Legal & Compliance
HIPAA Notice of Privacy Practices
Openness With Therapy is committed to protecting the privacy and confidentiality of your health information. This notice describes your rights and our legal obligations under HIPAA and Maryland law.
This is our Notice of Privacy Practices as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. § 164.520. We are required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this notice of our legal duties and privacy practices, and to notify you following a breach of your unsecured PHI. We are required to abide by the terms of this notice currently in effect.
1. Who We Are
Openness With Therapy ("we," "us," or "our") is a licensed mental health therapy practice operating exclusively via telehealth and serving clients located in the State of Maryland. We provide sensory profile clinical assessments and related therapeutic services. As a covered entity under HIPAA, we are required to protect the privacy of your Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices.
2. What Is Protected Health Information (PHI)?
PHI is individually identifiable health information that we create, receive, maintain, or transmit in connection with providing health care services to you. This includes:
Psychotherapy notes — notes recorded by a mental health professional documenting or analyzing the contents of a counseling session — receive heightened protection under HIPAA and Maryland law and are treated separately from the rest of your medical record. We will not use or disclose psychotherapy notes without your written authorization except in the very limited circumstances described below.
- Your past, present, or future physical or mental health condition
- The provision of health care services to you, including sensory profile assessments
- Payment for health care services provided to you
- Information that could reasonably identify you (name, date of birth, address, phone number, email, etc.)
- Session notes, assessment results, and clinical reports
- Communications between you and our practice
3. How We May Use and Disclose Your PHI
We may use and disclose your PHI for the following purposes without your written authorization:
Treatment
We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share relevant information with other health care providers involved in your care — such as your referring therapist, psychiatrist, or primary care physician — to ensure coordinated, appropriate treatment.
Payment
We may use and disclose your PHI to obtain payment for services we provide to you. Because we are a private-pay practice and do not bill insurance, this is limited to processing your payment and maintaining billing records. We do not submit claims to insurance carriers.
Health Care Operations
We may use and disclose your PHI for our internal operations, including quality assessment and improvement activities, clinical supervision, training, licensing and credentialing, and business management activities necessary to run our practice.
As Required by Law
We will disclose your PHI when required to do so by federal, state, or local law, including mandatory reporting obligations under Maryland law.
Mandatory Reporting — Child Abuse and Neglect
Under Maryland Code, Family Law § 5-704, we are mandatory reporters. If we have reason to believe that a child has been subjected to abuse or neglect, we are required by law to report that information to the appropriate authorities, regardless of your consent or the confidentiality of your PHI.
Mandatory Reporting — Vulnerable Adults
Under Maryland law, we may be required to report suspected abuse, neglect, or exploitation of a vulnerable adult to the appropriate authorities.
Serious Threats to Health or Safety — Duty to Warn
We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public. Under Maryland law, if you communicate a credible, specific threat of serious harm to an identifiable third party, we may be required to take reasonable steps to protect that person, which may include disclosing PHI to law enforcement or the potential victim.
Judicial and Administrative Proceedings
We may disclose your PHI in response to a court order, administrative order, subpoena, discovery request, or other lawful process, subject to applicable legal protections. We will make reasonable efforts to notify you before disclosing your PHI in response to a subpoena or discovery request so that you have an opportunity to seek a protective order.
Law Enforcement
We may disclose your PHI to law enforcement officials for limited purposes permitted under HIPAA, including to comply with a court order or warrant, to identify or locate a suspect, or to report a crime on our premises.
Health Oversight Activities
We may disclose your PHI to health oversight agencies — such as the Maryland Board of Professional Counselors and Therapists or the U.S. Department of Health and Human Services — for audits, investigations, inspections, and licensure activities.
Business Associates
We may share your PHI with third-party service providers ("Business Associates") who perform services on our behalf, such as our HIPAA-compliant telehealth platform, electronic health records system, and secure messaging provider. We have entered into Business Associate Agreements (BAAs) with all such vendors, contractually requiring them to protect your PHI in accordance with HIPAA.
Decedents
We may disclose PHI about a deceased individual to a coroner, medical examiner, or funeral director as authorized or required by law.
4. Uses and Disclosures Requiring Your Written Authorization
We will obtain your written authorization before using or disclosing your PHI for any purpose not described in this notice, including:
You may revoke any authorization you have given us at any time by submitting a written revocation to us. Your revocation will not affect any actions we took in reliance on your authorization before we received your revocation.
- Most uses and disclosures of psychotherapy notes
- Uses and disclosures of PHI for marketing purposes
- Sales of PHI
- Disclosure to family members, friends, or other individuals you identify (except in emergencies)
- Disclosure to employers or schools
- Any other use or disclosure not otherwise permitted by HIPAA or Maryland law
5. Your Rights Regarding Your PHI
You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to [email protected] with the subject line Privacy Inquiry.
Right to Access and Obtain a Copy of Your PHI
You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, which includes your clinical records and billing records. We will respond to your request within 30 days. We may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances and will explain any denial in writing.
Right to Amend Your PHI
You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny your request if we determine that the information is accurate and complete, was not created by us, is not part of the records we maintain, or is not information you would be permitted to inspect. We will respond within 60 days.
Right to an Accounting of Disclosures
You have the right to request a list of certain disclosures we have made of your PHI during the past six years, other than disclosures for treatment, payment, or health care operations, disclosures you authorized, or certain other exceptions. We will provide the first accounting in any 12-month period at no charge.
Right to Request Restrictions
You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except that we must agree to a restriction on disclosures to a health plan if you pay out of pocket in full for the service and the disclosure is not required by law.
Right to Request Confidential Communications
You have the right to request that we communicate with you about your PHI in a certain way or at a certain location — for example, by email only or at a specific address. We will accommodate reasonable requests.
Right to a Paper Copy of This Notice
You have the right to receive a paper copy of this notice at any time, even if you have agreed to receive it electronically. Contact us at the address above to request one.
Right to Be Notified of a Breach
You have the right to be notified if there is a breach of your unsecured PHI. We will notify you without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414).
6. Maryland State Law Protections
Maryland law provides additional privacy protections for certain categories of health information. Where Maryland law is more protective of your health information than HIPAA, we comply with Maryland law.
Mental Health Records
Under the Maryland Confidentiality of Medical Records Act (Md. Code, Health-Gen. §§ 4-301 et seq.) and the Maryland Mental Health Law (Md. Code, Health-Gen. §§ 4-307, 4-307.1), mental health records receive heightened confidentiality protections. We will not disclose your mental health records without your written authorization except as required by law or as otherwise permitted under applicable Maryland statutes.
Minors
Maryland law grants certain rights to minors with respect to their own health care. Under Md. Code, Health-Gen. § 20-104, a minor who is 16 years of age or older may consent to mental health treatment. Where a minor has the right to consent to treatment, the minor generally also has the right to control the confidentiality of records related to that treatment. We navigate parental access rights and minor confidentiality rights in accordance with applicable Maryland law and our clinical judgment.
Substance Use Disorder Records
If we maintain records related to substance use disorder treatment, those records are protected by federal law (42 C.F.R. Part 2) and Maryland law, which impose stricter confidentiality requirements than HIPAA. We will not disclose such records without your specific written consent except as permitted by applicable law.
7. Telehealth and Electronic Communications
All services are provided via telehealth to clients physically located in Maryland. We use a HIPAA-compliant telehealth platform and have executed a Business Associate Agreement with our platform provider. All video sessions are conducted over encrypted connections.
Email communications: We use a HIPAA-compliant, encrypted email system for all client communications. Emails sent to and from our practice are transmitted and stored using encryption that meets HIPAA Security Rule requirements. You may communicate with us by email with confidence that your information is protected.
Session recordings: We do not record telehealth sessions without your explicit written consent.
Location requirement: Telehealth services are available only to clients physically located in Maryland at the time of service, in accordance with Maryland licensure requirements.
8. Website Privacy
This section applies to information collected through our website at opennesswiththerapy.com and is separate from your PHI as a client.
Information You Provide
When you submit a booking request or contact form on our website, we collect the information you provide, including your name, email address, phone number, and any details you share in the message field. This information is used solely to respond to your inquiry and schedule services.
Automatically Collected Information
We may collect standard web analytics data such as IP address, browser type, pages visited, and session duration to understand how visitors use our site and to improve it. This data is not linked to your identity or your health information.
No Sale of Information
We do not sell, rent, or trade your personal information or PHI to any third party for commercial purposes.
9. Security Safeguards
We implement administrative, technical, and physical safeguards to protect your PHI from unauthorized access, use, disclosure, alteration, or destruction, as required by the HIPAA Security Rule (45 C.F.R. §§ 164.302–318). These safeguards include:
No system is 100% secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.
- Use of HIPAA-compliant, encrypted telehealth and communication platforms
- Business Associate Agreements with all vendors who access PHI
- Access controls limiting PHI access to authorized personnel only
- Secure, encrypted storage of electronic PHI
- Regular security risk assessments
- Workforce training on HIPAA privacy and security requirements
10. How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you in any way for filing a complaint.
U.S. Dept. of Health & Human Services
Office for Civil Rights
hhs.gov/ocr/privacy/hipaa/complaints1-800-368-1019
11. Changes to This Notice
We reserve the right to change the terms of this notice at any time. We may make the revised notice effective for PHI we already have about you as well as any PHI we receive in the future. We will post the current notice on our website and make it available to you upon request. The effective date of the current notice appears at the top of this document.
If we make a material change to this notice, we will notify active clients by email or through our client portal.
Questions About Your Privacy?
If you have questions about this notice or about how we handle your health information, please reach out. We are happy to explain your rights and our practices.
Openness With Therapy[email protected]Privacy Inquiry
Book Your AssessmentThis notice was last updated on September 1, 2026. It is intended to satisfy the requirements of 45 C.F.R. § 164.520 (HIPAA Notice of Privacy Practices) and applicable Maryland law. It does not constitute legal advice. Consult a licensed healthcare attorney for guidance specific to your situation.