HIPAA Notice of Privacy Practices
Revised January 2026
Your Information * Your Rights * Our Responsibilities
THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
NOTICE OF CLINICIANS' POLICIES AND PRACTICES TO PROTECT THE PRIVACY OF YOUR HEALTH INFORMATION
Your health record contains personal information about you and your health. This information about you that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services is referred to as Protected Health Information (“PHI”). This Notice of Privacy Practices describes how we may use and disclose your PHI in accordance with applicable law, including the Health Insurance Portability and Accountability Act (“HIPAA”), regulations promulgated under HIPAA including the HIPAA Privacy and Security Rules. It also describes your rights regarding how you may gain access to and control your PHI.
We are required by law to maintain the privacy of PHI and to provide you with notice of our legal duties and privacy practices with respect to PHI. We are required to abide by the terms of this Notice of Privacy Practices. We reserve the right to change the terms of our Notice of Privacy Practices at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time. We will provide you with a copy of the revised Notice of Privacy Practices by posting a copy on our website, sending an electronic copy within your therapyappointment.com profile (current clients only), or sending a copy to you in the mail upon request.
I. USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS
Unless the PHI is considered Highly Confidential Information and the applicable law regulating such information imposes special restrictions, Lisa Robinson, PhD may use or disclose your protected health information (PHI), for treatment, payment, and health care operations purposes with your CONSENT. To help clarify these terms, here are some definitions: "PHI" refers to information in your health record that could identify you. Treatment is when your clinician provides, coordinates or manages your mental health care and other services related to your mental health care. Payment is when Lisa Robinson, PhD obtains reimbursement for your healthcare or submits claims to an insurance company on your behalf. Health Care Operations are activities that relate to the performance and operation of my practice. "Use" applies only to activities, such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you. "Disclosure" applies to activities, such as releasing, transferring, or providing access to information about you to other parties.
Some examples in which disclosure requires only that you provide written, advanced CONSENT include the following:
• If you are using insurance or another third-party payer, certain information must be shared with them to obtain reimbursement for your health care, to determine eligibility or coverage, to submit health insurance claims on your behalf and/or to participate in utilization review activities. Information may include but is not necessarily limited to your diagnosis, dates of service, and type of service. If there is a managed care company, they may require additional information, such as your symptoms and your progress. Once released to insurance/third-party payers, the information is often stored in national computer databases. Patients have the right to restrict certain disclosures of PHI to these companies if the patient pays out-of-pocket in full for the health care service.
• Health care operations include but are not limited to quality assessment and improvement activities, business-related matters such as audits and administrative services, case management and care coordination, saying your name in the waiting room, contacting you by telephone, text, or email to remind you of your appointment, licensing, and conducting or arranging for other business activities (e.g., billing services) provided we have a written contract with the business that requires it to safeguard the privacy of your PHI.
• If required, we may use or disclose your PHI for mandatory public health activities to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or if directed by a public health authority, to a government agency that is collaborating with that public health authority.
• If required, we may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third-party payors based on your prior consent) and peer review organizations performing utilization and quality control.
• As required by law we must make disclosures to the Secretary of the Department of Health and Human Services for the purpose of investigating or determining our compliance with the requirements of the Privacy Rule.
• Use of PHI for marketing purposes (e.g., communicating to you about new services Dr. Robinson provides) requires your written authorization.
• Consultations with other health professionals about a case to assist in providing high-quality treatment. During a consultation, every effort is made to avoid revealing the identity of clients and the other professional is only told the minimum necessary to understand the situation and provide feedback. Other professionals are also legally bound to keep the information confidential.
• Extended leave coverage to provide backup for emergencies during Dr. Robinson’s absence.
• Business associates/contracted service providers have access to certain PHI as part of the service procedures. Dr. Robinson’s contracts currently include those with therapyappointment.com (online practice management system), telehealth platforms (e.g., EMDRremote.com, WeMind), and The Headstrong Project. As required by HIPAA, a formal business associate contract with these businesses exists in which they promise to maintain the confidentiality of this data except as specifically allowed in the contract or otherwise required by law. You may obtain a blank copy of this contract.
• Disclosures required to collect overdue fees due to lack of payment for services as discussed in the Agreement. We will only disclose the minimum amount of PHI necessary for purposes of collection.
• In the event of an emergency, we may use or disclose your PHI to medical personnel in order to prevent serious harm.
• In the event of a patient’s death, we may disclose PHI as mandated by state law, or to a family member or friend that was involved in your care or payment for care prior to death, based on your prior consent. A release of information regarding deceased patients may be limited to an executor or administrator of a deceased person’s estate or the person identified as next-of-kin. PHI of persons that have been deceased for more than fifty (50) years is not protected under HIPAA.
II. USES AND DISCLOSURES REQUIRING AUTHORIZATION
Other uses and disclosures of your PHI for purposes outside of treatment, payment, and health care operations will be made only with your AUTHORIZATION, unless otherwise permitted or required by law as described in this Notice. You may give written authorization to use your PHI or to disclose it to anyone for any purpose. An "authorization" is written permission above and beyond the general consent that permits only specific disclosures. In those instances when your clinician is asked for information for purposes outside of treatment, payment and health care operations (e.g., referral to another provider, consultation with the client’s psychiatrist or other MD, involvement of family members in your care), an authorization will be obtained from you before releasing this information, including releasing of your psychotherapy notes.
Other examples in which disclosure requires that you provide written AUTHORIZATION include the following:
• "Psychotherapy notes" are notes your clinician has made about your conversation during a private, group, joint or family counseling session which are kept separate from the rest of your medical record. These notes are given a greater degree of protection than PHI. Psychotherapy Notes will not be used or disclosed without your written authorization except for use by Lisa Robinson, PhD to provide treatment to you, to defend herself in a legal action or other proceeding brought by you, or as required by law.
• Lisa Robinson, PhD will not accept any payments from other organizations or individuals in exchange for making communications to you about treatments, therapies, health care providers or services unless you have given your written authorization to do so or the communication is permitted by law.
• For research, PHI may only be disclosed after a special approval process or with your authorization
• Federal and state law requires special privacy protections for certain health information about you (Highly Confidential/Sensitive Health Information), including AIDS/HIV records, Alcohol and Drug Abuse Treatment Program records and other health information that is given special privacy protection under state or federal laws other than HIPAA.
Per the Office of Civil Rights within the DHHS 42 CFR Part 2 offers heightened protections for SUD [substance use disorder] treatment records. While Dr. Robinson does not provide SUD treatment, it is possible that MRs could be sent to her from another provider of yours for the purpose of care coordination or continuity of care. Per DHHS 42 CFR Part 2 SUD treatment records:
• SUD treatment records received from Part 2 programs cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against an individual unless based on written consent or a court order (after notice and opportunity to be heard); the court order must be accompanied by a subpoena or other legal requirement compelling disclosure.
• Unlike standard protected health information (PHI), use of these specific Part 2 SUD records for TPO generally requires the patient’s written consent.
• Information disclosed under HIPAA may be subject to redisclosure by the recipient and therefore lose its protection.
• If Part 2 records are used for fundraising, individuals must first be provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.
Written authorization will be obtained from you before using or disclosing PHI in a way that is not described in this Notice.
You may revoke all such authorities (of PHI or psychotherapy notes) at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) your clinician has relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage and the law provides insurer the right to contest the claim under the policy.
III. USES AND DISCLOSURES WITH NEITHER CONSENT NOR AUTHORIZATION
Lisa Robinson, PhD may use or disclose PHI without your consent or authorization (and in some situations may be legally obligated to disclose PHI in an attempt to protect others from harm) in the following circumstances:
• Child Abuse: If there is cause to believe that a minor has been or may be, abused or neglected (including physical injury, substantial threat of harm, mental or emotional injury, or any kind of sexual contact or conduct), or that a child is a victim of a sexual offense (i.e., homosexual conduct, public lewdness, indecent exposure, indecency with a child, and improper photography or visual recording) a report must be made within 48 hours to the Texas Department of Protective and Regulatory Services, the Texas Youth Commission, or to any local or state law enforcement agency. Once such report is filed, additional information may be required.
• Adult and Domestic Abuse: If there is any cause to believe that an elderly or disabled/vulnerable person is in a state of abuse, neglect, or exploitation, your clinician must immediately report such to the Department of Protective and Regulatory Services or if the alleged abuse, neglect or exploitation occurred in a facility operated, licensed, certified or registered by a state agency (other than the Texas Department of Mental Health and Mental Retardation), to said state agency. Once such report is filed, additional information may be required. A psychologist who makes a disclosure regarding adult or domestic abuse must promptly inform the patient that such a report has been or will be made except if: (1) the psychologist in the exercise of his or her professional judgment believes informing the patient would place the patient at risk of serious harm; or (2) the psychologist would be informing a personal representative and the psychologist reasonably believes the personal representative is responsible for the abuse, neglect or other injury and that informing the personal representative would not be in the patient's best interest as determined by the psychologist in the exercise of professional judgment.
• Judicial or Administrative Proceedings: If you are involved in a court proceeding and a request is made for information about your diagnosis and treatment and the records thereof, such information is privileged under the state law, and will not be released without written authorization from you or your personal or legally appointed representative, a court order, or an administrative order or similar process. The privilege does not apply when you are being evaluated for a third party or where the evaluation is court ordered. You will be informed in advance if this is the case. If you are involved in or contemplating litigation, you should consult with an attorney to determine whether a court is likely to order me to disclose information.
• Serious Threat to Health or Safety: If a psychologist determines that there is a probability that a patient will inflict imminent physical injury on another, or that the patient will inflict imminent physical, mental or emotional harm upon him/herself or others, the provider may be required to take protective action by disclosing relevant confidential mental health information to medical or law enforcement personnel or by securing hospitalization of the patient.
• Worker's Compensation: If you file a worker's compensation claim, records relating to your diagnosis and treatment for which compensation is being sought may be disclosed to your employer's insurance carrier upon appropriate request without your authorization to determine the amount of payment or entitlement to payment.
• Sexual misconduct: When sexual misconduct by another mental health professional has been disclosed, a provider is required to report such misconduct to the appropriate licensing board.
• Complaints/Lawsuits: If a patient files a complaint or lawsuit against a psychologist (e.g., Licensing Board complaints, lawsuits, any other legal action against a professional license), the professional may disclose relevant information regarding that patient in order to defend him/herself. If a complaint is filed against a provider with a licensing board, they have the authority to subpoena confidential mental health information relevant to the complaint. The Texas Behavioral Health Executive Council or North Carolina Psychology Board shall, on its own motion or on the written request of a party to a contested case pending before the Board, issue a subpoena to require the attendance of a witness or the production of books, records, papers or other objects that may be proper for the purposes of the proceeding, if good cause is shown and on deposit of sums with the Board's Executive Director that will reasonably ensure payment of the estimated expenses of the witness or deponent.
• When the use and disclosure without your consent or authorization is allowed under other sections of Section 164.512 of the Privacy Rule and the state’s confidentiality law: This includes certain narrowly-defined disclosures to law enforcement agencies, to a health oversight agency (such as HHS or a state department of health), to a coroner or medical examiner, for public health purposes relating to disease or FDA-regulated products, or for specialized government functions such as fitness for military duties, eligibility for VA benefits, and national security and intelligence.
• As required by Law: PHI will be used or disclosed as required by the law. For example, PHI may be disclosed to the U.S. Department of Health and Human Services upon request for purposes of determining whether I am in compliance with federal privacy laws.
If any of these situations arise, every effort will be made to fully discuss it with you before any action is taken, and disclosures will be limited to what is necessary. While this written summary of exceptions to confidentiality are the most common and should prove helpful in informing you about potential problems, there may be additional disclosures of PHI that are required or permitted by law without your consent or authorization. It is important that you and Lisa Robinson, PhD discuss any questions or concerns you may have now or in the future. The laws governing confidentiality can be quite complex. In situations where specific advice is required, formal legal advice may be needed.
IV. Patient's Rights
• Right to Request Restrictions - You have the right to request additional restrictions on certain uses and disclosures of PHI about you. However, Lisa Robinson, PhD is not required to agree to a restriction you request, but if she does, she will abide by the agreement (except in an emergency). Any agreement to a request for additional restrictions must be in writing signed by the person authorized to make such an agreement.
• Right to Receive Confidential Communications by Alternative Means and at Alternative Locations - You have the right to request and receive confidential communication of PHI by alternative means and at alternative locations. You must make your request in writing. I must accommodate your request if it is reasonable, specifies the alternative means or location, and continues to permit us to bill and collect payment from you. For example, you may not want a family member to know that you are being seen by me. Upon your written request, all correspondence can be sent to another alternative address.
• Right to Inspect and Copy - You have the right to inspect or obtain a copy (or both) of PHI and psychotherapy notes in my mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. Lisa Robinson, PhD may deny your access to PHI under certain circumstances, but in some cases you may have this decision reviewed. Upon your request, your clinician will discuss with you the details of the request. A reasonable, cost-based fee may be charged for copies.
• Right to Amend - You have the right to request an amendment of PHI for as long as the PHI is maintained in the record. Your request must be in writing, and it must explain why the information you want amended or for certain other reasons. If I deny your request, I will provide you a written explanation. You may respond with a statement of disagreement to be appended to the information you want amended. If I accept your request to amend the information, I will make reasonable efforts to inform others, including people or entities you name, of the amendment and to include the changes in any future disclosures of the information.
• Right to an Accounting - You have the right to receive a list of instances in which your PHI was disclosed for purposes other than treatment, payment, or health care operations. Upon your request, you will be provided with the date the disclosure was made, the name of the person or entity to which the disclosure was made, a description of the PHI disclosed, and the reason for the disclosure. If you request this list more than once in a 12-month period, you will be charged a reasonable, cost-based fee for responding to these additional requests.
• Right to a Paper Copy - You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to receive the notice electronically.
• Right to Restrict Disclosures When You Have Paid for Your Care Out-of-Pocket - You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for my services.
• Right to Be Notified if There is a Breach of Your Unsecured PHI - You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) my risk assessment fails to determine that there is a low probability that your PHI has been compromised. The risk assessment can be done by a business associate if it was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, I will provide any required notice to patients and HHS. After any breach, particularly one that requires notice, I will re-assess its privacy and security practices to determine what changes should be made to prevent the re-occurrence of such breaches.
V. QUESTIONS & COMPLAINTS
If you have questions about this notice, disagree with a decision Lisa Robinson, PhD has made about access to your records, or have other concerns about your privacy rights, you may contact Lisa Robinson, PhD at 713-922-5339. If you believe that your privacy rights have been violated and wish to file a complaint you may send a written complaint to Robinson Psychological Services, PLLC at PO Box 1458, Skyland, NC 28776. You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services. Your clinician can provide you with the appropriate address upon request or you can access information about the complaint process by visiting: https://www.hhs.gov/hipaa/filing-a-complaint/what-to-expect/index.html.
Lisa Robinson, Ph.D. (Texas #32216) offers psychological services and is licensed in the State of Texas by the Texas Behavioral Health Executive Council, who may be contacted regarding questions and complaints about the practice of psychology. The Council’s physical and mailing address is:
Texas Behavioral Health Executive Council
George H.W. Bush State Office Bldg.
1801 Congress Ave., Ste. 7.300
Austin, Texas 78701
T: 512-305-7700
Investigations/Complaints: 800-821-3205
Lisa Robinson, Ph.D. (North Carolina #6155) offers psychological services and is licensed in the State of North Carolina by the North Carolina Psychology Board, who may be contacted regarding questions and complaints about the practice of psychology. The Board's mailing address is:
North Carolina Psychology Board
895 State Farm Road, Suite 101
Boone, NC 28607
828-262-2258
https://ncpsychologyboard.info/complaints/
You have rights under the Privacy Rule and no retaliation will be utilized against you for exercising your right to file a complaint.
VI. EFFECTIVE DATE, RESTRICTIONS, AND CHANGES TO PRIVACY POLICY
This notice went into effect on September 1, 2013 and was updated again on January 27, 2026. It will remain in effect until replaced. Lisa Robinson, PhD reserves the right to change our privacy practices and the terms of this notice at any time, provided that such changes are permitted applicable law, and to make the new notice provisions effective for all PHI that is maintained, including medical information created or received before the changes were made. Lisa Robinson, PhD will provide you with a copy of the revised Notice of Privacy Practices by posting a copy on her website, sending an electronic copy within your therapyappointment.com profile (current clients only), or sending a copy to you in the mail upon request. You may request a copy of our notice (or any subsequent revised notice) at any time.
CHANGES TO THE TERMS OF THIS NOTICE
Dr. Robinson can change the terms of this notice, and the changes will apply to all information she has about you. The new notice will be available upon request.
By placing your signature below, you attest that you have read and understand your rights and responsibilities under federal law regarding your PHI.
Effective Date is date of signature below: