HIPAA · Legal
Notice of Privacy Practices
Effective Date: April 2026 · Last Updated: April 26, 2026
1. Our Duties
Bold Brown Mental Health Counseling PLLC is required by law to:
- Maintain the privacy of your protected health information (PHI);
- Provide you with this notice of our legal duties and privacy practices regarding your PHI;
- Notify you in the event of a breach of your unsecured PHI; and
- Abide by the terms of the notice currently in effect.
We reserve the right to change the terms of this Notice and to make the revised Notice effective for PHI we already have about you, as well as any PHI we receive in the future. A current copy of this Notice will always be available on our website at boldbrowntherapy.com. You may also request a paper copy at any time.
2. How We May Use and Disclose Your Health Information
The following categories describe the ways we may use and disclose your PHI without requiring your authorization. At least one example is provided for each category.
For Treatment: We may use and disclose your PHI to provide, coordinate, or manage your mental health care and related services. For example, we may share relevant information with another treating clinician (such as your psychiatrist or primary care physician) to coordinate your care, with your written authorization where required by law.
For Payment: We may use and disclose your PHI to obtain payment for the services we provide. For example, we may disclose information to process a credit card transaction or to prepare a superbill for your out-of-network insurance reimbursement claim.
For Health Care Operations: We may use and disclose your PHI for internal operations necessary to run our practice. For example, we may use PHI for quality assurance review, training, or to contact you about appointment reminders.
Appointment Reminders and Health-Related Communications: We may use and disclose your PHI to contact you with reminders about appointments or to provide information about treatment alternatives or services that may be of interest to you.
As Required by Law: We will disclose your PHI when required to do so by applicable federal, state, or local law.
To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious and imminent threat to your health or safety or the health or safety of the public or another person. Any disclosure would be made to someone able to help prevent the threat.
Mandatory Reporting of Child Abuse and Neglect: As mandated reporters, we are required by applicable state law to report suspected abuse or neglect of a child to the appropriate government authority. In New York, reports are made to the Statewide Central Register (SCR) at 1-800-342-3720 pursuant to Social Services Law § 413. In Pennsylvania, reports are made to Pennsylvania ChildLine at 1-800-932-0313 pursuant to 23 Pa.C.S. § 6311.
Judicial and Administrative Proceedings: We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena, or other lawful process, subject to applicable privilege protections under New York Mental Hygiene Law § 33.13 and Pennsylvania 42 Pa.C.S. § 5944.
Law Enforcement: Under limited circumstances specified by law, we may disclose PHI to law enforcement officials.
Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to a coroner, medical examiner, or funeral director as authorized or required by law.
Health Oversight Activities: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure activities.
Research: We may use and disclose PHI for research purposes, subject to appropriate privacy protections required by law.
Serious Mental Illness or Danger to Others: As permitted by applicable state law, we may disclose PHI when, in our professional judgment, there is a serious and imminent threat of harm to an identifiable third party. In New York, this is governed by MHL § 33.13(c)(6). In Pennsylvania, this is governed by the duty established in Emerich v. Philadelphia Center, 720 A.2d 1032 (Pa. 1998).
Business Associates: We may share your PHI with Business Associates (such as our practice management software, billing services, or IT providers) who perform services on our behalf. Business Associates are required to protect your PHI under a signed Business Associate Agreement.
3. Special Protections — Reproductive Health Information
Effective December 23, 2024, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (45 C.F.R. §§ 164.502(a)(5)(iii) and 164.512(k)(4)) provides heightened protections for health information related to reproductive health care. We are prohibited from using or disclosing your protected health information for the purpose of investigating, imposing liability upon, or identifying you for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
Before disclosing your PHI for certain purposes — including health oversight activities, judicial and administrative proceedings, law enforcement, or disclosures to a medical examiner — in connection with reproductive health care, we are required to obtain a signed written attestation from the requesting party confirming that the use or disclosure is not for a prohibited purpose.
We presume that reproductive health care provided by another person or entity was lawful unless we have actual knowledge, or factual information from a reliable source, that such care was not lawful under the applicable law where it was provided.
4. Substance Use Disorder Records (42 C.F.R. Part 2)
If we receive records related to your substance use disorder (SUD) treatment from a program subject to 42 C.F.R. Part 2, those records are subject to additional federal privacy protections. Specifically:
- SUD records received from Part 2 programs may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you without your written consent or a court order (with notice and opportunity to be heard) accompanied by a subpoena or other legal compulsion.
- If you provide written consent for SUD records to be disclosed for treatment, payment, or health care operations, we or our Business Associates may further use or disclose such records to the extent permitted by HIPAA regulations.
- You may provide a single, general consent for all future uses or disclosures of SUD records for treatment, payment, and health care operations purposes.
5. Psychotherapy Notes
Psychotherapy notes (as defined in the HIPAA Privacy Rule) receive heightened protection beyond other PHI. We will not use or disclose your separately maintained psychotherapy notes for any purpose — including treatment, payment, or health care operations — without your specific written authorization, except as required or permitted by law (such as to avert a serious threat to health or safety, for training, or in connection with legal proceedings to which we are a party).
6. Uses and Disclosures Requiring Your Written Authorization
Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization, including:
- Most uses and disclosures of psychotherapy notes (as described above);
- Uses and disclosures of PHI for marketing purposes;
- Disclosures that constitute a sale of PHI; and
- Any other use or disclosure not otherwise permitted or required by law.
You may revoke any authorization you have provided in writing at any time. Revocation will be effective immediately, except to the extent that we have already taken action in reliance on your authorization.
7. Your Rights Regarding Your Health Information
You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to: Shruthi Nair, LMHC-D, LPC, Bold Brown Mental Health Counseling PLLC, 90 Broad St, 2nd Floor, New York, NY 10004, or shruthi@boldbrowntherapy.com.
Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI maintained in our records, including your medical and billing records. We may charge a reasonable fee for copying. We may deny your request in limited circumstances; you may request a review of any denial.
Right to Request Amendment: If you believe that PHI we have about you is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us or is accurate and complete. If we deny your request, you have the right to submit a statement of disagreement to be kept in your file.
Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI we have made (other than for treatment, payment, and health care operations, and certain other exceptions) for up to six years prior to the date of the request.
Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. While we are not required to agree to your request, if we do agree, we will be bound by that agreement except in emergencies. You have the right to restrict disclosures to your health plan for services you have paid for in full out of pocket.
Right to Request Confidential Communications: You may request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we contact you only via email or only at a particular address. We will accommodate reasonable requests.
Right to a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. Please contact us to request a copy.
Right to Notification of a Breach: You have the right to be notified in the event of a breach of your unsecured PHI, as required by the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D).
8. How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.
To file a complaint with us:Shruthi Nair, LMHC-D, LPC (Privacy Officer)
Bold Brown Mental Health Counseling PLLC
90 Broad St, 2nd Floor, New York, NY 10004
(201) 305-0733
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201
Hotline: 1-800-368-1019
9. Contact Us
If you have any questions about this Notice or our privacy practices, please contact:
Shruthi Nair, LMHC-D, LPC
Privacy Officer, Bold Brown Mental Health Counseling PLLC
90 Broad St, 2nd Floor, New York, NY 10004
(201) 305-0733