Offering individual, couples, family and group therapy in-office and online.
Approved to practice telehealth under PSYPACT and with NY State Residents.

Notice of Privacy Practices

Barbara Winter PhD PA
Effective Date: August 9, 2025

This Notice describes how your protected health information (PHI) may be used and disclosed, and how you can access this information. Please review it carefully. 

I. Uses and Disclosures for Treatment, Payment, and Health Care Operations

We may use or disclose your PHI for treatment, payment, and healthcare operations with your consent.

Definitions:

  • PHI: Information in your health record that could identify you.
  • Treatment: Coordinating or managing your care, such as consulting with another healthcare provider.
  • Payment: Obtaining reimbursement from your health insurer, confirming coverage, or related billing activities.
  • Healthcare Operations: Practice management activities, quality improvement, audits, administrative services, case management, and care coordination.
  • Use: Internal activities within this practice.
  • Disclosure: Providing access or transferring information outside this practice.

II. Uses and Disclosures Requiring Authorization

Any use or disclosure of PHI outside of treatment, payment, or healthcare operations requires your written authorization.

  • This includes psychotherapy notes, which are kept separate from your medical record and given special protection.
  • Authorizations may be revoked in writing at any time, except where we have already acted in reliance on them or where required by insurance law.
  • We will also obtain authorization before:
    1. Using or disclosing PHI in ways not described in this Notice.
    2. Using or disclosing psychotherapy notes.
    3. Using PHI for marketing.
    4. Disclosing PHI in a sale of PHI.

III. Uses and Disclosures Permitted Without Consent or Authorization

We may use or disclose PHI without consent or authorization in certain situations, including but not limited to:

  • Child abuse or neglect: As required by Florida law.
  • Abuse of a vulnerable adult: As required by Florida law.
  • Health oversight: Compliance investigations by the Florida Department of Health or other oversight agencies.
  • Judicial or administrative proceedings: As required by subpoena or court order, consistent with state law.
  • Serious threat to health or safety: If there is an immediate probability of physical harm to yourself or others.
  • Workers’ compensation: As required to process a workers’ compensation claim.
  • Public health and government functions: Certain narrowly defined disclosures to law enforcement, coroners, the FDA, public health authorities, and for national security purposes.

IV. Telehealth and Interstate Practice

We provide services via HIPAA-compliant telehealth platforms to eligible clients located in participating PSYPACT states and to residents of New York under applicable licensing laws. The same privacy protections described in this Notice apply to all telehealth sessions, including secure video and audio communications. 

V. Patient Rights

You have the right to:

  1. Request restrictions on certain uses or disclosures of your PHI (we are not required to agree).
  2. Request confidential communications by alternative means or at alternative locations.
  3. Inspect and copy your PHI (subject to certain legal limitations).
  4. Request an amendment to your PHI.
  5. Receive an accounting of certain disclosures of PHI.
  6. Obtain a paper copy of this Notice, even if you have agreed to receive it electronically.
  7. Restrict disclosure to health plans if you pay for services out-of-pocket in full.
  8. Be notified of a breach involving your unsecured PHI.
  9. Opt out of fundraising communications (if applicable).

VI. Our Duties

We are required by law to:

  • Maintain the privacy of PHI.
  • Provide you with this Notice of our legal duties and privacy practices.
  • Follow the terms of the Notice currently in effect.
  • Notify you following a breach of unsecured PHI without unreasonable delay, and no later than 60 days from discovery.

We reserve the right to change the terms of this Notice and make the new provisions effective for all PHI we maintain. Updated Notices will be provided in person, by mail, or electronically within 60 days of any significant change.

VII. Business Associates

We may engage third parties (e.g., billing services, attorneys, IT providers) who require access to PHI to perform services on our behalf. These “business associates” are required by contract to safeguard PHI in compliance with HIPAA.

VIII. Complaints

If you believe your privacy rights have been violated, you may file a written complaint with:

Barbara Winter PhD PA
2295 NW Corporate Blvd, Suite 231
Boca Raton, FL 33431

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate for filing a complaint.

This Notice replaces all previous Notices of Privacy Practices and is effective August 9, 2025.