Notice of Privacy Practices 

I. Introduction

Medical information about you and your health care is personal. Under the Health Insurance and Portability and Accountability Act of 1996 (“HIPAA”), you have certain rights regarding the use and disclosure of your Protected Health Information (“PHI”).  

The content of this Notice of Privacy Practices (“Notice”) includes information regarding: 

  • The ways Windflower Therapy and Wellness may use and disclose PHI about an individual according to HIPAA

  • Windflower Therapy and Wellness’s legal duties with respect to the information

  • Your rights with respect to the information

  • How you may exercise these rights

  • Whom you can contact for further information about the privacy policies at Windflower Therapy and Wellness

Windflower Therapy and Wellness is required by law to maintain the privacy of Protected Health Information.  Windflower Therapy and Wellness is required to provide individuals with notice of our legal duties and privacy practices with respect to PHI and to notify affected individuals following a breach of unsecured PHI. PHI is information that may identify you and relates to your past, present, or future physical or mental health or condition. In addition, it relates to the provision of health care or payment for the provision of health care for your past, present, or future physical or mental health or condition and related healthcare services. This Notice describes how we may use and disclose PHI to carry out treatment, obtain payment, perform our health care operations, and for other specified purposes that are permitted or required by law. 

Windflower Therapy and Wellness is required to follow the terms of this Notice currently in effect. We will not use or disclose PHI about you without your written authorization, except as described in this Notice. We reserve the right to change our practices and this Notice and to make the new Notice effective for all PHI we maintain.  When material changes are made to any privacy practices at Windflower Therapy and Wellness, we will promptly revise the Notice and have it available for distribution. 

II. Our Pledge

The privacy of your personal health information (PHI) is important to us. Your PHI includes but is not limited to, medical, dental, pharmacy, and mental health information. This Notice describes our privacy practices. All our employees, contractors, and staff must follow our privacy practices.  We use and disclose your PHI in compliance with all applicable state and federal laws.

III. How PHI About You May Be Used and Disclosed

The following categories describe different ways that we use and disclose PHI. For each category of use or disclosure, an explanation of what is meant and some examples are provided. Only some uses or disclosures in a category will be listed. However, all the ways we are permitted to use and disclose PHI will fall within one of the categories.

  • Treatment- We may use or disclose your health information to provide and coordinate the mental health treatment and services you receive. For example, if your mental health care needs are to be coordinated with the medical care provided to you by another healthcare provider. In that case, we may disclose your health information to a physician or other healthcare provider.

  • Payment- We may use and disclose your health information for various payment-related functions to bill for and obtain payment for the treatment and services we provide for you.

  • Healthcare Operations- We may use and disclose your health information for certain operational, administrative, and quality assurance activities in connection with our operations. These uses and disclosures are necessary to run the practice and ensure that our patients receive quality treatment and services. For example, healthcare operations include quality assessment and improvement activities, reviewing the competence or qualifications of healthcare professionals, evaluating practitioner and provider performance, conducting training programs, accreditation, certification, licensing, or credentialing activities.

  • Special Purposes- Under federal and applicable state law, we are permitted to use or disclose your PHI without your permission only when specific circumstances arise. We may use or disclose your PHI without your consent for the following purposes:

  • Individuals Involved in Your Care or Payment for Your Care- When appropriate, we may disclose PHI to a close personal friend or family member who is involved in your medical care or payment for your care.

  • Disclosures to Parents or Legal Guardians- If you are a minor, we may release your PHI to your parents or legal guardians when permitted or required under federal and applicable state law.

  • Public Health- We may disclose your PHI to federal, state, and local authorities or other entities charged with preventing or controlling disease, injury, or disability for public health activities.

  • Health Oversight Activities- We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and government monitoring of the healthcare system, government programs, and compliance with federal and applicable state law.

  • Law Enforcement- We may disclose your PHI for law enforcement purposes as required by law or in response to a court order, subpoena, warrant, summons, or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; about a death resulting from criminal conduct; about crimes on the premises or against a member of our workforce; and in emergency circumstances, to report a crime, the location, victims, or the identity, description, or location of the perpetrator of a crime.

  • Judicial and Administrative Proceedings- If you are involved in a lawsuit or a legal dispute, we may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful processes that meet the requirements of federal regulations.

  • United States Department of Health and Human Services- Under federal law, we are required to disclose your PHI to the U.S. Department of Health and Human Services to determine if we comply with federal laws and regulations regarding the privacy of health information.

  • Research- Under certain circumstances, we may use or disclose your PHI for research purposes. However, before disclosing your PHI, the research project must be approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

  • Coroners, Medical Examiners, and Funeral Directors- We may release your PHI to assist in identifying a deceased person or determine a cause of death.

  • Organ or Tissue Procurement Organizations- Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for tissue donation and transplant.

  • Notification- We may use or disclose your PHI to assist in a disaster relief effort so that your family, personal representative, or friends may be notified about your condition, status, and location.

  • Correctional Institution- If you are or become an inmate of a correctional institution, we may disclose to the institution or its agents PHI necessary for your health and the health and safety of others.

  • To Avert a Serious Threat to Health or Safety- We may use and disclose your PHI to appropriate authorities when necessary to prevent a serious threat to your health and safety or the health and safety of another person or the public. For example, we may disclose your health information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the potential victim of other crimes.

  • Military and Veterans- If you are an armed forces member, we may release your PHI as military command authorities require. We may also release PHI about foreign military personnel to the appropriate military authority.

  • National Security, Intelligence Activities, and Protective Services for the President and Others- We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, provision of protection to the President, other authorized persons or foreign heads of state, and other national security activities authorized by law.

  • As Required by Law- We must disclose your PHI when required by applicable federal or state law.

  • Treatment Alternatives- We may use and disclose PHI to tell you about or recommend possible alternative treatments, therapies, health care providers, or care settings that may interest you.

  • Health-Related Benefits and Services- We may use and disclose PHI to tell you about health-related benefits or services that interest you.

  • Appointment Reminders- We may use or disclose PHI to provide you with appointment reminders (such as voicemail messages, postcards, or letters). You have a right, as explained below, to request restrictions or limitations on the PHI we disclose. As described below, you also have a right to request that information be communicated to you in a certain way or location.

IV. Other Uses and Disclosures of PHI

Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above (or as otherwise permitted or required by law). If you authorize us, you may revoke it by submitting a written notice to Windflower Therapy and Wellness. Your revocation will become effective upon our receipt of your written notice. If you revoke your authorization, we will no longer use or disclose health information about you for the reasons covered by the written authorization. Your revocation will not affect any use or disclosures permitted by your authorization while it is in effect. Unless you give us written authorization, we cannot use or disclose your health information for any reason except those described in this Notice.

  • Marketing Health-Related Services- We will not use or disclose your protected health information for marketing communications without your written authorization and only as permitted by law.

  • Sale of PHI- We will not sell your protected health information without your written authorization and only as permitted by law.

V. Changes To This Notice

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changed Notice effective for all health information we maintain, including health information we created or received before making the changes. When we change our privacy practices, we will change this Notice, and the new Notice will be made available to you upon request.

VI. Your Health Information Privacy Rights

You have privacy rights under federal and state laws that protect your health information. These rights are important for you to know. You can exercise these rights, ask questions about them, and file a complaint if you think that your rights are being denied or your health information is not being protected. Providers and health insurers who are required to follow federal and state privacy law must comply with the following rights:

  • To Request Restrictions on Certain Uses and Disclosures of PHI- You have the right to request restrictions on our use or disclosure of your PHI by sending a written request to Windflower Therapy and Wellness at the contact information listed on the first page of this document. We are not required to agree to those restrictions. We cannot agree to restrictions on uses or disclosures that are legally required or are necessary to administer our business. We must agree to the request to restrict disclosure of PHI to a health plan if the disclosure is to carry out payment or health care operations and is not otherwise required by law. The PHI pertains solely to a health care item or service for which you, or another individual other than a health plan on your behalf, has paid us in full.

  • To Request Confidential Communications- You have the right to request that PHI be communicated to you by alternative means or at alternative locations. For example, you can ask that you only be contacted at work or by mail. We will accommodate all reasonable requests.

  • To Access PHI- You have the right of access to inspect and obtain a copy of your PHI.  You may not be able to obtain all of your information in a few special cases. For example, if your treatment provider determines that the information may endanger you or someone else. In the majority of cases, your copy of the records must be provided to you within fifteen (15) calendar days of receipt of the request. We may charge you a fee for copying, mailing, and the supplies necessary to fulfill your request. Usually, payment is to be received before a copy of the records is provided.  In accordance with Texas law, you have the right to obtain a copy of your PHI in electronic form for records that we maintain using an Electronic Health Records (EHR) system capable of fulfilling the request. Where applicable, we must provide those records to you or your legally authorized representative in electronic form within fifteen (15) days of receipt of your written request and a valid authorization for electronic disclosure of PHI. You may request a copy of authorization from Windflower Therapy and Wellness at the contact information listed on the first page of this document. Again, please note that we may charge you a fee for copying, mailing, and supplies necessary to fulfill your request. Usually, payment is to be received before a copy of the records is provided.

  • To Obtain a Paper Copy of the Notice Upon Request- You may request a copy of our current Notice at any time. Even if you have agreed to receive the Notice electronically, you are still entitled to a paper copy. You may obtain a paper copy from Windflower Therapy and Wellness at the contact information listed on the first page of this document. We may charge you a fee for copying, mailing, and the supplies necessary to fulfill your request. Usually, payment is to be received before a copy of the records is provided.

  • To Request an Amendment of PHI- If you feel the PHI we have about you is incorrect or incomplete, you may request an amendment. Requests must identify (i) which information you seek to amend, (ii) what corrections you would like to make, and (iii) why the information needs to be amended. We will respond to your request in writing within 60 days (with a possible 30-day extension). In our response, we will either: (i) agree to make the amendment or (ii) inform you of our denial, explain our reason, and outline appeal procedures. If denied, you have the right to file a statement of disagreement with the decision. We will provide a rebuttal to your statement and maintain appropriate records of your disagreement and our rebuttal.

  • To Receive an Accounting of Disclosures- You have the right to request an accounting of your PHI disclosures for purposes other than treatment, payment, or healthcare operations. Your request must state a time period. The time period for the accounting of disclosures must be limited to less than six years from the date of the request. We will respond in writing within 60 days of receipt of your request (with a possible 30-day extension). We will provide an accounting per 12-month period free of charge, but you may be charged for the cost of any subsequent accountings. We will notify you in advance of the cost involved, and you may choose to withdraw or modify your request at that time.

  • To be Notified in the Event of a Breach- You have a right to be notified of an impermissible use or disclosure that compromises the security or privacy of your PHI. We will provide notice to you as soon as is reasonably possible and no later than sixty (60) calendar days after discovery of the breach and in accordance with federal and state law.

  • To File a Complaint- If you believe your privacy rights have been violated, you may file a complaint with Windflower Therapy and Wellness at the contact information listed on the first page of this document. You may also file a complaint directly with any or all of the following federal and state agencies: the Secretary of the Department of Health and Human Services, the Office of the Attorney General of Texas, or the Texas Department of Health and Human Services: Texas State Board of Examiners of Professional Counselors. We will provide you with the addresses to file your complaint with the Secretary, the Office of the Attorney General of Texas, or the Texas Department of Health and Human Services: Texas State Board of Examiners of Professional Counselors, upon request. You will not be penalized in any way for filing a complaint. However, if you file a complaint, our professional ethics and board rules may require us to terminate our therapeutic relationship with you and refer you to other providers. Please contact us if you want more information about our privacy practices or have questions or concerns.

If you have any questions about this Notice of Privacy Practices, please contact our Privacy Officer: 

Windflower Therapy and Wellness

Katie Smith

8000 Fair Oaks Parkway, Suite 206

Fair Oaks Ranch, TX 78015

(830) 203-6839

Effective date: January 1, 2025