used or shared, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which enforces these protections.

2. Consent Requirements for Use and Disclosure of Part 2 Records.

• Before we use or share your substance use disorder records, we will generally ask you to sign a written consent form. One consent form can cover all future sharing of your records for treatment, billing, and running our practice. The consent form will tell you:
  • What information may be shared, and with whom;
  • Once your records are shared, the recipient may be allowed to share them again, and they may no longer be protected by 42 CFR Part 2;
  • What may happen if you choose not to sign.
• Some types of sharing require a separate, more specific consent – for example, sharing with criminal justice agencies, for research, or for marketing. We will never combine your consent for treatment, billing, and operations with consent for any other purpose. You may cancel your consent at any time by telling us in writing. If we have already shared your records based on your consent, we cannot undo what has already been done.

RESTRICTIONS ON LEGAL USE.

1. Restrictions on Use in Legal Proceedings.

• Your substance use disorder records – and any testimony about their contents – generally cannot be used against you in any court case, criminal proceeding, or government action.
• This protection applies unless you give written consent or a court issues a special order meeting the strict requirements of 42 CFR Part 2, Sections 2.64 and 2.65. These protections follow your records: even after we share them with another provider or insurer for treatment or billing, that recipient still cannot use your records against you in legal proceedings.

2. Redisclosure and Notice Requirements.

• Each time we share your substance use disorder records, we must include a written notice to the recipient stating that: (a) the records are federally protected; (b) they cannot be used against you in legal proceedings; and (c) a general release form is not sufficient to authorize further sharing.
• If the recipient is a HIPAA-covered provider or insurer, they may redisclose your records under HIPAA’s rules for treatment, payment, or health care operations – but they may never use your records in legal proceedings against you.
• If HIPAA does not cover the recipient, they may only share your records as specifically permitted by your consent and must have a written agreement in place to protect your information.
• Federal protections against unauthorized use or disclosure of your substance use disorder records remain fully in effect.

PART III: ADDITIONAL MARYLAND LEGAL PROTECTIONS.

Maryland law provides additional privacy protections for your mental health records beyond what federal law requires. Where Maryland law is more protective, we follow the stricter standard. Maryland also provides specific protections for abortion care and other sensitive health services under Health-General 4-302.5. Key protections include:

• Signed Authorization Required. We will not share your mental health treatment records without your written authorization unless disclosure is for treatment, is required by law, or falls within a specific exception under Maryland law.
  • Even when disclosure is permitted, we will share only the information relevant to the purpose of the disclosure – never your entire record.
  • Standard exceptions that permit sharing medical records with family members without authorization do not apply to mental health records. We will obtain your written authorization before sharing your mental health records with family, friends, or caregivers.
• Personal Notes. Maryland law recognizes a category of “personal notes” that are distinct from both your medical record and HIPAA’s “psychotherapy notes.” These are a provider’s private work product, maintained separately from your clinical file, and are not part of your medical record. Personal notes are neither discoverable nor admissible as evidence, so long as the provider retains them in the provider’s sole possession and does not disclose them to anyone other than a supervising provider, consulting provider, or the provider’s attorney. If a personal note is disclosed to anyone beyond these individuals, it loses its protected status and becomes part of your medical record.
• Person of Interest Definition. Maryland law defines who qualifies as a “person in interest” to request or authorize disclosure of your records (Health-General 4-301). This generally includes you, a person authorized to consent to your health care, a personal representative, a parent (with certain limitations), and an attorney you designate in writing.
• Minor Consent Laws. Maryland law provides two pathways for minors to consent to mental health services. Additional details about minor consent rights are available upon request:
  • Age 12 and older: A minor may consent to outpatient mental health treatment without parental involvement. The treating clinician retains the discretion to notify a parent and may withhold information from a parent if disclosure could harm the minor or deter them from seeking care.
  • Age 16 and older: A minor has the same capacity as an adult to consent to consultation, diagnosis, and treatment of a mental or emotional disorder – including medication – by a health care provider or clinic (Health-General 20-104). This consent capacity does not include the right to refuse treatment for which a parent has already given consent. The provider may, but is not required to, notify the parent.
  • Clinician’s Right and Duty to Disclose. Under both pathways, the treating clinician retains the professional discretion to notify a parent, guardian, or custodian about the minor’s treatment, even without the minor’s consent and even over the minor’s express objection. Additionally, regardless of the minor’s consent status, the clinician has an ethical duty, and in certain circumstances a legal obligation, to disclose information when necessary to protect the minor or others from serious harm, including risk of suicide or self-harm, risk of harm to others, or suspected abuse or neglect of the minor.

For more information about your rights under Maryland law, please contact us using the information on page 1 of this Notice.

PART IV: CHANGES AND UPDATES TO THIS NOTICE.

We are required by law to abide by the terms of the notice currently in effect. We reserve the right to change the terms of this notice at any time, and to make the new notice provisions effective for all protected health information that we maintain, including information created or received before the revised notice takes effect.

If we make a material change to our privacy practices, we will promptly revise this notice and will not implement the change before the effective date of the revised notice. We will: (a) post the revised notice prominently in our office and on our website; (b) make copies available to you at or before your next service delivery; and (c) provide a copy upon request. We will prominently display the effective date on all versions of this notice. For material changes, we may also provide direct notice through other appropriate means.

This Notice was last revised on: 3/10/2026