NOTICE OF PRIVACY PRACTICES (HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: October 1, 2026
Practice: Envisioning Wellness LLC, Dorothee Tshiela, MA, LPCC
Privacy Officer: Dorothee Tshiela, MA, LPCC (owner), (952) 314-8364, dorothee@envisioningwellness.com

This notice is for clients of Envisioning Wellness LLC. It explains how we may use and share your health information (called protected health information, or PHI) and what rights you have. The law requires us to protect your PHI, give you this notice, and follow it. For information collected through our website, see our Privacy Policy.

1. How we may use and share your PHI without your written permission

  1. Treatment. To provide and coordinate your care. Example: we talk with your primary care provider or psychiatrist about your treatment.

  2. Payment. To bill and collect for services. Example: we send a claim to your insurance plan and confirm your benefits.

  3. Health care operations. To run our practice. Example: quality review, clinical supervision, training, and legal or accounting help. We share only what is needed.

  4. Business associates. Companies that help us, such as billing, telehealth, records and IT vendors. Each signs an agreement to protect your PHI.

  5. As required by law. Including court orders, reports to public health or oversight agencies, and audits by the U.S. Department of Health and Human Services.

  6. Abuse and neglect. We must report suspected abuse or neglect of a child or a vulnerable adult.

  7. Serious threats. We may share PHI to prevent a serious and imminent threat to you or to others.

  8. Legal proceedings. We respond to a subpoena or similar request only as the law allows. In many cases that requires a court order or your written permission.

  9. Other permitted uses. Such as to a coroner, for certain research with approval, or for workers' compensation, as the law allows. Information we disclose under this notice may be shared again by the person who receives it, and it may then no longer be protected by HIPAA.

2. Uses and disclosures that need your written authorization

We need your written authorization for:

  1. Psychotherapy notes. These are our private process notes, kept apart from your record. Most uses and disclosures need your authorization.

  2. Marketing. Using your PHI to market products or services to you.

  3. Sale of PHI. We do not sell PHI.

  4. Anything not described in this notice.

You can cancel an authorization at any time in writing. It will not undo what we already did based on it. We do not use your PHI for fundraising.

We do not provide substance use disorder treatment.

3. Your rights

  1. See and get a copy of your records, on paper or in electronic form if we can provide it. We reply within 30 days. We may take one 30-day extension and will tell you why. We may charge a reasonable fee for copies.

  2. Ask for a correction to information you believe is wrong. We reply within 60 days, with one 30-day extension possible. If we say no, we explain why in writing.

  3. Get a list of disclosures we made of your PHI over the past 6 years. It leaves out treatment, payment, operations, disclosures you authorized, and some others the law lists.

  4. Ask us to limit how we use or share your PHI. We do not have to agree, except when you pay for a service in full out of pocket and ask us not to tell your health plan. Then we will agree, unless the law requires otherwise.

  5. Choose how we contact you. For example, a certain phone number or only through the portal. We will agree to reasonable requests.

  6. Get a paper copy of this notice, even if you accepted it electronically.

  7. Get notice of a breach of your unsecured PHI.

  8. Cancel an authorization you gave, as described in section 2.

  9. Choose a person to act for you, such as a legal representative. We will confirm they have the authority.

To use any right, write to the Privacy Officer or ask us for our request form. We will ask for reasonable proof of identity.

4. Our duties

  1. We protect the privacy and security of your PHI.

  2. We tell you promptly if a breach affects your PHI. We will notify you without unreasonable delay and no later than 60 days after we find the breach. Your state may set a shorter deadline.

  3. We follow the duties and practices in this notice and give you a copy.

  4. We do not use or share your PHI in ways this notice does not describe, unless you give written permission.

  5. We do not record sessions without your written permission.

  6. We keep your records in a secure, HIPAA-compliant electronic health record system provided by SimplePractice.

5. State law

If your state law gives your health information more protection than HIPAA, we follow the stricter rule. This includes the Minnesota Health Records Act and Washington's Uniform Health Care Information Act, plus the laws of Wisconsin, North Dakota, New Jersey and Texas.

6. Record retention

We keep client records for at least 7 years after your last service, or longer if the law of your state requires.

After the period ends, we destroy records in a way that keeps them private.

7. Changes to this notice

We may change this notice, and the change may apply to PHI we already hold. We will post the new notice on our website, make it available at your request, and share it with current clients in the client portal. The effective date is at the top.

8. Acknowledgment

When you start care, we will share this notice in your client portal and ask you to sign a form saying you received it. If you do not sign, we will record our good-faith effort to get your signature. Using our website does not count as this acknowledgment.

9. Questions and complaints

If you think we violated your privacy rights, you may complain to us, to the federal government, or to both. We will not retaliate against you for filing a complaint.

  1. Our Privacy Officer: Dorothee Tshiela, MA, LPCC, (952) 314-8364, dorothee@envisioningwellness.com. We will reply within 30 days.

  2. U.S. Department of Health and Human Services, Office for Civil Rights: 1-877-696-6775. Online: ocrportal.hhs.gov/ocr/cp.

  3. Your state licensing board:

Minnesota

Board of Behavioral Health and Therapy

(651) 201-2756; bbht.board@state.mn.us

Wisconsin

Marriage and Family Therapy, Professional Counseling and Social Work Examining Board (Professional Counseling Section), Wisconsin Department of Safety and Professional Services

608-266-2112; dsps@wisconsin.gov

North Dakota

North Dakota Board of Counselor Examiners

701-667-5969; ndbce@outlook.com

Washington

Washington State Department of Health

360-236-4700; HSQAComplaintIntake@doh.wa.gov

New Jersey

Professional Counselor Examiners Committee, New Jersey Division of Consumer Affairs

(973) 504-6582; www.njconsumeraffairs.gov/pc

Texas

Texas State Board of Examiners of Professional Counselors, Texas Behavioral Health Executive Council

(512) 305-7700; complaints (800) 821-3205 (24-hour); bhec.texas.gov

This notice follows the HIPAA Privacy Rule, 45 C.F.R. Parts 160 and 164, Subparts A and E, and the Breach Notification Rule, 45 C.F.R. §§ 164.400 to 164.414.NOTICE OF PRIVACY PRACTICES (HIPAA)