Notice of Privacy Practices

Original Effective Date: June 24, 2026, Updated on August 26, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Trellis Therapy of Loudoun, PLLC ("we," "us," "the practice") is committed to protecting the privacy of your health information. This notice describes how we may use and disclose your Protected Health Information (PHI) and your rights regarding it. We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. Parts 160 and 164, to maintain the privacy of your PHI, to give you this notice, to abide by its terms, and to notify you of any breach of unsecured PHI.

Who this notice covers. This notice applies to Trellis Therapy of Loudoun, PLLC. We are required by law to protect the privacy of your health information, to give you this notice explaining our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to tell you if a breach compromises the privacy or security of your information. It applies to your health information, not to visits to our website.

What we mean by your health information. Your health information — sometimes called protected health information, or PHI — is any information we create or receive about you that relates to your mental or physical health, the care you receive, or payment for that care, and that identifies you or could reasonably be used to identify you. It includes intake paperwork, assessments, diagnoses, treatment plans, session notes, correspondence, and billing records.

1. Your Rights

To inspect and copy PHI. You can ask for an electronic or paper copy of your clinical and billing records by submitting a written request.  A reasonable, cost-based fee may apply. We may deny a request if a licensed health care professional determines that access would endanger your life or another person's safety — and you have the right to have that decision reviewed. We will never withhold your records because of an unpaid balance.

There are narrow circumstances in which we may deny access — for example, if a licensed professional determines that access is reasonably likely to endanger you or another person. If we deny access, we will tell you in writing and explain how to have that decision reviewed by another licensed professional.

To ask us to correct your record. You can ask us to amend information you believe is incorrect or incomplete. Make the request in writing and give a reason. We may deny the request — for example, if we did not create the record, or if we determine the record is accurate and complete. If we deny it, we will explain why in writing, and you have the right to submit a written statement of disagreement that becomes part of your record and travels with the disputed information.

To ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree if it would affect your care. If you pay for a service in full out of pocket, you can require us not to share that information with a health insurer, and we must honor that.

Because this practice is entirely private pay, this right is straightforward here — but it becomes relevant if you request a superbill, since submitting it is what puts the information in front of your insurer. If you do not want a service disclosed to your insurer, tell us and do not submit a superbill for it

To get a list of disclosures. You have the right to an accounting of certain disclosures we made in the six years before your request. This list does not include disclosures for treatment, payment, or health care operations, disclosures you authorized, or disclosures made directly to you. The first accounting in any twelve-month period is free. We may charge a reasonable, cost-based fee for additional requests, and we will tell you the cost before we proceed.

To ask us to contact you a certain way. You have the right to ask that we communicate with you by a particular method or at a particular location — for instance, only by cell phone, or only at a work address, or with no voicemail left. We will accommodate reasonable requests and will not ask you why.

To get a paper copy of this notice. At any time, even if you agreed to receive it electronically. This notice is also posted in our office and published on trellisloudoun.com/notice-of-privacy-practices.

To choose someone to act for you. A person with medical power of attorney, or a legal guardian, can exercise your rights once we have verified their authority.

To be free from retaliation. We will never retaliate against you for exercising any right in this notice or for filing a complaint.

2. How Quickly We Respond to a Records Request

This is measured from our receipt of your written, dated, signed request.

We respond to a written, dated, signed request within 30 days if you received services in Virginia, Delaware, the District of Columbia, Illinois, North Carolina, Pennsylvania, or Florida. In Virginia we may take one additional 30-day extension if we notify you in writing and explain why (Va. Code § 32.1-127.1:03). If you received services in Maryland, we respond within 21 working days, and Maryland caps records fees by law. Use the Authorization to Release / Exchange Information to make the request.

3. Your Choices

For some information you can tell us your preference, and we will follow it. You can tell us to share, or not share, information with family, close friends, or others involved in your care or in paying for it.

If you are unable to tell us your preference — in an emergency, for example — we will use professional judgment and share only what is necessary in your best interest or to lessen a serious and imminent threat to health or safety.

We will never share the following without your written authorization: marketing, sale of your information, or your psychotherapy notes.

Marketing. We will not use your information to market anything to you without your authorization. No mobile or email information will be shared with third parties/affiliates for marketing/promotional purposes.All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Sale of your information. We do not sell your health information, and the law would require your authorization before anyone could.

Psychotherapy notes. These are your clinician's private process notes. They are kept separate from the rest of your record and are not released with a general records request. You do not have a right of access to psychotherapy notes under federal law, though we may choose to discuss their contents with you. Releasing them requires a separate, standalone authorization.

Family, friends, and others involved in your care. We may share information with a family member or friend involved in your care, or in an emergency, but only what is directly relevant and only where you have agreed, have had the opportunity to object, or are unable to agree because of an emergency. You can tell us at any time who may and may not be given information.

4. How We Typically Use and Share Your Information

To treat you. We may share information with other professionals involved in your care — for example, coordinating with your physician, with your authorization where required.

To run the practice. Scheduling, quality of care, contacting you about appointments, and administrative operations.

To bill for services. This practice is strictly out of network and does not submit claims to insurers. You pay us directly. On request we provide a superbill — an itemized statement — that you may submit to your insurer, which requires sharing a diagnosis code with them.

5. Uses and Disclosures We May Make Without Your Authorization

Only in these limited circumstances, and limited to the minimum necessary:

• Public health and safety. We may disclose information to public health authorities for purposes such as preventing disease or reporting reactions to medications.

• Serious and imminent threats to safety. To prevent a serious and imminent threat to your safety or to an identifiable person.

• Abuse, neglect, or exploitation. Mandatory reporting of suspected abuse, neglect, or exploitation of a child, older adult, or vulnerable adult — to the agency in the state where you are physically located at the time of the session.

• Required by law. Where federal, state, or local law compels disclosure.

• Specialized government functions. We may disclose information for military, national security, or protective services purposes where the law requires it.

• Health oversight. Audits, investigations, and inspections by agencies that oversee health care and licensing. We may disclose information to agencies that license and oversee health care providers, including licensing boards conducting an investigation.

• Judicial, legal, and administrative proceedings. If a court orders us to release information, we must comply. If we receive a subpoena that is not accompanied by a court order, we will generally not release your record unless you authorize it or the requesting party demonstrates that the legal requirements for disclosure have been met — and we will make reasonable efforts to notify you first. See Section 6 for the stronger rule that applies to substance use records.

• Coroners, medical examiners, and funeral directors. We may disclose information as necessary for them to perform their duties.

• Law enforcement and other governmental agencies, as and only as required by law.

• Workers' compensation, to comply with those laws.

• Business associates. We work with companies that handle your information on our behalf: our electronic health record system (TherapyNotes), our video, recording, transcription, and AI-summary platform (Zoom, including Zoom AI Companion), our phone and text messaging platform (Spruce), and our payment processor (Ivy Pay). Each has signed a Business Associate Agreement requiring it to protect your information under the same standards that apply to us. Our AI-assisted notetaking tool requires your written consent in advance, on the AI-Assisted Notetaking, Recording & Transcription Consent, and is reviewed and renewed each year. Texting is optional and covered by the Text Message (SMS) Communication Consent. Please note that a text message travels over your mobile carrier's network, which we do not control and which is not a secure or confidential channel — for that reason we keep text messages to scheduling and brief administrative matters, never to clinical content. We do not share or sell consumer personal information (including phone numbers and email addresses) to third parties or affiliates for marketing, promotion, or lead generation.

6. Information With Extra Protection

Federal regulations at 42 C.F.R. Part 2 give special protection to records of substance use disorder treatment received from a federally assisted program. This practice is not a Part 2 program. However, we may receive Part 2–protected records from another provider — through a referral, a transfer of care, or a release you sign. Records relating to substance use disorder diagnosis, treatment, or referral that we receive from a Part 2 program carry protection stronger than HIPAA.

• They cannot be used against you in any civil, criminal, administrative, or legislative proceeding without your written consent or a Part 2-compliant court order. A subpoena alone is not enough — and neither is a court order by itself. To compel these records, a Part 2-compliant court order must be accompanied by a subpoena or other lawful demand for the records. We will tell you if we receive either, unless the law forbids us from doing so.

• Any disclosure we make will carry the written prohibition-on-redisclosure notice required by 42 C.F.R. § 2.32.

• Disclosure requires your explicit written consent, except in narrow circumstances defined by law — a medical emergency, a crime committed on the premises or against practice personnel, or a report of suspected child abuse or neglect.

• You may revoke your consent at any time.

Use the Authorization to Release / Exchange Information for Part 2 records. Do not use this notice for that purpose — federal law prohibits combining a privacy notice with an authorization (45 C.F.R. § 164.508(b)(3)).

Minors. Where a client is a minor, who controls the record depends on the law of the state where services are provided, the minor's age, and the type of care. This is addressed in detail in the Minor Consent and Confidentiality Addendum and, for Illinois clients, in the Illinois Minor Consent Addendum. As a general matter we protect a minor client's therapeutic confidentiality to the greatest extent the law allows, while keeping parents and guardians appropriately informed. We explain how this will work — to the minor and to the parent — before treatment begins.

State laws that give you more protection. Where the law of the state in which you are located gives your information more protection than HIPAA does, we follow the stricter law. Because this practice provides telehealth across several states, the specific rules that apply to you follow your physical location at the time of service.

7. The Minimum Necessary Standard

We make every reasonable effort to limit the use, disclosure, or request of your Protected Health Information (PHI) to the minimum necessary amount required to accomplish the intended purpose of the treatment, payment, or healthcare operation. We do not access, share, or request your full clinical record unless it is explicitly justified and necessary for your ongoing care or required by law.

8. Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.

• We are required to abide by the terms of the notice currently in effect. Where a more stringent state or federal law applies, we follow the more stringent law.

• We will notify you promptly if your information is compromised in a breach.

• Records are maintained in a HIPAA-compliant electronic health record with administrative, physical, and technical safeguards. Paper records are stored securely and destroyed in compliance with law.

• We reserve the right to change this notice. Changes apply to all information we maintain. A revised notice will be available on request, posted in the office, and published on trellisloudoun.com/notice-of-privacy-practices.

9. Grievances, Complaints, and How to Reach Us

If you are unhappy with your care, your bill, or anything about how this practice operates, raise it directly. Concerns raised directly are almost always the ones we can fix, and working through a rupture is often useful clinical work in itself. Raising a concern will never result in retaliation, penalty, or termination of your services. You will receive a response — by phone, letter, or in session — describing what we have done about it.

If we can't resolve it, you may file a complaint with the state licensing board. Because this practice is licensed in several states, file with the board of the state where you were physically located when you received services.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/hipaa/filing-a-complaint/. A complaint must generally be filed within 180 days of when you knew or should have known that the act or omission complained of occurred. We will not retaliate against you for filing a complaint.

Privacy Officer and Practice Administrator:
Michelle Brueser, LCSW, LICSW, LCSW-C, LCAS
20915 Ashburn Road, Suite 215, Ashburn, VA 20147
(571) 746-5366
info@trellisloudoun.com

If anything in this notice is unclear, ask. We would much rather explain it than have you wonder.

10. Changes to the Terms of this Notice

We reserve the right to change the terms of this notice. Any modifications will apply to all information we maintain about you. The current notice will always be available on request, posted in our office, and published at trellisloudoun.com/notice-of-privacy-practices.