Notice of Privacy Practices
Caitlin FitzGerald Counseling and Art Therapy, PLLC
Caitlin FitzGerald, MA, LPC, ATR
12567 W Cedar Dr, Ste 230, Lakewood, CO 80228
(720) 583-5322 | caitlin@cfcounselingandarttherapy.com
Effective date of this version: October 3, 2026
THIS NOTICE DESCRIBES HOW MEDICAL AND MENTAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice describes your rights regarding the privacy of your health information. All other client rights and practice policies are described in my Client Intake Packet and remain in effect. If you have questions about this Notice, please contact me using the information above.
I. My Pledge Regarding Health Information
I understand that health information about you and your care is personal, and I am committed to protecting it. I create a record of the care and services you receive from me to provide quality care and to comply with legal requirements. This Notice applies to all records of your care created or kept by my practice, including information stored in my electronic health record system, SimplePractice.
I am required by law to:
Keep PHI that identifies you private.
Give you this Notice of my legal duties and privacy practices with respect to your PHI.
Follow the terms of the Notice currently in effect.
Notify you if a breach occurs that may have compromised the privacy or security of your PHI.
Where Colorado law provides greater privacy protection than federal law, I follow Colorado law.
II. How I May Use and Disclose Your Health Information
I may use and disclose your PHI for treatment, payment, and health care operations without your written authorization. Not every use or disclosure is listed below, but all permitted uses fall within one of these categories.
Treatment. I may use and disclose your PHI to provide, coordinate, or manage your care, including consulting with or referring you to other health care providers. Disclosures for treatment are not limited to the minimum necessary, because providers need complete information to give quality care. When I consult with other professionals for clinical guidance, I do not share your name or identifying information.
Payment. I may use and disclose your PHI to bill and receive payment for services. For example, I may share your diagnosis, dates of service, and type of service with your health insurance plan, including through SonderMind, to process a claim. If your account becomes past due, I may disclose the minimum information necessary to a collection agency.
Health Care Operations. I may use and disclose your PHI to run my practice, including quality review, licensing and credentialing, audits, and working with business associates such as my electronic health record and billing providers. Business associates are required by contract to protect your information.
Appointment Reminders and Services. I may use your PHI to send appointment reminders or tell you about treatment options and health-related services I offer.
III. Uses and Disclosures That Require Your Authorization
Other than the uses described in this Notice, I will not use or disclose your PHI without your written authorization. You may revoke an authorization in writing at any time. A revocation does not apply to information already disclosed while the authorization was in effect.
Psychotherapy Notes. I may keep "psychotherapy notes" as defined in 45 C.F.R. 164.501. These are kept separate from your clinical record. Any use or disclosure of these notes requires your written authorization, except: (a) for my use in treating you; (b) for training or supervising mental health practitioners; (c) to defend myself in a legal proceeding you bring against me; (d) for the Secretary of Health and Human Services to investigate my compliance with HIPAA; (e) when required by law, limited to what the law requires; (f) for health oversight activities related to the author of the notes; (g) for a coroner or medical examiner performing duties authorized by law; and (h) to help prevent a serious threat to the health or safety of you or others.
Marketing. I will not use or disclose your PHI for marketing purposes.
Sale of PHI. I will not sell your PHI.
Artwork. Artwork you create in session is part of your clinical record. I will not share it outside of treatment, supervision, or consultation without your written consent through my Artwork Release.
IV. Uses and Disclosures That Do Not Require Your Authorization
Subject to certain limits in the law, I may use or disclose your PHI without your authorization in the following situations. I will disclose only the minimum information necessary and will make every effort to inform you when it is safe to do so.
Required by Law. When state or federal law requires it, limited to what the law requires.
Abuse and Neglect Reporting. To report suspected abuse, neglect, or exploitation of a child, an elder, or an at-risk adult to the appropriate agency, as required by Colorado law.
Serious Threat to Health or Safety. To prevent or lessen a serious and imminent threat to your health or safety or that of another person, including Colorado's duty to warn and protect.
Health Oversight. To agencies authorized by law to oversee health care, such as the Colorado Division of Professions and Occupations, for audits, investigations, and licensing activities.
Judicial and Administrative Proceedings. In response to a court or administrative order. I may also respond to a subpoena or other lawful request if efforts have been made to notify you or to obtain a protective order. My preference is to obtain your authorization first.
Law Enforcement. For limited law enforcement purposes permitted by law, such as reporting a crime on my premises.
Coroners and Medical Examiners. When they are performing duties authorized by law.
Emergencies. To the extent necessary for emergency medical care to be provided.
Specialized Government Functions. For military, national security, or correctional purposes as permitted by law.
Workers' Compensation. To comply with workers' compensation laws. My preference is to obtain your authorization first.
Research. For research that has been approved through a process that protects your privacy.
V. Uses and Disclosures You May Object To
Family, friends, and others involved in your care. I may share PHI with a family member, friend, or other person you identify as involved in your care or in paying for it, unless you object in whole or in part. In an emergency, I may share information if I believe it is in your best interest and will give you the opportunity to object as soon as possible afterward.
Minor clients. Clients age 12 and older in Colorado may consent to their own outpatient psychotherapy. For these clients, the client controls access to their health information, as described in my Client Intake Packet.
VI. Your Rights Regarding Your Health Information
To exercise any of these rights, please submit your request in writing using the contact information at the top of this Notice.
Right to Request Restrictions. You may ask me not to use or disclose certain PHI for treatment, payment, or health care operations. I am not required to agree, and I may decline if it would affect your care.
Right to Restrict Disclosures to Your Health Plan. If you pay for a service in full out of pocket, you may ask me not to share information about that service with your health plan. I will agree unless the law requires me to share it.
Right to Confidential Communications. You may ask me to contact you in a specific way, such as at a certain phone number or mailing address. I will agree to all reasonable requests.
Right to Inspect and Copy. You may request an electronic or paper copy of your clinical record, other than psychotherapy notes. I will respond within 30 days of your written request. I may provide a summary if you agree, and I may charge a reasonable, cost-based fee as permitted by law. In limited circumstances I may deny access, and you may request a review of that decision.
Right to Amend. If you believe information in your record is incorrect or incomplete, you may ask me to correct it. I will respond within 60 days. If I deny your request, I will explain why in writing, and you may submit a statement of disagreement.
Right to an Accounting of Disclosures. You may request a list of disclosures I have made of your PHI in the past six years, other than for treatment, payment, health care operations, or disclosures you authorized. I will respond within 60 days. The first list in a 12-month period is free; I may charge a reasonable, cost-based fee for additional requests.
Right to Be Notified of a Breach. You have the right to be notified if a breach of your unsecured PHI occurs.
Right to a Copy of This Notice. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
VII. Complaints
If you believe your privacy rights have been violated, you may file a complaint with me or with the U.S. Department of Health and Human Services. I will not retaliate against you for filing a complaint.
With me: Caitlin FitzGerald, MA, LPC, ATR, (720) 583-5322, caitlin@cfcounselingandarttherapy.com
With HHS: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. Call 1-877-696-6775 or file online at hhs.gov/ocr/complaints.
With the State of Colorado: Concerns about my professional conduct may be directed to the Colorado Division of Professions and Occupations, Mental Health Licensing Section, 1560 Broadway, Suite 1350, Denver, CO 80202, (303) 894-7800.
VIII. Changes to This Notice
I reserve the right to change the terms of this Notice. Changes will apply to all PHI I hold about you. The current Notice will be available on my website, in my SimplePractice Client Portal, in my office, and upon request.
IX. Effective Date
Effective date of this version: October 3, 2026. This Notice replaces all prior versions.