Your Privacy Rights

Under HIPAA and Texas law, you have the right to:

• Receive a copy of this Notice of Privacy Practices, including a paper copy upon request.
• Inspect and obtain a copy of your medical record (see Right to Access Your Records, below).
• Request an amendment if you believe information in your record is incorrect or incomplete.
• Request restrictions on how your information is used or shared.
• Request that we communicate with you in a specific way (e.g., portal only, no voicemail).
• Receive an accounting of certain disclosures of your information.
• Authorize disclosures to specific individuals and revoke that authorization in writing at any time.
• File a complaint without fear of retaliation.
• Be notified in the event of a breach of unsecured protected health information.

Right to Access Your Records

You have the right to inspect and obtain a copy of the medical information we maintain about you, with limited exceptions permitted by law.

• How to request. Submit a written request through the patient portal or discuss at an appointment, fill out a signed Request for Records form, specifying the records, date range, preferred format, and where to send them. With your written direction, we will transmit a copy directly to a person or entity you choose. More information is available on the Request for Records form, which is available upon request.
• Portal access. Visit notes, results, and other clinical information are generally available to you in real time through the patient portal at no charge, consistent with the federal 21st Century Cures Act. Narrow exceptions permitted by law may apply.
• Timing. We respond within the timeframes required by federal and Texas law — generally within 15 business days under Texas Occupations Code §159.006, and no later than 30 days under HIPAA. If we need additional time, we will notify you in writing.
• Fees. Electronic copies through the portal are free. For paper copies or records produced outside the portal, a cost-based fee may apply under Texas Occupations Code §159.008. This practice does not typically charge for requests that are 50 pages or less. You will be contacted before records that incur a fee are produced.
• Denials and amendments. If we deny a request in whole or in part, we will tell you in writing why and explain your right to review where applicable. You may also request an amendment in writing if you believe information in your record is incorrect or incomplete.

Confidentiality & Limits of Confidentiality

All interactions and communications between you and Norton Psychiatry are private and protected under HIPAA and Texas law. No information about you will be released, and your status as a patient will not be confirmed, without your written authorization — except in the following circumstances, in which case your records may no longer be protected by HIPAA:

• Imminent danger to yourself. If you are at imminent risk of suicide or serious self-injury and cannot be kept safe in the outpatient setting, contact may be made with emergency services. This exception does not always apply to passive suicidal thoughts and will be discussed with you whenever clinically possible before any action is taken.
• Imminent danger to another person. If there is reasonable belief that you pose an imminent risk of harm to an identifiable third party, contact may be made with emergency services or the at-risk person. This will be discussed with you whenever clinically possible.
• Suspected abuse or neglect of a minor or vulnerable adult. Texas law requires reporting suspected abuse, neglect, or exploitation of a child, an elderly person, or a person with a disability.
• Court order or legal process. Records or testimony may be required by a judge's order or valid legal process. You will be notified when permissible.
• Coordination of care. With your written authorization, information may be shared with your therapist, primary care provider, pharmacy, other medical providers, or designated family members. This is not required but is strongly encouraged, as prior records help inform a thorough evaluation and treatment plan. You may authorize or revoke these releases at any time in writing.
• Practice operations. Limited information may be used for billing and the routine operation of the practice, as permitted by HIPAA.

How We Use Your Information

Your protected health information may be used and disclosed for the following purposes without your separate written authorization:

• Treatment. To provide, coordinate, and manage your psychiatric care, including sharing information with other providers involved in your treatment with your consent.
• Payment. To process payments and, upon request, to generate a superbill for potential out-of-network reimbursement through your commercial insurer.
• Healthcare operations. For routine practice activities such as quality improvement, staff training, and compliance with legal and professional obligations.

Your information will not be sold or shared with third parties for marketing purposes without your explicit written authorization.

Other Uses and Disclosures Permitted or Required by Law

• Public health activities. Your information may be disclosed to public health authorities for activities such as preventing or controlling disease, reporting births and deaths, monitoring adverse reactions to medications, or addressing problems with medical products, when permitted or required by law.
• Health oversight. Your information may be disclosed to government oversight agencies — including the U.S. Department of Health and Human Services, the Texas Medical Board, and other regulatory bodies — for audits, investigations, inspections, and licensure activities necessary to oversee the healthcare system.
• Judicial and administrative proceedings. Your information may be disclosed in response to a court order or, more rarely, in response to a subpoena or other lawful process, subject to the additional protections that apply to mental health records under HIPAA and Texas Health & Safety Code Chapter 611. When a subpoena is received without an accompanying court order, Norton Psychiatry will generally object to disclosure and notify you whenever permitted by law.
• Law enforcement. Limited information may be disclosed to law enforcement officials in response to a court order, warrant, or grand jury subpoena; to identify or locate a suspect, fugitive, material witness, or missing person; to report a crime committed on practice premises; or as otherwise required or permitted by law. Disclosures of mental health records to law enforcement are more restricted under Texas law and will be limited accordingly.
• Decedents, organ and tissue donation. Your information may be disclosed to coroners, medical examiners, and funeral directors as necessary to carry out their duties, and to organizations that coordinate organ, eye, or tissue donation when permitted by law.
• Research. Your information may be used or disclosed for research only when authorized by you in writing, or when the research has been reviewed and approved by an Institutional Review Board or Privacy Board that has determined appropriate safeguards are in place. Norton Psychiatry does not currently participate in research; this provision is included in case that changes in the future.
• Workers’ compensation. Your information may be disclosed as authorized by Texas workers’ compensation laws or similar programs that provide benefits for work-related injuries or illnesses.
• Serious threats to health or safety. Your information may be disclosed when necessary to prevent or lessen a serious and imminent threat to your health or safety, or to the health or safety of another identifiable person or the public. Disclosures are limited to those reasonably able to prevent or lessen the threat. This includes the situations described above under Confidentiality & Limits of Confidentiality.
• Specialized government functions. Limited disclosures may be made for specialized government functions including military and veterans’ activities, national security and intelligence, protective services, correctional institutions, and eligibility determinations for certain public benefits, as permitted by federal law.
• Required by law. Your information will be disclosed when required by federal, state, or local law, including mandatory reporting of suspected abuse or neglect as described above and any other reporting required of healthcare providers.

Psychotherapy Notes

• What they are. Under HIPAA, “psychotherapy notes” are a specific category of record — notes recorded by a mental health professional that document or analyze the contents of conversation during a private counseling session, kept separately from the rest of the medical record. They do not include the information that ordinarily makes up your chart, such as medications and monitoring, session start and stop times, treatment modalities and frequency, results of clinical tests, diagnoses, treatment plans, symptoms, prognosis, or progress to date. Psychotherapy notes are not necessarily kept for every patient, depending on their clinical care.
• Separate authorization required. Psychotherapy notes are subject to heightened protection. Most uses and disclosures of psychotherapy notes — including release to other providers, family members, insurers, or any other third party — require your separate, specific written authorization, even when you have already authorized release of your other medical records. Limited exceptions apply, such as use by the originating provider for your own treatment, supervision of trainees, defense of a legal action that you initiate, or disclosures required by law.
• How they are stored. When psychotherapy notes are maintained at Norton Psychiatry, they are kept separately from your medical record and are not included in routine records releases. A general authorization to release your medical records does not include psychotherapy notes; a separate written authorization that specifically references psychotherapy notes is required.

Sale, Marketing, and Psychotherapy Notes

Most uses and disclosures of psychotherapy notes, uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require your written authorization. Other uses and disclosures not described in this Notice will be made only with your written authorization, which you may revoke at any time.

Fundraising Communications

Norton Psychiatry does not engage in fundraising activities and will not contact you for fundraising purposes. If this ever changes, you will be notified in advance and given a clear opportunity to opt out of receiving such communications. Choosing to opt out will not affect your treatment or your relationship with the practice.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice of Privacy Practices at any time, upon request, even if you previously agreed to receive it electronically or by other means. To request a paper copy, ask at any appointment or contact the practice through any of the contact methods listed at the top of this Notice of Privacy Practices.

How Your Information Is Protected

Norton Psychiatry uses a HIPAA-compliant electronic health record (EHR) system to store and manage your protected health information. Appointment requests, intake forms, and clinical communications are handled through this secure system. Standard email and text messaging are not secure platforms and should not be used to transmit protected health information.

Business Associate Agreements (BAAs) are maintained with third-party service providers that handle protected health information on behalf of the practice, as required by HIPAA.

Changes to This Notice

Norton Psychiatry reserves the right to update this Notice of Privacy Practices at any time in accordance with applicable law. The most current version will always be available at www.nortonpsychiatry.com and upon request at the office. A revised notice will be provided at your next appointment or through an appropriate contact channel following any material change.