TeleHealthNP Notice of Privacy Practices
Effective date: September 1, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice applies to TeleHealthNP, LLC, doing business as TeleHealthNP, and its workforce when providing healthcare in Oregon, Washington, and Arizona. It covers protected health information (“PHI”), including electronic, paper, and spoken information. Independent pharmacies, laboratories, and other providers may have their own notices.
Questions or requests: Contact our Privacy Officer, Debra Johnson, at 602-810-0868, telehealthnp@telehealthnp.net, or 4910 SE 138th Ave, Portland, OR 97236. You may ask to discuss this Notice or request a paper copy at any time.
Your Rights
See or obtain your records
You may request access to or copies of medical and billing information in our designated record set, including records maintained for us in SimplePractice. Contact our Privacy Officer to make a request. We may ask you to put it in writing and verify your identity. We will provide the requested form and format when readily producible, including electronic copies where applicable, or work with you on an acceptable alternative.
We generally act within 30 days. If HIPAA permits an extension, we may take one additional 30-day period after giving you written reasons and a completion date within the original period. A shorter applicable state deadline controls. We may charge only fees allowed by law, and will explain any charge in advance. If we deny access, we will explain the reason and any right to review. Some information, including separately maintained psychotherapy notes, is excluded from the HIPAA access right.
Request an amendment
If information is inaccurate or incomplete, submit a written amendment request and your reason to our Privacy Officer. We generally respond within 60 days; a permitted extension of up to 30 days requires written notice. We may deny a request on grounds allowed by law, such as when the record is accurate and complete. If denied, we will explain how to submit a statement of disagreement and how it may accompany the disputed information.
Request confidential communications
You may ask us to contact you at a different address or by a particular method, such as by telephone instead of email. We will accommodate reasonable requests. Tell our Privacy Officer how and where to reach you safely. We will not require you to explain why you are making the request, although we may need information about how payment will be handled and an alternative contact method.
Request limits on uses or disclosures
You may ask us to restrict uses or disclosures for treatment, payment, healthcare operations, or involvement of others in your care. We do not have to agree to every request. If we agree, we follow the restriction except where law permits otherwise, such as necessary emergency treatment.
If you or someone other than your health plan pays for a particular item or service in full, you may require us not to disclose information solely about that item or service to your health plan for payment or healthcare operations, unless disclosure is required by law. Tell us before the disclosure occurs. This restriction does not automatically bind a pharmacy, laboratory, or another provider; contact them separately if needed.
Obtain an accounting of disclosures
You may request an accounting of certain disclosures during the six years before your request. It generally excludes treatment, payment, healthcare operations, disclosures you authorized, disclosures to you, and other legally excluded disclosures. Contact our Privacy Officer with the period requested. The first accounting in a 12-month period is free. We will tell you any permitted charge for an additional accounting and allow you to withdraw or change the request before a fee is incurred.
Obtain this Notice and use a representative
You may obtain a paper copy even if you agreed to electronic delivery. A legally authorized personal representative may exercise rights on your behalf, subject to applicable exceptions. We verify the person's authority and its scope. Access to a minor's records depends on applicable consent and confidentiality rules, including whether the minor independently consented to the care.
File a complaint
Contact our Privacy Officer by telephone, email, or mail to explain your concern. You may also complain to the Secretary of the U.S. Department of Health and Human Services through the Office for Civil Rights at https://www.hhs.gov/hipaa/filing-a-complaint/ or by writing to 200 Independence Avenue SW, Washington, DC 20201. We will not retaliate against you for a complaint or for exercising a privacy right.
How We Use and Disclose PHI
The descriptions below are subject to the additional protections explained later in this Notice. A permitted category does not authorize every disclosure within that category. Where applicable, we limit information to the minimum necessary for the purpose; this standard has exceptions, including certain treatment disclosures.
Treatment
We use information to evaluate your needs, provide telehealth care, manage prescriptions, and coordinate treatment. For example, your nurse practitioner may review your history in SimplePractice and send prescription information to a pharmacy or relevant findings to another treating clinician. We may contact you about appointments, treatment alternatives, or health-related services relevant to your care, as permitted by law.
Payment
We use and disclose information to bill for services and obtain payment. For example, we may provide billing details needed to process an authorized charge through Stripe or resolve a billing issue. Payment processing does not authorize sharing an entire clinical record. Where applicable and permitted, payment activities may involve an insurer or another payer; any accepted self-pay restriction applies.
Healthcare operations
We use information to manage and improve the practice. For example, authorized staff may review treatment records to assess quality or address a patient complaint. Operations can include staff training, compliance reviews, accounting, legal advice, audits, and permitted practice transitions.
People involved in your care and disaster relief
We may share relevant information with family, friends, or others involved in your care or its payment when you agree, have an opportunity to object and do not, or the circumstances reasonably indicate permission. If you cannot express a preference, we may use professional judgment to make a limited disclosure in your best interests when permitted. Similar rules may allow notification through disaster-relief organizations. Additional confidentiality laws can require written consent.
Public health, safety, and oversight
When authorized by law, we may disclose information for disease reporting, reporting adverse medication reactions or recalls, reporting suspected abuse or neglect, and other public health activities. We may disclose information to address a serious and imminent threat when the legal conditions are met, or to authorized oversight agencies for licensing, inspections, audits, and investigations.
Legal requirements and proceedings
We disclose information when required by law, including to HHS for compliance review. Court orders, subpoenas, and other requests must satisfy the legal protections that apply; a request alone does not automatically authorize disclosure. Legally permitted disclosures can also involve workers' compensation, law enforcement, correctional settings, military activities, or authorized national-security functions. We assess the applicable limits before disclosure.
Research and activities following death
We may use or disclose PHI for research only when legally authorized, such as with your authorization or an approved waiver that meets the applicable requirements. Where permitted, we may disclose information to organ-procurement organizations, coroners, medical examiners, or funeral directors for their authorized duties.
Vendors and communications
SimplePractice supports our electronic records, Acuity supports scheduling, and Stripe supports payment transactions. We also use Gmail, AT&T telecommunications, and a Squarespace public website. These names do not mean that all their features are designated for PHI. A vendor handling PHI on our behalf must have the contractual protections and safeguards required for its role, including a Business Associate Agreement when required.
Ordinary Squarespace contact forms, email, and text messages are not interchangeable with a designated secure clinical channel. Please ask how to send medical records or detailed health information. Appointment notifications can reveal your relationship with our practice. You may request a reasonable alternative communication method; choosing email or text does not waive our legal duties.
Uses Requiring Your Written Authorization
Most uses and disclosures of separately maintained psychotherapy notes, marketing uses requiring authorization, and sales of PHI requiring authorization need your written permission. Identifiable testimonials, photographs, or public patient stories also require appropriate authorization. Other uses and disclosures not described in this Notice will occur only with your written authorization unless otherwise required by law.
You may revoke an authorization in writing through our Privacy Officer. Revocation generally applies to future actions and does not undo actions already taken in reliance on your authorization. We will explain any legally applicable exception. Signing an acknowledgment of this Notice is not authorization for marketing, sale of information, or treatment.
Additional Protections
Substance-use-disorder records
If we receive or maintain records protected by 42 CFR Part 2, those protections apply in addition to HIPAA. These records, or testimony conveying their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent meeting Part 2 requirements or a qualifying court order issued after the required notice and opportunity to be heard. Before compelled disclosure, that order must be accompanied by a subpoena or other legal mandate. Applicable restrictions also protect against investigatory uses against you.
If we receive Part 2 records with consent for treatment, payment, or healthcare operations, any permitted subsequent use remains subject to Part 2's restrictions, including the protection against proceedings against you. Your consent for care coordination does not by itself authorize such a proceeding.
If we conduct legally permitted fundraising, you may opt out of future communications without affecting treatment or payment. Before using Part 2 records for fundraising, we will provide a clear, conspicuous advance opportunity to choose not to receive fundraising communications.
State and other confidentiality laws
When applicable law is more protective, we follow that law. For example, certain mental health, HIV-related, genetic, minor-consented, or other specially protected records may require specific consent or permit disclosure only to designated recipients, even where HIPAA would otherwise allow disclosure. We do not treat the general treatment, payment, and operations provisions above as permission to override those limits.
Oregon, Washington, and Arizona protections apply according to the record and circumstances. Before disclosing specially protected information, we determine whether written permission is required or a specific legal exception applies. Where a minor lawfully consents independently to care, access by a parent or guardian may be limited.
Our Responsibilities and Changes
We are required to maintain the privacy of PHI, apply applicable security protections, provide this Notice of our duties and practices, and notify affected individuals following a breach of unsecured PHI as required by law. We must follow the Notice currently in effect.
We reserve the right to change this Notice as permitted by law and apply the revised provisions to PHI we already hold as well as information received later. The updated Notice will show its effective date and be available on our website and on request. Any physical service location will make it available as required. A revision does not replace consent or authorization required by law.
Website Notice: telehealthnp.net/notice-of-privacy-practices
Privacy Officer: Debra Johnson
Mailing address: 4910 SE 138th Ave, Portland, OR 97236
Telephone: (602) 810-0868
Privacy email: telehealthnp@telehealthnp.net