Patient privacy · HIPAA

Notice of Privacy Practices

Effective date: May 2026

This Notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

Bella Acosta Arias, MD, PLLC ("the Practice," "we," "us," or "our") is committed to protecting the privacy of your health information. We are required by the Health Insurance Portability and Accountability Act (HIPAA) and applicable state law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices, to follow the terms of the Notice currently in effect, and to notify you if a breach of your unsecured PHI occurs. "Protected health information" is information that identifies you and relates to your physical or mental health, the care you receive, or payment for that care.

How we may use and disclose your health information

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment. We may use your PHI to provide, coordinate, and manage your psychiatric care, and we may share it with other providers involved in your care, such as your therapist, primary care physician, or OB/GYN, when doing so supports your treatment.
Payment. We may use and disclose your PHI to bill and obtain payment for services. For example, we may provide an itemized statement (superbill) that you choose to submit to your health plan for possible out-of-network reimbursement.
Health care operations. We may use your PHI for the operations of the Practice, such as quality assessment, record-keeping, scheduling, and the administrative functions needed to run the Practice.
Appointment and care reminders. We may contact you to remind you of appointments or to discuss your care, using the contact information and methods you have provided.

Other uses and disclosures permitted or required by law

In limited circumstances, the law permits or requires us to use or disclose your PHI without your authorization, including:

When required by federal, state, or local law.
For public health activities, such as reporting certain conditions or adverse events.
To report suspected abuse, neglect, or domestic violence as required or permitted by law.
For health oversight activities, such as audits or investigations by government agencies.
In response to a court or administrative order, subpoena, or other lawful legal process, in accordance with applicable law.
For specified law enforcement purposes, or to a coroner, medical examiner, or funeral director as permitted by law.
To avert a serious and imminent threat to the health or safety of you or another person.
For workers' compensation claims, organ donation, certain research, or military and national security purposes as authorized by law.

Mental health information may be subject to additional protections under state law. Where state and federal laws differ, we will apply the standard that is more protective of your privacy.

Uses and disclosures that require your written authorization

Most uses and disclosures not described in this Notice will be made only with your written authorization. In particular, your written authorization is required for:

Psychotherapy notes, except in limited circumstances permitted by law. Psychotherapy notes are notes recorded by a mental health professional that document or analyze the contents of a counseling session and are kept separate from the rest of your record.
Uses and disclosures of PHI for marketing purposes.
Any sale of your protected health information.

You may revoke a written authorization at any time, in writing, except to the extent we have already acted in reliance on it.

Forensic evaluations

Forensic psychiatric evaluations are not treatment and do not create a physician-patient relationship. When the Practice performs a forensic evaluation, it is conducted for a retaining attorney, court, or other third party, and the resulting information and report are provided to that retaining party rather than handled as treatment records. If you are the subject of a forensic evaluation, the examiner will explain, before the evaluation begins, the purpose of the evaluation and the limits of confidentiality that apply. This Notice governs treatment provided by the Practice and does not change the terms of any forensic engagement.

Telehealth and electronic communication

The Practice delivers care by secure, HIPAA-compliant telehealth. Standard email and the website contact form are not fully secure channels and should not be used for detailed clinical or sensitive health information. Established patients are provided with secure methods of communication at the start of care.

Your rights regarding your health information

You have the following rights with respect to your PHI:

Access and copies. You may inspect and request a copy of your health information, in paper or electronic form, subject to limited exceptions permitted by law.
Amendment. You may request that we amend health information you believe is incorrect or incomplete. We may deny a request in certain circumstances, and you may submit a statement of disagreement.
Accounting of disclosures. You may request a list of certain disclosures of your PHI made by the Practice, other than those made for treatment, payment, health care operations, or disclosures you authorized.
Restrictions. You may request a restriction on certain uses or disclosures. We are not required to agree to every request, but we will honor a request to restrict disclosure to a health plan for a service you paid for in full out of pocket.
Confidential communications. You may request that we communicate with you in a particular way or at a particular location, and we will accommodate reasonable requests.
Paper copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
Breach notification. You have the right to be notified if a breach of your unsecured PHI occurs.
Revoking authorization. Where you have given written authorization, you may revoke it in writing as described above.

To exercise any of these rights, contact the Practice using the information below. Some requests must be made in writing.

Our responsibilities

We are required by law to maintain the privacy and security of your protected health information.
We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this Notice and provide you with a copy of it.
We will not use or share your information other than as described here unless you tell us in writing that we may. If you give written permission, you may change your mind at any time.

Changes to this Notice

We may change this Notice from time to time, and any change will apply to information we already hold as well as information we receive in the future. The current Notice will be posted on this website with its effective date, and a copy will be available from the Practice on request.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with the Practice using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against, and your care will not be affected, for filing a complaint. Information about filing a complaint with the Office for Civil Rights is available at hhs.gov/ocr/privacy/hipaa/complaints.

Contact

Questions about this Notice, or requests to exercise your privacy rights, can be directed to the Practice's Privacy Officer at hello@bellaacostamd.com or (303) 257-4101.

This Notice of Privacy Practices is provided as a general template based on standard HIPAA requirements for a small psychiatric practice. Before it is published or distributed to patients, it should be reviewed by your own attorney or HIPAA compliance advisor, the effective date confirmed, and a named Privacy Officer designated. It is not legal advice.