HIPAA Notice of Privacy Practices

Effective date: August 23, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. My commitment

Health information about you and your care is personal, and I am committed to protecting it. I keep a record of the care I provide. This notice applies to the health information I maintain about you as part of this practice, and it explains how I may use your health information, when I may share it, and what rights you have.

II. How I may use and share your health information

For treatment

I use your health information to provide your care, and I may share it with other professionals involved in your treatment. For example, if I consult your primary care physician or therapist about your care, I may share relevant information to support your diagnosis and treatment.

For payment

I use and share your health information to bill and receive payment for the services I provide. For example, I may use diagnosis and service information to prepare your statements, superbills, or claims for out-of-network reimbursement. 

For health care operations

I use and share your health information as needed to run this practice and improve the care I provide. For example, I may use health information for quality review, practice administration, or maintaining the systems used to provide your care. 

III. Uses and disclosures that require your written authorization

  • Psychotherapy notes. If I maintain separate psychotherapy notes as defined by HIPAA, most uses and disclosures of those notes require your written authorization.

  • Marketing and sale of health information. Most uses and disclosures for marketing, and any disclosure that would be a sale of your health information, require your written authorization.

Any other use or disclosure not described in this notice will be made only with your written authorization.

IV. Uses and disclosures that do not require your authorization

Subject to applicable law, I may use or share your health information without your authorization:

  • When required by state or federal law, limited to what the law requires.

  • For public health and safety, including reporting suspected child, elder, or dependent adult abuse, and to prevent or lessen a serious threat to health or safety.

  • For health oversight activities, such as audits and investigations authorized by law.

  • For judicial and administrative proceedings, including in response to a court or administrative order, subpoena, or other lawful process, as permitted or required by law.

  • For law enforcement purposes, as permitted or required by law.

  • To coroners, medical examiners, and funeral directors carrying out duties authorized by law.

  • For organ and tissue donation purposes, where applicable.

  • For research, subject to applicable legal requirements.

  • For specialized government functions, such as military service, national security, or protective services.

  • For workers' compensation purposes, as required by law.

In all cases, including those listed above, if I have substance use disorder patient records about you that are subject to 42 CFR part 2, I cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena.

V. Sharing with family, friends, and others involved in your care

I may share limited health information with a family member, friend, or other person involved in your care or payment for your care when you agree, do not object, or when otherwise permitted by law. If you are unable to express a preference, I may share limited relevant information when permitted by law and when I believe it is in your best interest. In an emergency or disaster, I may also share limited information as permitted by law to help locate or notify someone involved in your care.

VI. Your rights

Get a copy of your health information. You can ask to see or receive an electronic or paper copy of your medical record and other health information I hold about you. I will provide a copy, or a summary if you agree to one, within the time required by applicable law. I may charge a reasonable, cost-based fee as permitted by law. If I deny your request in a case where review is available, you may ask to have the denial reviewed by a licensed health care professional who was not involved in the original decision. If I do not hold the information you are asking for and I know where it is, I will tell you where to direct your request.

Ask me to correct your health information. If you believe your health information is incorrect or incomplete, you can ask me in writing to amend it. I will respond in writing within the time required by law. I may deny your request, for example if the information is accurate and complete, if it is not part of the records I maintain, or if it was created by someone else who remains available to act on your request. If I deny it, I will explain why in writing, and you may submit a statement of disagreement to be kept with your record.

Ask me to limit what I use or share. You can ask me not to use or share certain health information for treatment, payment, or my operations. I am not required to agree to your request.

Restrict information about services you pay for in full. If you pay for a service entirely out of pocket, you can ask me not to share information about that service with your health plan for payment or my operations. I will agree unless the law requires me to share it.

Choose how I contact you. You can ask me to contact you in a specific way or at a different address. I will accommodate reasonable requests.

Revoke an authorization. If you have given me written authorization for a use or disclosure, you can revoke it in writing at any time. Revocation takes effect when I receive it and does not affect actions already taken in reliance on it. 

Get a list of those with whom I have shared your information. You can ask for an accounting of certain disclosures of your health information for the prior six years. Some disclosures are not included, as provided by law. I will respond within the time required by law. The first request in any 12-month period is free; additional requests may involve a reasonable fee.

Get a copy of this notice. You can ask for a paper or electronic copy of this notice at any time, even if you agreed to receive it electronically.

VII. My responsibilities

I am required by law to:

  • Maintain the privacy and security of your health information.

  • Provide you with this notice of my legal duties and privacy practices.

  • Follow the terms of the notice currently in effect.

  • Let you know promptly if a breach occurs that may have compromised the privacy or security of your health information.

I may change this notice, and any change will apply to all health information I maintain. The current version is available at nickwelshmd.com/notice-of-privacy-practices and on request.

VIII. Questions and complaints

For questions about this notice or your privacy rights, or to file a complaint, contact:

Nick Welsh, MD, Privacy Officer
1 Sansome Street, Suite 1400-A1029, San Francisco, CA 94104
office@nickwelshmd.com | 415-737-9911 

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: 

By mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201
By phone: 1-877-696-6775
Online: hhs.gov/hipaa/filing-a-complaint

I will not retaliate against you for filing a complaint.

IX. California law

California law, including the Confidentiality of Medical Information Act, provides additional protections for health information. For example, certain requests for information specifically relating to your participation in outpatient treatment with a psychotherapist require the person or entity making the request to submit a written request to you and to me before I may release the information. California law may also limit a parent's or other personal representative's access to a minor's records in certain circumstances, and it restricts certain disclosures to out-of-state individuals, entities, and agencies of information related to abortion and abortion-related care that is lawful in California. I follow applicable California law when it provides greater protection than federal law.