ITSCO
1. Our practice and our responsibilities
This notice applies to ITSCO, LLC and its workforce when providing ITSCO services. It applies to protected health information in paper, electronic, spoken, and other forms. It is not a joint notice for other practices, schools, the Mental Range Collective, or the operator of a technology platform.
We are required by law to protect the privacy of your health information, provide this notice of our legal duties and privacy practices, and follow the notice currently in effect. We must notify you as required by law following a breach of unsecured protected health information. We apply more protective state or federal confidentiality requirements when they apply.
You can exercise the rights below by contacting our Privacy Officer. We will verify identity and representative authority when needed. A portal may help you obtain information, but using a portal is not a condition of exercising your rights.
2. Your health-information rights
- Access and copies. Ask to inspect or receive paper or electronic copies of information in your designated record set, including medical and billing records. We generally respond within 30 days, or sooner if applicable law requires. A permitted extension requires written notice. We provide the requested format when readily producible, or agree with you on an alternative. Any permitted fee is reasonable and cost-based. We explain a denial in writing and any available review rights. Certain records, including separately maintained psychotherapy notes, have access exceptions.
- Corrections. Request an amendment in writing and explain why information is inaccurate or incomplete. We generally respond within 60 days, subject to a legally permitted extension with notice. If we deny the request, we explain why and how to submit a statement of disagreement for your record.
- Confidential communication. Ask us to contact you at a particular number or location or in a particular way. We accommodate reasonable requests. You do not have to explain why you are making the request.
- Restrictions. Ask us to limit uses or disclosures for treatment, payment, operations, or persons involved in your care. We need not agree to every request. We must honor a request to withhold information about a service paid out-of-pocket in full from your health plan for payment or health care operations, unless disclosure is required by law. Agreed restrictions remain subject to applicable emergency and legal exceptions.
- Accounting of disclosures. Ask for a list of disclosures that must be included under HIPAA for a period of up to six years before your request. Treatment, payment, operations, authorized disclosures, and other legally excluded disclosures generally are not included. The first accounting in a 12-month period is free. We tell you in advance about any permitted fee for an additional request and allow you to change or withdraw it.
- Paper notice. Request a paper copy of this notice at any time, even if you previously agreed to receive it electronically.
- Personal representatives. A person legally authorized to act for you may exercise rights within that authority. We verify the authority and follow applicable exceptions, including protections involving abuse, neglect, safety, and confidential care for minors.
- Complaints and breach notice. You may complain to ITSCO or HHS without retaliation. You have the right to receive any breach notification required by law.
3. Treatment, payment, and health care operations
Treatment: we use information to assess needs, plan and provide counseling, coordinate care, and make appropriate referrals. For example, members of your authorized care team may review a treatment plan. Sharing with an outside professional remains subject to applicable consent and confidentiality requirements.
Payment: we use and disclose information to determine coverage, obtain authorizations, bill, collect payment, or respond to a health plan’s payment review. A claim may include information about the service and diagnosis. Your right to restrict certain fully self-paid services is described above.
Operations: we use and disclose information for activities such as clinical supervision, quality and safety review, staff training, compliance, audits, and practice administration. Access must relate to the person’s work and applicable law.
We may contact you about appointments, treatment alternatives, and services related to your care. Communication preferences and separate SMS consent requirements still apply. Business associates providing services such as billing, hosting, or record management must have the agreements and safeguards required by HIPAA.
4. Family, representatives, schools, and your choices
Where permitted, we may share information relevant to a family member’s or other person’s involvement in care or payment if you agree, do not object when given an opportunity, or the law otherwise permits. If you cannot express a preference, a limited disclosure may be made using professional judgment and applicable law, such as in an emergency. We follow stricter rules for mental health or substance use disorder information.
Receiving services at a school does not by itself authorize disclosure of counseling records to school personnel. Any release must have an appropriate legal basis and any required authorization. School-maintained education records may be governed by FERPA rather than HIPAA; this notice describes ITSCO’s records and obligations.
For minors, consent and access depend on the service, legal authority, and applicable confidentiality law. We do not presume that every parent or guardian may see every record. Ask us to explain the rules relevant to your situation.
If we contact you for fundraising as permitted by law, you can opt out of further fundraising communications. Choosing not to receive them does not affect treatment or payment. Before using records protected by Part 2 for fundraising, we provide a clear opportunity to choose not to receive those communications.
5. Other uses and disclosures allowed or required by law
The following categories are subject to legal conditions and to more protective confidentiality rules. A request from an outside party does not automatically permit disclosure. We limit disclosures as required by law.
- Public health and safety: required reporting of disease or other public health matters; reporting suspected child abuse or neglect, abuse of an at-risk person, or domestic violence when authorized or required; and legally permitted action to reduce a serious and imminent threat.
- Oversight and compliance: authorized licensing, auditing, investigation, and health oversight activities, including disclosures to HHS to review compliance with privacy rules.
- Legal proceedings and law enforcement: responding to a valid legal process only after the applicable conditions, privileges, authorizations, and confidentiality protections are satisfied. Special Part 2 restrictions are described below.
- Other public purposes: disclosures permitted for workers’ compensation, specified military or national-security functions, coroners, medical examiners, funeral directors, and organ or tissue donation.
- Research: only with an appropriate authorization or another lawful basis, such as a legally approved waiver and required safeguards. This category does not itself enroll you in a research study.
7. Substance use disorder records and additional protections
Some substance use disorder records are protected by 42 CFR Part 2. If ITSCO receives or maintains these records, we follow the applicable Part 2 rules in addition to HIPAA. This statement does not mean every counseling record is a Part 2 record or that ITSCO is itself a Part 2 program.
Part 2 may allow a single written consent for future treatment, payment, and health care operations. When a HIPAA covered entity or business associate receives records under that consent, subsequent uses and disclosures may be permitted under HIPAA, subject to Part 2’s restrictions and more protective applicable law.
Part 2 records, or testimony describing their contents, cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings or investigations against you without the required specific written consent or a qualifying court order accompanied by a subpoena or similar legal mandate. A routine records request or ordinary subpoena alone does not remove these protections. Consent for proceedings against you must be separate from consent for other purposes.
Colorado and other applicable laws may impose additional limits on mental health communications, minors’ confidential care, and certain other sensitive records. We obtain any consent required by those laws and follow their disclosure limits. A permission described elsewhere in this notice does not override a stricter rule.
Information disclosed to a recipient not subject to HIPAA may be redisclosed and may no longer have HIPAA protection. Other protections, including Part 2 and state confidentiality law, may still apply. We provide legally required disclosure notices.
8. Portals, messaging, recordings, and documentation tools
ITSCO may use electronic records, portals, communications services, and assisted documentation tools to provide and administer care. These tools do not remove our confidentiality duties. We require appropriate safeguards and business associate agreements where required. Clinicians remain responsible for reviewing clinical documentation.
This notice does not authorize recording a session. Recording or transcription consent is handled separately when required. You may decline or withdraw an optional recording consent and discuss alternative documentation with your clinician. You may also request restrictions relating to other technology uses; we evaluate those requests under the rights described above.
Ordinary email and SMS carry privacy risks, including access through shared devices and carrier systems. Ask us for an appropriate way to exchange sensitive information. Choosing to receive texts does not authorize disclosure to another practice or permission for unrelated marketing.
Health records, consent evidence, and associated records are retained according to applicable professional and legal requirements. Exporting information or deleting a working draft does not guarantee immediate removal of all copies, logs, or backups. Replacing a name with initials is not necessarily de-identification under HIPAA.
9. Questions and complaints
Contact the ITSCO Privacy Officer listed below if you have a question, want to exercise a right, or believe your privacy rights were violated. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
HHS Office for Civil Rights: 200 Independence Avenue SW, Washington, DC 20201. The HHS complaint website explains how to file electronically or by mail.
10. Copies, acknowledgment, and changes
We make this notice available on our website and upon request. We may ask you to acknowledge receiving it. An acknowledgment is not consent to treatment, permission to disclose records, agreement to marketing, or a waiver of your rights. If an acknowledgment cannot be obtained, we document our efforts as required.
We may change this notice as permitted by law and make the revised notice apply to information already held and information received in the future. A revised notice will show its effective date and be available on our website, at our service locations, and on request.
Questions, privacy requests, and help
ITSCO, LLC • Privacy Officer: Michael Mendez • 437 Windchime Place, Colorado Springs, CO 80919.
Privacy questions and requests: PO@ITSCO.health or 833-444-8726. Website, portal, and SMS help: support@itsco.health. Please start with your contact information and the type of assistance you need; do not send detailed health information through ordinary email or text. We can arrange an appropriate way to exchange records.