DR. JULIA RIOS, PHD, LP
CLINICAL PSYCHOLOGIST
CA LICENSE PSY35585
(415) 580-0234
EFFECTIVE DATE OF THIS NOTICE This notice went into effect on June 13, 2026
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Commitment to Privacy
With limited exceptions, information about you and your health is confidential. Confidential information includes all individually identifiable information, whether in electronic or physical form, that is in my possession or is derived from information you share in confidence regarding your past medical or mental health history, a current or potential future mental or physical health condition, your mental or physical health treatment or payment for treatment. The specific health information I create and maintain is information that relates to your participation in outpatient treatment with a psychotherapist. All such information is referred to as protected health information (“PHI”).
I create a record of the care and services you receive from me. I need this record to provide you with quality care and to comply with certain legal requirements. I am required by law to safeguard the privacy of all PHI that identifies you. I am required to give you this notice and to follow the terms of the notice currently in effect. I am required by law to provide you with adequate notice of your rights and my legal duties if I create or maintain records protected by 42 C.F.R. Part 2. I will notify you if I become aware of an unauthorized access, use or disclosure of your health information.
I care about your privacy and I am committed to safeguarding your PHI. This notice details some of the ways in which I may use and disclose health information about you, as well as certain legal obligations I have regarding the use and disclosure of your health information. It also describes your rights regarding your health information. You are urged to read this carefully in order to understand my responsibilities in maintaining the privacy of your PHI and your rights.
Changes to the Notice
I provide you with a copy of this notice as part of your initial intake documentation which may be made available through our electronic record keeping system. I may change the terms of this notice at any time, and such changes will apply to all information I have about you as well as any information I receive in the future. The new notice will be available upon request and is posted on my website.
Protection of Your Health Information
Your confidential health information and PHI will be protected with the following measures:
I treat all information about you that I collect as confidential. This means that with limited exceptions, as discussed below, I will not share your information with anyone without your consent or written authorization.
When I am either permitted or required to share your confidential health information, whether with or without your written authorization, I will disclose only the minimum information necessary under the circumstances.
Access to your PHI is restricted only to clinical staff only who have a legitimate need for access in order to provide services to you.
Obtaining reasonable assurances in writing through a Business Associate Agreement with any outside services or other business associates which we may use in order to provide you with services or conduct necessary business operations
Maintaining physical, electronic, and procedural safeguards to comply with federal and state regulations guarding your PHI. More specifically, the Practice maintains your health information using a HIPPA compliant electronic health record (“EHR”) provided through SimplePractice, which complies with state and federal laws requiring the protection and security of patient information. These laws include California’s Confidentiality of Medical Information Act, and the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations including the federal privacy, security and enforcement rules, the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH*”*) and its implementing regulations including the Breach Notification Rule, and the HIPAA Omnibus Rule of 2013 requiring Business Associates to comply with the Privacy and Security Rules, and making Business Associates liable for HIPAA violations. Business Associates are third parties who are not employees, contractors or volunteers of the Practice but who are otherwise involved in our provision of treatment or healthcare operations. “Business Associate” is explained more fully below.
How I May Use or Disclose Health Information About You
The following categories describe different ways that I may use your health information and disclose your health information to other persons or entities. Not every use or disclosure in a category will be listed. However, all the ways we are permitted to use and disclose your health information will fall within one of the following categories.
Treatment:
Your health information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment. This means, for example, that your health information may be shared and discussed with a treating psychiatrist or another involved physician in order to coordinate care. Federal privacy regulations allow health care providers who have direct treatment relationship with the patient/client to use or disclose the patient/client’s personal health information without the patient’s written authorization, to carry out the health care provider’s own treatment, payment or health care operations.
I may also disclose your protected health information for treatment-related activities. This too can be done without your written authorization. For example, if I were to consult with another licensed health care provider about your condition, I would be permitted to use and disclose your personal health information, which is otherwise confidential, in order to assist me in diagnosis and treatment of your mental health condition. Disclosures for treatment purposes are not limited to the minimum necessary standard. Therapists and other health care providers sometimes need access to the full record and/or complete information in order to provide quality care. The word “treatment” includes, among other things, the coordination and management of health care providers with a third party, consultations between health care providers and referrals of a patient for health care from one health care provider to another.
I may also disclose your health information to a family member, other relative, domestic partner or a close personal friend, or any other person identified by you, if the information is directly relevant to that person’s involvement with your care or payment related to your care, after obtaining your consent or providing you with the opportunity to object to the disclosure and you express no objection. In the event of an emergency, I may disclose such information which I determine based upon professional judgment to be in your best interest without obtaining your consent or providing you with the opportunity to object.
If your records are protected under 42 C.F.R. Part 2, certain uses and disclosures permitted by HIPAA for treatment, payment, and health care operations are materially limited by the stricter standards of those regulations. 42 CFR Part 2 is a federal law and set of regulations in the United States that provides strict confidentiality protections for medical records related to substance use disorders (SUD). Information disclosed pursuant to these rules may be subject to redisclosure by the recipient and may no longer be protected by federal privacy standards.
Payment:
I may use and disclose your health information to bill for services and to obtain payment, including, if necessary, the reporting of limited information necessary to pursue collection through a collection agency.
With your consent or written authorization, I may disclose health information to your insurance company, health plan, or other third-third party payer or guarantor. This may include the disclosure of health information to obtain prior authorization for treatment. Your health information may also be disclosed in response to requests from your insurer, health plan, employee benefit plan or any governmental authority responsible for paying for health care services provided to you, to the extent necessary to allow responsibility for payment to be determined. In such cases you have a right to be provided with a copy of the request in writing within 30 days of the requestor’s receipt of the information requested.
Any information disclosed pursuant to this section will be limited to the minimum information necessary, and generally includes the nature of the services provided, the dates of services, the amount due and other relevant financial information.
You should be aware that, should you choose to use your insurance company, health plan or other third-party payer or guarantor to reimburse you for services, certain personal health information may be shared with the Medical Insurance Bureau (“MIB”), which may make your information available through the use of codes to its member insurers. You may request a copy of your MIB file at: https://www.mib.com/request_your_record.html or by calling 1-866-692-6901.
Health Care Operations:
I may use or disclose your health information for health care operations. For example, I may use a billing service, IT support, document management services, storage providers or other essential services. These uses and disclosures are necessary for the internal operations of this mental health practice. When these operations involve third parties who are not associated with the practice, we call them “Business Associates” (as discussed below) and enter into agreements with them to protect your confidentiality.
Lawsuits and Disputes:
If you are involved in a lawsuit, I may disclose health information in response to a court or administrative order. I may also disclose health information about your child in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested. However, for records protected by 42 C.F.R. Part 2, such records or testimony relaying their content shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide specific written consent or a court order is issued in accordance with 42 C.F.R. Part 2.
Certain Uses and Disclosures Require Your Authorization
Generally, I am not permitted to use or disclose your health information without your written authorization, except where disclosure is required or permitted by law. The authorization must state what information can be released, to whom, and for what purpose. It must be dated. You have the right to refuse to consent to disclosure without fearing any kind of pressure or retaliation. If you authorize me to use or disclose health information about you, you may limit the information to be used and/or disclosed and you may revoke the authorization in writing at any time. You also have the right to revoke your written authorization by providing me with notice, except to the extent that I have already acted in reliance on your authorization. The following uses and disclosures require your authorization.
Psychotherapy Notes:
A psychotherapist may at their discretion keep “psychotherapy notes” in addition to your treatment record. Sometimes called “process notes”, psychotherapy notes means notes recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of your diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date (45 CFR 501.164). To be considered “psychotherapy notes”, the notes must be separate from the medical record. These notes may capture your therapist’s impressions about you, contain details of psychotherapy conversations considered to be inappropriate for the medical record, and are used by your psychotherapist for future sessions. It is because of the sensitivity of these notes that they are kept separate from your medical record and not included in records which may be sent to insurers for payment. Psychotherapy notes cannot be disclosed without your written authorization, including disclosure for treatment purposes to a health care provider, unless the use or disclosure is:
For my use in treating you.
For my use in training or supervising mental health practitioners to help them improve their skills in group, joint, family, or individual counseling or therapy.
For my use in defending myself in legal proceedings instituted by you.
For use by the Secretary of Health and Human Services to investigate my compliance with HIPAA.
Required by law and the use or disclosure is limited to the requirements of such law.
Required by law for certain health oversight activities pertaining to the originator of the psychotherapy notes.
Required by a coroner who is performing duties authorized by law.
Required to help avert a serious threat to the health and safety of others.
Marketing Purposes or Sales:
I will not use or disclose your health information for marketing purposes or sell your health information for any reason.
Substance Use Disorder (SUD) Counseling Notes:
I may also maintain “SUD counseling notes,” which are notes recorded by a substance use disorder provider documenting the contents of a counseling session. Any use or disclosure of these notes requires your separate written authorization, which cannot be combined with a consent for other types of records. You can revoke your consent at any time except to the extent that I have already acted upon it to disclose these notes in accordance with your initial authorization.
Certain Uses and Disclosures Do Not Require Your Authorization
There are times when I am permitted or required by law to disclose certain confidential health information. Subject to certain limitations in the law, I can use and disclose your PHI without your authorization for the following reasons:
For reporting suspected child, elder, or dependent adult abuse. Sexual abuse of a child includes the creation of or streaming, downloading, storing or transmitting electronic images sexually depicting a child. This law is implicated even when a minor creates, streams, stores or transmits images of themselves.
For preventing or reducing a serious threat to anyone’s health or safety. If I believe that you are threatening serious bodily harm to another person, I am required to take protective actions. These actions may include notifying the potential victim, contacting the police, or seeking hospitalization for you.
If I have reason to believe that you present a danger to yourself. If you threaten to harm yourself, I may be obligated to seek hospitalization for you or to contact family members or others who can help provide you with protection.
For Workers Compensation to the extent necessary to comply with state workers compensation laws governing job-related injuries or illnesses.
Upon a request by certain legal representatives on your behalf such as a conservator who is authorized to access behavioral health records, or a person having durable powers of attorney for healthcare decisions under circumstances where you have been determined to lack capacity to make healthcare decisions. Legal representatives also include, upon your death, any personal representative (as statutorily defined), executor, or administrator of your estate or beneficiary potentially including any person who may have a present or future interest under a trust. Note that the Confidential Information of a deceased person ceases to be “PHI”, and loses its privacy protection 50 years from the date of a patient’s death.
When required by the Secretary of the Department of Health and Human Services or any of its offices, including the Office of Civil Rights to investigate or determine the Practice’s compliance with HIPAA or any of its implementing regulations.
In response to a lawfully executed search warrant from a law enforcement agency.
In response to a request by a medical examiner, forensic pathologist, or coroner when requested for the purpose of identifying you or locating your next of kin, or when investigating your death if it involves a public health concern, organ or tissue donation, child abuse, elder abuse, suicide, poisoning, or an otherwise unknown or suspicious death, or when otherwise authorized by the decedent’s representative.
For appointment reminders and health related benefits or services. I may use and disclose your PHI to contact you to remind you that you have an appointment with me. I may also use and disclose your PHI to tell you about treatment alternatives, or other health care services or benefits that I offer.
Pursuant to a legal proceeding that is initiated by or brought against you. For example, if you place your mental status at issue in litigation, such as in a lawsuit seeking damages for severe emotional distress, the defendant may have the right to obtain your psychotherapy records and/or the testimony of your psychotherapist by issuing a subpoena. Your personal health information may then be shared with retained experts in the case and shared with other parties in the litigation. Potentially that information may even be shared with a jury or other fact finder. Please note that we will not release your protected health information in response to a subpoena without your written authorization, unless required by law or court, except in cases where the records are sought for a workers’ comp determination or proceeding, and even then, such release of information shall be reasonably limited to only that information necessary for the determination or proceeding.
For certain specialized governmental functions related to the military, national security and intelligence. For example, if you are a member of the military, the disclosure of patient communications may be compelled in proceedings brought under the Uniform Code of Military Justice, 1) if the communication is evidence of child abuse or neglect, or in a proceeding in which one spouse is merely charged with a crime against a child of either spouse; or 2) if the communication reflects your intent to commit a future fraud or crime or if the services of the psychotherapist are sought to enable or aid anyone to commit or plan to commit what the patient knows or reasonably should know is a crime or fraud; or 3) when necessary to ensure the safety and security of military personnel, military dependents, military property, classified information or the accomplishment of a military mission. As a licensed psychotherapist, I am not under the jurisdiction of the military and therefore will not voluntarily disclose such information, although you should know that disclosure may be compelled in a military proceeding. If any of the exceptions in this paragraph are of concern to you, you should discuss them with your psychotherapist.
For health oversight activities. While California law is more protective of your right to confidentiality than HIPAA, in that California law requires your written authorization for a licensing board to access your health records as part of any investigation into a complaint against a licensee, there may still be health oversight situations in which your information may be accessed without the need to first obtain your authorization. Health oversight agencies include federal, state and local government agencies authorized by law to oversee the public and private healthcare care system or government programs in which health information is necessary for determining eligibility or compliance, or to enforce civil rights laws for which health information is relevant. Uses and disclosures for healthcare oversight must be limited to the minimum information necessary to accomplish the oversight objective. For example, the Department of Managed Health Care (“DMHC”) in California is a health oversight agency authorized to oversee HMOs and certain other health plans within the state. HIPAA permits covered health plans to disclose private health information to the DMHC for oversight activities including audits, civil, administrative or criminal investigations, inspections, and other activities necessary for the oversight of the healthcare system, government benefit programs, compliance with governmental regulation or compliance with civil rights laws. Health oversight investigators generally do not seek access to individual patient records, but instead review large numbers of records to determine whether a health care provider or organization may be violating the law. In the course of their efforts to protect the healthcare system, health oversight investigators may at times uncover evidence of wrongdoing unrelated to the health care system, such as evidence of criminal conduct by an individual who has sought health care. However, law enforcement may not use protected health information concerning an individual, discovered during the course of health oversight activities, for unrelated civil, administrative, or criminal investigations, against that individual unless the public interest and the need for disclosure clearly outweigh the potential for injury to the patient, to the psychotherapist patient relationship, and to the treatment services.
For use of business associates. Some services may be obtained through contracts with business associates. For example, I may contract with outside companies to provide legal services, accounting services, or billing services. When I contract with a business associate, I may disclose health information to the business associate so it can do the job we have asked it to do. To protect your health information, I enter into “Business Associate” agreements with them to require them to appropriately safeguard your health information.
For data breach notification purposes. I may use limited confidential health information such as your contact information to provide legally required notices of unauthorized acquisition, access or disclosure of your Confidential Information, if such were to occur. I may send notices directly to you or provide notice to the sponsor of a health plan through which you receive coverage.
To comply with the law. I may disclose health information about you if otherwise required by state or federal laws.
Certain Uses and Disclosures Require You to Have the Opportunity to Object
You have the right to the opportunity to object to disclosures to family, friends, or others. I may provide your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.
In the Event of an Emergency
Confidential treatment information may also be disclosed in the rare event of a medical or psychological emergency, meaning a sudden change in condition that may result in physical or psychological harm to you if left untreated.
Your Rights Regarding Confidential Information About You
You have the following rights regarding medical information I maintain about you:
To request a restriction on certain uses and disclosures of your information. This request must be in writing. I am not required to agree to your request, and I may say “no” if I believe it would affect your health care.
To request restrictions for out-of-pocket expenses paid for in full. You have the right to request restrictions on disclosures of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or a health care service that you have paid for out-of-pocket in full.
To request how I send confidential communications. You have the right to request that I communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that I only contact you at work or by mail. Your request must be in writing and specify the exact changes you are requesting.
To inspect and request a copy of your health record other than Psychotherapy Notes so long as the record is maintained (45 CFR 164.5249(a)). Your request must be in writing and specify the records to be copied. Upon receipt of your request, together with a fee, if required, to defray the costs of producing the copy, the Practice shall ensure that the copies are transmitted within 30 days after receiving the request. The following are some important exceptions:
The representative of a minor is not entitled to inspect or obtain copies of the minor’s patient records either i) with respect to which the minor has the right of inspection; or ii) where the health care provider determines that access to the patient records requested by the representative would have a detrimental effect on the provider’s professional relationship with the minor patient or the minor’s physical safety or psychological well-being (Health & Saf. Code §123115(a)).
A health care provider may deny a request by a patient where the provider determines there is a substantial risk of significant adverse or detrimental consequences to the patient in seeing or receiving a copy of the mental health records requested by the patient. However, the health care provider shall (i) make a written record, to be included with the mental health records requested, noting the date of the request and explaining the health care provider’s reason for refusing to permit inspection or provide copies of the records, including a description of the specific adverse or detrimental consequences to the patient that the provider anticipates would occur if inspection or copying were permitted; and (ii) permit inspection by, or provide copies of the mental health records to, a licensed physician and surgeon, licensed psychologist, licensed marriage and family therapist, licensed clinical social worker, or licensed professional clinical counselor, designated by request of the patient (Health & Saf. Code §123115(b)).
Your health care provider may confer with you in an attempt to clarify your purpose in obtaining a copy of your record and may choose to prepare a summary. If they choose to prepare a summary rather than allowing access to the entire record, they will make the summary available to you within 10 working days from the date of your request. If more time is needed, such as because of the length of the record or because you were discharged from a licensed health facility within the 10 days preceding your request, your provider will notify you that more time is needed and provide you with the date it will be completed. In no case may more than 30 days elapse between the date of your request and the delivery of the summary (Health & Saf. Code §123130).
To request an amendment to your health record if you feel the information is incorrect or incomplete. Your request must be made in writing and it must include a reason that supports the request.
To revoke your authorization. You have the right to revoke your authorization for the use or disclosure of your health information except to the extent that action has already been taken.
To choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
Complain about any aspect of our health information practices to the United States Department of Health and Human Services without fear of retaliation. Complaints should be in writing and may be directed to the Practice or the Office for Civil Rights, Region IX, U.S. Department of Health and Human Services.
To see and get copies of your PHI. Other than “psychotherapy notes” and “SUD counseling notes” you have the right to get an electronic or paper copy of your medical record and other information that I have about you. I will provide you with a copy of your record, or a summary of it, if you agree to receive a summary, within 30 days of receiving your written request, and I may charge a reasonable, cost-based fee for doing so.
To obtain a list of disclosures I have made. You have the right to request a list of instances in which I have disclosed your PHI for purposes other than treatment, payment, or health care operations, or for which you provided me with an Authorization. I will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list I will give you will include disclosures made in the last six years unless you request a shorter time. I will provide the list to you at no charge, but if you make more than one request in the same year, I will charge you a reasonable cost-based fee for each additional request. You also have the right to request an accounting of disclosures specifically for your substance use disorder records protected under 42 C.F.R. Part 2.
To correct or update your PHI. If you believe that there is a mistake in your PHI, or that a piece of important information is missing from your PHI, you have the right to request that I correct the existing information or add the missing information. I may say “no” to your request, but I will tell you why in writing within 60 days of receiving your request.
To get an electronic or paper copy of this note. You have the right to get a paper copy of this Notice, and you have the right to get a copy of this notice by e-mail. And, even if you have agreed to receive this Notice via e-mail, you also have the right to request a paper copy of it.
ACKNOWLEDGEMENT OF RECEIPT OF PRIVACY NOTICE
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By signing below, you are acknowledging that you have received a copy of HIPAA Notice of Privacy Practices.
CLIENTS SIGNATURE OF THIS NOTICE INDICATES THAT THEY HAVE READ, UNDERSTOOD, AND AGREE TO THE ITEMS CONTAINED IN THIS DOCUMENT.