California Notice of
Privacy Practices

Your privacy is protected under federal law (HIPAA) and the California Confidentiality of Medical Information Act (CMIA). I create and maintain records containing your protected health information (PHI) to provide quality care, and I am bound by strict legal and ethical codes to keep that information secure.

California and federal rules allow me to use or disclose your PHI without your written authorization for the following purposes:

• Treatment: I can disclose your PHI to coordinate or manage your healthcare. For example, I may consult with a clinical supervisor or another healthcare professional on your care team.
• Payment: I may use and disclose your PHI so services can be billed and paid by you, an insurance company, or a third party.
• Health Care Operations: I may use your PHI to support the administrative facets of my practice, such as quality reviews, compliance auditing, or business planning.
• Appointment Reminders: I may use your PHI to contact you with appointment reminders.

Under California law, I am required or permitted to disclose your PHI without your authorization in the following specific circumstances:

• Child, Elder, or Dependent Adult Abuse: If I have a reasonable suspicion that a child, elder, or dependent adult is being abused or neglected, I am a mandated reporter and must notify California Protective Services.
• Harm to Self or Others (Tarasoff Rule): If you communicate an imminent, serious threat of physical violence against an identifiable victim or yourself, I am required to take protective actions. This may include notifying the police and the intended victim.
• Legal Proceedings: I must disclose PHI in response to a judge's court order, a lawful administrative order, or a valid California subpoena.
• Law Enforcement & Government Functions: I may disclose PHI to law enforcement or specialized government entities for public safety or national security requirements.

Your explicit written consent—using a specific, dated, and time-limited California Release of Information form—is mandatory for:

• Psychotherapy Notes: Any separate personal process notes kept apart from your medical chart require your specific authorization to be shared.
• Marketing & Sale of Information: Under the CMIA, I am strictly prohibited from selling or using your information for marketing purposes without explicit consent.
• Employment & Third Parties: Disclosing details to your employer, school, or attorney requires an explicitly signed authorization.

You possess the following enhanced rights under California healthcare regulations:

• Right to Inspect and Copy (California Timeline): You have the right to inspect and obtain a copy of your mental health record. Under the CMIA, I must fulfill your request for copies within 15 business days of receiving your written request (faster than HIPAA's 30-day rule). A reasonable, cost-based fee may apply.
• Right to Request Restrictions: You can request restrictions on how I share your PHI.
• Right to Confidential Communications: You can request that I communicate with you in a specific format or location (e.g., emailing a secure portal link instead of calling your home phone).
• Right to Amend: If you believe information in your record is incorrect, you may request an amendment or submit a 250-word written addendum to be permanently attached to your file.
• Right to an Accounting of Disclosures: You may request a list of certain non-routine disclosures I have made of your PHI over the past six years.
• Right to Notice of a Breach: Under California's strict data breach laws, you have a right to be notified promptly if the security of your unsecured PHI is breached.

• Telehealth Consent: Per California Board of Behavioral Sciences (BBS) rules, we must verbally or textually establish consent for telehealth services before your first session. You must be physically located in California at the time of our session.
• Two-Party Recording Rule: Under California Penal Code Section 632, audio or video recording of therapy sessions is strictly prohibited unless both the client and the therapist provide explicit consent.
• Digital Security Boundaries: Email, text messaging, and social media networks are not 100% secure. Please limit clinical details over text or email. To protect your privacy and maintain clear boundaries, I do not accept "friend" or "follow" requests on personal social media accounts.

If you believe your privacy rights have been violated, you can file a formal complaint with no risk of retaliation. You can file with:

1. The Therapist Directly: Kathryn Carr Tepper, PsyD
2. California Department of Health Care Services (DHCS): Privacy Officer, P.O. Box 997413, MS 0010, Sacramento, CA 95899.
3. U.S. Department of Health and Human Services (HHS): Office for Civil Rights, 50 United Nations Plaza, Room 322, San Francisco, CA 94102.