Notice of Privacy Practices
Kori Abarzua, LCSW, PMH-C
Effective Date: October 2, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
At Kori Abarzua, LCSW, PMH-C, I respect the privacy of your personal and mental health information. I am required by law to maintain the privacy of your protected health information ("PHI"), provide you with this Notice describing my legal duties and privacy practices, and follow the terms of the Notice currently in effect.
This Notice applies to my professional services provided in Connecticut, Florida, Vermont, and South Carolina, as applicable. Where state or federal law provides greater protection for your information, I will follow the more protective applicable law.
YOUR RIGHTS
You have the right to:
Get a copy of your records
You may request to inspect or obtain a copy of your PHI and clinical records, subject to certain legal limitations.
Request a correction
You may ask me to amend information that you believe is incorrect or incomplete. I may deny the request in certain circumstances permitted by law, but I will provide a written explanation if I do so.
Request confidential communications
You may ask me to contact you in a specific way or at a specific location. I will consider reasonable requests related to the confidentiality of your information.
Ask me to limit what I use or share
You may request restrictions on certain uses or disclosures of your PHI. I am not required to agree to every requested restriction.
If you pay for a service completely out of pocket and request that the service not be disclosed to your health plan for payment or healthcare operations purposes, I will comply with that request when required by HIPAA.
Get a list of certain disclosures
You may request an accounting of certain disclosures of your PHI made by me, subject to exceptions provided by law.
Get a copy of this Notice
You may request a paper or electronic copy of this Notice at any time.
Choose someone to act for you
If you have given someone medical power of attorney or another person is legally authorized to act on your behalf, that person may exercise your rights and make decisions regarding your PHI as permitted by law.
File a complaint
You may file a complaint with me or with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated.
You will not be retaliated against for filing a complaint.
HOW I MAY USE AND DISCLOSE YOUR INFORMATION
The following are examples of how I may use or disclose your PHI without your written authorization when permitted by law.
Treatment
I may use or disclose your PHI to provide, coordinate, or manage your mental health treatment.
For example, I may communicate with another healthcare provider involved in your care when permitted by law and when the disclosure is appropriate for your treatment.
Payment
I may use or disclose your PHI to obtain payment for services.
For example, I may provide information to an insurance company or billing service to process claims, verify benefits, or obtain payment for therapy services.
Healthcare Operations
I may use or disclose your PHI for healthcare operations necessary to operate my practice and provide quality care.
Examples may include billing, quality improvement, credentialing, compliance activities, auditing, and maintaining the systems necessary to operate my practice.
Appointment Reminders and Communications
I may use your contact information to contact you about appointments, scheduling, billing, treatment-related matters, or other services related to your care.
You may request that I communicate with you using a particular method or at a particular location.
People Involved in Your Care
Unless you object, I may disclose limited information to a family member, close personal friend, or another person you identify as being involved in your care or payment for your care when the information is directly relevant to that person's involvement.
I may also disclose information to someone involved in your care when permitted by law in situations involving your best interests or emergency care.
Required by Law
I may use or disclose your PHI when required by federal, state, or local law.
Serious Threats to Health or Safety
I may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person, when permitted by law.
Abuse, Neglect, or Domestic Violence
I may disclose PHI when required or permitted by law to report suspected abuse, neglect, or domestic violence to the appropriate authorities.
Judicial and Administrative Proceedings
I may disclose PHI in response to a court or administrative order or certain lawful legal processes when permitted or required by law.
Law Enforcement
I may disclose PHI to law enforcement when permitted or required by applicable law.
Public Health
I may disclose PHI for certain public health activities when permitted or required by law.
USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION
Most uses and disclosures of psychotherapy notes require your written authorization, except in limited circumstances permitted by law.
Other uses and disclosures of your PHI that are not described in this Notice or otherwise permitted or required by law will be made only with your written authorization.
You may revoke an authorization in writing at any time, except to the extent that I have already relied upon the authorization.
I will not sell your PHI or use or disclose your PHI for marketing purposes when an authorization is required by law without first obtaining your written authorization.
PSYCHOTHERAPY NOTES
Psychotherapy notes are treated differently from other portions of your clinical record under federal law.
When I maintain psychotherapy notes as defined by HIPAA, most uses and disclosures of those notes require your written authorization, subject to limited exceptions provided by law.
SUBSTANCE USE DISORDER INFORMATION
Certain substance use disorder records may receive additional protections under federal law, including 42 CFR Part 2.
When applicable, I will comply with the requirements governing protected substance use disorder records.
HIPAA-covered providers that create or maintain Part 2 records are required to include information about Part 2 privacy protections in their Notice of Privacy Practices as of February 16, 2026.
STATE PRIVACY PROTECTIONS
Your mental health information may also be protected by state laws that provide additional confidentiality protections.
For example, Connecticut law provides specific confidentiality protections for communications and records relating to mental health treatment by social workers and other mental health providers.
Vermont law provides confidentiality protections for mental health records and clinical information, subject to specified exceptions.
South Carolina law provides confidentiality protections for records and information relating to mental health treatment, subject to statutory exceptions.
Florida law provides confidentiality protections for clinical mental health records and establishes circumstances in which records may be released.
Where applicable state law provides greater privacy protection than federal law, I will comply with the more protective requirement.
ELECTRONIC COMMUNICATION AND TELEHEALTH
My practice provides telehealth services and may use electronic systems for treatment, scheduling, documentation, communication, billing, and other healthcare operations.
I use reasonable safeguards to protect your PHI. However, no electronic communication system can be guaranteed to be completely secure.
Please avoid sending detailed or highly sensitive clinical information through ordinary email, text message, or website contact forms unless you have been specifically instructed to use a secure platform.
THIRD-PARTY SERVICE PROVIDERS
I may use third-party service providers to support my practice, including services related to:
Electronic health records
Telehealth
Scheduling
Billing and payment processing
Insurance claims
Administrative services
When applicable, these organizations may receive or access PHI as business associates or otherwise as permitted by law. Appropriate safeguards and agreements will be used as required by applicable law.
YOUR RIGHT TO REQUEST RESTRICTIONS
You may ask me to restrict the use or disclosure of your PHI for treatment, payment, or healthcare operations.
I am not required to agree to most requested restrictions.
However, if you pay for a service completely out of pocket and request that the information about that service not be disclosed to your health plan for payment or healthcare operations purposes, HIPAA generally requires me to honor that request.
BREACH NOTIFICATION
I am required by law to notify you following a breach of unsecured PHI when notification is required by law.
MY RESPONSIBILITIES
I am required by law to:
Maintain the privacy and security of your PHI
Provide you with this Notice describing my legal duties and privacy practices
Follow the terms of the Notice currently in effect
Provide you with a copy of this Notice upon request
Notify you as required by law if a breach occurs that compromises the privacy or security of your PHI
I reserve the right to change the terms of this Notice. If I make a material change to my privacy practices, I will update this Notice and make the revised Notice available as required by law.
The current version of this Notice will be available on my website and upon request.
QUESTIONS OR PRIVACY CONCERNS
If you have questions about this Notice or would like to exercise any of your privacy rights, please contact:
Kori Abarzua, LCSW, PMH-C
Email: koriabarzualcsw@gmail.com
You may also contact:
U.S. Department of Health and Human Services
Office for Civil Rights
You may obtain information about filing a HIPAA privacy complaint through the Office for Civil Rights.
You will not be retaliated against for filing a complaint.