Notice of Privacy Practices

This notice describes how your information may be used and disclosed and how you can get access to this information.
Please read it carefully.

My Duty

I am required by law to protect the privacy of your protected health information (PHI). To fulfill this duty, I limit access to and disclosure of personal information to what is reasonably necessary for the purpose, consistent with professional standards. I will follow the privacy practices described in this notice and notify you of a data breach when required by law.

Electronic Records & Security

I maintain a confidential electronic record of your care, including intake forms, session notes, billing, and communications. To support practice operations, I use trusted cloud-based services that employ industry-standard safeguards designed to protect your information from unauthorized access. Some of these providers operate infrastructure outside Japan, and your data may therefore be stored or handled outside Japan.

The services I use are subject to applicable and strict privacy protections and are configured to support HIPAA compliance. I maintain Business Associate Agreements (BAAs) and security agreements with these service providers. Safeguards include encryption, access controls, authentication measures, system monitoring, backups, and procedures for responding to security incidents.

In line with professional counseling standards, records are retained securely for a minimum of 7 years following our last date of contact.

How I May Use Your Information

I use your protected health information (PHI) to:

  • Schedule appointments, communicate with you, create and maintain records as required by professional standards, and deliver services to you.
  • Process billing and payments for services rendered using third-party payment processors.
  • Conduct routine practice operations, such as legal compliance, accounting, or professional consultation.
  • Submit required administrative or billing information to third-party payers (such as EAPs or TRICARE) only when you request these services and provide a signed authorization.
  • Comply with legal or regulatory requirements, including certain safety, abuse-reporting, public health, law enforcement, and judicial review.

When permitted or required by law, some of these uses may involve providing limited information to another person or organization. I will limit such information to what is reasonably necessary for the purpose. I will not sell or use your information for marketing purposes without your written permission.

Limits to Confidentiality

I keep information about your care confidential. In limited circumstances, I may be required by law or ethical duties to break confidentiality without your authorization, including cases of suspected child, elder, or dependent adult abuse/neglect, when there is an imminent threat of harm to yourself or others, comply with legal requirements, or respond to certain legal or regulatory matters.

To maintain quality care, I occasionally consult with professional colleagues bound by strict ethics. I take precautions to protect your privacy by omitting your name and minimizing identifying details.

I will obtain your written authorization when required by applicable law before providing your information for other purposes.

Private Notes

I may keep separate psychotherapy notes to help me reflect on our work together. Because these are for my own professional reference, they are not part of the clinical record made available to clients. These notes have additional privacy protections when U.S. law applies. I will obtain your written authorization before using or providing these notes except when permitted or required by law.

Your Rights

You have the following rights regarding your information and records I maintain:

  1. Access & Inspect: You have the right to request and inspect a copy of your clinical record (such as intake documents, formal session summaries, diagnosis, treatment plans, and billing history).
  2. Request Corrections: If you believe information in your official record is inaccurate or incomplete, you may submit a written request asking me to amend the record.
  3. Revoke Authorization: If you sign a Release of Information allowing me to communicate with an outside party, you may revoke that authorization in writing.
  4. Privacy Inquiries & Complaints: If you have questions about how your privacy is handled or wish to express a concern regarding your data, you may discuss it with me directly. You also have the right to file a complaint with my licensing board, relevant privacy authority, or U.S. Department of Health and Human Services, Office of Civil Rights. You will not be retaliated against for filing a complaint.

I may change this Notice from time to time. The current version will be available on my website or upon request. Changes will be effective as required by applicable law.

This version is effective September 15, 2026

Brian O’Sullivan, LMFT
Contact Form
090-6868-2672