Your record, and exactly who can see it.

Who this notice covers

This notice applies to Greet Health and to every clinician, supervisee, and staff member working at our downtown Gainesville location or delivering telehealth to patients located in Florida. We are a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and are also bound by Florida law, including Chapter 456 and Chapter 394, Florida Statutes.

Where Florida law gives you more protection than HIPAA, the stricter rule applies. This notice does not cover the educational articles on this website — those are addressed in the website privacy policy.

Information we keep

Once you request an appointment or begin care, we create and keep a record that may include:

• Identifying and contact information you give us, including name, date of birth, address, phone, email, and emergency contact.
• Clinical information: intake questionnaires, standardized assessment scores, diagnoses, treatment plans, progress notes, and correspondence with other providers you authorize.
• Session notes. We keep these in your medical record rather than as separate psychotherapy notes (see Section 5).
• Payment records. We are self-pay only, so this is limited to what you paid and when — no claims are submitted to a health plan.
• Scheduling and communication logs: appointment times, portal messages, and the fact that an SMS appointment reminder was sent.
• For telehealth: connection metadata such as session date, duration, and technical quality. We do not record telehealth sessions, audio or video, and never will without your separate written authorization.

How we use it routinely

HIPAA permits us to use and disclose your information for three routine purposes, without a separate authorization:

• Treatment — your clinician documents your care and, when clinically indicated, consults our clinical director or a supervising clinician within the practice. Sharing with an outside provider, including your primary care physician or prescriber, happens only with your written authorization.
• Payment — processing what you owe and receipts you request. If you ask for a superbill or a letter for reimbursement, we prepare it only at your request.
• Health care operations — scheduling, quality review, clinical supervision, training, licensure and accreditation requirements, and technical maintenance of our records systems.

We use vendors for our electronic health record, patient portal, telehealth platform, and messaging. Each one signs a HIPAA business associate agreement that limits what it may do with your information and requires it to protect the information as we do.

Disclosures we may make without your authorization

These are the real limits on confidentiality. We would rather you know them at the start than discover them in a hard moment. In each case we disclose the minimum necessary.

Session notes and your record

HIPAA has a special category called psychotherapy notes: a clinician's private session notes, kept physically and electronically separate from the medical record, which receive heightened protection. We do not maintain notes in that category. Everything your clinician documents about your sessions — what was discussed, how you are doing, what the plan is — is written into your medical record and protected under the same rules as the rest of it.

• Your session notes may be used for treatment, payment, and health care operations as described in Section 3 — the same as the rest of your record — rather than requiring a separate authorization each time.
• Disclosure to anyone outside the practice still requires your written authorization, other than in the situations Section 4 lists — a court order, a mandated report, or a serious and imminent threat.
• You have the right to read your session notes. Because they are part of your medical record, they are included when you request a copy of it — providers may withhold separately-kept psychotherapy notes, and that exception does not apply here.

The trade-off is worth stating plainly: session notes in the record are readable by you, and they are also covered by any release you sign. So when you authorize a disclosure, we go through with you what it will actually include, and you can narrow it — to dates of service, a summary letter, or a treatment plan — rather than releasing the full narrative.

Uses that always require your written authorization

• Marketing. We do not use your information to market anything to you, and we never use a patient story, quote, or photograph without a signed authorization.
• Sale of information. We do not sell protected health information. Full stop.
• Release to third parties. Sending records to an attorney, a school, an employer, a disability insurer, or another clinician happens only when you sign an authorization naming who, what, and for how long.
• Research. We are not conducting research at opening. If that changes, participation is opt-in and separate from your care.

You may revoke an authorization in writing at any time. Revocation stops future disclosures; it cannot undo one already made in reliance on it.

Your rights

Our duties

We are required by law to maintain the privacy and security of your protected health information, to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach compromises the privacy or security of your information.

We may change this notice. A revised notice applies to all information we hold, including information created before the change. The current version is always posted here and at our front desk, with the effective date at the top and prior versions listed below.

Complaints and contact

If you believe your privacy rights have been violated, tell us. You will not be retaliated against, penalized, or refused care for complaining — to us or to anyone else.