Nick Highland, LMHC
Mental Health Counseling
Effective Date: November 5, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Introduction
Your privacy and confidentiality are essential to the counseling relationship. This Notice of Privacy Practices explains how Nick Highland, LMHC (“the Practice”) may use and disclose your protected health information (PHI), your rights regarding that information, and my legal responsibilities under the Health Insurance Portability and Accountability Act (HIPAA), 42 CFR Part 2 when applicable, and other federal and New York State laws.
Protected health information includes information that identifies you and relates to your physical or mental health, the healthcare services you receive, or payment for those services. This may include assessments, diagnoses, treatment plans, progress notes, appointment information, communications, and billing records.
This notice applies to protected health information created, received, or maintained by Nick Highland, LMHC, through my independent counseling practice. Services provided through other healthcare organizations may be governed by those organizations’ separate privacy notices.
1. Your Rights Regarding Your Health Information
You have specific rights concerning your protected health information.
Access Your Health Records
You have the right to inspect or obtain a copy of most health information maintained in your designated record set, including clinical and billing records.
You may request records electronically or on paper.
I will generally provide access within 30 days of receiving your request, subject to legally permitted exceptions or extensions.
A reasonable, cost-based fee may apply when permitted by law.
Certain records, including separately maintained psychotherapy notes as defined by HIPAA, are excluded from the ordinary right of access.
Request Corrections
You may request an amendment to information you believe is inaccurate or incomplete.
If I deny your request, I will explain the reason in writing, generally within 60 days, subject to any legally permitted extension.
You may have the right to submit a statement of disagreement for inclusion in your record.
Request Confidential Communications
You may request that I communicate with you through a particular method or at a specific location.
For example, you may ask that I contact you by email rather than telephone, or avoid leaving voicemail messages.
I will accommodate reasonable requests for confidential communication.
Request Restrictions
You may request restrictions on certain uses or disclosures of your health information for treatment, payment, or healthcare operations.
Although I am not generally required to agree to a requested restriction, I will honor restrictions I agree to, subject to applicable legal exceptions.
If you pay for a specific service entirely out of pocket, you may request that information related to that service not be disclosed to your health insurance plan for payment or healthcare operations purposes. I must honor that request unless disclosure is required by law.
Request an Accounting of Disclosures
You may request an accounting of certain disclosures of your health information made during the previous six years.
This accounting does not generally include disclosures made for treatment, payment, healthcare operations, or certain other purposes excluded by law.
One accounting will be provided without charge during any 12-month period. Additional requests may be subject to a reasonable fee.
Additional accounting rights may apply to records protected by 42 CFR Part 2, including certain disclosures through intermediaries, as provided by applicable law and implementation requirements.
Obtain a Copy of This Notice
You have the right to receive a paper or electronic copy of this notice at any time.
The current notice is available at https://nickhighland.com.
Designate a Personal Representative
You may authorize someone to act on your behalf regarding your healthcare information.
I will verify the person’s legal authority before providing access or allowing them to exercise your rights.
Additional rules may apply to parents, legal guardians, and representatives of minors.
File a Complaint
You have the right to file a complaint if you believe your privacy rights have been violated.
You may contact me directly or file a complaint with the U.S. Department of Health and Human Services.
You will not be retaliated against for filing a complaint or exercising your privacy rights.
2. How Your Information May Be Used and Disclosed
HIPAA permits certain uses and disclosures of protected health information without separate written authorization.
These uses and disclosures remain subject to applicable state laws and additional confidentiality protections, including 42 CFR Part 2 when applicable.
Treatment
I may use or disclose your health information to provide, coordinate, or manage counseling services.
Examples include:
- Conducting clinical assessments.
- Developing and updating treatment plans.
- Maintaining clinical documentation.
- Coordinating care with other healthcare professionals.
- Making clinically appropriate referrals.
- Obtaining professional consultation when permitted by law.
Clinical consultation will be conducted with appropriate safeguards to protect confidentiality.
Payment
I may use or disclose information necessary to obtain payment for services.
Examples include:
- Submitting insurance claims.
- Verifying benefits or eligibility.
- Processing payments.
- Responding to payment inquiries.
- Providing documentation when required for reimbursement.
Insurance claims may include information such as your diagnosis, dates of service, procedure codes, and provider information.
Healthcare Operations
I may use or disclose information necessary for the lawful operation of my counseling practice.
Examples include:
- Maintaining and improving quality of care.
- Managing clinical and administrative records.
- Conducting compliance reviews.
- Responding to authorized audits.
- Maintaining secure practice technology.
- Managing billing and administrative activities.
When service providers handle protected health information on my behalf, appropriate safeguards and Business Associate Agreements will be used when required by HIPAA.
3. Other Permitted or Required Disclosures
Certain circumstances permit or require disclosure of health information without written authorization.
These disclosures are governed by applicable legal requirements, including stricter protections provided by New York State law or 42 CFR Part 2.
Required by Law
I may disclose information when required by applicable federal, state, or local law.
Abuse or Neglect
I may disclose information to appropriate authorities when legally required to report suspected child abuse or maltreatment, or when other reporting requirements apply.
Serious Threats to Health or Safety
When authorized by applicable law, I may disclose information reasonably necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person.
Public Health Activities
I may disclose information to authorized public health agencies when legally required or permitted.
Health Oversight Activities
I may disclose information to government agencies authorized to conduct professional licensing investigations, audits, inspections, or other lawful oversight activities.
Judicial and Administrative Proceedings
Information may be disclosed in response to a legally valid court order, subpoena, or other lawful process when disclosure is authorized or required.
Mental health records are subject to additional confidentiality protections and legal privileges.
A request from an attorney, employer, family member, or other third party does not automatically authorize the release of your records.
Additional restrictions apply to Part 2-protected records in investigations or legal proceedings against you.
Law Enforcement
Information may be disclosed to law enforcement only when legally permitted or required, and subject to applicable confidentiality restrictions.
Workers’ Compensation
Information may be disclosed when authorized by applicable workers’ compensation laws.
Research
Health information may be used or disclosed for research only when authorized by you or otherwise permitted under applicable privacy and research regulations.
Medical Examiners and Funeral Directors
Information may be disclosed to coroners, medical examiners, or funeral directors when legally authorized.
Organ and Tissue Donation
Information may be disclosed to authorized organ procurement organizations when applicable and legally permitted.
Specialized Government Functions
Certain limited disclosures may be authorized for military, national security, protective services, or other specialized government functions.
Federal Compliance
I may disclose information to the U.S. Department of Health and Human Services when required to demonstrate compliance with federal privacy laws.
4. Uses and Disclosures Requiring Your Written Authorization
Certain uses and disclosures of your information require your specific written authorization.
These generally include:
- Most uses or disclosures of separately maintained psychotherapy notes.
- Disclosures of substance use disorder counseling notes requiring separate consent under Part 2.
- Marketing uses or disclosures that require authorization under HIPAA.
- The sale of protected health information.
- Other uses or disclosures not otherwise permitted or required by law.
I do not sell protected health information or use it for commercial marketing without any authorization required by law.
When authorization is required, I will explain what information may be disclosed, to whom, and for what purpose.
You may revoke your authorization in writing at any time, except to the extent I have already acted in reliance on it or another legal exception applies.
5. Psychotherapy Notes
HIPAA provides special protections for psychotherapy notes.
Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a private, group, joint, or family counseling session that are maintained separately from the rest of the medical record.
They are distinct from routine clinical documentation, including:
- Session start and stop times.
- Treatment modalities and frequency.
- Diagnoses.
- Treatment plans.
- Symptoms and functional status.
- Clinical test results.
- Progress summaries.
If I maintain separately designated psychotherapy notes, their disclosure generally requires your specific written authorization.
Exceptions are limited to circumstances expressly permitted by law, such as use by the professional who created the notes for treatment or certain required legal or oversight purposes.
A general authorization to release your clinical records does not automatically authorize the release of separately maintained psychotherapy notes.
6. Substance Use Disorder Records and 42 CFR Part 2
Certain substance use disorder treatment records receive additional confidentiality protections under 42 CFR Part 2, a federal regulation protecting the privacy of individuals receiving substance use disorder diagnosis, treatment, or referral services from qualifying programs.
These protections may apply to records created or maintained by a qualifying program or records received from another provider or treatment program.
When records are subject to Part 2, I will comply with the applicable requirements concerning their use, disclosure, redisclosure, and protection.
Consent for Use and Disclosure
Part 2 generally requires patient consent for many uses and disclosures of protected substance use disorder records, subject to specific legal exceptions.
When Part 2 requires consent, I will obtain consent in accordance with applicable requirements before using or disclosing the information.
You may authorize the disclosure of information to particular healthcare providers, organizations, or other individuals for specified purposes.
When permitted by law, a single written consent may authorize future uses and disclosures for treatment, payment, and healthcare operations.
You may also provide a more limited consent when permitted by applicable law.
Treatment, Payment, and Healthcare Operations
Part 2 permits certain uses and disclosures for treatment, payment, and healthcare operations pursuant to a valid consent or other applicable legal authorization.
When a HIPAA-covered healthcare provider or other qualifying recipient receives Part 2 records pursuant to a valid consent authorizing treatment, payment, and healthcare operations, certain subsequent uses and disclosures may be permitted under HIPAA without obtaining a new consent for each disclosure.
However, applicable Part 2 protections remain in effect, including restrictions against using the records in legal proceedings against you.
Redisclosure of Protected Records
Part 2 places limitations on how protected substance use disorder information may be disclosed or redisclosed.
When applicable, disclosures will be made only under circumstances permitted by Part 2, including appropriate patient consent or an applicable legal exception.
Recipients of Part 2-protected records may have additional responsibilities regarding further use or disclosure.
Where required, information accompanying a disclosure will identify the applicable consent or its scope.
Protection Against Use in Legal Proceedings
Part 2-protected records, or testimony conveying their contents, may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you unless authorized by your specific written consent or by a qualifying court order accompanied by a subpoena or other legal mandate, as required by Part 2.
These protections apply to certain proceedings even after records have been lawfully disclosed to another healthcare provider or organization.
A court order authorizing such disclosure must satisfy the requirements of Part 2, including applicable notice and opportunity-to-be-heard protections.
Consent for use of records in proceedings against you must be separate from consent for other uses or disclosures.
Substance Use Disorder Counseling Notes
Part 2 provides special protections for separately maintained substance use disorder counseling notes.
These notes consist of a clinician’s analysis of conversations during substance use disorder counseling sessions and are maintained separately from the general treatment record.
When records qualify as substance use disorder counseling notes under Part 2, their use or disclosure generally requires a separate, specific written consent, subject to limited legal exceptions.
A general consent for treatment, payment, or healthcare operations does not automatically authorize their disclosure.
Disclosures Without Consent
Part 2 permits certain limited uses or disclosures without patient consent when specific legal conditions are satisfied.
Examples may include:
- Bona fide medical emergencies.
- Certain internal communications and services provided by qualified contractors.
- Reports of suspected child abuse or neglect as required by law.
- Certain crimes or threats involving a program or its personnel.
- Legally authorized research activities.
- Authorized audits and evaluations.
- Certain cause-of-death inquiries.
- Disclosures authorized by qualifying Part 2 court orders.
These exceptions are subject to specific limitations, documentation requirements, and applicable confidentiality protections.
Your Rights Regarding Part 2 Records
When Part 2 applies, you may have additional rights concerning:
- Consent to use or disclose your information.
- Withdrawal or modification of consent, subject to applicable legal limitations.
- Requests for restrictions on the use or disclosure of records.
- Access to information about certain disclosures.
- Identification of certain recipients who received information through intermediaries.
- Protection against unauthorized use of records in legal proceedings.
- Filing complaints regarding potential Part 2 violations.
Additional rights involving accounting of electronic disclosures will be honored as applicable under the relevant federal implementation requirements.
Fundraising Communications
I do not currently use protected health information for fundraising solicitations.
If Part 2-protected information were ever used for fundraising where legally permitted, you would receive the required advance notice and an opportunity to elect not to receive such communications.
Complaints and Violations
You have the right to raise concerns or file a complaint if you believe Part 2-protected information has been improperly used or disclosed.
Complaints may be submitted to me or to the U.S. Department of Health and Human Services, Office for Civil Rights.
You will not be retaliated against for filing a complaint.
7. New York State Confidentiality Protections
As a Licensed Mental Health Counselor in New York State, I am also subject to state confidentiality requirements and professional obligations.
New York law may impose additional restrictions on the disclosure of mental health information beyond those established by HIPAA.
As a general practice, I will not disclose identifiable mental health treatment information to family members, employers, schools, religious organizations, attorneys, or other outside individuals or organizations without your permission unless disclosure is permitted or required by applicable law.
Certain information may receive additional protections, including:
- Mental health treatment information.
- Substance use disorder treatment records.
- HIV-related information.
- Certain healthcare services provided to minors.
- Information protected by applicable professional privileges.
Where multiple privacy laws apply, I will follow their applicable confidentiality requirements, including any additional protections imposed by state or federal law.
8. Confidentiality and Minors
Parents and legal guardians generally have certain rights regarding the healthcare information of their minor children.
However, those rights may be limited by federal and New York State laws.
In some circumstances, minors may independently consent to particular healthcare services and have legal rights regarding the confidentiality of related information.
Access to records and disclosure of information will be determined according to applicable laws, the circumstances of treatment, and the authority of individuals requesting the information.
Confidentiality and its limitations will be discussed during intake when clinically appropriate.
9. Family Members, Friends, and Other Individuals
You may identify individuals whom you would like involved in your care.
When permitted by law, I may share limited information relevant to their involvement in your treatment or payment for your treatment, consistent with your preferences and applicable confidentiality requirements.
You may request that certain individuals not receive information about your treatment.
If you are unable to communicate your preferences, limited disclosures may be made when legally permissible and appropriate under the circumstances.
I do not maintain a hospital directory.
I do not use protected health information for fundraising solicitations.
10. Electronic Health Records and Telehealth
I may use electronic systems to maintain records, provide telehealth services, communicate with clients, process payments, and manage administrative functions.
These systems may include:
- Electronic health records.
- Telehealth platforms.
- Appointment scheduling systems.
- Insurance billing and payment systems.
- Electronic communication services.
I use reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of protected health information.
Outside service providers that handle protected health information on my behalf are subject to applicable privacy and security requirements, including Business Associate Agreements when required.
Telehealth Privacy
Telehealth services are provided using technology selected for appropriate healthcare use.
Although reasonable safeguards are used, no electronic communication system can be guaranteed completely free of security risks.
Clients are encouraged to participate in telehealth sessions from a private location using secure devices and internet connections.
Email and Electronic Communication
Ordinary email and text messaging may present privacy risks.
Electronic communications may be used for appropriate administrative purposes consistent with applicable law, your communication preferences, and established practice procedures.
You may request alternative communication methods when reasonable.
Sensitive clinical information should be communicated through appropriate secure methods whenever possible.
11. Minimum Necessary Information
For uses and disclosures subject to HIPAA’s minimum necessary standard, I will make reasonable efforts to limit the information used or disclosed to what is reasonably necessary for the intended purpose.
Some disclosures, including certain treatment disclosures and those authorized by you, are subject to different legal standards.
Applicable state and federal confidentiality restrictions will also be considered.
12. Record Retention
I maintain clinical records in accordance with applicable federal and New York State requirements.
Under New York State professional requirements, mental health counseling records generally must be retained for at least six years or until the client reaches age 22, whichever is longer.
Longer retention may be necessary when required by law or professional obligations.
Records will be maintained using appropriate confidentiality and security safeguards throughout the required retention period.
13. Breach Notification
I am required to maintain appropriate safeguards protecting your health information.
If a reportable breach of unsecured protected health information occurs, including Part 2-protected information when applicable, I will notify affected individuals and appropriate authorities as required by law.
Notifications will include information required by law about the incident and any recommended protective steps.
14. My Responsibilities
As a healthcare provider subject to HIPAA, I am legally required to:
- Maintain the privacy and security of protected health information.
- Provide this Notice of Privacy Practices.
- Follow the terms of the notice currently in effect.
- Respect your applicable privacy rights.
- Obtain written authorization or consent when legally required.
- Maintain appropriate safeguards for protected information.
- Comply with applicable 42 CFR Part 2 requirements.
- Notify affected individuals of reportable breaches.
- Comply with applicable federal and state confidentiality requirements.
I will not use or disclose your health information for purposes not described in this notice unless you authorize the use or disclosure in writing or another legal basis permits or requires it.
15. Changes to This Notice
I reserve the right to revise this Notice of Privacy Practices.
Revised terms may apply to all protected health information I maintain, including information collected before the revision, to the extent permitted by law.
Material changes will be reflected in an updated notice.
The current notice will be available upon request and published on my website.
16. Questions, Requests, and Privacy Complaints
If you have questions about this notice, wish to exercise your privacy rights, or believe your privacy rights have been violated, you may contact me directly.
Privacy Officer
Nick Highland, LMHC
Phone: 917-275-7145
Email: [email protected]
Website: https://nickhighland.com
Please use an appropriate secure communication method when submitting sensitive clinical information.
Federal Privacy Complaints
You may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights.
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, DC 20201
Phone: 1-877-696-6775
Website: https://www.hhs.gov/hipaa/filing-a-complaint/
You may complain to me, the Office for Civil Rights, or both.
You will not be retaliated against for filing a complaint or exercising your privacy rights.
Notice Effective Date: November 5, 2026
Provider: Nick Highland, LMHC
Privacy Officer: Nick Highland, LMHC
Phone: 917-275-7145
Email: [email protected]
Website: https://nickhighland.com