What happens to what you tell me.

Not much. There’s one form on this site, the short form on my contact page, and it’s the only thing here that takes anything you type. It asks for your name, a way to reach you, and how you found me, and it goes to my inbox. The site itself keeps none of it. I use Google Analytics and Google Search Console to see which pages get read and how people find the site. For that, every page loads one small script from Google, and Google Analytics sets two cookies that tell a return visit from a first one. They can stay for up to two years.

What I see is mostly summaries: which pages, on which days, the kind of device and browser, and whether you arrived from a search or a link. It also shows me roughly where a visit came from, down to a city. Google works that out from your connection and says it doesn’t keep it. It doesn’t show me who you are, and it never sees what you write to me.

Apart from Google’s script, and Paubox’s form on the contact page, the site loads no fonts, scripts or pictures from another company. Like any website, the computers that deliver it see your connection.

The button at the top of every page opens my scheduling page in a new tab. A company called Sessions Health runs that page for me. What you send there comes to me, the same as a message would. Nothing is set until I confirm it with you.

A company called Paubox runs the short form for me. It sits inside my contact page, so when that page opens, Paubox’s form loads with it. Paubox encrypts what you send and passes it to my inbox, and keeps a copy where I can see it. The form asks you to leave health details out. Paubox loads on the contact page and nowhere else.

If you write to me or text me, I’m the one who reads it. Nobody else does.

Apart from my scheduling page and the short form’s own page, a few links go elsewhere on purpose. The review link in the footer goes to Google. The license link on my About page and the two links on my Supervision page go to the Texas council’s site. The Facebook and Instagram links in the menu, the footer and my Contact page go to my pages there. What happens on those sites is theirs, not mine.

This is the notice the privacy law asks providers like me to give. It’s long, so here’s where to look if you only have a minute. Who I may tell without asking you first is under “How else can I use or share your health information”. That list is the law’s, not mine: it names every case the law allows, and most of them never come up in a counseling practice.

How to reach you in a way that stays private is under “Request confidential communications”. What happens to your record if there’s a lawsuit is under “Respond to lawsuits and legal actions”. And if anything in it is unclear, ask me, and I’ll explain it in plain words.

Your Information. Your Rights. My Responsibilities.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Rights

You have the right to:

• Get a copy of your paper or electronic medical record
• Correct your paper or electronic medical record
• Request confidential communication
• Ask me to limit the information I share
• Get a list of those with whom I’ve shared your information
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

Your Choices

You have some choices in the way that I use and share information as I:

• Tell family and friends about your condition
• Provide disaster relief
• Provide mental health care
• Market my services and sell your information

My Uses and Disclosures

I may use and share your information as I:

• Treat you
• Run my practice
• Bill for your services
• Help with public health and safety issues
• Do research
• Comply with the law
• Respond to organ and tissue donation requests
• Work with a medical examiner or funeral director
• Address workers’ compensation, law enforcement, and other government requests
• Respond to lawsuits and legal actions

To the extent that I have your substance use disorder patient records, subject to 42 CFR part 2, I will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of my responsibilities to help you.

Get an electronic or paper copy of your medical record. You can ask to see or get an electronic or paper copy of your medical record and other health information I have about you. Write to me at [email protected] and tell me which you want: an electronic copy, a paper copy or a summary. If you ask for an electronic copy, I’ll send it within 15 business days, and a paper copy or a summary comes within 30 days. I may charge a reasonable, cost-based fee.

Ask me to correct your medical record. You can ask me to correct health information about you that you think is incorrect or incomplete. Ask me how to do this. I may say “no” to your request, but I’ll tell you why in writing within 60 days.

Request confidential communications. You can ask me to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address. I will say “yes” to all reasonable requests.

Ask me to limit what I use or share. You can ask me not to use or share certain health information for treatment, payment, or my operations. I am not required to agree to your request, and I may say “no,” for example, if it could affect your care. If I agree to your request, I may still share this information in the event that you need emergency treatment.

If you pay for a service or health care item out-of-pocket in full, you can ask me not to share that information for the purpose of payment or my operations with your health insurer. I will say “yes” unless a law requires me to share that information.

Get a list of those with whom I’ve shared information. You can ask for a list (accounting) of the times I’ve shared your health information for seven years prior to the date you ask, who I shared it with, and why.

I will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked me to make). I’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this privacy notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. I will provide you with a paper copy promptly.

Choose someone to act for you. If someone has authority to act as your personal representative, such as if someone has your medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. I will make sure the person has this authority and can act for you before I take any action.

File a complaint if you feel your rights are violated. You can complain if you feel I have violated your rights by contacting me using the information at the foot of this notice.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-800-368-1019, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

You can also file a complaint about me as a Licensed Professional Counselor with the Texas Behavioral Health Executive Council, on its complaint form at bhec.texas.gov, by mail at 1801 Congress Ave., Ste. 7.300, Austin, Texas 78701, by phone at (512) 305-7700, or on its 24-hour complaints line, 1-800-821-3205. I will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell me your choices about what I share. If you have a clear preference for how I share your information in the situations described below, talk to me. Tell me what you want me to do, and I will follow your instructions.

In these cases, you have both the right and choice to tell me to:

• Share information with your family, close friends, or others involved in your care or payment for your care
• Share information in a disaster relief situation

If you are not able to tell me your preference, for example if you are unconscious, I may go ahead and share your information if I believe it is in your best interest. I may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases I never share your information unless you give me written permission:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

My own notes on marketing, sale, and psychotherapy notes. I will not sell your PHI. I will not use or disclose your PHI for marketing purposes without your prior written consent.

For example, if I request a review from you and plan to share the review publicly online or elsewhere to advertise my services or my practice, I will provide you with a release form and HIPAA authorization. The HIPAA authorization is required in the instance that your review contains PHI (i.e., your name, the date of the service you received, the kind of treatment you are seeking or other personal health details).

Because you may not realize which information you provide is considered “PHI,” I will send you a HIPAA authorization and request your signature regardless of the content of your review. Once you complete the HIPAA authorization, I will have the legal right to use your review for advertising and marketing purposes, even if it contains PHI.

You may withdraw this consent at any time by submitting a written request to me via the email address I keep on file or via certified mail to my address. Once I have received your written withdrawal of consent, I will remove your review from my website and from any other places where I have posted it.

I cannot guarantee that others who may have copied your review from my website or from other locations will also remove the review. This is a risk that I want you to be aware of, should you give me permission to post your review.

I do keep “psychotherapy notes” as that term is defined in 45 CFR § 164.501, and any use or disclosure of such notes requires your Authorization unless the use or disclosure is:

• For my use in treating you.
• For my use in training or supervising mental health practitioners to help them improve their skills in group, joint, family, or individual counseling or therapy.
• For my use in defending myself in legal proceedings instituted by you.
• For use by the Secretary of the Department of Health and Human Services (HHS) to investigate my compliance with HIPAA.
• Required by law and the use or disclosure is limited to the requirements of such law.
• Required by law for certain health oversight activities pertaining to the originator of the psychotherapy notes.
• Required by a coroner who is performing duties authorized by law.
• Required to help avert a serious threat to the health and safety of others.

My Uses and Disclosures

How do I typically use or share your health information? I typically use or share your health information in the following ways.

Treat you. I can use your health information and share it with other professionals who are treating you. Example: A doctor treating you for an injury asks another doctor about your overall health condition.

Run my practice. I can use and share your health information to run my practice, improve your care, and contact you when necessary. Example: I use health information about you to manage your treatment and services.

Bill for your services. I can use and share your health information to bill and get payment from health plans or other entities. Example: If you ask me for a superbill, it carries the information your plan needs to decide what it pays you back.

How else can I use or share your health information? I am allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. I have to meet many conditions in the law before I can share your information for these purposes.

In all cases, including those listed below, if I have substance use disorder patient records about you, subject to 42 CFR part 2, I cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.

Help with public health and safety issues. I can share health information about you for certain situations such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety

Do research. I can use or share your information for health research.

Comply with the law. I will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that I’m complying with federal privacy law.

Respond to organ and tissue donation requests. I can share health information about you with organ procurement organizations.

Work with a medical examiner or funeral director. I can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests. I can use or share health information about you:

• For workers’ compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions. I can share health information about you in response to a court or administrative order, or in response to a subpoena.

Texas law. This practice complies with all applicable federal and Texas privacy laws. Texas law adds a notice about electronic disclosure: I may not disclose your health information electronically without a separate authorization from you, except to another health care provider or health plan for treatment, payment, or health care operations, or as otherwise authorized or required by state or federal law.

Posting this notice on my website is the notice Texas asks me to give.

My Responsibilities

• I am required by law to maintain the privacy and security of your protected health information.
• I will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• I must follow the duties and privacy practices described in this notice and give you a copy of it.
• I will not use or share your information other than as described in this notice unless you tell me I can in writing. If you tell me I can, you may change your mind at any time. Let me know in writing if you change your mind.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Changes to the Terms of this Notice

I can change the terms of this notice, and the changes will apply to all information I have about you. The new notice will be available upon request, in my office, and on my website.

Effective date of this notice: October 28, 2026. It replaces my earlier notice, in effect from April 5, 2021 and updated December 22, 2022.

Privacy contact: Acelli Crippen-Kok, LPC-S, Solid Ground Counseling & Wellness, PLLC, 1464 E. Whitestone Blvd., Suite 1901, Cedar Park, Texas 78613. 512-793-7737, call or text. [email protected].