Notice of Privacy Practices (HIPAA) & Electronic Communication Agreement

RIVERWOOD PSYCHOTHERAPY LLC

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: JULY 1, 2026

Privacy Officer: James Boyda

Address: 1825 NE Broadway Street, Suite G, Portland, OR 97232, USA

Phone: (971) 328-3919

Email: info@riverwoodpsych.com

Notice of Privacy Practices (HIPAA)

I. OUR PLEDGE REGARDING HEALTH INFORMATION

RIVERWOOD PSYCHOTHERAPY LLC and its clinical providers (collectively, "the Practice," "we," or "us") understand that health information about you and your health care is personal. We are committed to protecting your protected health information ("PHI"). We create and maintain records of the care and services you receive in order to provide quality care, coordinate treatment, obtain payment for services, and comply with applicable legal requirements.

Protected health information ("PHI") may include information created or received by the Practice in written, electronic, or verbal form, including your mental and physical health history, symptoms, diagnoses, evaluations, treatment plans, psychotherapy services, medications, billing information, insurance information, and other information related to your care. This Notice applies to all records of your care generated or maintained by this mental health care practice.

We are required by law to:

  • Make sure that protected health information ("PHI") that identifies you is kept private.

  • Give you this Notice of our legal duties and privacy practices with respect to your health information.

  • Follow the terms of the Notice currently in effect.

  • Notify you promptly following a breach of your unsecured protected health information.

We may change the terms of this Notice at any time, and the revised Notice will apply to all protected health information we maintain. The most current version of this Notice will be available upon request, in our office, and on our website. You have the right to receive a paper copy of the current Notice at any time, even if you have agreed to receive it electronically.

II. HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

Federal privacy regulations under the Health Insurance Portability and Accountability Act ("HIPAA") permit health care providers with a direct treatment relationship to use and disclose protected health information without your written authorization for purposes of treatment, payment, and health care operations.

We may use and disclose your PHI in order to:

  • Plan, provide, and manage your psychotherapy and mental health treatment.

  • Consult with, coordinate care with, or refer you to other health care providers involved in your treatment when appropriate.

  • Determine your eligibility for insurance benefits.

  • Submit claims and receive payment from you, your insurance company, or another responsible party.

  • Obtain prior authorizations and communicate with your health plan regarding covered services.

  • Conduct quality assurance, clinical supervision, training, licensing, credentialing, auditing, compliance, administrative, and other business activities necessary to operate the Practice and provide high-quality care.

For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. This may include consulting with other licensed health care professionals involved in your care or referring you to another provider when appropriate.

For example, unless you request otherwise and we are legally able to honor that request, we may communicate with your referring provider, primary care physician, psychiatrist, or another treating provider to coordinate your care.

For Payment

We may use and disclose your PHI so that the services you receive at the Practice can be billed and payment collected from you, an insurance company, or another third party. For example, we may share your diagnosis, dates of service, and types of treatment with your health insurance plan to determine your eligibility for benefits, obtain prior authorization, or process your claims.

Lawsuits and Disputes

If you are involved in a lawsuit or legal proceeding, we may disclose health information in response to a court or administrative order. We may also disclose information in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to notify you or to obtain an appropriate protective order, as required by law.

Internal Practice Operations

As a team-based practice, PHI may be shared internally with authorized administrative staff for scheduling, billing, record management, quality improvement, and other administrative functions, and with clinical staff for supervision, consultation, or training permitted under HIPAA. All workforce members receive HIPAA training and are required to maintain the confidentiality of your information.

III. CERTAIN USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION

Psychotherapy Notes

We maintain "psychotherapy notes" as defined by 45 CFR § 164.501. Any use or disclosure of psychotherapy notes requires your written authorization except as permitted by law, including for our own training or supervision, our defense in legal proceedings initiated by you, or when otherwise required by law.

Marketing and Sale of PHI

We will not use or disclose your protected health information for marketing purposes, nor will we sell your protected health information in the regular course of our business without your written authorization.

IV. CERTAIN USES AND DISCLOSURES DO NOT REQUIRE YOUR AUTHORIZATION

Subject to applicable legal limitations, we may disclose your PHI without your written authorization for the following purposes:

  • Required by Law: When disclosure is required by federal, state, or local law.

  • Public Health Activities: Including reporting suspected child abuse, elder abuse, abuse of vulnerable adults, or preventing a serious threat to health or safety.

  • Law Enforcement and Judicial Proceedings: Including responding to court orders, warrants, subpoenas, or reporting crimes occurring on the premises.

  • Official Oregon Board Investigations: Formal investigations conducted by the Oregon Board of Licensed Professional Counselors and Therapists (OBLPCT) to ensure compliance with professional standards, legal requirements, and ethical obligations, including responding to complaints filed against a provider.

  • Specialized Government Functions: Including workers' compensation claims, military activities, or national security matters when authorized by law.

  • Appointment Reminders and Health-Related Communications: To contact you regarding appointments, scheduling, treatment alternatives, or other health-related services that may benefit your care.

V. YOUR RIGHTS WITH RESPECT TO YOUR PHI

Right to Request Restrictions

You have the right to request restrictions on certain uses or disclosures of your PHI for treatment, payment, or health care operations. While we will carefully consider every request, we are not required to agree to a requested restriction if doing so would interfere with your care or if HIPAA does not require us to honor it.

Requests should be submitted in writing to our Privacy Officer by mail, email, or delivered to our office.

Right to Restrictions for Out-of-Pocket Payments

If you pay for a service completely out of pocket, you may request that we not disclose information about that service to your health plan for payment or health care operations. We are required to honor such requests unless disclosure is otherwise required by law.

Right to Confidential Communications

You have the right to request that we communicate with you in a particular way (such as by cell phone only or at an alternate mailing address). We will accommodate all reasonable requests.

Right to Inspect and Receive Copies

With the exception of psychotherapy notes and certain other records excluded by law, you have the right to inspect and receive a paper or electronic copy of your medical record. We will generally provide access within 30 days and may charge a reasonable, cost-based fee as permitted by law.

Right to Request Amendment

If you believe information in your record is inaccurate or incomplete, you may request an amendment. If we deny your request, we will explain the reason for the denial in writing within the time required by law.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your PHI. This accounting will not include disclosures made for treatment, payment, health care operations, or disclosures you specifically authorized.

Right to Receive a Paper Copy

You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

VI. FILING A COMPLAINT

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Privacy Officer

James Boyda

Tel.: (971) 328-3919

Email: info@riverwoodpsych.com

U.S. Department of Health and Human Services

Centralized Case Management Operations

U.S. Department of Health and Human Services

200 Independence Avenue, S.W.

Room 509F, HHH Building

Washington, D.C. 20201

Phone (Toll-Free): (800) 368-1019

TDD: (800) 537-7697

Email: OCRComplaint@hhs.gov

Oregon Board of Licensed Professional Counselors and Therapists (OBLPCT)

3218 Pringle Road SE, Suite 120

Salem, OR 97302

Phone: (503) 378-5499

You may request a paper copy of this Notice of Privacy Practices at any time.

Telehealth Consultation & Electronic Communications Agreement

For purposes of this Agreement, Electronic Communications ("E-Communications") means any message transmitted electronically between you and the Practice, including email, SMS/text messages, secure messages submitted through the Practice website or client portal, and telehealth video conferencing platforms (such as Google Meet). These communications may include Protected Health Information ("PHI").

I. CONSENT TO TELEHEALTH

I understand that my provider may recommend telehealth services when clinically appropriate.

Telehealth uses secure interactive audio and/or video technology that allows me to communicate with my provider without being physically present in the same location.

I understand that telehealth may include:

  • Assessment

  • Diagnosis

  • Psychotherapy

  • Consultation

  • Care coordination

  • Education

  • Review of medical information

Benefits

Potential benefits include:

  • Increased access to care

  • Reduced travel time

  • Greater scheduling flexibility

  • Continuity of care

Risks

I understand that telehealth also carries risks, including:

  • Technical failures or interruptions

  • Reduced visual or audio quality

  • Unauthorized access despite reasonable security safeguards

  • Circumstances in which telehealth may not be clinically appropriate

My provider or I may discontinue a telehealth session if technical quality or clinical circumstances make continuation inappropriate.

If telehealth is not clinically appropriate, my provider may recommend in-person treatment or another level of care.

Telehealth Platform

The Practice currently utilizes Google Meet (or another HIPAA-compliant platform when appropriate) to conduct telehealth appointments.

To protect confidentiality, I agree:

  • Not to share meeting links with anyone who is not authorized to participate.

  • To participate from a private location whenever reasonably possible.

  • To inform my provider if another individual is present during the session.

Licensing

I understand that I must be physically located in a state where my therapist is legally authorized to practice at the time of each telehealth appointment unless otherwise permitted by law.

Emergencies

Telehealth is not an emergency service.

If I experience a medical or mental health emergency, I will:

  • Call 911

  • Go to the nearest emergency department

  • Call or text 988, the Suicide & Crisis Lifeline

II. ELECTRONIC COMMUNICATIONS

Authorization

By signing this Agreement, I authorize Riverwood Psychotherapy LLC to communicate with me electronically unless I revoke this authorization in writing.

Electronic communications may include:

  • Appointment scheduling

  • Appointment reminders

  • Billing notifications

  • Payment receipts

  • Customer service

  • Administrative requests

  • Practice announcements related to my care

  • Limited clinical communication when appropriate

Whenever clinically appropriate, therapeutic discussions should occur during scheduled appointments rather than through email or text messaging.

SMS Text Messaging Consent

The Practice may use SMS (text messaging) to communicate with you regarding appointment reminders, scheduling, billing, customer service, and other administrative matters related to the services we provide.

By signing this Agreement, you consent to receive SMS text messages from Riverwood Psychotherapy LLC.

Message frequency may vary. Standard message and data rates may apply depending on your mobile carrier.

You may opt out of receiving SMS text messages at any time by replying STOP to any text message from the Practice.

You may reply HELP for assistance or contact the Practice directly.

Choosing not to receive text messages will not affect your ability to receive treatment; however, the Practice may communicate with you through other available methods.

Mobile Privacy

Your mobile phone number and SMS consent information will not be shared with third parties or affiliates for marketing or promotional purposes.

The Practice uses SMS communications solely for purposes related to your treatment and administrative services.

If you wish to update or remove your electronic contact information, you may contact the Practice by phone, email, or written request.

Risks of Electronic Communications

Although the Practice uses HIPAA-compliant technologies whenever reasonably possible, electronic communications carry inherent risks.

These include:

  • Unauthorized interception

  • Misdirected communications

  • Device theft or unauthorized access

  • Email or text messages stored on third-party servers

  • Technical failures, malware, phishing attacks, or service interruptions

No electronic communication system can be guaranteed completely secure.

By choosing electronic communication, I acknowledge these inherent risks.

Client Responsibilities

To help protect my privacy, I agree to:

  • Maintain a current email address and mobile phone number.

  • Promptly notify the Practice of changes to my contact information.

  • Secure my devices using passwords, biometric authentication, or encryption whenever available.

  • Avoid sending highly sensitive clinical information through standard email or text messaging whenever possible.

  • Notify the Practice if I believe my email account or mobile device has been compromised.

I understand that electronic communications may become part of my permanent medical record.

III. EMERGENCY COMMUNICATIONS

DO NOT USE EMAIL, TEXT MESSAGES, WEBSITE MESSAGES, OR TELEHEALTH FOR EMERGENCIES.

Electronic communications are not monitored continuously, and the Practice cannot guarantee an immediate response.

If I require urgent assistance, I will:

  • Call 911

  • Go to the nearest emergency department

  • Call or text 988

IV. HIPAA & PRIVACY

The Practice complies with HIPAA, the HITECH Act, and applicable Oregon confidentiality laws.

I understand and agree that:

  • Electronic communications may be used for scheduling, billing, payment, administrative requests, appointment reminders, and care coordination.

  • The Practice will use HIPAA-compliant technologies whenever reasonably available.

  • Electronic communications may become part of my permanent medical record.

  • I may request access to my protected health information in accordance with HIPAA and Oregon law.

  • Reasonable, cost-based fees permitted by law may apply for copies of records.

V. REVOCATION

I may revoke my consent for electronic communications at any time by providing written notice to the Practice.

Revocation will not affect communications previously sent before the Practice received my request.

The Practice may discontinue electronic communications if necessary to protect confidentiality, maintain security, or comply with applicable law.

VI. ACKNOWLEDGMENT

By signing below, I acknowledge that:

  • I have read and understand this Consent for Telehealth Consultation & Electronic Communications Agreement.

  • I understand the benefits and risks of telehealth services.

  • I understand the risks associated with electronic communications.

  • I consent to receive telehealth services when clinically appropriate.

  • I authorize Riverwood Psychotherapy LLC to communicate with me electronically, including by email, SMS/text messaging, and secure messages submitted through the Practice website or client portal, subject to the terms of this Agreement.

  • I understand that I may opt out of SMS messages at any time by replying STOP.

  • I understand that I may revoke my consent for electronic communications at any time by providing written notice to the Practice.