HIPAA Notice of Privacy Practices

Introduction

I am required by law to maintain the privacy and security of your Protected Health Information (PHI) and to provide you with this notice of my legal duties and privacy practices with respect to your PHI.

This Notice of Privacy Practices describes how Firefly Counseling & Consulting and Dorrie Lombardi, LMHC (Florida), LCPC (Maine) may use and disclose your PHI to carry out treatment, payment, or health care operations, and for other purposes that are permitted or required by law.

What is Protected Health Information (PHI)?

PHI is information about you, including demographic information, that may identify you and that relates to:

• Your past, present, or future physical or mental health or condition
• The provision of health care to you
• The past, present, or future payment for the provision of health care to you

How I May Use and Disclose Your PHI

1. Treatment

I may use and disclose your PHI to provide, coordinate, or manage your mental health care and related services. This may include:

• Consultation with other health care providers about your treatment
• Referrals to other mental health professionals or specialists
• Coordination with your other healthcare providers (with your authorization)

2. Payment

I may use and disclose your PHI to obtain payment for services provided to you. This may include:

• Billing you or your insurance company
• Submitting claims to your insurance provider
• Verifying insurance coverage and benefits
• Collection activities if payment is not received

3. Healthcare Operations

I may use and disclose your PHI for healthcare operations purposes, including:

• Quality assessment and improvement activities
• Professional peer review and performance evaluations
• Training and education of staff and students
• Business planning and management
• Compliance with legal and regulatory requirements

Other Uses and Disclosures That Do Not Require Your Authorization

Required by Law

I may use or disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities

I may disclose your PHI to public health authorities for purposes such as preventing or controlling disease, injury, or disability.

Abuse, Neglect, or Domestic Violence

I may disclose your PHI to appropriate authorities if I reasonably believe you are a victim of abuse, neglect, or domestic violence, as permitted by law.

Health Oversight Activities

I may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, and inspections.

Judicial and Administrative Proceedings

I may disclose your PHI in response to a court order, subpoena, discovery request, or other lawful process, but only after efforts have been made to notify you or obtain a protective order.

Law Enforcement

I may disclose your PHI to law enforcement officials for law enforcement purposes as required or permitted by law.

Serious Threat to Health or Safety

I may use or disclose your PHI if I believe in good faith that such use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public or another person.

Military and Veterans

If you are a member of the armed forces, I may release your PHI as required by military command authorities.

Workers' Compensation

I may disclose your PHI to comply with workers' compensation or similar programs that provide benefits for work-related injuries or illness.

Uses and Disclosures That Require Your Written Authorization

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke your authorization in writing at any time, except to the extent that I have already taken action in reliance on your authorization.

Psychotherapy Notes

I keep separate psychotherapy notes that are not part of your medical record. These notes require your specific written authorization for any disclosure, with limited exceptions.

Marketing

I will not use or disclose your PHI for marketing purposes without your written authorization.

Sale of PHI

I will not sell your PHI without your written authorization.

Your Rights Regarding Your PHI

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. I am not required to agree to your request, except in the case where you request that I not disclose PHI to your health plan for payment or health care operations purposes and you have paid out-of-pocket in full for the service.

Right to Confidential Communications

You have the right to request that I communicate with you about your PHI by alternative means or at alternative locations. I will accommodate reasonable requests.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI contained in your medical and billing records. I may deny your request in certain limited circumstances. If denied, you may request a review of the denial.

Right to Amend

You have the right to request an amendment to your PHI if you believe it is incorrect or incomplete. I may deny your request in certain circumstances, but will provide you with a written explanation.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made by me during the six years prior to your request (or shorter period if requested).

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to receive the Notice electronically.

Right to Notification of Breach

You have the right to be notified if there is a breach of your unsecured PHI.

My Duties

I am required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of my legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if I am unable to agree to a requested restriction
• Accommodate reasonable requests for confidential communications

Changes to This Notice

I reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that I maintain. If I make material changes to the Notice, I will provide you with a revised Notice and post the revised Notice on my website.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with me or with the Secretary of the Department of Health and Human Services.

To File a Complaint with Me:

To File a Complaint with HHS:

You will not be retaliated against for filing a complaint.

Effective Date and Acknowledgment

This Notice is effective as of December 2025. By signing the Acknowledgment of Receipt form at the beginning of our therapeutic relationship, you acknowledge that you have received and reviewed this Notice.

Questions

If you have any questions about this Notice or about my privacy practices, please contact me using the information provided above.