Notice of Privacy Practices
How your protected health information may be used and disclosed, and your rights under HIPAA and California’s Confidentiality of Medical Information Act (CMIA). Effective May 1, 2026. Last updated May 1, 2026.
Notice of Privacy Practices Sections
1. Our Obligations
Pasadena Clinical Group is required by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and the California Confidentiality of Medical Information Act (CMIA, Civil Code § 56 et seq.) to maintain the privacy and security of your protected health information (PHI). We are required to provide you with this Notice of Privacy Practices, which describes how we may use and disclose your PHI and your rights regarding that information. We are required to abide by the terms of the Notice currently in effect. In several important respects, the CMIA provides protections that are stricter than HIPAA; where applicable, we adhere to the standard that affords the greatest protection for your PHI.
2. Uses and Disclosures of Protected Health Information
We may use and disclose your PHI for the following purposes without your written authorization, as permitted or required by law:
Treatment: We may use and disclose your PHI to provide, coordinate, and manage your mental health care and related services. This includes consultation between our therapists, coordination with other healthcare providers involved in your care (such as your primary care physician or psychiatrist), and referral management. For example, a group therapist may consult with an individual therapist within our Practice regarding your treatment plan.
Payment: We may use and disclose your PHI to obtain payment for the services we provide to you. This includes verifying your insurance eligibility and benefits, submitting claims to your health plan, responding to requests for additional clinical information from your insurer, and managing billing and collections. We limit disclosures to the minimum necessary information required by the insurer for payment purposes.
Healthcare Operations: We may use and disclose your PHI for our internal business operations, including quality assessment and improvement activities, training of clinical staff and trainees, licensing and credentialing, compliance audits, and business planning and development. We may also disclose PHI to our Business Associates (entities that perform services on our behalf, such as electronic health record vendors, billing services, and legal counsel) who have signed HIPAA-compliant Business Associate Agreements (BAAs).
Required by Law: We will disclose your PHI when required to do so by federal, state, or local law, including but not limited to mandatory reporting obligations under California law (see our Treatment Consent for mandatory reporting exceptions to confidentiality).
Public Health and Safety: We may disclose PHI to public health authorities for the purpose of preventing or controlling disease, injury, or disability; to report adverse events; and to report abuse or neglect as mandated by law.
Health Oversight Activities: We may disclose PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure actions.
Judicial and Administrative Proceedings: We may disclose PHI in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process, after making reasonable efforts to notify you as described in our Treatment Consent.
Law Enforcement: We may disclose PHI to law enforcement officials for certain purposes, such as complying with mandatory reporting requirements, responding to a court order or grand jury subpoena, and, in limited circumstances, to identify or locate a suspect, fugitive, material witness, or missing person.
Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to coroners and medical examiners for identification purposes, determining cause of death, or performing other duties authorized by law.
Serious Threat to Health or Safety: Consistent with applicable law and standards of ethical conduct, we may disclose PHI if we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, including as required under California’s Tarasoff duty-to-warn law (Civil Code § 43.92).
Other Uses Requiring Authorization: Any use or disclosure of your PHI for purposes not described in this Notice — including, but not limited to, the sale of PHI, use of PHI for marketing purposes, and disclosure of psychotherapy notes (as defined by HIPAA) — will be made only with your written authorization. You may revoke your authorization in writing at any time, except to the extent that we have already acted in reliance upon it.
3. California-Specific Protections
Under the California Medical Information Act (CMIA, Civil Code § 56 et seq.), patients are afforded additional rights and protections beyond those provided by HIPAA. Under CMIA, we are prohibited from disclosing your medical information without your written authorization, except as specifically permitted by law. CMIA imposes specific requirements for authorization forms, including the mandate that authorizations for the release of medical information be printed in at least 14-point type and contain specific language regarding the patient’s right to receive a copy.
Under California Health & Safety Code § 123100, you have the right to inspect and receive a copy of your medical records. We may charge a reasonable fee for copies, not to exceed the amount permitted by California law (currently $0.25 per page for paper copies, or actual cost for electronic copies). Under CMIA, we must provide copies within fifteen (15) days of receiving your written request.
Under California Welfare & Institutions Code § 5328, mental health records are afforded heightened confidentiality protections. Disclosure of mental health records without your written consent is permissible only in specific circumstances enumerated by statute, including mandatory reporting situations, court-ordered disclosures, and communications between qualified professionals for the purposes of diagnosis and treatment. You may also have the right to designate that certain information not be disclosed even in treatment coordination contexts.
Under HIPAA, psychotherapy notes receive special protection and are maintained separately from the rest of your clinical record. We will not disclose psychotherapy notes without your specific written authorization, except in very limited circumstances (such as for use by the originating therapist in treatment, for our own supervised training programs, or for defense in a legal proceeding brought by you).
4. Your Rights Regarding Protected Health Information
Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI contained in your designated record set (such as your clinical and billing records). We may deny your request in certain limited circumstances, including if a licensed health care professional determines that access is reasonably likely to endanger your life or physical safety or cause substantial harm to another person. If access is denied, you have the right to have the denial reviewed by a licensed healthcare professional designated by the Practice who was not involved in the original decision.
Right to Amend: If you believe that the PHI we maintain about you is incorrect or incomplete, you have the right to request an amendment. We may deny your request if we determine that the PHI is accurate and complete, was not created by us (unless the original source is no longer available), is not part of the designated record set, or is not information you are permitted to inspect. If we deny your request, you may submit a written statement of disagreement, which will be included in your record.
Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your PHI that we have made for purposes other than treatment, payment, or healthcare operations, or disclosures made pursuant to your authorization. The accounting will cover a period of up to six (6) years prior to the date of your request.
Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to a requested restriction, except in the case of a request to restrict disclosures to a health plan for payment or healthcare operations purposes when the services have been paid for in full out-of-pocket. If we agree to a restriction, we will comply with it unless the PHI is needed to provide emergency treatment.
Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI at an alternative address or by an alternative method (e.g., sending communications to a P.O. Box rather than a home address, or contacting you only by phone rather than by email). We will accommodate reasonable requests.
Right to Receive a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice of Privacy Practices upon request, even if you have agreed to receive it electronically.
Right to Be Notified of a Breach: You have the right to be notified in the event of a breach of your unsecured PHI, as required by HIPAA and California law (Civil Code § 1798.82).
5. Our Duties
We are required by law to: (a) maintain the privacy of your PHI and provide you with this Notice of our legal duties and privacy practices; (b) notify you in the event of a breach of your unsecured PHI; (c) abide by the terms of this Notice currently in effect; and (d) make a good-faith effort to obtain a written acknowledgment of receipt of this Notice from you. We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that we maintain. If we make material changes, we will post the revised Notice on our website and make paper copies available at our office. We will also provide a copy of the revised Notice to active patients at their next appointment or upon request.
6. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), at 200 Independence Avenue SW, Washington, D.C. 20201, or by calling 1-800-368-1019, or via the OCR complaint portal at www.hhs.gov/ocr. You may also file a complaint with the California Department of Public Health (CDPH) at P.O. Box 997377, MS 0500, Sacramento, CA 95899-7377, or by calling (916) 558-1784.
We will not retaliate against you for filing a complaint. You will not be denied services, charged differently, or otherwise discriminated against for exercising your rights under HIPAA or California law.
7. Informational Summary; Not Legal or Medical Advice
This Notice summarizes selected provisions of HIPAA, CMIA, and related California laws governing the use and disclosure of protected health information. It is not legal advice, is not a complete recitation of all applicable law, and may not address every situation. The official text of HIPAA, the HHS regulations at 45 CFR Parts 160 and 164, and the cited California statutes control over any inconsistency with this summary. Nothing on this page is medical or mental-health advice, diagnosis, or treatment, and the contents of this Notice may not be used to self-diagnose or self-treat any condition.
8. Limitation of Liability; Released Parties; Force Majeure
To the fullest extent permitted by law (and without diminishing any non-waivable obligation under HIPAA, CMIA, or other applicable law), Pasadena Clinical Group and each of its parent companies, subsidiaries, affiliates, owners, members, managers, partners, officers, directors, shareholders, supervising clinicians, employees, independent contractors, 1099 clinicians, supervisees, interns, post-doctoral fellows, externs, trainees, students, volunteers, peer-support workers, administrative staff, vendors, agents, attorneys, accountants, insurers, indemnitors, successors, and assigns (collectively, the “Released Parties”) shall not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages arising out of or relating to (a) Force Majeure events; (b) sophisticated third-party criminal activity, including ransomware, phishing, or theft; (c) the patient’s own use of unsecured channels (such as standard email or unencrypted messaging) after being warned of their risks; or (d) the conduct of third parties (including business associates, payors, courts, and law-enforcement agencies) operating outside the Released Parties’ control. Each Released Party is an intended third-party beneficiary of this limitation of liability and is entitled to enforce it directly.
9. Mandatory Pre-Suit Notice, Mediation, and Binding Individual Arbitration
Without waiving any patient’s right to file a complaint with the HHS Office for Civil Rights, the California Attorney General, the California Department of Public Health, or any other governmental authority (which rights are expressly preserved), any other dispute arising out of or relating to this Notice or our handling of PHI shall be resolved by: first, written notice and sixty (60) days of good-faith negotiation; second, non-binding mediation administered by JAMS (or, by mutual agreement, by the AAA) in Los Angeles County, California; and third, if not resolved, final and binding individual arbitration administered by JAMS pursuant to the JAMS Comprehensive (or Streamlined) Arbitration Rules & Procedures and the JAMS Consumer Minimum Standards (or, by mutual agreement, by the AAA), in Los Angeles County, California, before a single neutral arbitrator, governed by the Federal Arbitration Act and the California Arbitration Act. The parties expressly waive any right to a jury trial and any right to participate in any class, collective, mass, consolidated, representative, or private-attorney-general action (other than as expressly preserved by non-waivable statute). Detailed dispute-resolution terms are set forth in our Terms & Conditions, incorporated by reference.
10. Contact Information
For questions about this Notice of Privacy Practices or to exercise your rights: