Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.
Please read it carefully.

I have a duty to safeguard your protected health information (PHI)

I am required by law to protect the privacy of your PHI. This includes information that can identify you and relates to your past, present, or future health or condition, the care provided to you, or payment for that care.

To fulfill this duty, I follow the “minimum necessary” rule, which means that for most uses and disclosures, I only share the smallest amount of information necessary to accomplish the intended purpose

I create and store your records as part of my regular practice. These records are used to support your care and to meet professional and legal requirements. Records are maintained using cloud-based electronic systems (online storage) and are retained for a minimum of 7 years. I also use artificial intelligence (AI) tools to assist in creating records. While safeguards are in place to protect your information from unauthorized access, there are inherent risks associated with electronic systems, and no system can be completely secure.

Your information may be stored or processed outside of Japan, and privacy protections in those locations may differ.

I will follow the privacy practices described in this notice and notify you following a breach of unsecured PHI when required by law.

I reserve the right to change the terms of this notice at any time. Any changes will apply to PHI already on file. The current version will be available on my website or upon request.

How I May Use and Disclose Your PHI

A. I may use and share your protected health information (PHI) or personal data for these purposes without your written authorization:

  1. For Treatment: I may disclose your PHI to other health care providers involved in your care, though I make every effort to obtain your written consent beforehand.
  2. For Payment: To bill and collect payment for services.
  3. For Operations of my practice: To operate my practice, including consultation, supervision, legal, accounting, and administrative purposes.
  4. To Avoid Harm: For emergency or imminent risk of serious harm to you or others to help keep you or others safe.
  5. When Disclosure is Required by Law: For example, when law requires me to release PHI regarding victims of abuse or neglect.
  6. For Specific Government Functions: For example, national security or intelligence operations.

B. Other Uses and Disclosures Require Your Written Authorization:

  1. Marketing Purposes: I will not use or disclose your PHI for marketing purposes without your written authorization.
  2. Sale of PHI: I will not sell your PHI in the regular course of my business.
    In any other situation not described in the sections above, I will ask for your written authorization before using or disclosing any of your PHI.

Private Notes (“Psychotherapy Notes”)

In addition to your official record, I keep private notes from our sessions to help me reflect on our work together. Because these are for my own professional reference, they are maintained separately for my own professional use and are not part of the clinical record typically made available to clients. I also limit the sharing of these notes with others. Aside from rare legal requirements, I only disclose them to others if you provide a specific, separate authorization, or as permitted for my practice operations—such as for my own professional training or legal defense.

What Rights You Have Regarding Your PHI

You have the following rights:

  1. Request Limits on Uses and Disclosure of Your PHI: You may ask me to limit how I use or share your information. I will consider your request, but I am not required to agree. If I do agree, I will honor that limit except in emergencies or when disclosure is legally required.
  2. Choose How I Send PHI to You: You may request that I send information to you in a specific way. I will honor reasonable requests, consistent with my communication practices and the need to maintain the security and confidentiality of your information.
  3. Get Copies of Your PHI: You may request to see or get a copy of your records. Requests must be in writing. I will respond within 30 days. In some cases I may deny your request, but I will explain the reason in writing and tell you about your right to request a review. Fees may apply.
  4. The Right to Get a List of the Disclosures I Have Made: You may request a list of times I disclosed your information in the past six (6) years, except for disclosures you authorized in writing; for counseling coordination, payment, or practice operations; made directly to you; for national security/intelligence, to correctional/law-enforcement custodial officials, or as part of a limited data set; or otherwise excluded by law. Timing & fees: I will respond within 60 days (one 30-day extension possible with written notice). The first accounting in any 12-month period is free; reasonable cost-based fees may apply for additional requests.
  5. Correct Your PHI: If you believe there is a mistake or missing information in your record, you may ask me to correct or add to it. Requests must be in writing with your reason. I will respond within 60 days. If I deny the request, I will explain why and you may add a statement of disagreement to be included with future disclosures.
  6. Copy of This Notice: You may request a paper or electronic copy of this Notice at any time, even if you have agreed to receive it by email.
  7. Right to Restrict Disclosures for Out-of-Pocket Payments: If you pay for a session or service entirely on your own (without using insurance), you have the right to ask me not to share that specific information with your health plan for payment or operations. I will honor this request unless a law requires me to share it.

How to Complain About My Practices

If you believe your privacy rights have been violated, you may file a complaint with me:

Brian O’Sullivan, LMFT

[email protected]
090-6868-2672

You may also file a complaint with:

  • In Japan: Personal Information Protection Commission
  • In the United States: Department of Health and Human Services

I will not retaliate against you for filing a complaint.

EFFECTIVE DATE OF THIS NOTICE This notice went into effect on April 13, 2026