Telehealth Consent & HIPAA Notice

Effective Date: February 1, 2026 | Last Updated: February 1, 2026

This page contains two important documents: (1) our Telehealth Informed Consent, which explains how telehealth services work and your rights as a telehealth patient, and (2) our HIPAA Notice of Privacy Practices, which describes how we may use and disclose your Protected Health Information and your rights under federal law.

PART 1: Telehealth Informed Consent

1.1 Nature of Telehealth Services

Telehealth involves the use of electronic communications to provide therapy services when you and your provider are not in the same physical location. This includes real-time audio and video conferencing using secure, HIPAA-compliant technology platforms.

Telehealth sessions are conducted with the same professional standards as in-person sessions. Your provider is licensed in one or more of the jurisdictions we serve (Arizona, Arkansas, Virginia, and the U.S. Virgin Islands) and will provide the same quality of care regardless of the delivery method.

1.2 Client Location Requirement

You must be physically located in a jurisdiction where our clinicians are licensed — Arizona, Arkansas, Virginia, and the U.S. Virgin Islands — during all telehealth sessions. If you travel outside these jurisdictions, please notify your provider in advance, as we may be unable to provide telehealth services while you are there. At the beginning of each session, your provider will confirm your current physical location.

1.3 Technology Platform and Requirements

ZipHealthy uses HIPAA-compliant video conferencing technology for telehealth sessions. A link to access your session will be provided before each appointment. To participate in telehealth sessions, you will need:

• Stable Internet Connection: A reliable high-speed internet connection for uninterrupted video and audio
• Private Space: A quiet, private location where you can speak freely without being overheard
• Camera and Microphone: A device (computer, tablet, or smartphone) with a functioning camera and microphone

1.4 Benefits of Telehealth

• Convenience: Access therapy from the comfort of your home or office
• Accessibility: Eliminates travel time and transportation barriers
• Continuity of Care: Maintain consistent therapy appointments even when travel or illness prevents in-person visits
• Flexibility: Easier scheduling for those with busy schedules or caregiving responsibilities

1.5 Potential Risks and Limitations

While telehealth is an effective treatment modality, there are some potential risks and limitations:

• Technology Failures: Sessions may be interrupted due to internet connectivity issues, software problems, or equipment failures. If a session is disconnected, your provider will attempt to reconnect. If reconnection is not possible within 10 minutes, the session may need to be rescheduled.
• Privacy Concerns: Despite using secure, encrypted platforms, there is always some risk of unauthorized access to electronic communications. You are responsible for ensuring your own environment is private during sessions.
• Not Suitable for All Conditions: Telehealth may not be appropriate for all mental health conditions or situations. Your provider will discuss whether telehealth is appropriate for your specific needs and may recommend in-person services when clinically indicated.
• Emergency Limitations: In an emergency, your provider may not be able to provide immediate in-person assistance. See Section 1.8 below for emergency protocols.

1.6 Recording Prohibition

Telehealth sessions are not recorded by ZipHealthy or its clinicians. You may not record sessions (audio, video, or screenshot) without the prior written consent of your provider and all participants. Unauthorized recording may constitute a violation of applicable federal and state wiretapping and eavesdropping laws.

1.7 Your Rights Regarding Telehealth

You have the right to:

• Withdraw your consent for telehealth services at any time without penalty or impact on your access to other services
• Request to switch to in-person sessions, subject to availability and clinical appropriateness
• Ask questions about telehealth technology, procedures, and privacy safeguards at any time
• Expect the same confidentiality protections as in-person sessions
• Receive information about alternative treatment options, including referral to in-person providers

1.8 Emergency Protocols for Telehealth

If you experience a mental health crisis during a telehealth session:

• Provide Your Location: At the beginning of each telehealth session, confirm your current physical address with your provider so that emergency services can be contacted if needed
• Emergency Contact: Provide an emergency contact person who can be reached if you become unreachable during a crisis
• Call 911: If you are in immediate danger, call 911 or have your provider call 911 on your behalf
• Local Resources: Your provider will provide you with local crisis resources

1.9 Consent Acknowledgment

By scheduling and participating in a telehealth session with ZipHealthy, you acknowledge that you have read, understand, and agree to the terms of this Telehealth Informed Consent. A signed copy of this consent will be obtained as part of your clinical intake process. The signed version, rather than this web page, constitutes the binding consent document. This web page is provided for your information and reference.

PART 2: HIPAA Notice of Privacy Practices

2.1 Our Commitment to Your Privacy

ZipHealthy PLLC is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of Privacy Practices, and to follow the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain. If we make a material change, we will post the revised Notice on our website and make copies available upon request.

2.2 Uses and Disclosures That Do Not Require Your Authorization

We may use and disclose your PHI without your written authorization in the following circumstances:

Treatment: We may use and disclose your PHI to provide, coordinate, or manage your mental health care and related services. For example, we may share information with another provider to whom you have been referred for consultation or treatment.

Payment: We may use and disclose your PHI to obtain payment for services, including submitting claims to your health insurance plan, verifying insurance eligibility, and engaging in utilization review.

Healthcare Operations: We may use and disclose your PHI for our internal operations, including quality assessment and improvement, peer review, staff training, compliance activities, and business planning.

Required by Law: We may disclose PHI when required to do so by federal, state, or local law.

Public Health Activities: We may disclose PHI for public health activities, such as reporting communicable diseases, reporting adverse events, or notifying appropriate agencies about child abuse or neglect.

Victims of Abuse, Neglect, or Domestic Violence: We may disclose PHI to appropriate government authorities if we believe a patient is a victim of abuse, neglect, or domestic violence, as required or authorized by law. In Arkansas, licensed mental health professionals are mandatory reporters of suspected child abuse (Ark. Code Ann. 12-18-402) and adult abuse (Ark. Code Ann. 12-12-1708). Comparable mandatory-reporting laws apply in Arizona, Florida, Virginia, and the U.S. Virgin Islands.

Health Oversight Activities: We may disclose PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensure actions.

Judicial and Administrative Proceedings: We may disclose PHI in response to a court order. We may also disclose PHI in response to a subpoena or other lawful process, provided certain conditions are met under HIPAA.

Law Enforcement: We may disclose PHI to law enforcement officials under limited circumstances, including in response to a court order or warrant, to identify or locate a suspect, fugitive, or missing person, or to report certain types of wounds or injuries.

Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their duties.

Serious Threat to Health or Safety: We may use and disclose PHI when we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Specialized Government Functions: We may disclose PHI for military, national security, or intelligence purposes, or for protective services for the President and others, as authorized by law.

Workers' Compensation: We may disclose PHI as authorized by workers' compensation laws.

2.3 Uses and Disclosures That Require Your Written Authorization

Except as described above, we will not use or disclose your PHI without your written authorization. You may revoke an authorization at any time in writing, except to the extent that we have already taken action in reliance on the authorization. The following uses and disclosures require your specific written authorization:

• Most uses and disclosures of psychotherapy notes (see Section 2.4 below)
• Uses and disclosures of PHI for marketing purposes
• Sales of PHI
• Any other uses and disclosures not described in this Notice

2.4 Special Protections for Psychotherapy Notes

Psychotherapy notes — personal notes recorded by your provider during or after a therapy session that are maintained separately from your clinical record — receive additional protections under HIPAA. We will not use or disclose psychotherapy notes without your specific written authorization, except in the following limited circumstances as permitted by law:

• Use by the originating provider for your treatment
• For training programs for students, trainees, or practitioners in mental health
• To defend ourselves in a legal action or grievance brought by you
• As required by the U.S. Department of Health and Human Services for HIPAA compliance investigations
• As required by law to avert a serious and imminent threat to health or safety
• To report suspected abuse or neglect to the extent required by law

2.5 Substance Use Disorder Records

If you receive services related to a substance use disorder, your records may be subject to additional protections under federal regulation 42 CFR Part 2, which restricts the use and disclosure of substance use disorder treatment records. Under these regulations, we generally cannot disclose information identifying you as having or having had a substance use disorder, or disclose details of your treatment, without your specific written consent, except in limited circumstances authorized by law (such as a medical emergency or reporting of suspected child abuse or neglect). A general authorization for release of medical records is NOT sufficient to authorize disclosure of substance use disorder records under 42 CFR Part 2.

2.6 Your Rights Under HIPAA

You have the following rights regarding your Protected Health Information:

• Right to Access Your Records: You have the right to inspect and obtain a copy of your health records maintained by us, with limited exceptions. We may charge a reasonable fee for copies. We will respond to your request within thirty (30) days.
• Right to Request Amendments: You may request in writing that we amend health information we maintain about you if you believe it is inaccurate or incomplete. We may deny the request under certain circumstances, and if denied, you have the right to submit a written statement of disagreement.
• Right to Request Restrictions: You may request restrictions on certain uses and disclosures of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, except that we must agree to restrict disclosures to your health plan for services you have paid for in full out of pocket.
• Right to Confidential Communications: You may request that we communicate with you in a specific manner or at a specific location. For example, you may request that we contact you only by mail at a particular address. We will accommodate reasonable requests.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI that we have made during the six (6) years prior to your request (or since the effective date of this Notice, whichever is shorter). This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures you authorized in writing.
• Right to a Paper Copy: You have the right to obtain a paper copy of this Notice of Privacy Practices at any time by contacting our office, even if you have previously agreed to receive the Notice electronically.
• Right to File a Complaint: You may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. See Section 2.8 below for details. We will not retaliate against you for filing a complaint.

2.7 Our Duties

ZipHealthy is required to:

• Maintain the privacy of your Protected Health Information as required by law
• Provide you with this Notice of Privacy Practices describing our legal duties and privacy practices
• Follow the terms of this Notice currently in effect
• Notify you promptly in the event of a breach of your unsecured PHI, no later than sixty (60) days after discovery of the breach
• Apply the "minimum necessary" standard — when using or disclosing PHI or requesting PHI from others, we will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose
• Not use or disclose your PHI for marketing purposes without your written authorization
• Not sell your PHI without your written authorization
• Obtain your written authorization before using or disclosing psychotherapy notes, except as described in Section 2.4 above

2.8 Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint. You will not be penalized or retaliated against in any way for filing a complaint.

• Complaint to ZipHealthy: Contact our Privacy Officer using the information in Section 3 below.
• Complaint to HHS: You may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by calling (800) 368-1019, visiting hhs.gov/hipaa/filing-a-complaint, or writing to: Office for Civil Rights, U.S. Department of Health and Human Services, 1301 Young Street, Suite 1169, Dallas, TX 75202 (Region VI, covering Arkansas; for other jurisdictions, see hhs.gov/ocr for the regional office serving your location).

2.9 Changes to This Notice

We reserve the right to change the terms of this Notice at any time. Any changes will apply to all PHI we maintain, including PHI created or received before the effective date of the revised Notice. The revised Notice will be posted on our website and made available at our office. You may request a copy of the current Notice at any time.

3. Contact Information

If you have questions about this Telehealth Consent, our HIPAA Notice of Privacy Practices, or wish to exercise any of your rights described above, please contact our Privacy Officer:

ZipHealthy PLLC
Attn: Privacy Officer
240 S Main St, Suite #270
Bentonville, AR 72712
Email: [email protected]
Phone: (479) 259-1390