Rocky Mountain Thrive PLLC
Effective Date: October 27, 2026
This notice describes how your medical information may be used and disclosed and how you can get access to this information. Please review it carefully.
This is a summary of how we may use and disclose your protected health information and of your rights and choices regarding that information. The sections that follow explain each item in more detail. Your information is protected under the Health Insurance Portability and Accountability Act (HIPAA) and under Colorado law, including the Colorado Mental Health Practice Act (C.R.S. Title 12, Article 245), the Colorado medical records statute (C.R.S. § 25-1-802), and the rules of the Colorado mental health licensing boards. Where Colorado law is stricter or more protective than federal law, we follow Colorado law.
You have the right to:
You also have choices about how we use and share information when we:
Our uses and disclosures. We may use and disclose your information as we:
To the extent that we hold substance use disorder patient records subject to 42 CFR Part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.
Rocky Mountain Thrive PLLC ("we," "us," or "the practice") respects your privacy. We are legally required to maintain the privacy of your protected health information (PHI) under HIPAA and other federal and state laws, and to follow state privacy laws when they are stricter or more protective of your PHI than federal law. As part of that commitment, we are providing you with this Notice of Privacy Practices ("Notice"). This Notice describes:
If you have any questions about this Notice, or wish to exercise any of the rights it describes, contact our Privacy Officer:
Rocky Mountain Thrive PLLC, Attn: Privacy OfficerYour PHI is health information about you that could be used to identify you and that we create, receive, keep, or transmit in electronic, oral, or written form. It includes information such as your name, contact information, past, present, or future physical or mental health conditions, the care you receive, and payment for your care.
We create a record of the care and services you receive in order to provide your care and to comply with legal requirements. This Notice applies to all PHI that we create, receive, or maintain. We follow the duties and privacy practices described in this Notice and any changes once they take effect.
We may change the terms of this Notice, and the changes will apply to all PHI we hold about you. The current Notice is available on request, on our website at rockymountainthrive.com, and through the client portal.
We will notify you if a breach occurs that compromises the privacy or security of your unsecured PHI. We will notify you without unreasonable delay and within the time required by law, which for Colorado residents is no later than 30 days after the breach is discovered. We will usually notify you in writing by first-class mail, or by email if you have agreed to receive notices electronically. If we have insufficient or out-of-date contact information, we may provide notice in another legally acceptable form.
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
You have the right to inspect or receive a copy of the health records we maintain about you by submitting a signed and dated written request. There is no fee to inspect your records (C.R.S. § 25-1-802). You may request paper or electronic copies, and we may charge a reasonable, cost-based fee for copies as HIPAA allows. We will respond within 30 days of your request; if we need more time, we will tell you in writing and respond within an additional 30 days. Please note two limits. First, "psychotherapy notes" as defined by HIPAA (45 CFR § 164.501) are a clinician's private process notes kept separate from your record; they are not part of your clinical record and are not subject to this right of access. Your progress notes, assessments, treatment plans, and telehealth records are part of your record. Second, we may deny access to information compiled for a legal proceeding, or where a licensed professional determines that access would endanger your life or physical safety or that of another person; you may ask for a review of that decision. If you are a minor who consented to your own treatment under Colorado law (C.R.S. § 12-245-203.5 or § 27-65-104), your records will not be shared with a parent or guardian without your permission except as Colorado law allows.
You may ask us to correct or amend PHI that you believe is incorrect or incomplete. For these requests:
You have the right to ask us to restrict how we use or share your PHI for treatment, payment, or health care operations, or with certain people involved in your care. We may ask that you make the request in writing. For these requests:
You have the right to ask for a list of the times we have shared your information without your written permission in the past six years, for example a report we were required by law to make. For these requests:
If you have given someone a medical power of attorney, or if someone is your legal guardian or otherwise your personal representative under Colorado law, that person may exercise your rights and make choices about your PHI. We will confirm the person's authority before acting.
You have the right to ask us to communicate with you in a certain way or at a certain location, for example only by email or only at a specific phone number. We will not ask the reason. Your request must say how or where you wish to be contacted, and we will accommodate all reasonable requests.
You may ask for a paper or electronic copy of this Notice at any time, even if you agreed to receive it electronically.
If you believe we have violated your privacy rights, you may file a complaint with us by writing to the Privacy Officer at the address above, or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Room 509F, HHH Building, Washington, D.C. 20201, or online at www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.
For certain health information you can tell us your choices about what we share. If you have a clear preference in the situations described below, tell us and we will follow your instructions. You have both the right and the choice to tell us whether to:
If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, and we may share information when needed to lessen a serious and imminent threat to health or safety.
In the following cases we will never share your information unless you give us written permission:
You may revoke a written permission at any time, in writing, except to the extent we have already acted on it.
The law permits or requires us to use or disclose your PHI for the purposes described in this Notice. We have included examples but have not listed every permissible use or disclosure. When using, disclosing, or requesting PHI, we make reasonable efforts to limit it to the minimum necessary to accomplish the purpose. Once PHI has been disclosed as the law permits or requires, the recipient may be able to share it further, and it may no longer be protected by the safeguards that apply while it is in our possession.
We use your PHI within the practice for your treatment, for billing, and for running the practice. Beyond that, we do not disclose your PHI to anyone outside the practice without your signed release of information, except for the disclosures required or permitted by law that are described in this Notice. If we receive a request for your records from another party, we will confirm that a valid release from you is in place before releasing anything.
We use your PHI to provide your care. Within the practice, your clinician may share it with their clinical supervisor and with practice staff who help coordinate your care. Our practice is to obtain your signed release of information before we talk with anyone outside the practice about your care, such as your physician, psychiatrist, or a previous or current therapist, except in an emergency or where the law requires or permits disclosure as described in this Notice.
We may use and disclose your PHI to bill and collect payment from you, your health plan, or others responsible for payment. For example, we share information with your health insurance plan so it will pay for the services you receive.
We may use and disclose your PHI to run the practice, improve your care, and contact you when necessary, for example for quality review, clinical supervision, training, and practice management.
We may share your PHI with companies that perform services for us, such as our electronic health record, billing, secure messaging, and cloud technology providers. Each has signed an agreement requiring it to protect your PHI as the law requires.
We may contact you by phone, text message, email, or the client portal about appointments, billing, and other practical matters, consistent with the communication preferences you give us.
We will share your PHI when federal or state law requires it, including with the U.S. Department of Health and Human Services when it investigates our compliance with privacy law.
Colorado's shield law (Senate Bill 23-188, including C.R.S. § 12-30-121 and § 13-90-107) protects people who receive, seek, or support reproductive health care or gender-affirming health care that is lawful in Colorado, including related mental health and counseling services. Colorado courts will not issue subpoenas, and Colorado agencies will not cooperate, in another state's effort to investigate or penalize such care. We will not voluntarily disclose your records, billing information, or personal data to out-of-state law enforcement or agencies for that purpose, and we will release them only if a Colorado court orders it.
We may share your PHI when we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person.
We may share your PHI in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process when the requirements of HIPAA and Colorado law for such disclosures are met.
In rare situations the law also permits disclosures that we do not expect to make in a psychotherapy practice, for example to public health authorities, to a coroner or medical examiner after a death, for a workers' compensation claim, to law enforcement as permitted by law, or for specialized government functions such as military or national security activities. If one of these situations ever arises, we will disclose only what the law permits and only the minimum necessary.
In the following situations we are required by Colorado law to disclose information without your consent:
For more information on permitted uses and disclosures, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.