Notice of Privacy Practices

Effective Date: September 30, 2026

Your Information. Your Rights. My Responsibilities.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

Protecting the privacy and confidentiality of your health information is an important professional responsibility. During the course of providing psychological services, I create and maintain a confidential clinical record. This Notice explains how your Protected Health Information (“PHI”) may be used and disclosed, your rights regarding that information, and my responsibilities for protecting it.

This Notice applies to PHI created, received, maintained, or transmitted by Dr. Hillier PLLC in electronic, paper, verbal, or other form.

Your Rights

You have the right to:

  • Obtain a paper or electronic copy of your health information as permitted by law
  • Ask that information in your record be corrected or amended
  • Request confidential communications
  • Ask that certain uses or disclosures of your information be restricted
  • Receive an accounting of certain disclosures
  • Obtain a paper or electronic copy of this Notice
  • Authorize another person to act on your behalf
  • Revoke certain authorizations previously given
  • File a complaint if you believe your privacy rights have been violated

These rights are described in greater detail below.

My Responsibilities

I am required by law to:

  • Maintain the privacy and security of your Protected Health Information
  • Provide you with this Notice of Privacy Practices
  • Follow the privacy practices described in the Notice currently in effect
  • Notify you as required by law if a breach occurs that may have compromised the privacy or security of your information

I may revise this Notice as permitted by law. Any revised Notice may apply to information already maintained by the practice as well as information created or received in the future. The current Notice will be available upon request and through this website.

Confidentiality Protections

Psychologist-client communications are protected by confidentiality laws and professional ethical standards. Florida law provides specific protections for psychologist-client communications. When psychological services are provided to a client who is physically located in another jurisdiction, additional or different confidentiality, privacy, or privilege requirements may apply. When services involve more than one jurisdiction, I will follow the confidentiality, privacy, and professional requirements applicable to the services being provided. When legal requirements differ or conflict, I will take appropriate professional and legal steps to determine the requirements that govern.

Except when disclosure is permitted or required by applicable law, confidential psychological information will not be disclosed without appropriate written authorization or consent.

How Your Health Information May Be Used or Disclosed

Federal and applicable state law permit certain uses and disclosures of health information in connection with providing and administering health care. Because psychological records receive significant confidentiality protections, uses and disclosures are also evaluated under applicable state law and professional requirements.

Treatment

I may use your health information to provide and manage your psychological care. When legally permitted and clinically appropriate, this may include professional consultation or coordination with another healthcare professional involved in your care. When written authorization is required by applicable law, I will obtain it before disclosing your information.

Payment

I may use or disclose information as legally permitted and reasonably necessary to obtain payment for services provided. This may include:

  • Preparing invoices or statements
  • Processing payments
  • Preparing a superbill at your request
  • Processing an insurance claim when applicable
  • Addressing payment-related administrative matters

Healthcare Operations

I may use health information, as permitted by applicable law, for activities necessary to operate the practice and maintain the quality and safety of services. These activities may include:

  • Professional consultation
  • Quality improvement
  • Risk management
  • Practice administration
  • Information security
  • Legal and regulatory compliance

Uses and disclosures remain subject to applicable confidentiality requirements.

Uses and Disclosures Requiring Your Written Authorization

Written authorization is generally required for uses or disclosures of your information that are not otherwise permitted or required by law. Examples may include:

  • Disclosures to attorneys, employers, family members, friends, or other individuals when authorization is required
  • Most uses and disclosures of psychotherapy notes
  • Marketing uses when authorization is required by HIPAA
  • The sale of Protected Health Information
  • Other uses or disclosures not otherwise permitted by law

You may revoke an authorization in writing at any time, except to the extent that action has already been taken in reliance upon it or as otherwise permitted by law.

Psychotherapy Notes

HIPAA provides additional protection for psychotherapy notes, which have a specific legal definition. Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a counseling conversation and maintained separately from the remainder of the clinical record. Psychotherapy notes do not include all progress notes, treatment plans, medication information, session times, test results, or other information maintained as part of the general clinical record. Most uses and disclosures of psychotherapy notes require your specific written authorization unless an exception under applicable law applies.

Uses and Disclosures That May Occur Without Your Written Authorization

Depending upon the circumstances and applicable law, information may be used or disclosed without your written authorization when permitted or required by law.

Required by Law

Information may be disclosed when federal, state, or local law requires disclosure.

Abuse, Neglect, or Exploitation

I may be required to report suspected abuse, neglect, or exploitation of a child, vulnerable adult, or other person protected by law. Reporting obligations may vary depending upon the jurisdiction in which psychological services are being provided.

Serious Threats or Risks of Harm

Applicable law may permit or require disclosure when a client communicates a threat or presents a risk of harm that meets the legal standard of the jurisdiction governing the service. The criteria for disclosure and the actions required or permitted may vary by jurisdiction. When the applicable legal standard is met, I may take actions permitted or required by law, which may include contacting an identified potential victim, law enforcement, emergency services, or another appropriate person or agency.

Health Oversight and Other Legally Authorized Disclosures

Information may be disclosed when permitted or required by law for purposes such as:

  • Licensing or professional oversight
  • Government audits or investigations
  • Certain legally authorized law-enforcement requests
  • Workers’ compensation matters
  • Other governmental or regulatory functions authorized by law

Judicial and Administrative Proceedings

Information may be disclosed when required by a valid court order or other legally enforceable process. Because psychologist-client communications may be protected by confidentiality and privilege under applicable state and federal law, appropriate legal and professional steps will be taken to protect confidentiality and privilege when applicable. A subpoena alone does not necessarily eliminate applicable confidentiality or privilege protections.

Family Members and Others Involved in Your Care

Psychological information is not routinely disclosed to family members, friends, partners, employers, or others merely because they are involved in your care or payment for services. When appropriate, you may authorize me in writing to communicate with another person or professional. Your authorization may specify:

  • Who may receive information
  • What information may be disclosed
  • The purpose of the disclosure
  • The duration of the authorization

Emergency and other legally authorized disclosures may be handled differently when permitted or required by law.

Professional Consultation

As part of providing high-quality psychological care, I may consult with another qualified professional when clinically appropriate and legally permitted. Whenever reasonably possible, identifying information is minimized. Professionals participating in consultation are expected to maintain the confidentiality of the information discussed.

Appointment Reminders and Administrative Communication

Your information may be used to provide appointment reminders and communicate with you regarding scheduling, billing, payment, or other administrative matters related to your psychological services. Reasonable efforts will be made to protect your privacy. The secure SimplePractice Client Portal is the preferred method for confidential electronic communication. Email and text messaging should generally be limited to administrative matters.

Your Right to Inspect or Receive a Copy of Your Record

You may request access to or a copy of your clinical record as provided by applicable federal and state law. Requests should be made in writing. Certain information may be excluded from access when permitted by law, including psychotherapy notes when applicable. The form and manner in which records or summaries may be provided are governed by applicable federal and state law. Reasonable cost-based fees may be charged when permitted by law.

Your Right to Request an Amendment

If you believe information in your record is incorrect or incomplete, you may request an amendment in writing. A request may be denied when permitted by law. If a request is denied, you will be informed of the denial and any applicable right to submit a written statement of disagreement.

Your Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your health information. I am not required to agree to every requested restriction. If I agree to a restriction, I will comply with it unless an exception permitted by law applies.

Services Paid Fully Out of Pocket

If you pay in full out of pocket for a healthcare service and ask that information about that service not be disclosed to your health plan for payment or healthcare operations, I will generally honor that request unless disclosure is required by law.

Your Right to Request Confidential Communications

You may request that I communicate with you in a particular way or at a particular location. For example, you may request use of a specific telephone number, mailing address, or other reasonable method of communication. Reasonable requests will be accommodated.

Your Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your Protected Health Information made during the period permitted by applicable law, generally up to the prior six years. Certain disclosures are excluded from the accounting requirement under HIPAA. The first accounting within a 12-month period is generally provided without charge. A reasonable cost-based fee may apply to additional requests during the same 12-month period after advance notice.

Your Right to a Copy of This Notice

You may request a paper or electronic copy of this Notice at any time.

Personal Representatives

If another person is legally authorized to act on your behalf regarding your health information, that person may exercise your privacy rights to the extent permitted by law. Documentation of that person's authority may be required.

Substance Use Disorder Records and 42 CFR Part 2

Federal law provides additional protections for certain substance use disorder (“SUD”) patient records under 42 U.S.C. § 290dd-2 and 42 CFR Part 2. Not every discussion of alcohol or substance use during psychotherapy makes the clinical record subject to Part 2. If Dr. Hillier PLLC creates, receives, or maintains records that are subject to Part 2, those records will be handled in accordance with the additional federal requirements that apply. Where applicable, those protections may include:

  • Additional requirements governing consent to use or disclose SUD patient records
  • Restrictions on the use of certain SUD records in civil, criminal, administrative, or legislative proceedings
  • Additional protections for certain SUD counseling notes
  • Privacy and breach-notification requirements applicable to Part 2 records

Any consent or authorization required by Part 2 will be obtained and handled in accordance with applicable federal law.

Marketing, Sale of Health Information, and Fundraising

I do not sell your Protected Health Information. I do not use or disclose your Protected Health Information for marketing when HIPAA requires your authorization unless you have provided that authorization. I do not use your Protected Health Information to solicit fundraising contributions.

Electronic Records and Telepsychology

Clinical records are maintained using a secure electronic health record system. Psychological services may also be provided through secure telepsychology technology. Federal privacy protections generally apply to both in-person and telepsychology services. When telepsychology is provided to a client physically located in another jurisdiction, applicable confidentiality, privacy, privilege, reporting, and professional requirements of that jurisdiction may also apply. Reasonable administrative, physical, and technical safeguards are used to protect your information. However, no electronic communication or information system can eliminate every possible security risk. Additional information regarding telepsychology and interstate practice is provided in the Informed Consent for Telepsychology provided to clients receiving remote services.

Interstate Practice and State-Specific Privacy Protections

I am licensed as a psychologist in Florida and may also provide telepsychology to clients located in other jurisdictions when legally authorized to do so, including through the Psychology Interjurisdictional Compact (“PSYPACT”) when applicable. PSYPACT authorization does not replace or eliminate applicable privacy, confidentiality, privilege, reporting, or professional requirements of a jurisdiction in which services are provided. If the law of the jurisdiction applicable to your care provides privacy protections or restrictions that are more protective than those described in this Notice, those requirements will be followed when they apply. Where necessary, additional state-specific privacy information may be provided to supplement this Notice.

Breach Notification

If a breach of unsecured Protected Health Information occurs, you will be notified when required by applicable law. Any required notification will be provided in accordance with applicable federal and state requirements.

Complaints

If you believe your privacy rights have been violated, you may contact:

Dr. Hillier PLLC
Donna Hillier, PsyD
(844) 814-8140
drhillier@donna-hillier.com

You may also file a complaint with the:

U.S. Department of Health and Human Services
Office for Civil Rights (OCR)

You are not required to contact me before filing a complaint with OCR. You will not be retaliated against, denied treatment, or otherwise penalized for filing a privacy complaint.

Questions

If you have questions about this Notice, your privacy rights, or how your health information is used or protected, please contact:

Donna Hillier, PsyD
Dr. Hillier PLLC
(844) 814-8140
drhillier@donna-hillier.com

Scroll to Top