Notice of Privacy Practices

Updated July 1, 2026

This Notice of Privacy Practices (“NPPs”) applies to Ezer Counseling (The Woodlands, Texas), which provides couples therapy counseling services (“Provider”).

As your provider we care about the confidentiality and security of your medical records, as well as how it is used. Pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and 42 C.F.R. Part 2 – Confidentiality of Substance Use Disorder Patient Records (“Part 2”), the NPPs describe how medical information about you may be used and disclosed and how you can get access to this information. Please read carefully. This applies to covered entities even if they are not considered a “program” under 42 C.F.R. Part 2.11.

This Notice of Privacy Practices describes how Provider may use and release protected health information about you that we maintain and may be updated from time-to-time as regulations and technology change.

Provider has an obligation to maintain the privacy and security of protected health information. In the event of a reportable breach, you will be notified and all other conditions of the Breach Notification Rule will be met.

Permitted and required disclosures of protected health information:

Treatment, Payment and Healthcare Operations.

Pursuant to HIPAA, as one of your healthcare providers, we may use and disclose protected health information (“PHI”) about you for treatment, payment and healthcare operations without your authorization. Some examples of these types of uses/disclosures are:

Treatment: We may use or disclose PHI about you to provide your prescribed products, equipment or service. We may consult and coordinate with your physician. We may remind you of medication or supply refills and schedule visits/appointments. We may provide you information about treatment alternatives or other health benefits and services that may be of interest to you through newsletters or other means. We may also disclose your PHI to other healthcare providers (such as Physicians, labs and pharmacies) involved in your treatment.
Payment: We may use or disclose your PHI to bill and collect payment for the products, equipment or services we provide to you. We may contact your insurer or other payor to obtain eligibility and coverage information. We may also disclose your PHI to health plans, healthcare clearinghouses or other healthcare providers involved in your care for their payment activities.
Healthcare Operations: We may use or disclose your PHI for quality assessment activities, evaluation of our employee’s performance, business planning and development, and management and general administrative purposes. We may disclose your PHI to health plans or other healthcare providers for their quality assessment, employee evaluation or healthcare compliance activities.

We also may engage consultants and contractors to perform certain services for us. When the nature of these services involves PHI disclosure, the consultants/contractors are required to appropriately safeguard the PHI they receive, maintain and/or transmit.

Other Permitted and Required Use and Disclosures.

We may use or disclose your PHI for the following reasons without your consent:

Persons involved in care/payment. We may disclose relevant parts of your PHI to family members or other persons involved in your care and its payment. We may notify such persons or public or private entities involved in disaster relief efforts of your location, general condition or death.
Limited marketing purposes. From time to time, we may also provide promotional items of nominal value or marketing information communicated to you in person. Will ask for online review and to use email, text or other means of communication between Provider and the patient.
Governmental agencies. We may disclose parts of your PHI to governmental authorities entitled to receive such information, including the Secretary of Health and Human Services.
Required or permitted by law. We may disclose parts of your PHI in other situations not mentioned above when required or permitted by law.

Substance Use Disorder Information:

Not all information related to substance use disorder (“SUD”) that is received by Provider is subject to 42 CFR Part 2. Provider has policies and procedures and follows the appropriate process for receiving and requesting this category of PHI. We obtain patient consent and receive SUD PHI in accordance with HHS guidance, as set forth in Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data?

Nothing in this section conflicts with the requirements that patients or visitors do not bring or use illegal drugs (or legal drugs in an abusive way, including opioids) into this facility. Provider’s priority is for the safety of its patients, staff and visitors and it reserves all legal rights to address a situation, including informing appropriate law enforcement and emergency medical services.

Psychotherapy Note Information:

The Privacy Rule defines psychotherapy notes as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record. Psychotherapy notes do not include any information about medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, or results of clinical tests; nor do they include summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. Psychotherapy notes also do not include any information that is maintained in a patient’s medical record. See 45 CFR 164.501.

Provider does create, receive, maintain or transmit psychotherapy notes, as defined at 45 CFR § 164.508(a)(2).

The Privacy Rule requires a covered entity to obtain a patient’s authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes. See 45 CFR 164.508(a)(2). A notable exception exists for disclosures required by other law, such as for mandatory reporting of abuse, and mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient; however, in Texas, the general rule is that a counselor does not have a duty to warn.

Other Disclosures:

Except as provide by our Notice of Privacy Practice Practices, we will not use or disclose protected health information about you without your written authorization.

HIPAA Authorization:

This is a separate, signed document which identifies who we can share your PHI with or who you do not want your PHI shared with. A legal representative who is legally acting on the patient’s behalf has the same rights. For certain types of health information, you can tell us your choices including sharing information with family, friends or others involved in your care when they are present. In a disaster relief situation, we will act in accordance with any directives announced by a federal or a state agency.

Marketing or Sale of PHI.

We will never share your information for marketing, fund raising or sales purposes. This would require express, written authorization from you.

Your Rights:

The following is a statement of your rights regarding your PHI and a brief description of how you may exercise these rights:

Access: You may have the right to inspect and copy the PHI we maintain about you except for psychotherapy notes, information complied in anticipation of a legal proceeding or other PHI to which you access is limited by federal law. Request to inspect and copy records must be in writing directed to our Privacy Officer and provides specific information to assist us in fulfilling your request. We may charge a reasonable fee for copying and mailing copies. If we deny your request for access, under most circumstances, you have the right to have the denial reviewed. Please contact our Privacy Officer if your questions concerning your right to inspect and copy your records.
Copy of Medical Records: You have the right to request a copy of your designated health record set or a portion of your medical record. A third-party may be utilized to provide this information to you in a method that does not subject our infrastructure or other patient medical records to a potential cybersecurity vulnerability. Your records will be provided within the typical 30-day period, which may be extended an additional 30-days per HIPAA, unless state law requires that your medical records are provided in a shorter time period. If an extension is needed, then you will be informed and provided with your medical records no later than 60 days after the request.
Confidential communications: You have the right to request that PHI be sent to you by alternate means or at alternative locations. For instance, you can ask that we send mail to a post office box rather than to your home address.
Restrictions: You have the right to request restrictions on how we use or disclose your PHI for our treatment, payment and healthcare operations activities. You also have the right to request that we not release any part of your PHI to family members or others who may be involved in your care. Your request must be in writing to our Privacy Officer and must specify what part of your PHI you do not want released and to who you do not want it released. We are not required to agree to your request and only our Privacy Officer is authorized to agree to such requests. If we agree to your request, we will abide by the restriction unless the restricted PHI is needed to provide you emergency treatment.
Amendment: You have the right to request that we amend the PHI we maintain about you. Request for amendment must be in writing directed to our Privacy Officer and provide a reason to support your requested amendment. If we deny your request for amendment, you may file a written statement of disagreement with our Privacy Officer, and we will include it in your PHI when used and disclosed.
Accounting: You have the right to receive an accounting of certain disclosures of PHI made by us. Your request for accounting must in writing directed to our Privacy Officer and must not request an accounting for more than six years. Certain disclosures are not required to be included in the accounting including; disclosures for our treatment, payment, and healthcare.
Health oversight activities: We may disclose parts of your PHI to regulatory authorities for purposes of monitoring the healthcare system and compliance with civil rights laws and government regulations and healthcare programs requirements.
Health or safety: We may use or disclose parts of your PHI if we believe it is necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of another person or the public. In certain circumstances, this may include disclosing parts of your PHI local utility companies or emergency services so that they may provide appropriate assistance in the event of an emergency or power outage.
Abuse, Neglect or domestic violence: We may disclose part of your PHI to appropriate government agencies if we believe you may be a victim of abuse, neglect or domestic violence and such disclosure is authorized applicable law or regulation.
Public health activities: We may disclose parts of PHI to public health authorities for purposes of controlling disease, injury or disability. We may also release parts of your PHI to the Food and Drug Administration to report adverse events, track products, enable recalls, conduct post marketing surveillance and other activities in connection with its regulations of the quality, safety and effectiveness of certain products or activities.
Research: Subject to certain restrictions, we may disclose parts of your PHI to facilities research when an individual authorization waived is approved by an institutional review or privacy board.
De-identification information: We may use or disclose parts of your PHI that do not personally identify you or reveal who you are.
Workers compensation: To the extent authorized by applicable law, we may disclose your PHI to workers compensations or similar programs that provide benefits for work related injuries or illnesses.
Correctional institutions: If you are incarcerated or otherwise in the custody of law enforcement officials, we may disclose certain parts of your PHI to the correctional institution or facility or its authorized personnel.
Legal proceedings: We may disclose parts of your PHI in any judicial or administrative proceeding pursuant to court order or if we meet other legal requirements.
Law Enforcement: We may disclose parts of your PHI to locate or identify a suspect, fugitive, material witness or missing person; to comply with laws such as those requiring reporting of certain injuries or death or to report certain crimes.
Coroners, medical examiners and funeral directors: We may disclose part of your PHI to coroners and medical examiners for identification purposes, to determine cause of death or as otherwise required by law. We may also disclose, consistent with applicable law, part of your PHI to funeral directors to permit them to carry out duties.
Organ or tissue donation purposes: We may disclose parts of your PHI to organ procurement organizations or other entities to facilitate organ or tissue procurement, banking or transplantation.
Specialized government functions: Under certain circumstances, we may disclose parts of your PHI to armed forces personnel and to department of state and other federal officials in connections with specialized government functions (including military missions, national security and protective services), operations activities, incidental disclosures, disclosures for national security , disclosures to correctional institutions certain disclosures of PHI without personally identifying information and any disclosures made prior to this Privacy Practice.
Copy of notice of privacy practices: You have a right to receive a paper copy of our Notice of Privacy Practices even if you agree to receive our Notice of Privacy Practices electronically. You may obtain a copy from your local services center or by contacting our Privacy Officer and requesting a copy by mail.
Pictures and recordings: Because other patients are in the vicinity, patients, legal representatives or individuals accompanying a patient are expressly prohibited from recording or taking pictures. As part of your informed consent form and /or as required by law diagnostic procedures are recorded and included as part of the medical record.

Our Responsibilities:

We are required by law to maintain the privacy of protected health information and to provide you notice of our legal duties and privacy practices with respect to protected health information.

We are required to abide by the terms of our Notice of Privacy Practices or applicable state laws which provide for more restrictions on the use and disclosure of your PHI.

Change to Notice of Privacy Practices:

We may change the terms of our Notice of Privacy Practices at any time. The new Notice of Privacy Practices will apply to all PHI that we maintain on or after the effective date of the new Notice of Privacy Practices. Upon request to your local service center, we will give you a copy of a new Notice of Privacy Practices. You may also obtain this information by calling our Privacy Officer and requesting a copy by mail.

Complaints:

If you believe your HIPAA or Part 2 privacy rights have been violated, you may contact our Privacy Officer and provide specific information of the alleged violation. You may also notify the Secretary of Health and Human Services through their portal - https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.

We will not retaliate against you for filing a complaint.

Additional Information:

If you need additional information about our Privacy Practices, please contact Ms. Dana Sutter, LCSW-S at dana.sutter@ezertherapy.com.