HIPAA NOTICE OF PRIVACY PRACTICES

---

 Marble Counseling & Consulting, LLC

 Effective Date: May 29, 2026 

(This notice is reviewed annually or upon updates to practice operations or applicable law.)

Privacy Contact: Rachael Marble Leary, LPC, CADCII
Phone: 541-668-6141 | Email: marble@marblecounseling.org

Your Information. Your Rights. Our Responsibilities.

This notice describes how your health information may be used and disclosed and how you can get access to this information. Please review it carefully.

What is Protected?

Protected Health Information (PHI) includes any personal health information that can identify you. This may include records of evaluation, treatment, visits, billing, diagnoses, and any communication containing health-related data.

Your Rights

You have the right to:

• Get a copy of your paper or electronic health record

• Request a correction to your health record

• Request confidential communications (e.g., by mail, alternative phone number)

• Ask us to limit what we use or share

• Ask us not to share information with your health insurer for services you paid for entirely out of pocket

• Get a list of who we've shared your information with (accounting of disclosures)

• Get a paper copy of this notice at any time

• Choose someone to act on your behalf (e.g., caregiver, legal guardian, or health care proxy)

• Receive a "Good Faith Estimate" explaining how much your mental health care will cost. This applies to individuals who are uninsured or not using insurance. For more information, visit: www.cms.gov/nosurprises

• File a complaint if you believe your rights have been violated

Your Choices

You may tell us your preferences in how we share your information in situations such as:

• Sharing with family, friends, or others involved in your care

• Disaster relief situations

• Inclusion in hospital directories

If you're unable to express your preference (e.g., unconscious), we may share if we believe it is in your best interest or to prevent serious harm.

We never share your information without written consent for:

• Marketing purposes

• Sale of your information

• Most disclosures of psychotherapy notes

• Any disclosure of substance use disorder (SUD) counseling notes — these require a separate, standalone written authorization that cannot be combined with other consents

Our Uses and Disclosures

We typically use or share your information to:

• Treat you — Coordinate care with other providers

• Run our organization — Manage operations and quality of care

• Bill for your services — Send claims to insurance or collect payment

We may also share information to:

• Prevent or control disease

• Report suspected abuse, neglect, or domestic violence (as required by law)

• Comply with public health or safety laws

• Assist with product recalls or FDA requirements

• Support health oversight activities (e.g., audits, licensure)

• Participate in health research (when legally permitted)

• Comply with legal requirements, including court orders or subpoenas. We may disclose information in response to a valid court order or administrative subpoena. However, psychotherapy notes and substance use records will not be disclosed unless specific legal requirements under HIPAA or 42 CFR Part 2 are met.

• Respond to workers' compensation claims, law enforcement, or national security inquiries

• Organ and tissue donation, coroner, or funeral director needs

Substance Use and Mental Health Information

Records related to substance use treatment are protected under 42 CFR Part 2 and have stricter confidentiality protections than general health records under HIPAA. These records will not be released without your written consent, except as specifically required by law. Your authorization for SUD records must be separate and standalone — it cannot be combined with authorization for other types of records. You may revoke this authorization at any time in writing, except to the extent action has already been taken in reliance on it.

Psychotherapy notes are protected separately under HIPAA (45 CFR § 164.501) and will only be shared with your written authorization, except in the following circumstances:

• For your provider's use in treating you

• For use in training or supervising mental health practitioners

• For your provider's use in defending against legal proceedings you have initiated

• For use by the Secretary of Health and Human Services to investigate HIPAA compliance

• When required by law, limited to the requirements of such law

• For certain health oversight activities pertaining to the originator of the notes

• When required by a coroner performing duties authorized by law

• When required to avert a serious and imminent threat to health or safety

Appointment Reminders & Administrative Use

We may use or disclose your PHI to contact you for appointment reminders or to inform you about treatment alternatives or other health-related services that may benefit you.

Mandatory Reporting & Duty to Warn

We are legally mandated to report suspected abuse or neglect of children, elders, or vulnerable adults to appropriate authorities. Disclosure of confidential information may also occur without consent if there is a serious and imminent threat of harm to self or others, in accordance with Oregon law and professional ethics (ORS 419B.005; ACA Code of Ethics, Standard B.2.a).

Digital Record Systems

Marble Counseling & Consulting LLC uses HIPAA-compliant electronic systems for recordkeeping and documentation (e.g., SimplePractice, Zoom, Blueprint). These platforms are regularly reviewed to meet ethical and security standards.

Electronic Communication and Telehealth

Marble Counseling & Consulting LLC uses HIPAA-compliant platforms for telehealth, scheduling, and communication. While reasonable safeguards are taken, confidentiality cannot be fully guaranteed for email, text, or video communications. Clients are encouraged to use the secure client portal for clinical matters. Communications outside of session should be limited to administrative purposes (e.g., scheduling, billing). Telehealth may not be suitable for all clinical needs; appropriateness will be assessed on an ongoing basis.

Minor Consent and Limits of Caregiver or Guardian Access to Records

Under Oregon law (ORS 109.675), individuals aged 14 and older may independently consent to behavioral health services. In alignment with Oregon law (ORS 109.675, 109.680), caregiver or guardian access to minor records will be limited when the minor has consented to treatment independently, unless disclosure is clinically appropriate or required by law. Provider discretion and ethical standards guide this determination.

Record Retention

Clinical records are retained for a minimum of seven (7) years from the date of last service or longer if required by state or federal law. For minors, records are retained for at least seven years after the minor reaches the age of majority. After the retention period, records are securely destroyed in compliance with HIPAA and Oregon law.

Professional Consultation

Your provider may seek consultation with other licensed mental health professionals to ensure quality of care. These consultations do not include identifying information unless you have provided written authorization, and they occur within HIPAA-compliant frameworks such as peer consultation or supervision.

Custodian of Records

In the event of provider death or incapacity, your records will be transferred to a designated custodian to ensure ethical closure of care. For Marble Counseling & Consulting LLC, this role is fulfilled by: Melissa Frazier, LPC. Secure Portal: https://melissa-frazier-counseling.individualsecure.me

Our Responsibilities

We are legally required to:

• Maintain the privacy and security of your PHI

• Notify you promptly in writing if a breach occurs that may have compromised the privacy or security of your information, in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414)

• Abide by the terms of this notice

• Not use or share your information in ways not described here without your written permission

You may revoke your authorization at any time in writing, except to the extent that action has already been taken in reliance on that authorization.

Changes to This Notice

We may change this notice at any time. Updates will apply to all existing information and will be posted in our office and available online or upon request. This notice is reviewed annually or upon updates to practice operations or applicable law.

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint:

With Us: Contact Rachael Marble Leary using the information above.

With the U.S. Department of Health and Human Services:

Office for Civil Rights

200 Independence Avenue, S.W., Washington, D.C. 20201

Phone: 1-877-696-6775

www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.

If you require this notice in an alternative format (e.g., large print, translated), please contact your provider.

This notice is available on the practice website here and in the SimplePractice Client Portal.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html