Notice of Privacy Practices

I. Our Commitment to Your Privacy

NHC understands that your health information is personal, and we are committed to protecting your privacy. This Notice describes how NHC may use and disclose your PHI in accordance with applicable federal and state laws, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Utah Mental Health Confidentiality Act.  

NHC is required by law to:

  • Make sure that PHI that identifies you is kept private.

  • Give you this Notice of NHC's legal duties and privacy practices with respect to your PHI.

  • Follow the terms of this Notice currently in effect.

  • Notify you following a breach of unsecured PHI.  

II. How NHC May Use and Disclose Your Health Information

NHC may use and disclose your PHI for a variety of reasons. For example:

  • Treatment: NHC may use and disclose your PHI to provide, coordinate, or manage your health care and related services, such as scheduling appointments, consulting with other health care providers, and obtaining prior authorization for treatment.

  • Payment: NHC may use and disclose your PHI to obtain payment for the health care services NHC provides to you, such as billing your insurance company or processing credit card payments.

  • Health Care Operations: NHC may use and disclose your PHI to conduct health care operations, such as quality assessment and improvement activities, staff training, and auditing. This includes consultation with legal counsel or other professionals for risk management or quality assurance purposes, and for professional consultation or supervision to ensure the quality of your care, while maintaining your confidentiality to the extent permitted by law.

  • Required by Law: NHC may disclose your PHI when required to do so by federal, state, or local law. This may include disclosures for the following purposes:

    • Public Health: To public health authorities for purposes such as preventing or controlling disease, injury, or disability (e.g., reporting a contagious disease to the health department as required by Utah law).

    • Child Protection: Reporting suspected child abuse or neglect to the Division of Child and Family Services.

    • Elder Abuse Reporting: Reporting suspected elder abuse or neglect to Adult Protective Services, as required by Utah law.

    • Legal Proceedings: Complying with a valid court order, subpoena, or other legal process.

    • Abuse or Neglect: To a government authority if NHC reasonably believes you are a victim of abuse, neglect, or domestic violence.

    • Serious Threat to Health or Safety: NHC may disclose your PHI if NHC believes it is necessary to prevent a serious threat to your health or safety or the health or safety of others. This may include disclosures to law enforcement in situations of imminent danger, such as when there is a credible threat of:

      • Self-harm

      • Harm to others, including specific and credible threats of violence towards an identifiable person

      • Suspected elder abuse or neglect where the individual is at immediate risk of harm

  • Other Uses and Disclosures: NHC may use and disclose your PHI for other purposes with your written authorization. Examples include:

    • Disclosing your PHI to family members or other individuals involved in your care.

    • Using your PHI for research purposes.

    • Using your de-identified PHI in marketing materials, such as brochures or website testimonials.

    • Any other use or disclosure of your PHI that is not specifically described in this Notice.

III. Psychotherapy Notes

NHC maintains psychotherapy notes separately from your general medical record. Psychotherapy notes include what the therapist writes down during your session. They are the therapist's personal notes about your sessions and contain details not included in your medical record. These notes are given special protection under HIPAA and Utah's Mental Health Confidentiality Act. NHC will not use or disclose these psychotherapy notes without your written authorization, except as permitted by HIPAA, such as for NHC's own use in your treatment, for staff training and supervision, or as required by law, such as in cases of court orders or to prevent serious harm. Please note that you cannot see or get a copy of these notes, even if you request to inspect and copy your general medical record, except as required by law, such as by court order in legal proceedings related to your mental health, or if your legal representative requests access. These notes are not subject to the same access rules as your general medical record.

IV. Your Health Information Rights

You have the following rights regarding your PHI:

  • Right to Inspect and Copy: You have the right to inspect and copy your PHI, but not psychotherapy notes. This right may be limited in certain situations as permitted by law, such as when disclosure would endanger the life or safety of yourself or another person.

  • Right to Request Amendment: You have the right to request that NHC amend your PHI if you believe it is incorrect or incomplete. To request an amendment, please send a message through Spruce Health at https://spruce.care/newheightscounseling or call (385) 449-0150, and an Amendment Request Form will be sent to you through the client portal. NHC will respond to your request within 30 days. NHC may deny your request under certain circumstances, but will provide you with a written explanation if we do so.

  • Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI made by NHC within the past six years. This accounting will include information about who received your PHI, when it was disclosed, and for what purpose. This does not include disclosures made for treatment, payment, or health care operations.

  • Right to Request Restrictions: You have the right to request restrictions on how NHC uses and discloses your PHI. While NHC will consider your request, NHC is not legally required to agree to all restrictions.  

  • Communicating with You About Your Health Information: You can utilize the messaging feature in the client portal to complete any necessary forms, update your billing information, and view and download any documents that I have uploaded for you. While NHC highly recommends the use of secure communication methods such as Spruce Health and the client portal, you can request that we communicate with you using non-secure methods by submitting a Request for Non-Secure Communication form. NHC will accommodate reasonable requests and inform you of the risks associated with non-secure communication methods.

  • Right to Request a Paper Copy: You have the right to receive this document as a PDF, which can be printed.

V. Our Responsibilities

NHC is required to:

  • Maintain the privacy of your PHI.

  • Provide you with this Notice of our privacy practices.

  • Abide by the terms of this Notice.

  • Notify you if we discover a breach of unsecured PHI.

VI. Electronic Health Records

NHC utilizes Electronic Health Records (EHRs) to manage client information. To protect your electronic PHI, NHC has implemented safeguards such as access controls, encryption, and regular security assessments, in compliance with HIPAA's Security Rule and Utah's data security laws, including the Utah Health Data Security Act. These safeguards include:

  • Access controls to limit who can access your PHI.

  • Encryption to protect your PHI during transmission and storage.

  • Regular security assessments and audits to identify and address potential vulnerabilities.

  • Policies and procedures for addressing security breaches or unauthorized access to electronic PHI, including prompt notification to affected clients in the event of a data breach.

VII. Marketing and Fundraising

NHC will obtain your written authorization before using your PHI for marketing or fundraising purposes, in accordance with HIPAA guidelines. This may include activities such as:

  • Sending you newsletters about new services or events.

  • Contacting you about fundraising campaigns related to mental health.

  • Sharing your de-identified PHI in testimonials or case studies.

VIII. Complaints

If you have any concerns or believe your privacy rights have been violated, we encourage you to first discuss these with us directly. You can address these concerns with your therapist during a therapy session, or you can contact Cody Merrell through Spruce Health at https://spruce.care/newheightscounseling or by phone call at (385) 449-0150. NHC will acknowledge receipt of your concern and make every effort to address and resolve it promptly and thoroughly.

If you believe your privacy rights concerns have not been addressed, you may also submit a written complaint using the Privacy Complaint Form. To request this form, please contact Cody Merrell through Spruce Health at https://spruce.care/newheightscounseling or by phone call at (385) 449-0150. or ask your therapist to send you the form through the client portal. NHC will not retaliate against you for filing a complaint.

If your concerns regarding your privacy rights have not been addressed through the Privacy Complaint form, you may also submit a written complaint to the Secretary of the U.S. Department of Health and Human Services. Information about filing a complaint with HHS can be found at https://www.hhs.gov/ocr/privacy/hipaa/complaints/.

IX. Breach Notification

NHC will notify you if we discover a breach of your unsecured PHI, as required by HIPAA's Breach Notification Rule.

X. Electronic Signatures

This Notice of Privacy Practices may be signed electronically, and any electronic signature shall have the same validity and effect as an original handwritten signature. NHC ensures that the electronic signature process complies with all applicable legal requirements.

XI. Effective Date

This Notice is effective as of January 8, 2025.