Privacy Policy

Personal Health Information (PHI)

When you engage in therapy services, I collect and maintain Protected Health Information (PHI) as defined by HIPAA, including:

• Identifying Information: Name, date of birth, address, phone number, email address
• Clinical Information: Mental health history, presenting concerns, treatment goals, session notes, diagnoses (for documentation only, not marketing), treatment plans, progress notes
• Billing Information: Payment method, insurance information (if applicable), superbills, receipts
• Communication Records: Emails, voicemails, text messages related to therapy services

Legal Basis for Collection: PHI is collected with your informed consent for the purpose of providing professional psychotherapy services.

Website Usage Data (Non-PHI)

When you visit attachmentrepairpsychotherapy.com, I collect non-identifiable website usage data:

• Technical Data: IP address, browser type, device type, operating system
• Usage Data: Pages visited, time spent on site, referral source (e.g., Google search, Psychology Today)
• Cookies: Session cookies for website functionality (see Section 5)

Legal Basis for Collection: Website usage data is collected for improving user experience, understanding traffic patterns, and optimizing website performance.

Disclosures WITH Your Consent

I may share your PHI only with your written authorization to:

• Other healthcare providers (e.g., psychiatrists, primary care physicians) for coordinated care
• Insurance companies for reimbursement purposes (if you request superbills)
• Family members or support persons you designate

You control these disclosures. Written authorization is required and can be revoked at any time.

Disclosures WITHOUT Your Consent (Required by Law)

Colorado law and HIPAA require disclosure of PHI without consent in specific circumstances:

Mandatory Reporting (Colorado C.R.S. § 19-3-304, § 26-3.1-101)

• Child abuse or neglect — Suspected abuse or neglect of a child under 18 must be reported to county department of human/social services
• Elder abuse or neglect — Suspected abuse, neglect, or exploitation of adults 70+ or at-risk adults must be reported
• Imminent danger to self or others — If you pose a serious and imminent threat of physical harm to yourself or an identifiable third party, I may disclose PHI to law enforcement, emergency services, or the intended victim

Court Orders & Legal Proceedings

• Valid court orders or subpoenas may require disclosure of PHI
• I will notify you and assert privilege when legally permissible

Business Associates (HIPAA-Compliant)

I share limited PHI with HIPAA-compliant Business Associates who assist with practice operations:

• Telehealth Platform: [Specify: Zoom with HIPAA BAA, SimplePractice, Doxy.me, etc.] — Secure video sessions
• Electronic Health Records (EHR): [Specify: SimplePractice, TherapyNotes, etc.] — Client records, billing, scheduling
• Payment Processing: [Specify: Stripe, Square, etc.] — Credit card processing
• Email Provider: [Specify: ProtonMail, Google Workspace with HIPAA BAA, etc.] — Secure email communications

All Business Associates sign HIPAA Business Associate Agreements (BAAs) ensuring PHI protection.

Clinical Supervision

As a Licensed Professional Counselor Candidate (LPCC), I am required by Colorado law to receive clinical supervision. Your PHI may be shared with my supervisor, Shannon Heers, LPC #4786, for:

• Case consultation and clinical guidance
• Quality assurance and treatment planning
• Professional development and licensure compliance

Supervision is conducted confidentially and complies with HIPAA and Colorado confidentiality laws. All supervision discussions are protected under professional confidentiality standards.

I implement industry-standard security measures to protect your PHI and website data:

Technical Safeguards

• Encryption: All telehealth sessions use end-to-end encryption (AES-256 or equivalent)
• Secure Email: Encrypted email communication via [specify: ProtonMail, HIPAA-compliant email provider]
• HIPAA-Compliant Platforms: All technology vendors sign Business Associate Agreements (BAAs)
• Password Protection: Strong passwords and two-factor authentication (2FA) on all systems
• Regular Updates: Software and security patches applied regularly

Physical Safeguards

• Device Security: All devices used for therapy services are password-protected and encrypted
• Secure Storage: Paper records (if any) stored in locked filing cabinets in secure location
• Telehealth Only: No in-person office reduces physical security risks

Administrative Safeguards

• Training: Ongoing HIPAA compliance and security training
• Access Controls: Only authorized personnel (me and my supervisor) access PHI
• Breach Response Plan: Procedures for responding to security incidents or data breaches

Limitations

While I implement robust security measures, no system is 100% secure. I cannot guarantee absolute security of information transmitted over the internet. You acknowledge and accept this risk by using telehealth services.

Your Responsibility:

• Use secure internet connections (avoid public Wi-Fi for therapy sessions)
• Ensure privacy during sessions (private, confidential location)
• Protect your login credentials for client portal and scheduling systems

Clinical Records (PHI)

Colorado law requires I retain clinical records for seven (7) years after the last date of service. This includes:

• Session notes
• Treatment plans
• Billing records
• Correspondence related to therapy

After seven years, records are securely destroyed (shredded for paper records, permanently deleted for electronic records).

Exception: Records for minors are retained until the minor reaches age 25 (Colorado law).

Website Usage Data

Non-identifiable website usage data (analytics, cookies) is retained for two (2) years for website optimization purposes.

I reserve the right to update this Privacy Policy to reflect changes in legal requirements, practice operations, or privacy standards. Material changes will be communicated via:

• Website notification — Updated effective date at top of this page
• Email notification — For current clients, email notification of significant changes

Your continued use of therapy services or this website after changes constitutes acceptance of the updated Privacy Policy.

Current Version: v2.0, effective November 10, 2025