Home > Privacy and HIPAA notice
Privacy policy and HIPAA notice
This page explains how this website handles your information (Part 1) and how my practice uses and protects your health information under HIPAA (Part 2). Effective September 24, 2026.
Last updated September 24, 2026
Part 1: This website
What this site collects
This site has no user accounts, no advertising trackers, and no analytics tools, and I do not set cookies. The site loads its typeface from Google Fonts, so Google may receive your IP address and browser details when a page loads. The site is hosted on Cloudflare, which processes each request and may keep standard technical logs (such as IP address and browser type) for security and performance.
Contact form and phone
If you send a message through the contact form, I receive the details you enter (name, email, optional phone, and your message). The form passes your message through a third-party form service to reach me. It is not a secure channel, so please do not include private health details. Phone calls and voicemails are used only to respond to you and schedule care.
Booking, billing, and video sessions
Scheduling, insurance billing, and video sessions run through Headway. Headway has its own privacy policy and HIPAA notice of privacy practices, which apply to the information you give it.
What I do not do
I do not sell your personal information or use it for advertising. This site is intended for adults. Links to other sites (Psychology Today, Headway, and authors' websites) are governed by those sites' own policies.
Part 2: HIPAA Notice of Privacy Practices
This notice describes how health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
I am required by the federal HIPAA privacy rule to keep your protected health information (PHI) private, to give you this notice of my legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if there is a breach of your unsecured PHI.
How I may use and disclose your information without your authorization
- Treatment. To provide and coordinate your counseling, including consulting with other health care providers involved in your care when needed.
- Payment. To bill and collect payment, including sharing information with your health plan and with Headway, which handles billing on my behalf.
- Health care operations. For activities such as quality review, clinical supervision or consultation, and administration of my practice.
- Business associates. With vendors who help run my practice (such as Headway) under agreements that require them to protect your information.
- Required by law and safety. When the law requires it or permits it, such as reporting suspected child abuse or neglect or abuse of an older or vulnerable adult, responding to a court order or valid legal process, cooperating with the state licensing board or health oversight agencies, or preventing a serious and imminent threat to your health or safety or that of others.
- Other permitted disclosures. Limited situations such as public health activities, law enforcement as permitted by law, and coroner or workers' compensation matters.
Uses that require your written authorization
I will get your written authorization before using or sharing your information for reasons not described above. Specific authorization is required for most uses and disclosures of psychotherapy notes (which receive extra protection), for marketing, and for any sale of PHI. You may revoke an authorization in writing at any time, except to the extent I have already acted on it.
Your rights
- Access. You may ask to inspect or get a copy of your records. In limited cases access may be denied, and I will explain why.
- Amendment. You may ask me to correct information you believe is wrong or incomplete.
- Accounting of disclosures. You may ask for a list of certain disclosures I have made of your information.
- Restrictions. You may ask me to limit how I use or share your information. I am not required to agree, except that I must agree to a request not to share information with your health plan for a service you have paid for in full out of pocket.
- Confidential communications. You may ask me to contact you in a particular way or place, and I will accommodate reasonable requests.
- Paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.
- Breach notification. You have the right to be notified if there is a breach affecting your unsecured PHI.
Questions and complaints
To use any of these rights or to ask a question, contact me at (513) 995-8532. If you believe your privacy rights were violated, you may file a complaint with me or with the U.S. Department of Health and Human Services Office for Civil Rights through its complaint page. I will not retaliate against you for filing a complaint.
Changes to this notice
I may change this notice and the changes will apply to all information I hold. The current version will always be posted here with its effective date. Ohio law and professional ethics rules may provide additional protection for your information.
Effective date: September 24, 2026. Privacy contact: Brian Girton, LPCC, (513) 995-8532.
Related: contact and scheduling and what to expect.