THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Notice of Privacy Practices (NPP)
Hillord Health LLC (“Practice”) is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, to maintain the privacy of your Protected Health Information (PHI) and to provide you with notice of our legal duties and privacy practices with respect to your PHI.
1. What is Protected Health Information (PHI)?
PHI includes any individually identifiable health information we create, receive, maintain, or transmit, including information about your physical or mental health condition, the provision of healthcare, or payment for healthcare that can reasonably be used to identify you. This includes your name, address, date of birth, Social Security number, diagnosis, treatment records, session notes, billing records, and any electronic communications related to your care.
2. How We May Use and Disclose Your PHI
Treatment: We may use and disclose your PHI to provide, coordinate, and manage your mental health treatment. For example, we may consult with other licensed professionals involved in your care, with your written authorization where required.
Payment: We may use your PHI to bill and collect payment for services rendered, including submission of claims to insurance companies or third-party payers.
Healthcare Operations: We may use your PHI for quality assurance, training, auditing, licensing, and accreditation activities necessary to operate the Practice.
As Required by Law: We will disclose PHI when required by federal, state, or local law, including reporting obligations related to abuse, neglect, or domestic violence.
Public Health Activities: Disclosures may be made to authorized public health authorities to prevent or control disease, injury, or disability.
Serious Threat to Health or Safety: We may disclose PHI if we believe in good faith that such disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
Judicial and Administrative Proceedings: We may disclose PHI in response to a court or administrative order, subpoena, or discovery request, subject to applicable legal protections.
Law Enforcement: Under specific circumstances defined by HIPAA, we may disclose PHI to law enforcement officials.
Supervisory Disclosure (QS): As a Board-Approved Qualified Supervisor, Pastor Mervin Ellis may review de-identified or appropriately authorized clinical material with supervised interns for training and oversight purposes only, consistent with Florida Board and AAMFT standards.
3. Uses and Disclosures Requiring Your Authorization
Except as described above, we will not use or disclose your PHI without your written authorization. This includes, but is not limited to: psychotherapy notes (maintained separately from the general medical record), marketing purposes, and sale of PHI. You may revoke any authorization at any time in writing, except where we have already relied on it.
4. Minimum Necessary Standard
We make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request, in accordance with the HIPAA Minimum Necessary Rule (45 CFR §164.502(b)).
5. Business Associates
We may share PHI with third-party service providers (“Business Associates”) who assist us in operating our practice, including electronic health record systems, billing services, and HIPAA-compliant telehealth platforms. All Business Associates are required by contract to appropriately safeguard your PHI in accordance with 45 CFR §164.504(e).
6. Breach Notification
In the event of a breach of unsecured PHI, we will notify you as required by the HITECH Act and applicable HHS regulations (45 CFR §§164.400–414), including the nature of the breach, PHI involved, steps you should take, and what we are doing to investigate and mitigate the harm.
7. Contact & Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at info@hillordhealth.com or with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.
Privacy Officer: Pastor Mervin Ellis, MS, LMFT · Phone: (305) 561-6957 · Email: info@hillordhealth.com
Website & Practice Privacy Policy
Last Updated: January 1, 2024
1. Information We Collect
Information You Provide: When you complete our intake form, contact us, or use our chat feature, we collect: name, email address, phone number, mental health concerns, therapy preferences, and any notes you voluntarily share. We also collect payment card information through our secure checkout flow (processed via SSL-encrypted channels).
Automatically Collected Information: We may collect non-identifiable technical data such as browser type, device type, and general geographic region (state-level only) to improve our website performance. We do not use third-party tracking cookies for advertising purposes.
Chat & Communication Data: Messages sent through our live chat widget are used solely to respond to your inquiries and improve support. Chat logs containing PHI are protected under HIPAA.
2. How We Use Your Information
- To match you with an appropriate therapist based on your intake responses
- To schedule, conduct, and document clinical sessions
- To process payments and send receipts
- To communicate appointment reminders, policy updates, and administrative notices
- To comply with legal, regulatory, and licensing obligations
- To improve our intake, matching, and telehealth systems
3. Data Storage & Security
All client records and PHI are stored using HIPAA-compliant systems with role-based access controls, audit logging, and encryption at rest and in transit (minimum 256-bit AES and TLS 1.2+). Our telehealth platform is HIPAA-compliant and all video sessions are end-to-end encrypted. Client intake data submitted through this website is stored locally on your device session until formally transferred to our secure EHR system.
4. Retention of Records
Clinical records are retained for a minimum of seven (7) years from the date of the last service, or seven (7) years after a minor client turns 18, whichever is later, in compliance with Florida Statutes §456.057 and applicable HIPAA standards.
5. Third-Party Services
We do not sell, rent, or trade your personal information to any third party for marketing purposes. We may share data only with HIPAA Business Associates who have executed a Business Associate Agreement (BAA) and are contractually obligated to protect your information.
6. Children’s Privacy
Our online intake process is designed for adults (18+). For minors receiving services, a parent or legal guardian must provide written consent. All minor records are handled with heightened confidentiality protections under Florida law and HIPAA.
7. Changes to This Policy
We reserve the right to update this Privacy Policy at any time. Material changes will be posted on this website and, where required by law, communicated directly to active clients. Continued use of our services after the effective date constitutes acceptance of the revised policy.
