Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Spruce View Therapy, PLLC
Michaela Zoppa, MA, LPC
719-900-1005
Effective Date: July 2, 2025
I. SUMMARY:
This is a summary of how we may use and disclose your protected health information and your rights and choices when it comes to your information. We will explain these in more detail on the following pages.
Your Rights
You have the right to:
Get a copy of your paper or electronic protected health information.
Correct your protected health information.
Ask us to limit the information we share, in some cases.
Get a list of those with whom we've shared your information.
Request confidential communication.
Get a copy of this privacy notice.
Choose someone to act for you.
File a complaint if you believe we have violated your privacy rights.
Your Choices:
You have some choices about how we use and share information as we:
Communicate with you.
Tell family and friends about your condition.
Provide disaster relief
Provide mental health care
Market our services
Our uses and Disclosures:
We may use and disclose your information as we:
Treat you.
Bill for services.
Run our organization.
Do research.
Comply with the law.
Respond to organ and tissue donation requests.
Work with a medical examiner or funeral director.
Address workers' compensation, law enforcement, and other government requests.
Respond to lawsuits and legal actions.
*Please keep in mind that this information contains both protection under the Health Insurance Portability and Accountability Act (HIPAA) and Colorado State law (including but not limited to C.R.S. § 25-1-802, § 12-45-220, and 4 CCR 737-1) which may give individuals greater protection.
II. PURPOSE:
Spruce View Therapy, PLLC (“Spruce View” or “I”) respect your privacy. I am also legally required to maintain the privacy of your protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) and other federal and state laws. I follow state privacy laws, including when they are stricter or more protective of your PHI than federal law.
As part of my commitment and legal compliance, I am providing you with this Notice of Privacy Practices (Notice). This Notice describes:
My legal duties and privacy practices regarding your PHI, including my duty to notify you following a data breach of your unsecured PHI.
My permitted uses and disclosures of your PHI.
Your rights regarding your PHI.
Contact:
If you have any questions about this Notice, please contact me at michaela@spruceviewtherapy.com.
PHI Defined:
Your PHI is health information about you:
Which someone may use to identify you; and
Which we keep or transmit in electronic, oral, or written form.
It includes information such as your:
Name;
Contact information;
Past, present, or future physical or mental health or medical conditions;
Payment for health care products or services; or
Prescriptions.
Scope:
I create a record of the care and health services you receive, to provide your care, and to comply with certain legal requirements. This Notice applies to all the PHI that I generate and that I receive or maintain. I follow the duties and privacy practices that this Notice describes and any changes once they take effect.
Changes to this Notice:
I can change the terms of this Notice, and the changes will apply to all information I have about you. The new notice will be available on request, in our office, and on our website.
Data Breach Notification
I will promptly notify you if a data breach occurs that may have compromised the privacy or security of your PHI. I will notify you within the legally required time frame, no later than 60 days after a breach is discovered. Most of the time, I will notify you in writing, by first-class mail, or I may email you if you have provided me with your current email address and you have previously agreed to receive notices electronically. In limited circumstances when I have insufficient or out-of-date contact information, I may provide notice in a legally acceptable alternative form.
III. YOUR RIGHTS:
When it comes to your health information, you have certain rights. This section explains your rights and some of my responsibilities to help you. You have the right to:
1. Get a copy of your PHI. You can ask to see or obtain an electronic or paper copy of the PHI that I maintain about you (right to request access).
Clarifications about your access rights under Colorado law (C.R.S. § 25-1-802):
As a client receiving psychotherapy services in Colorado, you have the right to access your medical records, including those maintained as part of your mental health treatment. Upon submitting a valid, signed, and dated authorization, you—or your personal representative—may inspect your records at reasonable times and with reasonable notice. If your treatment has ended, a summary of your mental health records may also be made available upon written request. You may request a copy of your records, including electronic copies if the originals are stored electronically and readily producible in that format. Reasonable fees may apply in accordance with HIPAA. If diagnostic films (e.g., X-rays, MRIs, CT scans) are involved and a licensed provider determines that copies are insufficient for treatment purposes, original films may be released under HIPAA-compliant authorization and must be returned within 30 days. Requests for inspection will be documented by date and time and must be acknowledged by your signature; there is no fee for in-office inspection. Please note that psychotherapy office notes are not considered part of the medical record. Additionally, if you are a minor receiving treatment for sexually transmitted infections, substance use, or drug-related concerns, your records will not be released to a parent or guardian without your explicit authorization, as permitted by law. Records of services delivered via telehealth are considered part of your official medical record.
2. Ask me to correct your medical record. You may ask me to correct or amend PHI that I maintain about you that you think is incorrect or inaccurate. For these requests:
you must submit requests in writing or electronically, specify the inaccurate or incorrect PHI, and provide a reason that supports your request
I will generally decide to grant or deny your request within 60 days. If I cannot act within 60 days, I will give you a reason for the delay in writing and include when you can expect me to complete my decision, which will be no longer than an additional 30 days. I will only ask for an extension once in response to a request.
I may deny your request for an amendment if you ask us to amend PHI that is not part of our record, that I did not create, that is not part of a designated record set, or that is accurate and complete.
3. Ask us to limit what we use or share. You have the right to ask us to limit what I use or share about your PHI (right to request restrictions). You can contact me and request that I not use or share certain PHI for treatment, payment, or operations or with certain persons involved in your care. I may require that you submit this request in writing. For these requests:
I am not required to agree;
I may say “no” if it would affect your care; but
I will agree not to disclose information to a health plan for purposes of payment or health care operations if the requested restriction concerns a health care item or service for which you or another person, other than the health plan, paid in full out-of-pocket, unless it is otherwise required by law.
4. Get a list of those with whom we've shared your PHI. You have the right to request an accounting of certain PHI disclosures that I have made. For these requests:
I will respond no later than 60 days after receiving the request. I may ask for an additional 30 days during this 60-day period, but if I do, I will only do it once, provide a written statement of why, and indicate the date by which I intend to send the response.
I will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures, such as any you asked me to make; and
I will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months. I will notify you about the costs in advance and you may choose to withdraw or modify your request at that time.
5. Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. I will confirm the person has this authority and can act for you before I take any action.
6. Request confidential communications. You have the right to request that I communicate with you about health matters in a certain way or at a certain location. For example, you can ask that I only contact you at work or at a specific address. For these requests:
I will not ask for the reason;
you must specify how or where you wish to be contacted; and
I will accommodate reasonable requests.
7. Make a Complaint: You have the right to complain if you feel I have violated your rights. I will not retaliate against you for filing a complaint. You may either file a complaint:
directly with us by contacting michaela@spruceviewtherapy.com. All complaints must be submitted in writing; or
with the Office for Civil Rights at the US Department of Health and Human Services. Send a letter to U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Room 509F HHH Bldg. Washington, D.C. 20201; or visit www.hhs.gov/ocr/privacy/hipaa/complaints/.
IV. YOUR CHOICES:
For certain health information, you can tell me your choices about what I share. If you have a clear preference for how I share your information in the situations described below, please contact me and I will make reasonable efforts to follow your instructions.
In these cases, you have both the right and choice to tell me whether to:
Share information, such as your PHI, general condition, or location, with your family, close friends, or others involved in your care.
Share information in a disaster relief situation, such as to a relief organization to assist with locating or notifying your family, close friends, or others involved in your care.
V. USES AND DISCLOSURES:
The law permits or requires me to use or disclose your PHI for various reasons, which I explain in this Notice. I have included some examples, but have not listed every permissible use or disclosure. When using or disclosing PHI or requesting your PHI from another source, I will make reasonable efforts to limit my use, disclosure, or request about your PHI to the minimum we need to accomplish our intended purpose. PHI that the law permits or requires us to disclose may be further shared by recipients and is no longer protected by law or the safeguards and restrictions in place when it is in our possession
In non-emergency situations, no PHI will be disclosed without direct written prior permission being given by you except in limited circumstances, as outlined in this section and section VI. If permission is given, this will be documented and included in your file. Permission can later be revoked at any time. If I receive a release asking for your PHI from another party I will first verify this with you and ask for your permission to release your PHI. If you do not give permission, I will not release your PHI.
Additionally, in the following cases, I will not share your information unless you give me your written permission:
Most sharing of “psychotherapy notes” as defined by 45 CFR § 164.501;
For marketing purposes;
Selling or otherwise receiving compensation for disclosing your PHI;
Certain research activities; and
Other uses and disclosures not described in this Notice.
Uses and Disclosures for Treatment, Payment, or Health Care Operations
Treatment: I may use or disclose your PHI and share it with other professionals who are treating you, including doctors, nurses, technicians, medical students, or hospital personnel involved in your care. For example, I might disclose information about your overall health condition to physicians who are treating you for a specific injury or condition.
Billing and payment: I may use and disclose your PHI to bill and get payment from health plans or others. For example, I share your PHI with your health insurance plan so it will pay for the services you receive.
Running our organization. I may use and disclose your PHI to run my practice, improve your care, and contact you when necessary. For example, I may use your PHI to manage the services and treatment you receive or to monitor the quality of my health care services.
VI. OTHER USES AND DISCLOSURES:
Complying with the law. For example, we will share your PHI if the Department of Health and Human Services requires it when investigating our compliance with privacy laws.
Helping with public health and safety issues. For example, we may share your PHI to:
report injuries, births, and deaths;
prevent disease;
report adverse reactions to medications or medical device product defects;
avert a serious threat to public health or safety.
Responding to legal actions. For example, we may share your PHI to respond to:
a court or administrative order or subpoena;
discovery request; or
another lawful process.
Note: If communications between a minor-patient and their mental health professional do not form the basis of a report of child abuse or neglect as described in C.R.S. § 19–3–304, then the therapist-patient privilege applies to communications in a dependency and neglect proceeding.
Working with medical examiners or funeral directors. For example, we may share PHI with coroners, medical examiners, or funeral directors when an individual dies.
Responding to organ and tissue donation requests. For example, we may share your PHI to arrange an authorized organ or tissue donation from you or a transplant for you.
Addressing workers' compensation, law enforcement, or other government requests. For example, we may use and disclose your PHI for:
workers' compensation claims;
health oversight activities by federal or state agencies;
law enforcement purposes or with a law enforcement official; or
specialized government functions, such as military and veterans' activities, national security and intelligence,
presidential protective services, or medical suitability
Reproductive Health Care PHI Uses and Disclosures Requiring an Attestation. By law, if we collect, receive, or maintain PHI that is potentially related to your reproductive health care, in some cases we must obtain an attestation from PHI recipients that they will not use or share that PHI for a purpose prohibited by law. For example, these situations may involve:
Health oversight activities. For example, we may share your reproductive health care-related PHI in some situations for health oversight agency audits or inspections, civil or criminal investigations or proceedings, or licensure actions.
Judicial and administrative proceedings. For example, we may share your reproductive health care-related PHI in some situations in response to a court or administrative order, subpoena, or discovery request.
Law enforcement purposes. For example, we may share your reproductive health care-related PHI in some situations for law enforcement purposes, including in response to a court-ordered warrant or a law enforcement official's request for information about a victim of a crime.
Coroners or medical examiners. For example, we may share your reproductive health care-related PHI in some situations to a coroner or medical examiner to identify a deceased person, determine cause of death, or other duties as authorized by law
The following are circumstances in which I am required to waive confidentiality, without
your consent, as mandated by Colorado state law:
DUTY TO WARN: If you communicate to me a serious threat of imminent physical violence against a specific person or persons, including those identifiable by their association with a specific location or entity, I have a legal obligation to warn or protect the identified person or persons. In addition to the actions noted above, pursuant to C.R.S. 12-245-203.5(7), a mental health professional must notify the minor’s parent or legal guardian unless doing so would be inappropriate or detrimental to the minor’s care and treatment.
MANDATORY REPORTING: Under Colorado law, mental health providers are considered mandatory reporters. This means that anyone who reasonably suspects or knows a child has been abused or neglected, or has witnessed conditions likely to cause harm, must immediately report it to the county department, local law enforcement, or the child abuse hotline.