THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: September 28, 2026.

This Notice applies to Toolbox Counseling and to every therapist and staff member of the practice. It describes our legal duties and privacy practices concerning protected health information — the individually identifiable information we create or receive about your health, your care, and payment for your care.

  • Utah law is stricter than federal law, and where it is, Utah law controls. This Notice describes what federal law permits. Utah Code § 58-60-114 prohibits a mental health therapist from disclosing confidential communications with a client without the client's express written consent, subject to specific exceptions. Several disclosures that federal law would permit — for example, many disclosures for the health care operations of another provider, or disclosures to family members without your agreement — we do not make, because Utah law does not allow us to. Section 3 of the Client Services Agreement describes the Utah rules in detail and is the more accurate description of our actual practice.

HOW WE MAY USE AND DISCLOSE YOUR INFORMATION WITHOUT YOUR WRITTEN AUTHORIZATION

Treatment

Federal law permits us to use and disclose your information to provide, coordinate, or manage your care. Example: a covered entity may send a treatment summary to a patient's primary care physician so that medication and therapy are coordinated.

Utah law is narrower, and we follow Utah law. We obtain your written consent before sharing your confidential communications with another provider, including for treatment. So although this category appears under the heading above, in practice Toolbox Counseling treats it as requiring your authorization.

Payment

We may use and disclose your information to bill and collect payment for services. Example: we may send your health plan the dates of your sessions, the service codes, and your diagnosis so that a claim can be paid. If you pay for a service in full yourself and ask us not to bill your plan for it, we will honor that request.

Health Care Operations

We may use and disclose your information for our own operations — quality review, staff training, business management, and administrative activities. Example: we may review our own records to confirm that our documentation meets professional standards.

Business Associates

We use outside vendors to operate the practice, including our electronic health record, client portal, billing service, payment processor, telehealth platform, secure messaging, answering service, and professional advisors. Each has signed a written agreement requiring it to protect your information, to use it only for the purposes we specify, to report any breach, and to impose the same obligations on its own subcontractors. 

Appointment Reminders

We may contact you to remind you of an appointment, by the method you have authorized in Section 5 of the Client Services Agreement. You may tell us at any time to stop, or to use a different method, and we will.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your information without your authorization in these circumstances:

  • When required by law, including the reports described below.

  • Suspected child abuse or neglect. Required. Utah Code § 80-2-602.

  • Suspected abuse, neglect, or exploitation of a vulnerable adult. Required. Utah Code § 26B-6-205.

  • A communicated threat of physical violence against an identifiable person. We must warn the person and notify law enforcement. Utah Code § 78B-3-502.

  • Communicable disease reporting to public health authorities. Utah Code § 26B-7-206.

  • To prevent a serious and imminent threat to your health or safety or that of another person, to someone able to help.

  • Judicial and administrative proceedings, in response to a court order. We do not release records in response to a subpoena alone; see the Client Services Agreement.

  • Health oversight activities, such as an investigation by the Division of Professional Licensing.

  • Workers' compensation, as authorized by law.

  • Coroners, medical examiners, and funeral directors, as authorized by law.

  • Specialized government functions, such as military and national security activities, as authorized by law.

  • To defend ourselves in a legal or licensing action you bring against us.

Example of a required disclosure: if you tell your therapist that a child you live with is being physically abused, your therapist must report it immediately, and cannot agree to keep it confidential.

USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION

Any use or disclosure not described above will be made only with your written authorization. That includes, always:

  • Psychotherapy notes. Your therapist's separate process notes are not released for treatment, payment, or health care operations without a separate, standalone written authorization from you. 45 C.F.R. § 164.508(a)(2). Your health plan may not condition payment on your providing it.

  • Marketing. We do not use your information for marketing.

  • Sale of information. We do not ever sell your information.

  • You may revoke an authorization at any time, in writing. Revocation stops future disclosures; it cannot undo a disclosure we already made in reliance on it.

YOUR RIGHTS

You have the right to:

  • Inspect and obtain a copy of your record. Generally, within 30 days, with one possible 30-day extension of which we would notify you in writing. We may charge a limited, cost-based fee. You may ask for an electronic copy and for delivery to a person you designate. 45 C.F.R. § 164.524. Parents of a minor child, see below.

  • Request an amendment to your record if you believe it is inaccurate or incomplete. If we deny the request, we will tell you why in writing, and you may submit a statement of disagreement that becomes part of your record. 45 C.F.R. § 164.526.

  • Receive an accounting of certain disclosures we have made in the six years before your request, other than disclosures for treatment, payment, and operations, disclosures you authorized, and a few other categories. 45 C.F.R. § 164.528.

  • Request restrictions on how we use or disclose your information. We are not required to agree to every request, with one exception: if you pay for a service in full yourself, you may require us not to disclose information about that service to your health plan, and we must comply. 45 C.F.R. § 164.522(a)(1)(vi).

  • Request confidential communications — that we contact you at a particular phone number, address, or by a particular method. We will accommodate reasonable requests, and we will not ask you why.

  • Receive a paper copy of this Notice on request, even if you agreed to receive it electronically.

  • Be notified if a breach occurs that compromises the privacy or security of your information.

  • Complain — see below — without retaliation.

Parents and Minor Children

Under Utah Code § 26B-2-244, effective May 6, 2026, a parent has the right to obtain and access the medical records of the parent's child, at no charge and within five business days of the request, unless the parent's rights have been terminated, the child is emancipated or legally married, a court order provides otherwise, or the record relates to sexual assault counseling under Utah Code § 77-38-204. There is no general mental health exception to this right. Section 3 of the Client Services Agreement explains what this means for adolescent clients and how we handle it.

OUR DUTIES

Toolbox Counseling is required by law to:

  • maintain the privacy and security of your protected health information;

  • give you this Notice of our legal duties and privacy practices, and abide by the terms of the Notice currently in effect;

  • notify you if a breach occurs that compromises the privacy or security of your information; and

  • obtain your written acknowledgment that you received this Notice.

This Notice is posted in a clear and prominent location in our office, copies are available for you to take, and it is posted on our website.

We reserve the right to change this Notice and to make the revised Notice effective for information we already hold as well as information we create in the future. If we make a material change, we will post the revised Notice in our office and on our website, make copies available on request, and provide it to you.

INFORMATION WE RECEIVE FROM OTHERS MAY BE RESTRICTED

Information disclosed to a third party under this Notice may be redisclosed by the recipient and may no longer be protected by federal privacy law.

If we receive records from a substance use disorder treatment program covered by 42 C.F.R. Part 2, those records — and any information we take from them — may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you have given written consent or a court has ordered it after notice and an opportunity for you to be heard. Toolbox Counseling is not itself a Part 2 program.

COMPLAINTS

If you believe your privacy rights have been violated, please tell us. You may file a complaint with:

Toolbox Counseling — Privacy Officer

Alexis Kattelman, CMHC

Address: 138 E 12300 S Unit 825 Draper, Utah 84020

Phone: 801-448-7620

Email: info@toolboxcounseling.org

You may also file a complaint with the federal government:

U.S. Department of Health and Human Services

Office for Civil Rights

Address: 200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201

Phone: 1-877-696-6775

Online: www.hhs.gov/ocr/privacy/hipaa/complaints/

Complaints to OCR generally must be filed within 180 days of when you knew or should have known of the violation.

We will not retaliate against you in any way for filing a complaint.

QUESTIONS

For more information about this Notice or our privacy practices, contact Alexis Kattelman, CMHC at 801-448-7620 or info@toolboxcounseling.org.

ACKNOWLEDGMENT OF RECEIPT

You are not asked to sign this Notice. Your receipt of it is acknowledged on the signature page of the Client Services Agreement, which is the single document you sign at intake. If you would like a separately signed acknowledgment, ask and we will provide one.

Notice of Privacy Practices