This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
Effective date: 8/1/2025
COMMITMENT TO PRIVACY:
Lilac Speech and Language, PLLC is committed to protecting the privacy of your Protected Health Information (PHI) as required by federal law, including the Health Insurance Portability and Accountability Act (HIPAA), and Washington (WA) and California (CA) state laws, including the Washington's My Health My Data Act (MHMDA) and California’s Confidentiality of Medical Information Act (CMIA). PHI includes information about your past, present, or future physical or mental health, healthcare services, or payment for healthcare services that can identify you. This notice explains how we may use and disclose your PHI, your rights regarding this information, and our legal obligations to protect it. For information about non-PHI health data collected through our website, see our “Consumer Health Data Privacy Policy” at www.lilacspeechandlanguage.com. We are required by law to maintain the privacy of your PHI, provide you with this notice, abide by its terms, notify you if we are unable to agree to a requested restriction on how your PHI is used or disclosed, accommodate reasonable requests you may have to communicate PHI by alternative means or at alternative locations, and notify affected individuals following a breach of unsecured PHI. We reserve the right to change the terms of this notice, and such changes will apply to all information we have about a client. The new notice will be available upon request. We will ask you to sign a document to acknowledge receipt of this notice.
HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION (PHI): The following describes different ways that health information may be used and disclosed. Several categories will be listed with examples. Not every use or disclosure within a category will be listed; However, all of the ways we are permitted to use and disclose health information will fall within one of the categories.
For Treatment and Healthcare Operations: Federal privacy regulations allow health care providers who have direct treatment relationship with the patient/client to use or disclose the patient/client’s PHI without the patient/client’s written authorization, to carry out the healthcare provider’s treatment. We may use PHI to provide, coordinate, or manage healthcare with any healthcare provider such as doctors and/or other specialists involved in the patient/client’s care without written authorization. For example, if a healthcare provider were to consult with another licensed professional about the patient/client’s condition, we would be permitted to use and disclose PHI, which is otherwise confidential, in order to assist with the healthcare provider in diagnosis and treatment of your condition. Disclosures for treatment purposes are not limited to the minimum necessary standard, because other healthcare providers need access to the full record and/or full and complete information in order to provide quality care. The word “treatment” includes the coordination and management of healthcare providers with a third part, consultations between healthcare providers, and referrals of a patient for healthcare from one healthcare provider to another, among other things.
For Payment: We may use or disclose your PHI to bill or obtain payment for healthcare services provided. For example, we may share PHI with health plans to receive payment. We will notify you of requests for your medical information as required by CA law, such as before disclosing to an employer.
As Required by Law: We may disclose your PHI when required by federal, state, or local law, such as for public health activities, health oversight audits, or judicial proceedings.
For Health Oversight Activities: We may share PHI with government agencies for audits, investigations, or inspections to ensure compliance with healthcare regulations.
To Report Abuse or Neglect: We may disclose PHI to state or local agencies authorized to receive reports of abuse, neglect, or domestic violence, limited to the information necessary for the report.
For Judicial and Administrative Proceedings: We may disclose PHI in response to a court order or subpoena, as permitted by law.
For Law Enforcement Purposes: We may disclose PHI to identify or locate a suspect, fugitive, or missing person, or to report a crime, as allowed by law.
To Avert a Serious Threat to Health or Safety: We may disclose PHI to prevent a serious threat to your health or safety or that of others.
For Specialized Government Functions: We may disclose PHI for military, veteran, or national security purposes, as permitted by law.
Incidental Disclosures: We may unintentionally disclose PHI (e.g., information overheard in a waiting room) despite taking reasonable steps to maintain confidentiality.
SECURE COMMUNICATION METHODS
To ensure the security of your PHI, we use the following HIPAA-compliant communication methods: (a) Phone calls to or from (509) 652-2214; (b) Secure Messaging via the Spruce Health platform, (c) Google Workspace email to/from lindsey@lilacspeechandlanguage.com.
DISCLOSURES REQUIRING YOUR AUTHORIZATION
Session Notes: We keep “session notes” and any use or disclosure of such notes requires written authorization unless the use or disclosure is: (a) for our use in treatment, (b) for our use in training or supervising associates to help them improve their clinical skills, (c) for my use in defending myself in legal proceedings, (d) for use by the Secretary of Health and Human Services to investigate my compliance with HIPAA, (e) required by law and the use or disclosure is limited to the requirements of such law, (f) required by law for certain health oversight activities pertaining to the originator of the session notes, (g) required by a coroner who is performing duties authorized by law, (h) required to help avert a serious threat to the health and safety of others.
We will not use or disclose your PHI for purposes not listed above without your written authorization. We may collect written authorization for purposes including, but not limited to the following (authorizations must be in writing, specifying the information, recipients, purpose, expiration, and your right to revoke):
Use or disclosure for marketing purposes, except as permitted by law.
Disclosures that constitute a sale of PHI. We will not sell your PHI in the regular course of this business.
Disclosures of substance use disorder (SUD) treatment information from providers subject to federal law for substance use disorder records, unless authorized by you or a valid court order with notice and opportunity for you to object.
You may revoke your authorization in writing at any time, except to the extent we have already acted on it. To revoke an authorization, contact the owner using secure communication methods listed in Section III.
CERTAIN USES AND DISCLOSURES DO NOT REQUIRE YOUR AUTHORIZATION: Subject to certain limitations in the law, we can use or disclose PHI without authorization for the following reasons:
When disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of such law.
For public health activities, including reporting suspected child, elder, or dependent adult abuse, or preventing or reducing a serious threat to anyone’s health or safety.
For health oversight activities, including audits and investigations.
For judicial and administrative proceedings, including responding to a court or administrative order, although my preference is to obtain an authorization from you before doing so.For law enforcement purposes, including reporting crimes occurring on my premises.
To coroners or medical examiners, when such individuals are performing duties authorized by law.
For research purposes, including studying and comparing the patients who received one form of care versus those who received another form of care for the same condition.
Specialized government functions, including, ensuring the proper execution of military missions; protecting the President of the United States; conducting intelligence or counterintelligence operations; or, helping to ensure the safety of those working within or housed in correctional institutions.
For workers’ compensation purposes. Although we prefer to obtain an authorization from you, we may provide your PHI in order to comply with workers’ compensation laws.
Appointment reminders and health related benefits or services. We may use and disclose your PHI to contact you to remind you that you have an appointment with us. We may also use and disclose PHI to tell you about treatment alternatives, or other health care services or benefits that we offer.
CERTAIN USES AND DISCLOSURES REQUIRE YOU TO HAVE THE OPPORTUNITY TO OBJECT
Subject to certain limitations in the law, we may provide your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.
YOUR RIGHTS REGARDING YOUR PHI AND CHD
Right to Inspect and Copy: You may request access to your PHI or CHD in our records, other than session notes. We will provide an electronic or paper copy of your medical record and other information we have within 30 days of receiving your written request. We may charge a reasonable fee for copying or mailing. In some cases, we may deny access (e.g., if it poses a risk to your safety), but you may request a review of the denial. We will provide a free copy of your records if needed for appealing a denial of Social Security benefits.
Right to Amend: You may request corrections to your PHI or CHD if you believe it is inaccurate or incomplete. Requests must be in writing and include a reason. We may deny the request if the information is accurate, complete, or not created by us, but we will inform you of the reason.
Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made without your authorization over the past six years. One accounting per year is free; additional requests may incur a fee.
Right to Request Restrictions: You may request limits on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to family and friends. We are not required to agree, except if you paid for services out-of-pocket in full and request that we not share PHI with your health plan.
Right to Confidential Communications: You may request that we communicate with you via alternative means or locations (e.g., a different phone number). We will accommodate reasonable requests.
Right to Appeal: If we deny your request to access your PHI (i.e., if it poses a risk to your safety), you may request a review of the denial by contacting our Privacy Official (the owner) via our SpruceHealth secure messaging app or via phone at (509) 612-2214.
Right to a Copy of This Notice: You may request a paper or electronic copy of this notice at any time.
Right to File Complaints: You have the right to file a complaint if you believe your privacy rights have been violated. You may file a complaint by contacting Lilac Speech and Language, PLLC owner Lindsey Vollmert, MS, CCC-SLP at (509) 652-2214 or via the secure SpruceHealth messaging platform. You may also file a complaint with the Secretary of U.S. Department of Health and Human Services at www.hhs.gov/hipaa/filing-a-complaint or 1-800-368-1019. We will not retaliate against you for filing a complaint.
PRIVACY POLICY REGARDING THE “CONTACT US” FORM ON OUR WEBSITE
Information you provide through our website’s “contact us” form such as name, email, phone number, or health-related inquiries, is considered CHD under MHMDA. Please see our standalone “Consumer Health Data Privacy Policy” available at www.lilacsoeechandlanguage.com for details on how we collect, use, share, and protect this information and your related rights.
CHANGES TO THIS NOTICE
We reserve the right to revise this Notice of Privacy Practices. Changes will apply to all PHI and CHD we maintain. We will post the revised notice in our offices, on our website, and provide a copy upon request. If required by law, we will notify you directly of material changes.
ADDITIONAL INFORMATION
Language Assistance: If you need this notice in another language or require assistance, contact our Privacy Official (the owner) in writing via the secure SpruceHealth messaging platform. Language assistance services are provided free of charge.
SUD Information: SUD treatment records from providers subject to 42 CFR Part 2 have additional protections and will not be disclosed without your consent or a valid court order.
EFFECTIVE DATE OF THIS NOTICE
This notice went into effect on 8/1/2025.