Privacy Policy and HIPAA Notice

1Who and what this covers

This page covers two related but separate things.

• A website privacy policy, covering what this site collects from anyone who visits it. That is sections 2 to 4.
• A HIPAA Notice of Privacy Practices, covering how Jona Psychiatry handles protected health information as a healthcare provider covered by the Health Insurance Portability and Accountability Act. That is sections 5 to 16.

Visiting this website does not make you a patient and does not create a provider and patient relationship. The HIPAA sections apply once you are receiving care from this practice.

In this notice, protected health information means information that identifies you and relates to your health, your care, or payment for your care. It is shortened to PHI below.

2Information collected through this website

This website is deliberately simple. It collects only what you actively choose to send:

• What you enter into the appointment request form: your name, email address, phone number, the state you are located in, the service you are interested in and your message.
• What you enter into the question form on the blog: a name or initials, an optional email address and your question.
• Standard technical information recorded by the web host, such as IP address, browser type, and which pages were requested, used to keep the site running and secure.

Both forms work by opening your own email program with the message prepared, so nothing you type is posted to a third party service by this website. What you send then travels as ordinary email. See section 4.

Information you send is used to answer your enquiry and to arrange care. It is not sold, rented, or shared with anyone for marketing.

The site stores one thing in your own browser: whether you marked a blog article helpful. That never leaves your device and is not linked to you.

3Cookies and analytics

This website sets no advertising cookies, uses no tracking pixels, and runs no analytics or advertising scripts.

Two fonts are loaded from Google Fonts, which means your browser makes a request to Google to download them, and Google will see your IP address as part of that request. No other external service is contacted.

If analytics or any other third party service is added later, this section will be updated to name it before it goes live.

4Forms and email are not secure

This matters, so it is stated plainly rather than buried. Ordinary email and ordinary website forms are not secure channels. They can be intercepted, misdirected, or read by anyone with access to a shared device or account.

• Please do not send diagnoses, medication histories, symptom detail or anything else sensitive by web form or email.
• Send only what is needed to arrange a call. Keep the clinical conversation for your appointment.
• Video appointments run on a HIPAA-compliant, encrypted platform, which is a different and far safer channel than email.
• If you email the practice anyway, you are choosing to accept that risk. You can ask us to reply only by telephone instead, and we will.

5HIPAA Notice of Privacy Practices

Federal law requires this practice to maintain the privacy of your protected health information, to give you this notice of our legal duties and privacy practices, to notify you if a breach affects your unsecured PHI, and to follow the terms of the notice currently in effect.

You will be given this notice to read and acknowledge as part of your intake paperwork. You may ask for a paper copy at any time, even if you agreed to receive it electronically, and it is published here permanently.

6Treatment, payment and healthcare operations

These are the everyday uses, and they do not need your separate written authorization.

Treatment

To provide, coordinate and manage your care. For example, sending a prescription to your pharmacy, discussing your treatment with your primary care provider or therapist where that is in your interest, arranging a referral, or reviewing records from a previous provider.

Payment

To be paid for the care provided. For example, verifying coverage, submitting claims, and responding to an insurer's questions about a claim. Claims generally include a diagnosis and the type of service provided.

Healthcare operations

To run the practice lawfully and well. For example, quality review, credentialing and licensing, training, and business management. Where an outside company handles something on our behalf, such as billing or the video platform, they are bound by a written Business Associate Agreement requiring them to protect your information to the same standard.

Appointment reminders and care communications

We may contact you to remind you of an appointment or to discuss treatment options. Tell us how you prefer to be reached and we will follow it. See your right to confidential communications in section 10.

People involved in your care

We may share information relevant to their involvement with a family member, partner or friend you have identified, or with someone paying for your care. Where you are present and able to decide, we will ask you first, or give you a clear chance to object. Where you are not able to decide, we will use professional judgement about what is in your best interest and share only what is directly relevant.

7Other disclosures permitted or required by law

These do not need your authorization. This is the complete list of the categories that apply to this practice.

• Required by law. Where a federal, state or local law requires the disclosure, limited to what the law requires.
• Public health activities. Preventing or controlling disease, reporting to a public health authority, and reporting adverse events for products regulated by the Food and Drug Administration.
• Abuse, neglect or domestic violence. Reporting to an authority permitted by law to receive such reports, including mandatory reporting concerning children and vulnerable adults.
• Health oversight. To an oversight agency for audits, investigations, inspections and licensure activity.
• Judicial and administrative proceedings. In response to a court order, or to a subpoena or discovery request where the required assurances about notifying you or protecting the information have been given.
• Law enforcement. In the limited circumstances HIPAA permits, such as a court order or warrant, identifying or locating a suspect or missing person, or reporting a crime on the premises.
• Coroners, medical examiners and funeral directors. As needed to carry out their duties.
• Organ and tissue donation. To organizations that handle procurement or transplantation.
• Research. Only where an institutional review board or privacy board has approved a protocol with privacy protections, or where the information has been de-identified.
• To prevent a serious threat. Where disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety, or to the health or safety of another person, and to someone able to help prevent it.
• Specialized government functions. Military and veterans activities, national security and intelligence, protective services for the President and others, and correctional institutions where you are an inmate.
• Workers' compensation. As authorized by, and to the extent necessary to comply with, workers' compensation laws.

8Uses that need your written authorization

Any use or disclosure not described in this notice will be made only with your written authorization. The following always require it:

• Psychotherapy notes, except in the narrow circumstances federal law allows, such as your own treatment by us, our training programs, defending a legal action you have brought, or a required health oversight or serious threat disclosure.
• Marketing that involves payment to us from a third party.
• Any sale of protected health information. This practice does not sell your information.
• Most disclosures to an employer, a school, a court or an attorney that are not otherwise permitted above.

You may revoke an authorization in writing at any time. Revoking it stops any future use or disclosure under it. It cannot undo something already done in reliance on it.

9Records that carry extra protection

Some categories of record are protected more strictly than ordinary medical records, and are treated accordingly here.

• Psychotherapy notes. Notes recording or analyzing a counselling session, kept separate from the rest of your record. They are not released with a general records request and generally require a specific authorization.
• Substance use disorder records. Where federal confidentiality rules for substance use disorder patient records apply, disclosure is restricted well beyond ordinary HIPAA standards, and generally needs your specific written consent even for treatment purposes.
• Mental health records under state law. Maryland, Washington DC and Virginia each have their own mental health confidentiality statutes. Where state law gives you more protection than HIPAA, the state law is followed.
• HIV, genetic and reproductive health information, where specific state or federal restrictions apply.

Where two rules conflict, this practice applies whichever gives you the greater protection.

10Your rights

You may exercise any of these by contacting the practice in writing. We will respond within the timeframes the law requires.

Get a copy of your record

You may inspect and obtain a copy of your medical and billing records, including an electronic copy where we hold them electronically, and you may ask us to send a copy to someone you name. We may charge a reasonable, cost-based fee. Access to psychotherapy notes may be limited, and access may be denied in the narrow circumstances the law allows, some of which you may have reviewed.

Ask us to correct your record

If you believe something is incorrect or incomplete, you may ask us to amend it. We may decline, and if we do we will tell you why in writing, and you may submit a statement of disagreement to be kept with the record.

Get a list of disclosures

You may request an accounting of certain disclosures we have made, generally covering the six years before your request, and excluding disclosures for treatment, payment and operations, and those you authorized. One accounting in any twelve months is free.

Ask us to limit what we use or share

You may request a restriction. We are not usually required to agree, but if we do agree we will follow it. One restriction we must honour: if you pay in full, out of pocket, for a specific service, you may require that we do not disclose information about that service to your health plan for payment or operations purposes.

Ask us to contact you a particular way

You may ask us to contact you only at a specific number or address, or to avoid leaving voicemail, and we will accommodate reasonable requests without asking why.

Get a paper copy of this notice

On request, at any time, even if you agreed to receive it electronically.

Be told if your information is breached

We will notify you if a breach occurs that compromises the privacy or security of your unsecured information.

Choose someone to act for you

A person with legal authority to make healthcare decisions for you, such as a healthcare power of attorney or a guardian, may exercise these rights on your behalf. We will confirm their authority first.

Complain without consequence

See section 15. Making a complaint will never affect your care.

11Our responsibilities

• We are required by law to keep your protected health information private and secure.
• We will give you this notice describing our legal duties and privacy practices, and follow the terms of the notice in effect.
• We will notify you promptly if a breach occurs that compromises your unsecured information.
• We apply the minimum necessary standard: where a disclosure is not for treatment, we share the least information needed to achieve the purpose.
• We will not use or share your information other than as described here unless you tell us in writing that we may. If you change your mind, you may revoke that permission in writing at any time.

12How your information is protected

Reasonable administrative, physical and technical safeguards are used, including encrypted video appointments, access controls on electronic records, secure electronic prescribing, written Business Associate Agreements with any vendor handling your information, and secure disposal of paper records.

No system can be guaranteed completely secure, which is exactly why this practice asks you not to send sensitive detail by ordinary email.

13Minors and this website

This is an adult psychiatry practice. This website is not directed at children, and information is not knowingly collected through it from anyone under 18. If you believe a child has sent information through this site, contact us and it will be deleted.

Where a minor is lawfully entitled to consent to their own care, or where state law gives a minor rights over their own records, those rights are respected.

14Changes to this notice

We may change this notice, and any change applies to information we already hold as well as information we receive in future. The current version is always published on this page, with its effective date shown at the top, and a copy is available at each office.

15Complaints

If you believe your privacy rights have been violated, you may complain to the practice, to the federal government, or to both. You may do both at once.

To the practice

Contact the Privacy Officer, Dr. Meseret Asfaw, using the details in section 16. Complaints are best made in writing so there is a record, but will be accepted by telephone.

To the federal government

You may file with the Secretary of the US Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington DC 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/complaints. A complaint must generally be filed within 180 days.

You will never be penalised, refused care, or treated differently for making a complaint.

16Contact

To exercise any right in section 10, ask a question about this notice, or raise a concern:

• By phone on (240) 673-7091
• By email to masfaw@JonaPsychiatry.com, for administrative matters only, remembering that email is not secure
• By fax on (240) 907-5355
• By post to either office listed on the contact page, marked for the attention of the Privacy Officer