I. DISCLOSURES NOT REQUIRING INFORMED PATIENT CONSENT

1. To the extent that the records are needed for billing, collection or payment of claims; and
   
   
2. To the extent that: (a) the disclosure is for the psychologist's or another health care provider's treatment of a patient; and (b) performance of the recipient's duties requires access to the records, a psychologist may disclose records to another health care provider; to any person acting under the supervision of a health care provider; or to medical staff members, employees or persons serving in training programs or participating in volunteer programs and affiliated with the health care provider, if any of the following is applicable:
   
   
   1. The person is rendering assistance to the patient.
      
      
   2. The person is being consulted regarding the health of the patient.
      
      
   3. The life or health of the patient appears to be in danger and the information contained in the patient health care records may aid the person in rendering assistance.
      
      

II. USES AND DISCLOSURES REQUIRING INFORMED CONSENT OR AUTHORIZATION

1. Definitions:
   
   The following Privacy Rule definitions apply to the remainder of this document.
   
   
   1. PHI is (with certain exceptions) individually-identifiable health information regarding the patient.
      
      
   2. Psychotherapy notes means notes recorded (in any medium) by a psychologist documenting or analyzing the contents of a conversation with a patient or patients during a private counseling session or a group, joint, or family counseling session and are separated from the rest of the patient's medical or mental health records.
      
      
   3. Treatment, Payment and Health Care Operations means:
      
      
      1. A psychologist's own Treatment, Payment and Health Care Operations;
      2. The Treatment activities of another health care provider;
      3. The Payment activities of another entity covered under HIPAA (e.g., an insurer);
      4. Certain Health Care Operations of another entity covered under HIPAA if: i) the psychologist and the other entity each has a relationship with the patient; ii) the PHI pertains to that relationship; and iii) the disclosure is for: quality assessment and improvement; certain performance evaluation, enhancement or training; or health care fraud and abuse detection or compliance.
         
         
   4. Treatment means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.
      
      
   5. Payment means when the psychologist obtains reimbursement for the provision of health care. An example of payment would include, but is not limited to, obtaining third-party reimbursement, the determinations of eligibility or coverage (including coordination of benefits or the determination of cost-sharing amounts), and adjudication or subrogation of health benefit claims.
      
      
   6. Health care operations mean activities that relate to the performance or operation of the psychologist's practice. The following are several examples of health care operations: conducting quality assessment and improvement activities, including outcomes evaluations and development of clinical guidelines, (provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities); population-based activities relating to improving health or reducing health care costs; protocol development, case management, and care coordination; business related matters such as administrative services; contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment.
      
      
   7. Use means the sharing, employment, application, utilization, examination, or analysis of individually-identifiable health information within an entity (e.g., the psychologist's office, clinic, practice group, etc.).
      
      
   8. Disclosure means the release, transfer, provision of access to, or divulging in any other manner, of information outside the entity holding the information.

2. Uses and Disclosures Within and Beyond Treatment, Payment, and Health Care Operations

   For uses and disclosures of PHI that fall a) within the above-quoted Privacy Rule definition of treatment, payment or health care operations; b) but beyond the exceptions to informed consent listed in Section I, the psychologist must obtain the patient's informed consent (see footnote 1) but need not obtain an authorization. A psychologist must obtain an authorization for uses and disclosures beyond the Privacy Rule definition of treatment, payment or health care operations (unless otherwise permitted or required by law as described below in Section III "Uses and Disclosures with Neither Consent nor Authorization").

   Rather than attempting to distinguish between situations where only an informed consent is required and situations where an authorization is required, it may be simpler to always use an authorization. Authorization under the Privacy Rule is similar to, but more detailed than, informed consent under state law. (The authorization provided with this product meets the Privacy Rule requirements, as well as state informed consent requirements.)

3. Psychotherapy Notes

   Any use or disclosure of psychotherapy notes requires an authorization with certain exceptions. The exceptions to authorizations are:
   

   1. When carrying out the following treatment, payment, or health care operations:
      1. use by the psychologist who created the psychotherapy notes for treatment;
      2. use or disclosure by the psychologist for his/her training programs (in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their counseling skills); or
      3. use or disclosure by the psychologist to defend himself/herself in a legal action or any other proceeding brought by the patient; and
   2. The following required or permitted uses or disclosures:
      1. required by HHS to determine compliance with the Privacy Rule;
      2. required by law;
      3. for health oversight activities (including psychology board actions) with respect to the psychologist who created the notes;
      4. about decedents to coroners and medical examiners, as permitted by state law.
         
         
4. Compound Authorizations
   
   
   1. An authorization for the use or disclosure of PHI may specify that such PHI may be disclosed to multiple individuals or entities provided that treatment, payment, enrollment in the health plan, or eligibility for benefits is not conditioned on such authorized use or disclosure.
   2. An authorization for a use or disclosure of Psychotherapy Notes may not be combined with an authorization for use or disclosure of PHI. However, an authorization for a use or disclosure of Psychotherapy Notes may be combined with another authorization for a use or disclosure of Psychotherapy Notes.
      
      
5. Revocation of Authorization
   
   A patient may revoke his/her authorization at any time, provided the revocation is in writing. Exceptions: 1) The psychologist has taken action in reliance on the authorization; or 2) If the authorization was obtained as a condition to obtaining insurance coverage, and other law provides the insurer with the right to contest a claim under the policy.
   
   
6. Documentation of Authorization
   
   The Privacy Rule requires that psychologists must document and retain any signed authorization for at least six years from the date of its creation or the date when it was last in effect, whichever is later.
   

III. USES AND DISLOSURES WITH NEITHER CONSENT NOR AUTHORIZATION

1. Child Abuse Reporting
   
   Any psychologist who has reasonable cause to suspect that a child seen by the psychologist in the course of professional duties, has been abused or neglected or having reason to believe that a child seen in the course of professional duties has been threatened with abuse or neglect and that abuse or neglect of the child will occur, shall immediately inform, by telephone or personally, the county department or the child welfare agency (in a county having a population of 500,000 or more), or the police or sheriff's department, of the facts and circumstances contributing to the suspicion of child abuse or neglect, or to a belief that abuse or neglect will occur.
   
   
2. Adult and Domestic Abuse Reporting
   
   If a psychologist is aware of circumstances that would lead a reasonable person to believe or suspect that abuse, material abuse or neglect of an elder adult has occurred, the psychologist may report such elder abuse to the county agency (designated by the county board to establish and implement the elder abuse reporting system) or to any state official, including any representative of the office of the long term care ombudsman. The psychologist may make such a report if the psychologist believes that the disclosure is necessary to prevent serious harm to the patient or other potential victims; and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure and (A) the psychologist believes that the disclosure is necessary to prevent serious harm to the patient or other potential victims; or (B) the patient cannot agree to disclosure because of incapacity and this would impair immediate enforcement activity. For (B), the public official authorized to receive the report must represent that (i) the patient's health information will not be used against them and (ii) immediate enforcement activity would be materially impaired by waiting until the patient has the capacity to agree to the disclosure. The psychologist shall indicate the facts and circumstances of the situation as part of the report.
   

   Informing the patient
   A psychologist who makes a disclosure regarding adult or domestic abuse must promptly inform the patient that such a report has been or will be made except if:
   

   1. the psychologist in the exercise of his or her professional judgment believes informing the patient would place the patient at risk of serious harm; or
      
   2. the psychologist would be informing a personal representative and the psychologist reasonably believes the personal representative is responsible for the abuse, neglect or other injury and that informing the personal representative would not be in the patient's best interest as determined by the psychologist in the exercise of professional judgment.
      
      
3. Health Oversight Activities (State Psychology Boards)
   
   The Department of Regulation and Licensing may issue subpoenas for the attendance of witnesses and the production of documents or other materials prior to the commencement of disciplinary proceedings.

   A psychologist must comply in a timely manner with the Psychology Examining Board's investigation of complaints lodged against the applicant or licensee of the board.
   

4. Judicial and Administrative Proceedings
   
   If a patient is involved in a court proceeding and a request is made for information about his or her diagnosis and treatment and the records thereof, such information is privileged under state law, and the psychologist must not release information without the written authorization of the patient or the patient's personal or legally-appointed representative, or a court order. The privilege does not apply when the patient is being evaluated for a third party or where the evaluation is court ordered. The psychologist will inform the patient in advance if this is the case.
   
   
5. Serious Threat to Health or Safety
   
   A psychotherapist has a duty to warn when it is foreseeable that an act or omission to act, may cause harm to someone. The duty to warn or to institute commitment proceedings is not limited by the requirement that threats be directed to an identifiable target.
   
   
6. Worker's Compensation
   
   A psychologist who examines an employee upon the request of the employee's employer or worker's compensation insurer may be required to testify as to the results of the examination. Additionally a psychologist who treated a worker compensation claimant for any condition reasonably related to the condition for which the claimant claims compensation may be required to testify in the workers compensation case. An employee who reports an injury alleged to be work-related or files an application for hearing waives the psychologist-patient privilege with respect to any condition or complaint reasonably related to the condition for which the employee seeks compensation.
   

IV. PATIENTS' RIGHTS AND PSYCHOLOGIST'S DUTIES

1. Patient's Rights
   
   
   1. Right to Request Restrictions
      
      A patient has the right to request restrictions on the uses or disclosures of PHI about the patient to carry out treatment, payment, and health care operations; however, the psychologist is not required to accept the requested restrictions.

      A psychologist who agrees to a restriction may not use or disclose PHI in violation of such restriction, except that, if the patient who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment, the psychologist may use the restricted PHI, or may disclose such information to a health care provider, to provide such treatment to the patient. If restricted PHI is disclosed to a health care provider for emergency treatment, the psychologist must request that such health care provider not further use or disclose the information. A restriction agreed to by a psychologist must not prevent uses or disclosures permitted or required by the Privacy Rule.

      A psychologist may terminate his/her agreement to a restriction, if (1) the patient agrees to or requests the termination in writing; (2) the patient orally agrees to the termination and the oral agreement is documented; or (3) the psychologist informs the patient that he/she is terminating his/her agreement to a restriction, except that such termination is only effective with respect to PHI created or received after the psychologist has so informed the patient.

      Psychologists must maintain a written or electronic record of any such restriction, denial or termination. Psychologists must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later.
      

   2. Right to Receive Confidential Communications by Alternative Means and at Alternative Locations
      
      A psychologist must permit patients to request and receive communications of PHI from the psychologist by alternative means or at alternative locations. A psychologist must accommodate reasonable requests by patients (e.g. a patient may request that bills not be sent to his home).
      
      
   3. Right to Inspect and Copy
      
      
      1. General right:
         
         A psychologist must permit a patient to request access to inspect and to obtain a copy of PHI (including psychotherapy notes) about the patient in a designated record set, for as long as the PHI is maintained in the record. Designated Record Set means a group of records maintained by or for a psychologist that is the following: A. The medical records and billing records about patients maintained by or for the psychologist; or B. Used, in whole or in part by or for the patient to make decisions about patients. The psychologist may require patients to make requests for access in writing, provided he/she informs patients of such a requirement.

         Documents prepared for litigation at the request of an attorney should be assumed to be covered by the state attorney-client privilege and should not be included in the patient's record or released to anyone without consulting with the attorney who requested it. Other documents prepared for litigation may be released to the patient if the provider chooses to do so. A psychologist may be able to withhold these documents from a patient if state law permits it. Before withholding these documents, psychologists are advised to check with local counsel.

      2. Timely response by the psychologist
         
         Generally, the psychologist must act on a request for access no later than 30 days after receipt of the request as follows:

         If the psychologist grants the request, in whole or in part, he/she must inform the patient of the acceptance of the request and provide the access requested.
         
         If, however, the request for access is for PHI that is not maintained or accessible to the psychologist on-site, the psychologist must either grant or deny the request (as per the preceding paragraph) no later than 60 days from the receipt of such request.

         If the psychologist is unable to take one of these actions within the specified time, the psychologist may extend the time only once by no more than 30 days. If the psychologist does extend the time, he/she must still (within the original time limits) provide the patient with a written statement of the reasons for the delay and the date by which the psychologist will complete his/her action on the request.
         

      3. Allowing inspection and/or copying
         
         The psychologist must provide the access requested by patients, including inspection or obtaining a copy, or both, of the PHI regarding them in designated record sets. If the same PHI that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the psychologist need only produce the PHI once in response to a request for access.

      4. Providing access in the form or format the patient requests

         The psychologist must provide the patient with access to the PHI in the form or format requested by the patient, if it is readily producible in such form or format. If the PHI is not readily producible in such form or format, it may be produced in a readable hard copy form or such other form or format as agreed to by the psychologist and the patient. The psychologist may provide the patient with a summary of the PHI requested (in lieu of access to the PHI) or may provide an explanation of the PHI only if the patient agrees in advance to the summary or explanation and the fees imposed, if any, by the psychologist.
         
         
      5. Convenient time and manner of access
         
         The psychologist must provide the access as requested by the patient in a timely manner (see Section "b." above), including (i) at any time during regular business hours after reasonable notice; (ii) arranging with the patient for another convenient time and place to inspect or obtain a copy of the PHI; or (iii) mailing the copy of the PHI at the patient's request. The psychologist may discuss the scope, format and other aspects of the request for access with the patient as necessary to facilitate the timely provision of access.

         Any patient upon submitting a statement of informed consent may inspect the health care records of a health care provider pertaining to that patient at any time during regular business hours, upon reasonable notice.
         

      6. Fees
         
         If the patient requests a copy of the PHI, or agrees to a summary or explanation of the PHI (see Section "d." above), the psychologist may impose a reasonable, cost-based fee, provided that the fee includes only the cost of copying, including the cost of supplies for and labor of copying, postage, and preparing an explanation or summary of the PHI if the fees are agreed to by the patient. The psychologist may withhold access until the fee has been paid.
         
         
      7. Reviewable grounds for denial of patient access
         
         No denial provided for in state law.
         
         
      8. Right to review a denial of access
         
         No denial provided for in state law.
         
         
      9. Process for review of denial
         
         No denial provided for in state law.
         
         
      10. Psychologist's duties after denying access
          
          No denial provided for in state law.
          
          
      11. Documentation
          
          A psychologist must document the titles of the persons or offices responsible for receiving and processing requests for access by patients and the designated record sets that are subject to access by patients. Designated Record Set means a group of records maintained by or for a psychologist that is the following: A. The medical records and billing records about patients maintained by or for the psychologist; or B. Used, in whole or in part by or for the patient to make decisions about patients. Psychologists must maintain a written or electronic record of any such documentation. Psychologists must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later.
          
          
   4. Right to Amend Records
      
      
      1. Patient's general right to amend
         
         A patient has the right to have a psychologist amend PHI or a record about the patient in a designated record set for as long as the PHI is maintained in the designated record set. The psychologist may require patients to make requests for amendments in writing and to provide a reason to support a requested amendment, provided that he/she informs patients in advance of such requirements.
         
         Timely Action by the Psychologist
         
         1. The psychologist must act on the patient's request for an amendment no later than 60 days after receipt of such a request as follows:
            • If the psychologist grants the requested amendment, in whole or in part, he/she must take the actions required by section "b.", below;
            • If the psychologist denies the requested amendment, in whole or in part, he/she must provide the patient with a written denial, in accordance with section "e.", below.
         2. If the psychologist is unable to act on the request for amendment within that time, he/she can take a one-time only extension of no more than 30 days. Within the 60-day time frame, the psychologist must provide the requester with a written statement of the reasons for the delay and the date for completing action on the request.
            
            
      2. Accepting the amendment
         
         If the psychologist accepts the requested amendment in whole or in part, he/she must comply with the following requirements:
         
         1. make the appropriate amendment to the PHI or record that is the subject of the request for amendment by, at minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the amendment;
         2. timely inform the patient, (see Section "a.", above,) that the amendment is accepted and have the patient identify the relevant persons with whom the psychologist may share the amendment, (see next section) and agree to have the psychologist notify such persons; and
         3. make reasonable efforts to inform and provide the amendment within a reasonable time to:
            
            • those persons identified by the patient as having received PHI about the patient and needing the amendment; and
            • persons, including business associates, that the psychologist knows have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely on such information to the patient's detriment.
              
              
      3. Acting on notices of the amendment
         
         A psychologist who is informed by another Covered Entity of an amendment to a patient's PHI, (see Section "b.", above) must amend the PHI in designated record sets as provided by Section "a.", above.
         
         
      4. Documentation
         
         A psychologist must document the titles of the persons or offices responsible for receiving and processing requests for amendments by patients. Psychologists must maintain a written or electronic record of any such documentation for six years from the date of its creation or the date when it was last in effect, whichever is later.
         
         
      5. Denial of amendment
         
         
         1. The Psychologist may deny the request if he/she determines that the PHI or record that is the subject of the request:
            • was not created by the psychologist (unless the patient provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment); or
            • is not part of the designated record set; or
            • would not be available for inspection under the Right to Inspect and Copy provision; or
            • is accurate and complete.
              
         2. If the psychologist denies the requested amendment in whole or in part, the psychologist must comply with the following requirements:
            1. Written Denial - the psychologist must provide the patient with a timely (see Section "a.", above) written denial; the denial must be in plain language and contain:
               • the basis for the denial;
               • a statement of the patient's right to submit a written statement disagreeing with the denial and how the patient may file such a statement;
               • a statement that, if the patient does not submit a statement of disagreement, the patient may request that the psychologist provide the patient's request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and
               • a description of how the patient may complain to the psychologist pursuant to the complaint procedures or to the Secretary of Health and Human Services. The description must include the name or title and telephone number of the contact person or office designated to receive such complaints.
                 
            2. Statement of Disagreement - The psychologist must permit the patient to submit to the psychologist a written statement disagreeing with the denial all or part of a requested amendment and the basis of such disagreement. The psychologist may reasonably limit the length of that statement.
               
            3. Rebuttal Statement - The psychologist may prepare a written rebuttal to the patient's statement of disagreement and must provide a copy the rebuttal to the patient.
               
            4. Recordkeeping - The psychologist must, as appropriate, identify the record or PHI in the designated record set that is the subject of the disputed amendment and append or otherwise link to the patient's request for amendment, the psychologist's denial of the request, the patient's statement of disagreement, if any, and the psychologist's rebuttal, if any, to the designated record set.
               
            5. Future Disclosures -
               
               • If a statement of disagreement has been submitted by the patient, the psychologist must include the material appended in accordance with the preceding section ((D) "Recordkeeping"), or, at the election of the psychologist, an accurate summary of any such information, with any subsequent disclosure of the PHI to which the disagreement related.
               • If the patient has not submitted a written statement of disagreement, the psychologist must include the patient's request for amendment and his/her denial, or an accurate summary of such information, with any subsequent disclosure of the PHI only if the patient has requested such action in accordance with Section (B).
               • When a subsequent disclosure described in the above two points is 1) made using a "standard transaction" under the HIPAA Transaction Rule (an electronic transmission of any health information to carry out a financial or administrative activity, such as submitting a claim for reimbursement) and 2) that transaction does not permit the additional material to be included with the disclosure, then the psychologist may separately transmit the material required by these above two points as applicable, to the recipient of the standard transaction.
                 
                 
   5. Right to an Accounting of Disclosures
      
      
      1. General right
         
         
         1. A patient generally has a right to receive an accounting of disclosures of PHI for which the patient has neither provided consent nor authorization (as described above in Section III. "Uses and Disclosures with Neither Consent nor Authorization"). The psychologist is only required to account for disclosures that occurred within the six years prior to the date of the request for the accounting.
            
            The following disclosures are not subject to the accounting requirement:
            • For treatment, payment, and health care operations;
            • Pursuant to the patient's authorization;
            • To the patient;
            • That are incidental to permitted or required uses or disclosures (e.g., a patient's name is called out in the waiting room and overheard by another person);
            • That occurred prior to the compliance date for the psychologist (the date on which the psychologist takes an action that would require him/her to be compliant with the Privacy Rule; e.g., an electronic submission of a claim.);
            • To correctional institutions or law enforcement officials; or
            • For national security or intelligence purposes.
            Disclosures not listed in this section (which are rare) may also need to be included in the psychologist's accounting.
         2. If a health oversight agency or law enforcement official provides the psychologist with a written statement that an accounting to the patient would be reasonably likely to impede the agency's activities (and specifying the time for which such a suspension is required), then the psychologist must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official (for the time specified by such agency or official).
            
            • If the statement of the health oversight agency or law enforcement official is made orally, the psychologist must:
              1. Document the statement, including the identity of the agency or official making the statement;
              2. Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and
              3. Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless the health oversight agency or law enforcement official submits a written statement during that time.
         3. A patient may request an accounting of disclosures for a period of time less than six years from the date of the request.
            
            
      2. Content of the accounting
         
         The psychologist must provide the patient with a written accounting that meets the following requirements:
         
         1. Except as otherwise provided by section "a." above, the accounting must include disclosures of PHI that occurred during the six years (or such shorter time period at the request of the individual as provided in section "a.iii." above) prior to the date of the request for an accounting, including disclosures to or by business associates of the psychologist.
         2. The accounting must include for each disclosure:
            
            • The date of the disclosure;
            • The name of the entity or person who received the PHI and, if known, the address of such entity or person;
            • A brief description of the PHI disclosed; and
            • A brief statement of the purpose of the disclosure that reasonably informs the patient of the basis for the disclosure; or, in lieu of such statement:
              1. A copy of the patient's written authorization; or
              2. A copy of a written request for a disclosure, if any.
         3. If, during the period covered by the accounting, the psychologist has made multiple disclosures of PHI to the same person or entity for a single purpose, or pursuant to a single authorization, the accounting may, with respect to such multiple disclosures, provide:
            • The information required by section "b.ii" above, for the first disclosure during the accounting period;
            • The frequency, periodicity, or number of the disclosures made during the accounting period; and
            • The date of the last such disclosure during the accounting period.
              
              
      3. Providing the accounting
         
         
         1. The psychologist must act on the patient's request for an accounting, no later than 60 days after receipt of such a request, as follows.
            • The psychologist must provide the patient with the accounting requested; or
            • If the covered entity is unable to provide the accounting within 60 days, the covered entity may extend the time to provide the accounting by no more than 30 days, provided that:
              1. The psychologist, within 60 days, provides the patient with a written statement of the reasons for the delay and the date by which the psychologist will provide the accounting; and
              2. The psychologist may have only one such extension of time for action on a request for an accounting.
         2. The psychologist must provide the first accounting to a patient in any 12 month period without charge. The psychologist may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same patient within the 12 month period, provided that the psychologist informs the patient in advance of the fee and provides the patient with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.
            
            
      4. Documentation
         
         
         1. The psychologist must document the following:
            • The titles of the persons or offices responsible for receiving and processing requests for an accounting by patients.
            • The written accounting that is provided to the patient; and
            • The information required to be included in an accounting under section "b." above, for disclosures of PHI that are subject to an accounting under section "a.", above.
         2. Psychologists must maintain a written or electronic record of any such documentation. Psychologists must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later.
            
            
   6. Right to a Paper Copy of Privacy Notice
      
      A patient has a right to obtain a paper copy of the notice of the psychologist's privacy practices upon request, even if the patient has agreed to receive the notice electronically.
      
      
2. Psychologist's Duties
   
   
   1. The psychologist is required to maintain the privacy of PHI and to provide the patient with a notice of his/her legal duties and privacy practices with respect to PHI.
      
   2. The psychologist may change the privacy policies and practices described in the notice, if he/she reserves the right to do so. Unless the psychologist notifies the patient of such changes, however, the psychologist is required to abide by the terms currently in effect.
   3. If the psychologist intends to revise his/her policies and procedures, he/she must describe in the notice to patients how the psychologist will provide patients with a revised notice of privacy policies and procedures (e.g., by mail, e-mail).
      

V. COMPLAINTS

Complaints to the Psychologist - A psychologist must provide a process for patients to make complaints concerning the psychologist's policies and procedures or his/her compliance with such policies and procedures.

Documentation of Complaints - A psychologist must document all complaints received, and their disposition, if any. Psychologists must maintain a written or electronic record of any such complaints. Psychologists must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later.

VI. PRIVACY SAFEGUARDS

A psychologist must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI. A psychologist must reasonably safeguard PHI from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of the Privacy Rule.

VII. USES AND DISCLOSURES INVOLVING PERSONAL REPRESENTATIVES

1. Personal Representatives of Adults and Emancipated Minors
   
   Where an incapacitated patient has a guardian or other legal representative with authority to make health care decisions for the patient, the psychologist must treat the guardian or legal representative as the patient with respect to PHI that is relevant to that individual's representation (letting the guardian or legal representative exercise the privacy rights that a patient would normally exercise, e.g., receiving notice, consenting to disclosure, having access to their records and the right to amend).

   A psychologist may elect not to treat the guardian or legal representative as the patient if:
   

   1. The psychologist has a reasonable belief that:
      
      1. The guardian or legal representative has subjected or may subject the patient to abuse or neglect; or
         
      2. Treating the guardian or legal representative as the patient could endanger the individual; and
         
   2. The psychologist decides in the exercise of professional judgment that it is not in the patient's best interest to let the guardian or legal representative exercise the patient's privacy rights.
      
      
2. Personal Representatives of Unemancipated Minors

   If a psychologist is treating a child or ward, the psychologist must treat the parent or legal guardian (of the child or ward) as the patient with respect to PHI relevant to that representation (letting the parent or guardian exercise the privacy rights that a patient would normally exercise, e.g., receiving notice, consenting to disclosure, having access to their records and the right to amend).

   There may be laws in your state that would allow minors to consent to treatment. Should your records in treating a minor be requested in relation to such a law, legal consultation is suggested.

   The psychologist should not treat the parent or guardian as the patient when the parent or guardian has specifically agreed, before the child or ward receives psychological services, that certain issues must be reserved to the child or ward (for example where the parent or guardian agrees that communications between the psychologist and child or ward will be confidential).

   Regardless of what is stated above, if there are any state laws that specifically grant or deny the parent or guardian access to the minor's PHI, such laws must be followed.
   
   A psychologist may elect not to treat a parent or guardian as the patient if:
   

   1. the psychologist has a reasonable belief that:
      
      1. the parent or guardian has subjected or may subject the patient to abuse or neglect; or
         
      2. that treating the parent or guardian as the patient could endanger the individual and
         
   2. the psychologist decides in the exercise of professional judgment that it is not in the patient's best interest to let the parent or guardian exercise the patient's privacy rights.
      
      
3. Personal Representatives of Deceased Patients

   The psychologist must treat the personal representative of a deceased patient as the patient with respect to PHI that is relevant to the representative's representation (letting the personal representative exercise the privacy rights that a patient would normally exercise, e.g., receiving notice, consenting to disclosure, having access to records and the right to amend).
   
   A psychologist may elect not to treat the personal representative of a deceased patient as the patient if:

   1. the psychologist has a reasonable belief that the personal representative has subjected the patient to abuse or neglect and
      
   2. the psychologist decides in the exercise of professional judgment that it is not in the patient's best interest to let the personal representative exercise the patient's privacy rights.
      
      
      
4. Verification of Authority of Personal Representatives

   In sections "A," "B," and "C." above, psychologists must verify that the person claiming to be the patient's legal representative has the legal authority to represent the patient and verify the scope of his/her authority. When in doubt, the psychologist should insist on documentation. The legal representative is only entitled to receive PHI that is relevant to his/her representation (e.g., if a legal representative is only authorized to make decisions regarding a patient's cancer treatment, they may only receive PHI relevant to the cancer treatment. They would not need to know about extramarital affairs). If you are uncertain as to the person's authority as a legal representative in general, or are uncertain that the requested PHI is relevant to the person's representation of the patient, you may wish to consult with legal counsel or insist that the legal representative obtain a court order.

¹ Informed consent means written consent to the disclosure of information from patient health care records to an individual, agency or organization that includes all of the following: (a) The name of the patient whose record is being disclosed. (b) The type of information to be disclosed. (c) The types of health care providers making the disclosures. (d) The purpose of the disclosure such as whether the disclosure is for further medical care, for an application for insurance, to obtain payment of an insurance claim, for a disability determination, for a vocational rehabilitation evaluation, for a legal investigation or for some other specified purpose. (e) The individual, agency, or organization to which the disclosure may be made. (f) The signature of the patient or person authorized by the patient and, if signed by a person authorized by the patient, the relationship of that person to the patient or the authority of the person. (g) The date on which the consent is signed. (h) The time period during which the consent is effective.