Effective Date: January 1, 2026

​

At Fill My Cup Counseling, your privacy matters deeply. This page explains how your health information may be used and disclosed, and how you can access your information under the Health Insurance Portability and Accountability Act (HIPAA).

​

Please review it carefully.

 

Our Commitment to Your Privacy

Your Protected Health Information (PHI) includes information about your mental health, medical history, treatment, and identifying details. We are legally and ethically committed to protecting it.

​

We are required by law to:

• Keep your PHI private and secure

• Provide you with this Notice of Privacy Practices

• Follow the terms currently in effect

• Notify you if a breach compromises your information

• Comply with all federal HIPAA regulations, including 2026 privacy updates

We may update this notice at any time. The current version will always be available on this website.

 

How We May Use and Share Your Health Information

HIPAA allows certain uses and disclosures of PHI without your written authorization. Below are the most common situations.

​

1. Treatment, Payment, and Health Care Operations

We may use or share your information for:

       Treatment – Consulting with other licensed professionals, coordinating care, or making referrals.
       Payment – Billing insurance or collecting payment.
       Health Care Operations – Supervision, training, quality review, compliance, and licensing. Example: If                         consultation with another clinician would support your care, relevant information may be shared for treatment         purposes.

​

2. Reproductive Health Privacy Protections (2026 Update)

Federal HIPAA regulations strengthened in 2026 prohibit the use or disclosure of PHI for the purpose of investigating or imposing liability related to lawful reproductive health care. If reproductive health information is requested for law enforcement or investigative purposes, federal law may require a signed legal attestation before disclosure is permitted. Your reproductive health information receives additional federal protection.

 

3. Legal Proceedings

We may disclose PHI if required by:

• Court order

• Subpoena (with appropriate legal safeguards)

• Administrative proceedings

Whenever possible, we prioritize protecting your privacy and will seek appropriate protections.

 

4. Situations That Do Not Require Authorization

We may disclose PHI without written authorization when legally required, including:

• Reporting suspected child, elder, or dependent adult abuse

• Preventing a serious threat to health or safety

• Health oversight audits or investigations

• Workers’ compensation claims

• Law enforcement activities permitted by law

• Coroner or medical examiner duties

• Certain approved research activities

• National security or specialized government functions

 

5. Appointment Reminders & Care Communication

We may contact you to:

• Remind you of appointments

• Provide information about services or treatment options

• Coordinate care

You may request confidential communication methods at any time.

 

Uses That Require Your Written Authorization

We will obtain your written permission before:

• Sharing psychotherapy notes (with limited legal exceptions)

• Using information for marketing

• Selling PHI (which we do not do)

You may revoke authorization in writing at any time.

​

Digital Records & Third-Party Apps (2026 Access Update)

You have the right to receive your records electronically. If you request that we send your PHI to a third-party app (such as a personal health application), we will comply when feasible. However, once transmitted to a non-HIPAA-covered app, the information may no longer be protected under HIPAA. We encourage you to review the privacy practices of any app you choose.

 

Your Rights Under HIPAA

You have the right to:

1. Request Restrictions

Ask us to limit certain uses or disclosures. We may decline unless it involves services you paid for in full out-of-pocket.

 

2. Restrict Disclosure to Insurance (If Paid in Full)

If you pay out-of-pocket in full, you can request that we not share related information with your health plan. We must honor this request.

​

3. Request Confidential Communication

Ask us to contact you in a specific way (e.g., different phone number or mailing address).

​

4. Access Your Records

Request an electronic or paper copy of your records (excluding psychotherapy notes). We respond within 30 days. Only reasonable, cost-based fees may apply. You may also request that we send your records directly to a designated third party.

 

5. Request an Accounting of Disclosures

Receive a list of certain disclosures made in the last six years (excluding treatment, payment, and operations).

 

6. Request Amendments

Ask us to correct or update information in your record. If we deny the request, you will receive a written explanation.

 

7. Receive Breach Notification

Be notified if your unsecured PHI is compromised in a data breach.

​

8. Obtain a Copy of This Notice

Request a paper or electronic copy at any time.

 

Filing a Complaint

If you believe your privacy rights have been violated, you may:

• Contact us directly at: [Insert Practice Contact Information]

• File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights

You will not face retaliation for filing a complaint.

​

Questions?

If you have questions about your privacy rights or this Notice of Privacy Practices, please contact:

Fill My Cup Counseling

765-203-1011

lmillburg@fillmycupcounseling.com