Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

That header is required by federal law, and the rest of this notice is required too. If you become a client, you’ll receive this notice at intake through the client portal and I’ll ask you to acknowledge it. It’s posted here because you shouldn’t have to become a client to read it.

This notice covers clients of Holliday Approach LLC’s therapy practice. Health information means information that identifies you and relates to your health or your care, like session notes, your intake, a diagnosis, or billing records. Coaching clients: coaching is not a health care service, so HIPAA doesn’t govern coaching records, but your coaching agreement holds them to written confidentiality terms. What the website itself collects is a separate, smaller matter, covered in the Privacy Policy.

How I use and share health information

For your treatment. I use your records to provide your care: reviewing history before sessions, writing notes, planning what we do next. With your written consent, I may coordinate with another provider involved in your care, like a psychiatrist or your physician.

For payment. I use billing information to charge the card on file and to generate superbills you can submit to your insurer. If you ask me for a superbill, it will include the information insurers require, including a diagnosis code; you choose whether to submit it.

For running the practice. The law calls this “health care operations”: quality review, required record-keeping, clinical consultation, defending the practice in an audit. Consultation with other clinicians happens without identifying you wherever possible.

When the law requires or permits it, without your authorization. These are the narrow exceptions that apply to every therapist: reporting suspected abuse or neglect of a child or vulnerable adult; a specific, credible threat of serious harm to an identifiable person; a court order (a subpoena alone is not a court order, and I’m required to assert your privilege and notify you before anything is released); health oversight activities like a licensing board audit; workers’ compensation as provided by law; and public health reporting where it applies.

Everything else requires your written authorization. In particular: psychotherapy notes (process notes I keep separate from your record) get extra protection and almost never leave my files without your specific written permission; your information is never used for marketing and never sold. By law, either would require your written authorization; neither will happen. You can revoke any authorization in writing at any time, except for disclosures already made while it was in effect.

Michigan and Ohio both give mental health records protection beyond HIPAA’s floor. Where state law is stricter, I follow state law.

Your rights over your records

See and get a copy. You can inspect your records and get a copy, on paper or electronically, usually within 30 days. In rare situations a clinician can withhold parts of a record, with a right to have that decision reviewed.

Ask me to correct something. If you believe something in your record is wrong or incomplete, you can request an amendment in writing. If I don’t make the change, you can add a statement of disagreement to the record.

Restrict what goes to your insurer. Because this practice is self-pay, this right matters here: when you pay for a service out of pocket in full, you can require that information about that service not be disclosed to your health plan, and I must agree. Other restriction requests I’ll consider but am not always required to grant.

Choose how I reach you. You can ask me to contact you at a specific number or address, or not to leave voicemails, and I’ll accommodate any reasonable request without asking why.

Get a list of disclosures. You can request an accounting of the disclosures I’ve made of your information in the past six years, beyond those for treatment, payment, and operations.

Be told about a breach. If a breach of unsecured health information affects you, I’m required to notify you, and I would.

Get a paper copy of this notice. Ask any time, even if you agreed to receive it electronically.

My duties

I’m required by law to maintain the privacy and security of your health information, to give you this notice, and to follow the version currently in effect. Records live in a HIPAA-secure electronic health record system, not on this website. Clinical records are kept for at least seven years after our last session, as Michigan and Ohio law require, and then destroyed securely. If the practices described here change in a meaningful way, the notice will be updated in the portal and on this page, with a new effective date.

Complaints

If you believe your privacy rights have been violated, you can raise it with me directly, by phone at 616-213-3026, through the “Something else” option on the contact form, or in session, and you can file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: hhs.gov/ocr, 1-800-368-1019, or 200 Independence Avenue SW, Washington, DC 20201. Filing a complaint will never affect your care, and retaliation is prohibited by law.

Questions

The privacy contact for this practice is Melinda Holliday, LMSW, at 616-213-3026. Ask me directly, in session, by phone, through the “Something else” option on the contact form, or by email at . Effective date: September 11, 2026.