Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This notice describes the privacy practices of United Autism Therapy and everyone on our team — our Board Certified Behavior Analysts (BCBAs/LBAs), behavior technicians (RBTs), speech-language pathologists, occupational therapists, and administrative staff, as well as students and trainees under our supervision. It applies to care delivered in our center, in your home, in the community, and by telehealth. Because most of the individuals we serve are children, this notice usually applies to your child’s health information, and a parent or legal guardian generally exercises the rights in this notice on the child’s behalf as their “personal representative.” Where this notice says “you” or “your,” it includes the patient and their personal representative.

We are required by federal law to maintain the privacy and security of your child’s protected health information (“PHI”); to give you this notice of our legal duties and privacy practices and follow the terms of the notice currently in effect; and to notify you promptly if a breach occurs that may have compromised the privacy or security of that information. We will not use or share your child’s information other than as described here unless you tell us we can in writing — and if you do, you may change your mind at any time by telling us in writing.

For the following purposes, we may use or share your child’s health information without your written authorization, subject to the limits of federal and Virginia law:

Except as described in this notice, we will not use or disclose your child’s health information without your written authorization. In particular, we will never: use or share your child’s information for marketing without your written authorization; sell your child’s health information; or share psychotherapy notes (where applicable) except as the law permits. And because our families often ask: we will never publish your child’s name, photo, video, or story — on our website, in testimonials, or on social media — without your separate written permission, which you may decline or revoke at any time without any effect on your child’s care. If you authorize a use of information, you may revoke that authorization in writing at any time; the revocation applies going forward.

You have the following rights regarding your child’s health information. To exercise any of them, contact our Privacy Officer using the information at the end of this notice — we can help you with any request.

• Get a copy of the record. You can ask to see or receive an electronic or paper copy of your child’s record. We will provide it, usually within 30 days, and may charge a reasonable, cost-based fee.



• Ask us to correct the record. If you believe information in the record is incorrect or incomplete, you can ask us to amend it. We may decline in limited circumstances, and if we do, we will explain why in writing within 60 days.


• Request confidential communications. You can ask us to contact you in a specific way or at a specific location — for example, only on your mobile phone — and we will accommodate reasonable requests.



• Ask us to limit what we use or share. You can request restrictions on how we use or disclose information for treatment, payment, or operations. We are not required to agree to every request — but if you pay for a service in full out of pocket and ask us not to share that information with your health plan for payment or operations purposes, we must agree, unless a law requires the disclosure.



• Get a list of disclosures. You can request an accounting of certain disclosures we have made of your child’s information in the six years before your request (this does not include disclosures for treatment, payment, operations, or ones you authorized). One list per year is free; additional lists may carry a reasonable, cost-based fee.


• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.


• Choose someone to act for you. A legal guardian, healthcare power of attorney, or other personal representative may exercise these rights on the patient’s behalf; we will verify their authority before acting on a request.


• Be notified of a breach. We will tell you promptly if a breach may have compromised the privacy or security of your child’s information.


• File a complaint — without any fear of retaliation. If you believe privacy rights have been violated, you can file a complaint with us by contacting our Privacy Officer, and you can file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue S.W., Washington, D.C. 20201 · 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints. We will never retaliate against you for filing a complaint.

A parent or legal guardian generally acts as the personal representative of a minor child and may exercise the rights in this notice on the child’s behalf. Limited exceptions exist — for example, where Virginia law gives a minor the right to consent to certain care and to related confidentiality, or where we reasonably believe that treating a person as the personal representative would not be in the child’s best interest, such as in situations involving suspected abuse or neglect. In those situations, we follow federal and Virginia law.

We can change the terms of this notice at any time, and changes will apply to all health information we maintain, including information created before the change. The current notice — with its effective date — will always be posted on our website and available at our office, and you may request a copy at any time.

If you have questions about this notice or how your child’s information is handled, please contact our Privacy & Compliance Team. United Autism Therapy · Woodbridge, VA — serving all of Northern Virginia · Phone: +1 (703) 261-4446 · Email: info@unitedautismtherapy.com