HIPAA Compliance & Privacy Notice

1. Our Commitment to Privacy

At In Therapy, we recognize that trust is the foundation of effective mental health care. We are committed to complying with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as amended by the HITECH Act, and all applicable state privacy laws.

This Privacy Notice describes how we may use and disclose your protected health information (PHI) and how you can access or control that information. By engaging our services, you acknowledge that you have received, read, and understood this notice.

2. Information We Collect & How We Use It

Types of Information Collected

• Demographic Data: Name, date of birth, contact information, emergency contacts
• Clinical Records: Session notes, treatment plans, diagnostic assessments, progress reports
• Administrative Data: Insurance information, payment records, consent forms
• Digital Footprint: Secure platform login data, session recordings (only with explicit consent), encrypted messaging logs

Permitted Uses & Disclosures

We may use and disclose your PHI for:

• Treatment: Coordinating care among your therapy team and providers
• Payment: Billing insurance companies and processing payments
• Healthcare Operations: Quality assurance, staff training, and compliance auditing

3. Security Safeguards

Protecting your data is embedded in our infrastructure and daily operations. Our security measures include:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit
• Access Controls: Role-based access, multi-factor authentication (MFA), and automatic session timeouts
• Auditing: Continuous monitoring, regular third-party security assessments, and annual HIPAA risk analyses
• Vendor Management: All business associates sign strict BAA (Business Associate Agreements) compliant with HIPAA §164.504(e)

4. Your Rights Under HIPAA

As a patient, you have the right to:

• 📄 Access & Inspect: View and obtain copies of your records within 30 days of request
• ✏️ Amend: Request corrections to inaccurate or incomplete information
• 📋 Accounting of Disclosures: Receive a list of certain disclosures made for non-treatment purposes
• 🔒 Request Restrictions: Ask us to limit how your information is used or shared (we will honor legally required requests)
• 📩 Alternative Communications: Request secure communication methods (e.g., encrypted email, specific mailing addresses)
• 📑 Receive This Notice: Obtain a paper copy of this privacy notice upon request

To exercise these rights, submit a written request to our Privacy Officer. We will process requests within legally mandated timeframes without charging unreasonable fees.

5. When We Share Information

We will not share your PHI without your written authorization, except in the following circumstances:

• Legal Requirements: Court orders, subpoenas, or mandatory reporting laws (e.g., child/elder abuse, imminent harm)
• Public Health & Safety: Disease control, FDA reporting, or preventing serious threat to health/safety
• Law Enforcement: When required by statute or to identify suspects/fugitives
• Decedents: Information necessary for coroners or medical examiners

6. Breach Notification Protocol

In the unlikely event of an unauthorized access, use, or disclosure of your PHI, we will:

1. Contain and investigate the incident within 24 hours
2. Notify affected individuals without unreasonable delay (and no later than 60 days after discovery)
3. Report breaches affecting 500+ individuals to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR)
4. Provide credit monitoring or identity protection services if personally identifiable information is compromised

7. Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

• Our Privacy Officer (contact information below) — There will be no retaliation for filing a complaint
• The U.S. Department of Health & Human Services, Office for Civil Rights: 200 Independence Ave SW, Washington, DC 20201 | www.hhs.gov/hipaa
• Your state's Department of Health

8. Contact & Compliance Officer

For questions about this policy, to exercise your rights, or to report a privacy concern, please contact: