HIPAA & Privacy Policy

This Notice of Privacy Practices (“Notice”) describes how A Safe Space, LLC (“we,” “our,” or “us”) may use and disclose your Protected Health Information (“PHI”). It also describes your rights regarding your PHI and our legal obligations to protect it. This Notice is provided in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and relevant Colorado law, which recognizes the critical importance of maintaining medical record confidentiality. PHI is information about you, including demographic data, that may identify you and that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for that care. Please review this Notice carefully. This document is a notice of our privacy policies and legal duties; it is not a consent for treatment, a contract for services, or a billing agreement.

Our Privacy Obligations

We are required by law to maintain the privacy and security of your PHI. We are legally obligated to provide you with this Notice detailing our legal duties and privacy practices with respect to your PHI. We are also obligated to notify you following a breach of unsecured PHI. We must follow the terms of the Notice that is currently in effect. Our privacy practices comply with federal regulations, including HIPAA, and applicable Colorado statutes and regulations governing the confidentiality of health information. The confidentiality of every individual patient record, which includes all medical, mental health, and demographic information, will be protected at all times in accordance with these applicable laws. The State of Colorado has declared that maintaining the confidentiality of medical records is of the utmost importance.

How We May Use and Disclose Health Information

The following categories describe the different ways we may use and disclose your PHI without your written authorization. For each category, we will explain what we mean and provide examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of these categories.

For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your medical treatment and any related services. This includes coordinating your care with other health care providers.

• Example: We may disclose your PHI to a practitioner to whom you have been referred to ensure that the practitioner has the necessary information to diagnose and treat you.
• Example: We may disclose PHI to another practitioner or health care provider who is treating you. The practitioner-patient privilege exists in Colorado to encourage full disclosure for effective diagnosis and treatment.

For Payment

We may use and disclose your PHI to bill and obtain payment for the health care services we provide to you.

• Example: We may need to give your health plan information about a service you received at our facility so your health plan will pay us or reimburse you for the service. This may include providing information to determine your eligibility or coverage for benefits and for utilization review activities.

For Health Care Operations

We may use and disclose your PHI for our health care operations. These uses and disclosures are necessary to run our facility and ensure that all of our patients receive quality care.

• Example: We may use PHI to review our treatment and services and to evaluate the performance of our staff in caring for you.
• Example: We may also use PHI for business management and general administrative activities, including, but not limited to, compliance with legal requirements, auditing, and defending ourselves in legal actions. In cases of litigation, Colorado law recognizes that medical information pertinent to a claim may be disclosed.

Individuals Involved in Your Care or Payment for Your Care

We may release PHI to a family member, other relative, or close personal friend who is involved in your medical care or payment for your care, provided the information is directly relevant to that person’s involvement. We may also make such disclosures after your death. This is typically done only if you agree, are given the opportunity to object and do not, or if we infer from the circumstances that you do not object. If you are not able to agree or object, we may exercise our professional judgment to determine whether a disclosure is in your best interest.

As Required By Law

We will disclose your PHI when required to do so by federal, state, or local law. For example, we are required to disclose PHI to the Secretary of the U.S. Department of Health and Human Services to investigate our compliance with privacy regulations.

Public Health and Safety

We may disclose your PHI for public health activities, such as:

• Preventing or controlling disease, injury, or disability.
• Reporting births, deaths, or suspected child abuse or neglect.
• Reporting adverse reactions to medications or problems with products.
• Notifying individuals of product recalls.
• Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.
• Averting a serious threat to your health or safety or the health and safety of the public or another person.

Legal Proceedings, Lawsuits, and Law Enforcement

We may disclose PHI in the course of any judicial or administrative proceeding, in response to a court order, subpoena, discovery request, or other lawful process. Under Colorado law, the practitioner-patient privilege generally protects your medical information from disclosure without your consent. However, this privilege may be waived. Waiver occurs if you inject your physical or mental condition into a legal case as the basis of a claim or defense. There is also a statutory exception to the privilege in Colorado for medical malpractice lawsuits, which permits a practitioner who is sued by a patient to be examined regarding information acquired while attending to that patient. We may also disclose PHI to law enforcement officials as required or permitted by law, such as to identify or locate a suspect, report a crime on our premises, or respond to a warrant.

Other Permitted and Required Disclosures

We are also permitted or required to disclose PHI in the following situations:

• Coroners, Medical Examiners, and Funeral Directors: To identify a deceased person or determine a cause of death.
• Organ and Tissue Donation: To organizations that handle organ procurement or transplantation.
• Research: For research purposes under certain limited circumstances and subject to strict confidentiality requirements.
• Workers’ Compensation: As necessary to comply with laws relating to workers’ compensation or similar programs.
• Specialized Government Functions: For military and veterans’ activities, national security and intelligence, and protective services.
• Inmates: If you are an inmate of a correctional institution, we may release your PHI to the institution or law enforcement officials for your health and the health and safety of others.

Special Protections for Sensitive Women’s Health Information

We understand the particularly sensitive nature of women’s health information. Certain categories of your Protected Health Information (PHI) may be subject to heightened protection under federal and Colorado law. The practitioner-patient privilege is intended to protect patients from potential embarrassment and humiliation that could result from the disclosure of sensitive information. Colorado law provides special protections for certain types of health information. This can include, but is not limited to, information related to:

• Reproductive health, including services related to contraception, pregnancy termination, or fertility treatments.
• Mental health services or psychotherapy notes.
• Diagnosis and treatment of sexually transmitted infections.
• Treatment for substance use disorders.
• Genetic testing information.

In certain circumstances, information related to the diagnosis or treatment of minors for specific conditions, such as sexually transmitted infections or substance use disorders, may be subject to strict confidentiality rules that limit release to parents or guardians without the minor’s consent, as specified under Colorado law.

We are committed to adhering to these enhanced protections. When state or federal laws require a higher level of confidentiality for certain types of PHI, we will comply with those stricter standards. This may require us to obtain your specific written authorization before disclosing such information, even for purposes that might otherwise be permitted. We will not disclose this specially protected information without your explicit permission, except when required or permitted by law.

Your Rights Regarding Your Health Information

You have the following rights regarding the Protected Health Information (PHI) we maintain about you. To exercise these rights, you may be required to submit a written request to our Privacy Officer at the contact information provided in this Notice.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of PHI that may be used to make decisions about your care. Pursuant to Colorado law, your patient record shall be available for inspection upon submission of a valid, signed, and dated authorization. There is no fee for inspecting your records.

You also have the right to request a copy of your records. We will provide a copy or a summary of your health information, usually within 30 days of your request. A reasonable, cost-based fee may be charged for the costs of copying, mailing, or other supplies associated with your request, in accordance with HIPAA regulations and Colorado law. If your records are maintained electronically, you have the right to request an electronic copy, which we will provide if the records are readily producible in the requested format. Please note that under Colorado law, the statutory definition of “patient record” for this purpose does not include a practitioner’s private office notes. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to PHI, you may request that the denial be reviewed.

Right to Amend

If you believe that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our office. Your request for an amendment must be made in writing and must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the health information kept by or for our office;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

If we deny your request, we will provide you with a written explanation of the reason for the denial.

Right to Request Restrictions

You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.

We are not required to agree to your request, except where the disclosure is to a health plan for purposes of payment or health care operations (and not for treatment) and the PHI pertains solely to a health care item or service for which you, or someone on your behalf, has paid us in full out-of-pocket. If we do agree to another type of restriction, we will comply with your request unless the information is needed to provide you with emergency treatment.

Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of your PHI for purposes other than treatment, payment, health care operations, and certain other disclosures (such as any you asked us to make). Your request must state a time period, which may not be longer than six years. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail to a post office box. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy.

Uses and Disclosures That Require Your Authorization

Other than for the purposes described in this Notice, or as otherwise permitted or required by law, we will not use or disclose your Protected Health Information (PHI) without your specific, written authorization. For example, we will obtain your written authorization for:

• Marketing: We will not use or disclose your PHI for marketing purposes without your authorization.
• Sale of PHI: We will not sell your PHI to third parties without your authorization.
• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes require your authorization.
• Other Uses: Any other use or disclosure of PHI not covered by this Notice or the laws that apply to us will be made only with your written permission.

You may revoke any authorization you provide at any time, provided that the revocation is in writing. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written authorization. Please understand that we are unable to take back any disclosures we have already made with your permission, and we are required to retain our records of the care that we provided to you. To be effective, your revocation must be submitted in writing to our Privacy Officer.

State Law, HIPAA, and Other Legal Exceptions

We are subject to both federal and state laws governing the privacy of your health information. The Health Insurance Portability and Accountability Act (HIPAA) provides a federal floor of privacy protections. Colorado law also provides significant protections for medical records and has declared their confidentiality to be of utmost importance. Where federal and state laws conflict, we will follow the law that provides greater protection for your privacy.

The practitioner-patient privilege in Colorado is a key protection, generally preventing the disclosure of your information in legal proceedings without your consent. However, both state and federal laws create specific exceptions where your PHI may be disclosed without your authorization. These situations include, but are not limited to:

• Legal Process: When required by a court order, subpoena, warrant, or other lawful process in a judicial or administrative proceeding.
• Public Health and Safety: Disclosures to public health authorities for disease control, or to avert a serious threat to health or safety.
• Abuse and Neglect: Reporting suspected child abuse or neglect to government authorities authorized to receive such reports.
• Law Enforcement: Responding to certain requests from law enforcement officials, for example, to identify a suspect or report a crime.
• Governmental Functions: Disclosures for specific governmental functions, such as investigations into Medicaid fraud or for national security purposes.

In all such cases, we will disclose only the minimum necessary information required to comply with the legal mandate.

Data Security, Electronic Records, and Breach Response

We are committed to protecting your Protected Health Information (PHI) from unauthorized access, use, or disclosure. We have implemented administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of your paper and electronic health information. Our workforce is trained on privacy and security policies, and access to your PHI is limited to those individuals who need it to perform their job duties. All electronic medical records are treated as strictly privileged and confidential.

In the unfortunate event of a security breach involving your unsecured PHI, we will promptly investigate and take steps to mitigate any harm. We will notify you in a timely manner, as required by HIPAA and Colorado law. If the breach involves encrypted information, we are still required to notify you if the key or other means to decipher the information was also acquired. Depending on the scale of the breach, we may also be required to notify the U.S. Department of Health and Human Services and the Colorado Attorney General. We will provide you with information about the breach and what steps you can take to protect yourself.

Complaints and Questions

If you have any questions about this Notice or our privacy practices, or if you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services.

To file a complaint with us, please contact our Privacy Officer at:

To file a complaint with the U.S. Department of Health and Human Services, please visit their website or contact them directly. You will not be penalized or retaliated against for filing a complaint.

Changes to This Notice

We reserve the right to change our privacy practices and the terms of this Notice at any time. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in our facility and on our website. The Notice will contain the effective date. You may request a paper copy of our current Notice at any time.

Cookies and Analytics

This website may use basic analytics and cookies to understand how visitors use the site. You can manage cookies through your browser settings.