NOTICE OF PRIVACY PRACTICES
Rebeca Gilbert Counseling
Karis Counseling, LLC
Original Effective Date: February 7, 2022
Revised Effective Date: September 28, 2026
Privacy Contact: Rebeca Gilbert
Email: hello@rebecagilbert.com
Phone: 407-205-8303
YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES.
This notice describes how health information about you may be used and disclosed, how you can access this information, and your rights regarding your protected health information. Please review it carefully.
Rebeca Gilbert Counseling / Karis Counseling, LLC (“the Practice”) is committed to protecting the privacy and confidentiality of your health information.
This Notice describes how your protected health information (“PHI”) may be used and disclosed, your rights regarding your PHI, and the Practice’s responsibilities under the Health Insurance Portability and Accountability Act (“HIPAA”) and other applicable federal and state privacy laws.
This Notice applies to health records created or maintained by the Practice.
YOUR RIGHTS
You have certain rights regarding your health information.
Access your health information
You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information maintained about you.
Generally, a copy or summary will be provided within the time required by law. A reasonable, cost-based fee may be charged when permitted by law.
Certain information, including psychotherapy notes as defined by HIPAA, is not subject to the same right of access.
Ask to correct your health information
You may ask the Practice to correct health information that you believe is incorrect or incomplete.
Your request may be denied when permitted by law. If your request is denied, you will be provided an explanation in writing.
Request confidential communications
You may ask the Practice to contact you in a specific way or at a specific location. Reasonable requests will be accommodated.
Ask to limit uses or disclosures
You may ask the Practice not to use or disclose certain PHI for treatment, payment, or health care operations. The Practice generally is not required to agree to your request.
If you pay for a health care service out-of-pocket in full and request that information about that service not be disclosed to your health plan for payment or health care operations, the Practice will honor that request unless disclosure is required by law.
Get a list of certain disclosures
You may request an accounting of certain disclosures of your PHI made during the six years before your request.
The accounting generally will not include disclosures for treatment, payment, or health care operations or certain other disclosures excluded by law.
One accounting will be provided during a 12-month period without charge. A reasonable, cost-based fee may apply to additional requests during the same period.
Get a copy of this Notice
You may request a paper or electronic copy of this Notice at any time.
Choose someone to act for you
If someone has legal authority to act on your behalf, that person may exercise your rights regarding your health information as permitted by law.
The Practice may verify that person's authority before taking action.
Revoke an authorization
If you provide written authorization for the use or disclosure of your PHI, you may generally revoke that authorization in writing at any time.
Revocation will not affect actions already taken in reliance on your authorization.
File a complaint
If you believe your privacy rights have been violated, you may contact the Practice using the information provided at the end of this Notice.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
The Practice will not retaliate against you for filing a complaint.
YOUR CHOICES
Family, friends, and others involved in your care
You may tell the Practice whether relevant health information may be shared with a family member, close friend, or another person involved in your care or payment for your care.
Mental health information may receive additional protections under state law. Information will be disclosed only as permitted by applicable federal and state law.
Marketing, testimonials, and reviews
The Practice will not use or disclose your PHI for marketing purposes when written authorization is required by law unless you provide that authorization.
If the Practice requests permission to publicly use a testimonial, review, endorsement, or other statement that identifies you as a client or reveals PHI, any authorization required by law will be obtained before the information is used.
You may generally revoke an authorization in writing, subject to actions already taken in reliance upon it.
Sale of PHI
The Practice does not sell your PHI.
Fundraising
The Practice does not use your PHI for fundraising communications.
HOW YOUR HEALTH INFORMATION MAY BE USED OR DISCLOSED
Treatment
Your health information may be used and, when legally permitted, disclosed to provide, coordinate, or manage your treatment.
For example, information may be shared with another health care professional involved in your care when permitted by applicable federal and state confidentiality laws.
Payment
PHI may be used and disclosed as necessary to obtain payment for services, including billing, claims, benefits, or payment processing when applicable.
Health Care Operations
PHI may be used and disclosed as necessary to operate the Practice and provide quality care, including appropriate administrative, practice-management, legal, compliance, and quality-assurance activities.
Appointment reminders and treatment-related communications
Your contact information and PHI may be used to communicate with you about appointments, scheduling, billing, treatment-related matters, treatment alternatives, or other health care services.
You may request reasonable restrictions regarding how the Practice communicates with you.
Abuse, neglect, health, and safety
The Practice may use or disclose PHI when permitted or required by law, including circumstances involving suspected abuse or neglect, mandatory reporting obligations, or a serious threat to the health or safety of you or another person.
Legal and regulatory requirements
The Practice may use or disclose PHI when permitted or required by applicable federal or state law. This may include certain:
Court orders, subpoenas, or other lawful legal proceedings;
Health oversight, licensing, audit, or regulatory activities;
Mandatory reporting requirements;
Law enforcement requests when disclosure is legally permitted or required; and
Workers' compensation matters when applicable.
Mental health records and communications may receive protections beyond those provided by HIPAA. The Practice will comply with applicable confidentiality and privilege laws.
Other uses and disclosures permitted or required by law
The Practice may use or disclose PHI in other limited circumstances when permitted or required by federal or state law.
Such disclosures will be limited to what is permitted or required by applicable law.
PSYCHOTHERAPY NOTES
The Practice may maintain psychotherapy notes as that term is defined under HIPAA. Psychotherapy notes receive additional protection under federal law and are maintained separately from the remainder of the medical record when they meet the legal definition of psychotherapy notes.
In most circumstances, your written authorization is required before psychotherapy notes may be used or disclosed.
Authorization generally is not required for certain limited purposes permitted by law, including:
Use by the originator of the notes for your treatment;
Certain training or supervision activities permitted by law;
Defending the Practice or therapist in a legal action or proceeding brought by you;
Certain health oversight activities;
Uses or disclosures required by law;
Activities authorized by the U.S. Department of Health and Human Services to investigate HIPAA compliance; or
Uses or disclosures necessary to prevent or lessen a serious and imminent threat to health or safety when permitted by law.
STATE-SPECIFIC PRIVACY AND CONFIDENTIALITY PROTECTIONS
The Practice provides professional counseling services to clients located in Florida, Georgia, and Colorado.
HIPAA establishes federal privacy protections. State law may provide additional or more stringent protections concerning mental health records, confidential communications, privilege, disclosure, access to records, mandatory reporting, or other privacy matters.
When applicable state law provides greater privacy protection or greater individual rights than HIPAA, the Practice will comply with the more protective applicable requirement.
The law applicable to your care may depend on the state in which you are located when services are provided.
Florida Clients
Communications between a mental health professional licensed or certified under Chapter 491, Florida Statutes, and the professional's patient or client are confidential.
Florida law provides limited circumstances in which that privilege may be waived or disclosure may be required or permitted, including written authorization by the client, certain legal proceedings involving the professional, mandatory reporting obligations, and certain specific threats of serious bodily injury or death.
The Practice will comply with applicable Florida confidentiality, privilege, record, and mandatory reporting requirements.
Georgia Clients
For clients receiving services while located in Georgia, the Practice will comply with applicable Georgia laws governing the confidentiality and privilege of professional counseling records and communications, access to records, mandatory reporting, and disclosures required or permitted by law.
When applicable Georgia law provides greater privacy protection than HIPAA, the Practice will follow the more protective requirement.
Colorado Clients
For clients receiving services while located in Colorado, the Practice will comply with applicable Colorado laws governing the confidentiality and privilege of professional counseling records and communications, access to records, mandatory reporting, and disclosures required or permitted by law.
When applicable Colorado law provides greater privacy protection than HIPAA, the Practice will follow the more protective requirement.
SUBSTANCE USE DISORDER RECORDS — 42 CFR PART 2
Certain records relating to substance use disorder (“SUD”) treatment may receive additional confidentiality protections under federal law, including 42 CFR Part 2.
To the extent the Practice creates, receives, or maintains SUD patient records protected by Part 2, those records will be used and disclosed only as permitted by applicable law.
Records protected by Part 2, or testimony describing information contained in those records, generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide the consent required by law or the use or disclosure is authorized by an appropriate court order and subpoena or other legal mandate satisfying applicable Part 2 requirements.
When Part 2 applies, additional requirements may govern the use and disclosure of SUD records, consent, redisclosure, breach notification, fundraising communications, and other privacy rights.
Nothing in this Notice is intended to represent that all records maintained by the Practice are Part 2 records or that the Practice is a Part 2 program.
THE PRACTICE'S RESPONSIBILITIES
The Practice is required by law to:
Maintain the privacy and security of your protected health information;
Follow the duties and privacy practices described in the Notice currently in effect;
Provide you with this Notice describing its legal duties and privacy practices;
Notify you promptly if a breach occurs that may have compromised the privacy or security of your information; and
Comply with applicable federal and state privacy and confidentiality laws.
The Practice will not use or disclose your PHI other than as described in this Notice unless you authorize the use or disclosure in writing or the use or disclosure is otherwise permitted or required by law.
If you provide written authorization, you may generally revoke that authorization in writing at any time, subject to actions already taken in reliance upon it.
CHANGES TO THIS NOTICE
The Practice reserves the right to change the terms of this Notice and its privacy practices as permitted by law.
Changes may apply to PHI already maintained by the Practice as well as information received in the future.
When this Notice is materially revised, the current Notice will be available upon request and on the Practice's website.
QUESTIONS OR COMPLAINTS
If you have questions about this Notice, wish to exercise one of your privacy rights, or believe your privacy rights have been violated, please contact:
Rebeca Gilbert, LPC, LMHC
Rebeca Gilbert Counseling / Karis Counseling, LLC
Email: hello@rebecagilbert.com
Phone: 407-205-8303
You may also file a complaint with:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
The Practice will not retaliate against you for filing a complaint.
Original Effective Date: February 7, 2022
Revised Effective Date: September 28, 2026
This revised Notice supersedes the prior version effective February 7, 2022.