HIPAA Notice of Privacy Practices

1. What We Promise You

Before getting into the legal detail, here is what our obligations come down to:

• We are required by law to keep your protected health information private and secure, to follow the practices described in this notice, and to give you a copy of it.
• Your diagnosis is never shared with your landlord. A housing provider who receives your ESA letter learns only that a licensed professional has documented a disability-related need, nothing more. That limit is built into the Fair Housing Act, 42 U.S.C. § 3604(f)(3)(B).
• We never sell your health information, use it for marketing, or share psychotherapy notes without your written permission.
• If a breach ever compromises your information, we will notify you promptly.
• Anything beyond what this notice describes requires your written authorization, and you can revoke that authorization at any time by telling us in writing.

2. How Your Information Is Used to Serve You

Three everyday uses keep our service running. These do not require separate permission from you:

Clinical evaluation and care. The LMHP assigned to your case reviews your screening responses, conducts your evaluation, and documents whether an emotional support animal or psychiatric service dog is an appropriate part of your treatment plan. Your information may also be shared with other professionals involved in your care, for instance if your clinician consults a colleague or refers you for in-person follow-up.

Operating our platform. We use your information to manage your account, schedule consultations, send appointment reminders and letter-delivery notifications, respond to your support requests, and improve the quality of our services.

Payment. We share limited information with our payment processor to complete your transaction and maintain billing records as the law requires.

3. When the Law Permits or Requires Disclosure

Certain disclosures are permitted or mandated by law, usually because they serve the public good. We must satisfy strict legal conditions before making any of them:

A stronger shield for substance use records. If we hold substance use disorder patient records covered by 42 CFR Part 2, those records cannot be used against you in any civil, criminal, administrative, or legislative investigation or proceeding unless you consent in writing or a court issues both an order and a subpoena. This protection applies across every category in the table above.

4. Choices That Stay in Your Hands

Some sharing only happens on your terms. Tell us your preference and we will follow it:

• Whether we share information with family members, close friends, or anyone else involved in your care or in paying for it
• Whether we share information in a disaster relief situation
• Whether we contact you for fundraising. You can opt out at any time, and if Part 2 substance use records are involved, we must give you clear advance notice and a choice first

If you are ever unable to tell us your preference, for example due to incapacitation, we may share information when we believe it is in your best interest, or when needed to lessen a serious and imminent threat to health or safety.

And to repeat the bright line from Section 1: marketing use, sale of your information, and most sharing of psychotherapy notes never happen without your written permission. No exceptions.

5. Your Eight Rights Over Your Health Information

Federal law gives you specific, enforceable rights. Here is each one, and what to expect when you use it:

Right 1: Access your records. Ask for an electronic or paper copy of your medical record, evaluation notes, and your ESA or PSD letter. We respond within 30 days and may charge only a reasonable, cost-based fee.

Right 2: Request corrections. If you believe information in your record is wrong or incomplete, ask us to amend it. If we decline, we will explain why in writing within 60 days.

Right 3: Choose how we contact you. Prefer email over phone, or a different mailing address? Ask, and we will honor every reasonable request for confidential communications.

Right 4: Restrict sharing. You can ask us to limit what we use or share for treatment, payment, or operations. We are not always required to agree (for example, if the restriction could affect your care), but one restriction is guaranteed: if you pay for a service entirely out of pocket, you can direct us not to share that information with your health insurer, and we must comply unless another law requires the disclosure.

Right 5: See who we’ve told. Request an accounting of disclosures covering the six years before your request, including who received your information and why. Routine disclosures for treatment, payment, and operations are excluded. Your first accounting each year is free.

Right 6: Get this notice on paper. Even if you agreed to electronic delivery, you can request a printed copy at any time and we will provide it promptly.

Right 7: Appoint a representative. Someone with legal authority, such as a medical power of attorney or a legal guardian, can exercise these rights for you. We verify that authority before acting on it.

Right 8: Complain without fear. If you believe your privacy rights were violated, contact us at info@RealESAletter.com or by call/text at (800) 372-0148. You may also complain directly to the U.S. Department of Health and Human Services Office for Civil Rights: by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or through the HHS complaint portal. We will never retaliate against you for filing a complaint.

6. How RealESALetter.com and Your Clinician Work Together

The licensed mental health professionals on our panel are independent providers, not our employees. Where RealESALetter.com acts as a business associate to your clinician, we handle your PHI under HIPAA’s business associate rules and a written agreement that binds us to the safeguards in this notice. Your treatment relationship, and the clinical judgment behind your letter, belongs to your LMHP.

Some states layer additional protections on top of HIPAA, particularly for mental health records. Where state law is stricter, we follow the stricter standard, and we may ask for your consent before making disclosures that state law puts under your control.

7. Updates to This Notice

We may revise this notice, and any revision applies to all information we hold about you. The current version is always posted at realesaletter.com and available on request. When we make material changes, we will update the effective date at the top of this page.

Contact