REBECCA BARCLAY, LPC, LLC
401 E. Louther St., Suite 225 Carlisle, PA 17013
Phone: 717-601-2440
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. MY LEGAL DUTIES REGARDING YOUR PROTECTED HEALTH INFORMATION (PHI)
I understand that information about you and your health care is personal. I am committed to protecting the privacy of your protected health information ("PHI"). I create and maintain records of the care and services you receive to provide quality care and to meet legal requirements. This Notice applies to all records of your care maintained by this practice. It describes how I may use and disclose your protected health information, your rights regarding that information, and my legal obligations.
Under the Health Insurance Portability and Accountability Act (HIPAA), as amended by the HIPAA Omnibus Rule, I am required to:
Maintain the privacy and security of your PHI.
Provide you with this Notice of my legal duties and privacy practices.
Abide by the terms of the Notice currently in effect.
Notify you following a breach of unsecured PHI, as required by federal law.
Ensure that all business associates and their subcontractors safeguard your PHI under legally binding agreements.
I may update this Notice to comply with evolving privacy regulations; any changes will apply to all information in your record. Signed forms are available on your client portal under the Files tab. If you have trouble accessing them, I can electronically send them to you, upon request, for your records.
II. HOW I MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU: The following categories outline how I may use and disclose your health information. Not every example is listed, but all permitted uses and disclosures fall within these categories.
A. Treatment, Payment, and Health Care Operations
Federal privacy regulations permit health care providers with a direct treatment relationship to use or disclose PHI without written authorization for:
Treatment: Providing, coordinating, or managing your mental health care. Example: Consulting with another licensed health care provider about your treatment.
Payment: Activities necessary to obtain payment for services. Example: Submitting claims to your insurance company.
Health Care Operations: Practice operations such as quality assessment, training, supervision, licensing, or administrative activities.
Disclosures for treatment purposes are not limited to the minimum necessary standard as providers need comprehensive information to deliver quality care.
B. Other Permitted or Required Uses and Disclosures
Subject to applicable law, I may use or disclose your PHI without authorization for the following purposes:
To family members, friends, or others involved in your care or payment for care, unless you object in whole or part. This may include disclosures related to deceased individuals unless the individual objected prior to death. The opportunity to consent may be obtained retroactively in emergency situations.
To your personal representative, as permitted by law.
To business associates who perform services on my behalf and are required by law to protect your PHI.
As required by federal, state, or local law.
To avert a serious and imminent threat to the health or safety of you or others.
For public health activities, including reporting abuse, neglect, or domestic violence.
For health oversight activities such as audits, investigations, and licensure.
For judicial or administrative proceedings when legally required.
For law enforcement purposes as permitted by law.
For workers’ compensation claims as allowed by state law. Although my preference is to obtain an Authorization from you, I may provide your PHI to comply with workers’ compensation laws.
To coroners, medical examiners, and funeral directors as authorized by law.
For research purposes, when permitted by law.
For specialized government functions, including military, national security, or correctional institutions.
Appointment reminders and health related benefits or services. I may use and disclose your PHI to contact you to remind you of a scheduled appointment. I may also use and disclose your PHI to tell you about treatment alternatives or other health care services or benefits I offer.
II-B. PENNSYLVANIA-SPECIFIC CONFIDENTIALITY PROTECTIONS
In addition to federal HIPAA protections, your mental health records are also protected by the Pennsylvania Mental Health Procedures Act (50 P.S. § 7101 et seq.) and other applicable Pennsylvania confidentiality laws. These laws provide heightened privacy protections for mental health treatment records.
Under Pennsylvania law:
Mental health records may not be released without your written authorization, except in limited circumstances permitted by law.
Disclosures are strictly limited to the minimum necessary information required by law.
Records may be disclosed without authorization only for purposes such as: medical emergencies, court orders, audits by authorized government agencies, or where otherwise specifically required by Pennsylvania statute.
When state law is more restrictive than HIPAA, Pennsylvania law controls.
III. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION
I must obtain your written authorization for the following uses and disclosures:
Progress Notes and Clinical Record: Progress notes document elements of care (e.g. interventions, client response, diagnosis, treatment plan, risk assessment, and next steps) for each therapy session. I maintain psychotherapy notes as defined by federal law. These notes are used only by me and are kept separate from your medical record. Uses or disclosures require authorization except when permitted by law, such as for treatment, supervision, legal defense, or health oversight.
** Psychotherapy Notes: My record of process-oriented impressions, hypotheses, transference/countertransference concerns, and other content not required for treatment, billing, or continuity of care. They are kept separate from your clinical record and receive special HIPAA protection.
Marketing Purposes: I do not use or disclose PHI for marketing purposes.
Sale of PHI: I do not sell your PHI.
Fundraising Communications: I do not currently engage in fundraising activities. If this changes, you will be notified and given the right to opt out of receiving such communications.
Any other uses or disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent that action has already been taken.
IV. YOUR RIGHTS REGARDING YOUR PHI
You have the following rights, subject to certain legal limitations:
Right to Request Restrictions: You may request limits on how your PHI is used or disclosed for treatment, payment, or health care operations. I am not required to agree to your request (and may decline to do so if I believe it would affect your health care), except that I must agree to restrict disclosures to a health plan if you paid for the service in full out-of-pocket.
Right to Confidential Communications: You may request that I communicate with you in a specific way (for example, home or office phone) or send mail to a different address, and I will agree to all reasonable requests.
Right to Inspect and Copy: You may inspect or obtain a paper or electronic copy of your clinical record, or summary if you prefer, except psychotherapy notes, within 30 days. Requests must be in writing. I may charge a reasonable, cost-based fee.
Right to Amend: You may request that I correct or amend your PHI. I may deny the request but will provide a written explanation.
Right to an Accounting of Disclosures: You may request a list of disclosures of your PHI excluding disclosures for treatment, payment, or health care operations. I will provide this accounting, covering the past six years unless a shorter period is requested, within 60 days. Requests exceeding one instance per year may incur a reasonable, cost-based fee.
Right to a Paper Copy of This Notice: You may request a paper or electronic copy at any time.
To exercise any of these rights, please submit a written request to me at the contact information listed above.
V. COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with me and/or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.
To file a complaint with me, contact:
Rebecca Barclay, LPC
Phone: 717-601-2440
VI. ACKNOWLEDGMENT OF RECEIPT
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By checking the box below, you confirm that you have received a copy of HIPAA Notice of Privacy Practices.
EFFECTIVE DATE OF THIS NOTICE:
Original Notice: June 17, 2021; Revision effective as of 01/12/2026.
If you have any questions or concerns about this document, please contact: Rebecca Barclay, 717-601-2440, or through the secure messaging feature on the portal.