Notice of Privacy Practices

Effective Date: June 24, 2026, Updated August 17, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

When it comes to your health information, you have certain rights. What you share in therapy is private, and protecting it is one of our most important responsibilities. This notice explains how we handle your health information, what rights you have over it, and what to do if you have concerns.

It applies to everyone we work with, whether we meet in the office or over video, and in every state where we're licensed. If anything here is unclear, please ask — we're glad to walk through it with you.

1. Who this notice covers

This notice applies to Trellis Therapy of Loudoun, PLLC. We are required by law to protect the privacy of your health information, to give you this notice explaining our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

We are also required to notify you if a breach occurs that compromises the privacy or security of your information.

This notice covers your health information. It does not cover what happens when you visit our website — that is described separately in our Website Privacy Policy.

2. What we mean by "your health information"

Your health information, sometimes called protected health information or PHI, is any information we create or receive about you that relates to your mental or physical health, the care you receive, or payment for that care, and that identifies you or could reasonably be used to identify you.

For a therapy practice, that includes your record: intake paperwork, assessments, diagnoses, treatment plans, session notes, correspondence, billing records, and any information you give us about your history.

3. How we use and share your information without asking you first

There are three purposes for which the law permits us to use and share your information without a separate authorization from you.

3.1 Treatment

We use your information to provide your care and to coordinate it with others involved in your treatment.

For example: if you and we agree that consulting your psychiatrist would be useful, we may share your diagnosis and treatment plan with that psychiatrist. We may also consult with another licensed clinician about your care — a normal and expected part of practicing responsibly — and we will limit what we share to what that consultation requires.

3.2 Payment

We use your information to be paid for the services we provide.

For example: because this practice is private pay and does not contract with insurance, we use your information to process your payment through our payment processor and, if you request one, to prepare a superbill you may submit to your insurer yourself. If you submit a superbill, your insurer will receive the diagnosis and service codes on it. That is your decision to make, and Section 7.4 explains a right that may matter to you here.

3.3 Health care operations

We use your information to run the practice properly and to keep the quality of care high.

For example: reviewing our own documentation, obtaining legal or accounting advice, evaluating clinician performance, and maintaining our records system.

4. Uses and disclosures that require your written authorization

For anything outside Sections 3 and 5, we will ask you to sign an authorization first. The following always require one:

Psychotherapy notes. These are the separate notes a clinician may keep to document or analyze the contents of a session, kept apart from the rest of your record. They receive extra protection under federal law, and almost every disclosure of them requires your specific written authorization.

Marketing. We will not use your information to market anything to you without your authorization.

Sale of your information. We do not sell your health information, and the law would require your authorization before anyone could.

Everything else. Any use or disclosure not described in this notice will be made only with your written authorization.

You can change your mind. You may revoke an authorization at any time by telling us in writing. Revoking it stops any future use or disclosure under that authorization. It cannot undo something we already did in reliance on it, and it does not apply where the law allows us to act without your authorization.

5. Uses and disclosures the law requires or permits without your authorization

These are the situations where we may — and sometimes must — share your information even if you would prefer we did not. We tell you about them in advance so that nothing here comes as a surprise.

When the law requires it. Some disclosures are simply mandatory.

Suspected abuse or neglect. Every clinician here is a mandated reporter. If we have reason to suspect the abuse or neglect of a child, an older adult, or an incapacitated person, we are required to report it to the appropriate authorities. This obligation follows the law of the state where you are located when you receive services.

Serious and imminent threats to safety. If you communicate a serious and imminent threat of physical violence against a clearly identified person, or if there is a serious risk to your own safety, we may disclose the information necessary to prevent harm — to potential victims, to law enforcement, to emergency services, or to people in a position to help. Virginia law addresses this duty specifically at Va. Code § 54.1-2400.1. We will always try to work with you first; disclosure is a last step, not a first one.

Court orders and legal proceedings. If a court orders us to release information, we must comply. If we receive a subpoena that is not accompanied by a court order, we will generally not release your record unless you authorize it or the requesting party demonstrates that the legal requirements for disclosure have been met — and we will make reasonable efforts to notify you first.

Health oversight. We may disclose information to agencies that license and oversee health care providers, including licensing boards conducting an investigation.

Public health activities. We may disclose information to public health authorities for purposes such as preventing disease or reporting reactions to medications.

Coroners, medical examiners, and funeral directors. We may disclose information as necessary for them to perform their duties.

Workers' compensation. We may disclose information as authorized by workers' compensation laws.

Law enforcement. In limited circumstances defined by law, we may disclose information to law enforcement officials.

Specialized government functions. We may disclose information for military, national security, or protective services purposes where the law requires it.

Research. We may use your information for research only where an institutional review board has approved a protocol with privacy protections in place, or where the information has been de-identified. This practice does not currently participate in research.

Business associates. We work with companies that handle your information on our behalf — our electronic health record system, our telehealth platform, our payment processor, and our AI-assisted notetaking tool. Each has signed a business associate agreement requiring it to protect your information under the same standards that apply to us. Our AI-assisted notetaking tool is covered separately by Form 5, which requires your written consent and your verbal consent at the start of each recorded session.

Family, friends, and others involved in your care. We may share information with a family member or friend involved in your care, or in an emergency, but only what is directly relevant and only where you have agreed, have had the opportunity to object, or are unable to agree because of an emergency. You can tell us at any time who may and may not be given information.

6. Information with extra protection

6.1 Psychotherapy notes

See Section 4. These notes are kept separate from the rest of your record and are not released with a general records request. You do not have a right of access to psychotherapy notes under federal law, though we may choose to discuss their contents with you.

6.2 Substance use disorder records

Federal regulations at 42 C.F.R. Part 2 give special protection to records of substance use disorder treatment received from a federally assisted program. This practice is not a Part 2 program. However, we may receive Part 2–protected records from another provider — through a referral, a transfer of care, or a release you sign.

Where we hold information covered by Part 2:

•   We will not re-disclose it to anyone else without your written consent, unless the law specifically permits it.

•   You may give a single consent covering all future disclosures for treatment, payment, and health care operations, rather than signing a separate consent each time.

•   You may revoke that consent at any time, in writing.

•   Part 2 information generally may not be used against you in a criminal investigation or prosecution without a court order meeting specific requirements.

If you are unsure whether something in your record carries these protections, ask us.

6.3 Minors

Where a client is a minor, who controls the record depends on the law of the state where services are provided, on the minor's age, and on the type of care. This is addressed in detail in Form 7 (Minor Client Consent, Custody & Confidentiality Addendum) and, for Illinois clients, in Form 11.

As a general matter, we protect a minor client's therapeutic confidentiality to the greatest extent the law allows, while keeping parents and guardians appropriately informed about treatment. We explain how this will work — to the minor and to the parent — before treatment begins.

6.4 State laws that give you more protection

Where the law of the state in which you are located gives your information more protection than HIPAA does, we follow the stricter law. Because this practice provides telehealth across several states, the specific rules that apply to you follow your physical location at the time of service. Form 4 explains this.

7. Your rights

These rights are yours. Exercising any of them will never affect your care.

7.1 To see and get a copy of your record

You have the right to inspect and obtain a copy of your record, including an electronic copy if you prefer. Ask us in writing.

We will respond within 30 days. Virginia law requires a response within the same period (Va. Code § 32.1-127.1:03(E)). If we need more time, we may take one 30-day extension and will tell you why in writing. We may charge a reasonable, cost-based fee for copies, as the law permits.

There are narrow circumstances in which we may deny access — for example, if a licensed professional determines that access is reasonably likely to endanger you or another person. If we deny access, we will tell you in writing and explain how to have that decision reviewed by another licensed professional.

7.2 To ask us to correct your record

If you believe something in your record is wrong or incomplete, you may ask us in writing to amend it, and you should tell us why.

We may deny the request — for example, if we did not create the record, or if we determine the record is accurate and complete. If we deny it, we will explain why in writing, and you have the right to submit a written statement of disagreement that becomes part of your record and travels with the disputed information.

7.3 To get a list of disclosures

You have the right to an accounting of certain disclosures we made in the six years before your request. This list does not include disclosures for treatment, payment, or health care operations, disclosures you authorized, or disclosures made directly to you.

The first accounting in any twelve-month period is free. We may charge a reasonable, cost-based fee for additional requests, and we will tell you the cost before we proceed.

7.4 To ask us to restrict what we share

You may ask us to limit how we use or share your information. We are not required to agree to every request, but we will consider it seriously, and if we agree we will honor it unless you need emergency treatment.

One restriction we must honor. If you pay for a service in full, out of pocket, you have the right to require that we not disclose information about that service to a health plan for payment or health care operations purposes. Because this practice is entirely private pay, this right is straightforward here — but it becomes relevant if you request a superbill, since submitting it is what puts the information in front of your insurer. If you do not want a service disclosed to your insurer, tell us and do not submit a superbill for it.

7.5 To ask us to contact you a certain way

You have the right to ask that we communicate with you by a particular method or at a particular location — for instance, only by cell phone, or only at a work address, or with no voicemail left. We will accommodate reasonable requests and will not ask you why.

7.6 To get a paper copy of this notice

You may ask for a paper copy at any time, even if you agreed to receive it electronically. This notice is also posted in our office and published on trellisloudoun.com.

7.7 To be told if there is a breach

If a breach occurs that compromises the privacy or security of your unsecured health information, we will notify you as the law requires.

7.8 To have someone act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights on your behalf. We will confirm the person's authority before acting.

7.9 How to exercise a right

Put your request in writing and send it to the address at the top of this notice, or ask us for the appropriate form. We will respond within the timeframes described above. If you would rather talk it through first, call us — most of these requests are simpler than they sound.

8. Your responsibilities

Your care works better when the following are true. These are not legal obligations, but they matter.

•   Give us accurate and complete information about your history, your current symptoms, other providers you see, and any medications you take.

•   Tell us if something in your record looks wrong.

•   Tell us promptly when your address, phone number, or emergency contact changes.

•   Tell us your physical location at the start of every telehealth session, so we can reach emergency services if we ever need to.

•   Follow the practice's policies on scheduling, cancellation, and payment, which are set out in Forms 1 and 3 in your intake forms packet.

•   Tell us if something is not working — about the therapy, the schedule, the bill, or anything else. See Section 11.

•   Treat the privacy of others in the office and, in couples or family work, the confidentiality of the people in the room with you.

9. Our duties

We are required by law to:

•   maintain the privacy and security of your health information;

•   give you this notice describing our legal duties and privacy practices;

•   follow the terms of the notice currently in effect;

•   notify you if a breach compromises your unsecured health information; and

•   obtain your written authorization before using or disclosing your information for any purpose not described in this notice.

We will not condition your treatment on your signing an authorization, except in the narrow circumstances the law allows, and we will not retaliate against you for exercising any right described here.

10. Changes to this notice

We reserve the right to change this notice and to make the revised notice apply to information we already hold as well as to information we create in the future.

If we make a material change, we will post the revised notice in our office and on trellisloudoun.com, and we will make copies available on request. The current version is always identified by the effective date at the top of the first page. You may ask for a copy of the revised notice at any appointment.

11. Concerns, grievances, and complaints

11.1 Start with us

If you are unhappy with your care, your bill, your privacy, or anything about how this practice runs, please tell us. Concerns raised directly are almost always the ones we can actually fix, and in therapy, working through a rupture is often some of the most useful work there is.

Contact Michelle Brueser, LCSW, at info@trellisloudoun.com, or write to the office address at the top of this notice. We will acknowledge your concern promptly and respond in writing if you ask us to.

11.2 Complaint to the federal government

You may file a privacy complaint with the U.S. Department of Health and Human Services. You do not have to come to us first, and you do not need our permission.

Office for Civil Rights

U.S. Department of Health and Human Services

200 Independence Avenue SW, Room 509F, HHH Building

Washington, DC 20201

(800) 368-1019 · TDD (800) 537-7697

ocrportal.hhs.gov/ocr/portal/lobby.jsf

A complaint must generally be filed within 180 days of when you knew or should have known of the problem.

11.3 Complaint to a state licensing board

You may also file a complaint with the licensing board of the state where you were located when you received services.

Virginia:

Virginia Department of Health Professions, Enforcement Division

Perimeter Center, 9960 Mayland Drive, Suite 300

Henrico, VA 23233-1463

Complaint hotline: (800) 533-1560 · (804) 367-4691

Virginia Board of Social Work

9960 Mayland Drive, Suite 300, Henrico, VA 23233-1463

(804) 367-4441 · socialwork@dhp.virginia.gov

Other states. Clinicians at our practice are also licensed in Maryland, the District of Columbia, Delaware, Pennsylvania, Illinois, and North Carolina. If you received services while located in one of those jurisdictions, ask us and we will give you the contact information for that board, or you can find it on the board's website.

11.4 No retaliation

We will never retaliate against you, penalize you, or terminate your services for raising a concern or filing a complaint. This is a promise and it is also the law.

12. Questions

If anything in this notice is unclear, ask. We would much rather explain it than have you wonder.

Michelle Brueser, LCSW

Privacy Officer, Trellis Therapy of Loudoun, PLLC

20915 Ashburn Road, Suite 215, Ashburn, VA 20147-5678

info@trellisloudoun.com

Changes to the Terms of this Notice

We reserve the right to change the terms of this notice. Any modifications will apply to all information we maintain about you. The updated notice will be available upon request in our office and on our website.