THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your health record contains personal information about you and your health. This information that may identify you and relates to your past, present, or future physical or mental health condition and related health care services is referred to as Protected Health Information (PHI).

This Notice of Privacy Practices describes how we may use and disclose your PHI in accordance with applicable law, including:

• The Health Insurance Portability and Accountability Act (HIPAA)
• HIPAA Privacy and Security Rules
• 42 CFR Part 2 (Confidentiality of Substance Use Disorder Records), where applicable
• The Illinois Mental Health and Developmental Disabilities Confidentiality Act
• The American Psychological Association Code of Ethics

It also describes your rights regarding how you may gain access to and control your PHI.

“Use” applies only to activities within our clinic such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you. “Disclose” applies to activities outside our clinic, such as releasing, transferring, or providing access to information about you to other parties. “Authorization” is your written permission to disclose confidential mental health information; all authorizations must be on a specific legally required form.

We maintain your confidentiality and release information only in accordance with state and federal law.

This duty of confidentiality continues after treatment ends, and, where applicable, continues after a patient’s death in accordance with applicable law.

Our Legal Duties

We are required by law to:

• Maintain the privacy of PHI
• Provide notice of our legal duties and privacy practices
• Follow the terms of this Notice currently in effect

We reserve the right to change this Notice at any time. Updated versions apply to all PHI we maintain and will be made available via:

• Website posting
• Mailed copy upon request
• Copy at your next appointment

If this Notice is updated, the revised version will be posted on our website by the effective date of the revision. If required by law, we will also notify patients of the updated Notice and how to access it, including through routine or annual communications.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

We use and disclose the minimum necessary PHI for treatment, payment, and operations. Your general consent for treatment may also allow us to use and disclose your PHI for ongoing treatment, payment, and health care operations without requiring a separate authorization each time, as permitted by law.

For Treatment Your PHI may be used and disclosed for providing, coordinating, or managing your treatment, including consultation with treatment team members or other professionals. We will keep you informed when these types of disclosures will be made.

For Payment PHI may be used for billing, eligibility determination, claims management, collection activities, and utilization review. 

For Health Care Operations We may use PHI for business activities including but not limited to: quality review, staff supervision, licensing, accreditation, and contracted services (e.g., billing vendors).

Substance Use Disorder (SUD) Records – 42 CFR Part 2

If you receive services involving diagnosis, referral, or treatment of substance use disorders, federal law (42 CFR Part 2) may provide additional confidentiality protections. 

These protections may:

• Restrict disclosure without specific consent
• Limit redisclosure by recipients
• Require special authorization language

Where applicable, SUD records may be treated differently than general PHI. We comply with current federal confidentiality requirements and breach notification standards. Where 42 CFR Part 2 or other applicable law is more stringent than HIPAA, we follow the more restrictive law.

Federal law prohibits use of SUD records in criminal, civil, administrative, or legislative proceedings without patient consent or specific court order.

Redisclosure Warning: Information disclosed from substance use disorder treatment records may be protected by federal confidentiality law (42 CFR Part 2). If such information is disclosed with your authorization or as otherwise permitted by law, the recipient may redisclose that information, and it may no longer be protected by HIPAA or federal substance use confidentiality rules.

Patient Portal and Electronic Communication

The patient portal is intended primarily for:

• Scheduling
• Billing
• Administrative communication

Portal messaging is not monitored in real time and is not appropriate for urgent or emergency clinical communication.

If you are experiencing an emergency, call 911 or go to the nearest emergency room.

Proxy portal access may be granted to parents or guardians of minor patients in accordance with law and clinical appropriateness.

Digital Privacy and Electronic Information Collection

We may collect, store, and transmit PHI electronically through systems such as electronic health records, intake systems, and communication platforms.

For minors:

• Parent/guardian consent is required for children under 13 for digital services
• Shared consent models may apply for teens ages 13–17
• Parent portal proxy access may be provided unless limited by law or clinical necessity

Reproductive Health Privacy Protections

Federal law restricts use or disclosure of PHI for investigations or enforcement related to lawful reproductive health care.
We will comply with all applicable federal and state privacy protections related to reproductive health information.

Uses and Disclosures Requiring Authorization

Uses not permitted by law require written authorization.
You may revoke authorization in writing unless action has already been taken based on that authorization. It will become effective when it has been received at our Deerfield office. You may not revoke an authorization if the authorization was obtained as a condition of obtaining insurance coverage; other law provides the insurer with the right to contest a claim under the policy or the policy itself.

Authorization is required for:

• Most uses of psychotherapy notes
• Marketing uses of PHI
• Uses not otherwise described in this Notice, except as allowed by federal and state laws

Uses and Disclosures Without Authorization

Following is a list of the categories of uses and disclosures permitted by HIPAA without an authorization. Applicable law and ethical standards require us to disclose information about you without your authorization only in a limited number of situations, such as: 

• Child abuse reporting: If we have reasonable cause to believe a child known to us in our professional capacity may be an abused or neglected child, we must report this belief to the appropriate authorities.
• Adult abuse reporting: If we have reason to believe that an individual who is protected by state law (including those in the elderly and disabled populations) has been abused, neglected, or financially exploited, we must report this belief to the appropriate authorities.
• Health oversight activities: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections, including licensure or disciplinary actions.
• Court orders: If you are involved in a court proceeding and a request is made for information by any party about your evaluation, diagnosis, and treatment, and the records thereof, we will release such information only with a court order. Information about all other psychological services is also privileged; the privilege does not apply when you are being evaluated for a third party or where the evaluation is court ordered. You must be informed in advance if this is the case.
• Serious threat to health or safety: If you communicate to us, or we believe there is a specific threat of imminent harm against the public, yourself, and/or another individual(s), we may make disclosures that we believe are necessary to protect the public, you, and/or that individual(s) from harm. If information is disclosed to prevent or lessen a serious threat, it will be disclosed to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
• Workers’ compensation: We may disclose PHI regarding you as authorized by and to the extent necessary to comply with laws relating to worker’s compensation, or other similar programs established by law, that provide benefits for work-related injuries or illness without regard to fault.
• Medical emergencies: We may use or disclose your PHI in a medical emergency situation to medical personnel only in order to prevent serious harm. Our staff will try to provide you with a copy of this notice as soon as reasonably practicable after the resolution of the emergency.
• Law enforcement where legally required: We may disclose PHI to a law enforcement official as required by law in compliance with a subpoena (with your written consent), a court order, administrative order, or similar document for the purpose of identifying a suspect, material witness, or missing person in connection with the victim of a crime, a deceased person, the reporting of a crime in an emergency, or a crime on the premises.

   

There may be additional disclosures of PHI that we are required or permitted by law to make without your consent or authorization (when the use and disclosure without your consent or authorization is allowed under other sections of Section 164.512 of the Privacy Rule and the state’s confidentiality law). However, the disclosures listed above are the most common.

Family Involvement in Care

We may share information with family or individuals involved in care with patient permission or when required or permitted by law.

Rights of Minors and Parent/Guardian Access

Under HIPAA, parents or legal guardians are generally treated as the minor patient’s personal representative and may access the minor’s records, unless: 

• State law allows the minor to consent independently, or
• Disclosure could endanger the minor, or
• Other legal exceptions apply

Patients under twelve years of age and their parents or legal guardian(s) should be aware that the law allows parents or legal guardian(s) to examine their child’s treatment records. Parents or legal guardian(s) of children ages twelve to seventeen can examine their child’s records if the child consents and we find no compelling reasons for denying the access. Parents or legal guardian(s) of children ages twelve to seventeen are entitled to information concerning their child’s current physical and mental condition, diagnosis, treatment needs, services provided, and services needed. 

Since parental involvement is often crucial to successful treatment, in most cases we require that minors and their parents or legal guardians) enter into an agreement that allows parents or legal guardian(s) access to certain additional treatment information. Parents or legal guardian(s) will be provided with general information about the progress of their child’s treatment. Any other communication will require the child’s authorization, unless we feel that the child is in danger or is a danger to someone else, in which case we will notify the parents or legal guardian(s) of our concern. 

Before giving parents or legal guardian(s) any information, we will discuss the matter with the child, if possible, and do our best to handle any objections they may have. 

If you are separated or divorced from the child’s other parent, please be aware that it is the policy of ATC to notify the other parent that a therapist is meeting with your child. We believe it is important that all parents have the right to know, unless there are truly exceptional circumstances or court-ordered restrictions on information provided to the non-custodial parent, that their child is receiving mental health evaluation or treatment.

In most outpatient settings, complete confidentiality between a minor and their parents or legal guardians cannot be guaranteed except where limited by law. Illinois law may provide additional or more restrictive confidentiality protections for mental health records. We follow Illinois confidentiality law and federal law when determining disclosure.

Safety-related concerns will be shared with parents or guardians when required by law or clinical duty.

Transition at Age 18

When a patient turns 18:

• The patient controls access to their records
• Parents or others must have written authorization (ROI) unless otherwise allowed by law

Patient Rights

Includes rights to:

• Request restrictions: You have the right to request restrictions on certain uses and disclosures of PHI. We are not required to agree to your request, but we will consider the request very seriously. If we agree, we will abide by our agreement unless the information is needed in an emergency or by law.
• Confidential communication: You have the right to request and receive confidential communications of PHI by alternative means and at alternative addresses. 
• Inspect and copy records: You have the right to inspect and copy PHI that is maintained in a “designated record set.” A designated record set contains mental health, medical, billing, and any other records that are used to make decisions about your care. We may charge a reasonable, cost-based fee for copies. We will provide a copy or a summary of your health information within approximately thirty days of your request. Please note that electronic transmissions can put your privacy at risk. You have the right to request that a copy of your PHI be provided to another person. We retain the right to deny your request under certain circumstances.
• Request amendments: If you feel that the PHI we have about you is incorrect or incomplete, you have the right to ask us to amend the information, although we are not required to agree to the amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us. We may prepare a rebuttal to your statement and will provide you with a copy. Please contact us if you have any questions.
• Request accounting of disclosures: You generally have the right to receive an accounting of disclosures of PHI. We will include all disclosures except those about treatment, payment, or health care operations, and certain other disclosures (such as any you asked us to make). We may charge you a reasonable, cost-based fee if you request more than one accounting in any twelve-month period.
• Receive paper copy: You have the right to obtain a paper copy of this notice from us upon request, even if you have agreed to receive this notice electronically.
• Restrict disclosure to health plan for self-pay care: You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for our services.
• Receive breach notification: You have the right to be notified if:

1. There is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule} involving your PHI,
2. PHI has not been encrypted to government standards
3. Our risk assessment fails to determine that there is a low probability that your PHI has been compromised

Complaints

If you believe your privacy rights were violated, you may contact:
The Anxiety Treatment Center of Greater Chicago
707 Lake Cook Road Suite 310
Deerfield, IL 60015
877-559-0001

You may also contact the United States Department of Health and Human Services toll-free at 877-696-6775. You may file a written complaint with them at the following address:

The U.S. Department of Health & Human Services Hubert H. Humphrey Building

200 Independence Avenue S.W. Washington D.C. 20201

We will not retaliate against you for filing a complaint.

Effective Date and Acknowledgement 

This notice became effective on February 12, 2026.