Effective date: 2026-07-30 · This Notice replaces all prior Notices of Privacy Practices issued by Blu Orchard Therapy of Washington, PLLC.

​

Blu Orchard Therapy of Washington, PLLC ("Blu Orchard," "we," "us," or "the Practice") is required by federal and Washington State law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice describing our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect.

​

This Notice is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA, 45 CFR Parts 160 and 164), the 2024 HHS Reproductive Health Care Privacy Final Rule (89 Fed. Reg. 32976, effective June 25, 2024; compliance required by February 16, 2026), the Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2, as amended by the 2024 final rule), Washington's Uniform Health Care Information Act (Ch. 70.02 RCW), Washington's My Health My Data Act (Ch. 19.373 RCW), Washington's adult and adolescent behavioral health confidentiality laws (Ch. 71.05 RCW and Ch. 71.34 RCW), Washington's behavioral health agency licensing rules (Ch. 246-341 WAC), and other applicable law.

​

Where Washington law is more protective than HIPAA, we follow the more protective standard.

​

1. About This Notice

What is PHI? Protected Health Information means any information about your health, health care, or payment for health care that identifies you. Behavioral health records, psychotherapy notes, substance use disorder records, and reproductive health care records all receive additional protections under state and federal law and are described specifically in this Notice.

​

Who this Notice applies to. This Notice applies to Blu Orchard Therapy of Washington, PLLC as the licensed behavioral health agency and covered entity. It applies to all Blu Orchard workforce members, including employees, contracted clinicians, students and interns, and business associates acting on our behalf.

​

Your rights. This Notice describes your rights and our obligations regarding your PHI. You have the right to a paper copy of this Notice on request, even if you agreed to receive it electronically.

​

2. How We May Use and Disclose Your Information — Without Your Written Authorization

 

Federal and Washington law permit us to use and disclose your PHI without your written authorization only in specific, limited circumstances. When we do, we disclose only the minimum information necessary.

​

2.1 For treatment

We may use and disclose your PHI to provide, coordinate, or manage your care. For example, if your Provider consults with another Blu Orchard clinician about your case, or with your primary care provider (with your consent under Ch. 70.02 RCW), we may share information necessary for that consultation.

​

2.2 For payment

We may use and disclose your PHI to obtain payment for services — for example, to submit claims to your health plan, verify benefits, or obtain prior authorization. If you have paid for a service out-of-pocket in full and requested that we not share information about that service with your health plan, we will honor that request under 45 CFR § 164.522(a)(1)(vi).

​

2.3 For health care operations

We may use and disclose your PHI for operations such as quality improvement, clinical supervision, staff training, licensing audits, compliance activities, and business planning. Only the minimum information necessary is used.

​

2.4 As required by law

We will disclose your PHI when required by federal or state law — for example, in response to a lawful court order, subpoena that meets Washington's more-protective standards (RCW 70.02.060), or investigation by a health oversight agency.

​

2.5 For public health activities

We may disclose PHI to public health authorities to prevent or control disease, injury, or disability; for reports of births, deaths, or reportable communicable diseases; and to report reactions to medications or product defects. Substance use disorder disclosures for public health purposes are further restricted under 42 CFR Part 2.

​

2.6 Mandatory reporting: child abuse or neglect (RCW 26.44)

If we have reason to believe that a child has been abused or neglected, we are required by Washington law to report within 48 hours to Child Protective Services or law enforcement.

​

2.7 Mandatory reporting: vulnerable adult abuse (RCW 74.34)

If we have reason to believe that a vulnerable adult has been abused, neglected, financially exploited, or abandoned, we are required to report to Adult Protective Services or law enforcement.

​

2.8 Reporting professional misconduct (RCW 18.130.070)

If we become aware that another licensed health care provider has engaged in unprofessional conduct, we may be required by Washington law to report to the appropriate licensing authority.

​

2.9 Duty to warn (RCW 71.05.120; *Petersen v. State*; *Volk v. DeMeerleer*)

Under Washington law, if your Provider determines that you present an actionable threat of serious physical harm to a reasonably identifiable victim or victims, your Provider may have a duty to take reasonable protective measures. Reasonable protective measures may include communicating the threat to the potential victim, notifying law enforcement, or seeking your voluntary or involuntary hospitalization.

​

2.10 To avert a serious threat to health or safety

We may disclose PHI to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of others. Substance use disorder records are further restricted under 42 CFR Part 2.

​

2.11 Health oversight, judicial and administrative proceedings, law enforcement

We may disclose PHI to a health oversight agency for legally authorized activities including audits, investigations, inspections, and licensure or disciplinary actions. Behavioral health information is further protected under Ch. 71.05 RCW, Ch. 71.34 RCW, and Ch. 70.02 RCW.

​

2.12 Coroners, medical examiners, and funeral directors

We may disclose PHI as necessary for the purposes of identifying a deceased person, determining a cause of death, or other functions authorized by law.

​

2.13 Research

We do not currently conduct research using client records. If we do so in the future, we will require appropriate authorization and Institutional Review Board approval or a waiver, consistent with HIPAA, 42 CFR Part 2, and Washington law.

​

2.14 Business associates

We may disclose PHI to business associates who perform services on our behalf (for example, our electronic health record vendor, telehealth platform, or billing service). As permitted under 45 CFR § 164.504(e), we disclose PHI to business associates only under a written agreement that requires them to safeguard your PHI, use it only for permitted purposes, and return or destroy it at contract termination.

​

3. Uses and Disclosures That Require Your Written Authorization

 

We must obtain your specific written authorization for most uses and disclosures not described in Section 2. Categories that always require your written authorization include:

• Marketing. We do not use your PHI for marketing without your explicit written authorization. We do not sell your PHI.

• Sale of PHI. We do not sell your PHI. Any sale would require your specific written authorization.

• Psychotherapy notes. Psychotherapy notes (your Provider's personal notes about a counseling session, maintained separately from your record) are given additional protection under HIPAA. We will not disclose psychotherapy notes without your specific written authorization except in the narrow circumstances permitted by 45 CFR § 164.508(a)(2).

•  Substance use disorder records. Records identifying you as receiving or having received substance use disorder assessment or treatment are protected under 42 CFR Part 2 and require your specific Part 2-compliant written authorization for most disclosures, subject to strict redisclosure limits and use restrictions in civil, criminal, administrative, and legislative proceedings.

• Reproductive health care information (2024 HHS Rule). See Section 4 below.

• Consumer health data governed by Washington's My Health My Data Act (Ch. 19.373 RCW). See Section 5 below.

• Fundraising. We do not currently fundraise using PHI.

 

You may revoke your authorization at any time, in writing, except to the extent that we have already acted in reliance on it.

 

4. Reproductive Health Care Information — Special Protection (2024 HHS Final Rule)

 

Under the 2024 HHS Reproductive Health Care Privacy Final Rule (89 Fed. Reg. 32976; compliance date February 16, 2026), we provide additional protections for information about reproductive health care.

​

What is reproductive health care information? For purposes of this Notice, reproductive health care means health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes, including contraception, pregnancy, pregnancy loss, fertility, and other reproductive services that were lawful in the state where the care was provided at the time it was provided.

​

What we will not do. We are prohibited from using or disclosing your PHI for either of the following purposes:

• To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that was lawful in the state where the care was provided.

• To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that was lawful in the state where the care was provided.

• To identify any person for either of the purposes above.

 

Attestation requirement. If we receive a request for PHI potentially related to reproductive health care where the requestor is a health oversight agency, law enforcement agency, coroner or medical examiner, or someone acting under those authorities, we will require the requestor to sign a written attestation confirming that the requested PHI will not be used for a prohibited purpose. If the requestor cannot or will not provide a valid attestation, we will not disclose the information for that purpose.

Washington law is aligned. Washington law (including Ch. 70.02 RCW, RCW 71.05, and the "Shield Law," HB 1469, 2023) provides additional protections for reproductive and gender-affirming health care information. Where Washington and federal law differ, we follow the more protective standard.

​

5. Consumer Health Data — Washington's My Health My Data Act (Ch. 19.373 RCW)

Washington's My Health My Data Act ("MHMDA") provides additional protections for "consumer health data," which includes information that identifies you and is linked to your past, present, or future physical or mental health status. Under MHMDA:

• We do not sell your consumer health data.

• We do not share your consumer health data with third parties except for treatment, payment, and health care operations described in this Notice, or with your written authorization.

• You have the right to withdraw a prior authorization for the collection or sharing of your consumer health data.

• You have the right to have your consumer health data deleted, subject to legal retention requirements (see Section 8, "Records Retention").

For questions about your consumer health data or to exercise a right under MHMDA, contact our Privacy Officer at the contact information in Section 12.

​

6. Special Categories of Information

 

6.1 Substance use disorder records (42 CFR Part 2)

If you have received substance use disorder assessment, diagnosis, or treatment as part of your care, records identifying you as such are protected by 42 CFR Part 2 (as amended by the 2024 HHS final rule). Part 2 requires your specific Part 2-compliant written authorization for most disclosures, imposes redisclosure limits, and restricts use of your records in civil, criminal, administrative, and legislative proceedings against you.

​

6.2 Behavioral health records (Ch. 71.05 RCW; Ch. 71.34 RCW)

Adult and adolescent behavioral health records receive additional protection under Washington law. Disclosures generally require your written authorization except in the limited circumstances described in RCW 71.05.630, RCW 71.34.335, and this Notice.

​

6.3 HIV and sexually transmitted infection information

HIV test results and STI-related information receive additional protections under Washington law (RCW 70.24). Disclosures require your specific written authorization except in narrow circumstances defined by statute. Blu Orchard does not routinely test for or diagnose HIV or STIs, but may receive HIV/STI information from other providers or as part of a client's disclosed history. If such information appears in the record, it is protected under RCW 70.24.105 and is only disclosed as that statute permits.

​

6.4 Genetic information

Genetic information is protected under the federal Genetic Information Nondiscrimination Act (GINA). Blu Orchard does not obtain or use genetic test results in behavioral health care. If genetic information appears in a record (for example, in a client-provided medical history), it is protected under the same standards as other PHI, and we do not use or disclose it for underwriting, employment, or discriminatory purposes as prohibited by GINA (42 U.S.C. § 2000ff).

​

6.5 Psychotherapy notes

Psychotherapy notes are your Provider's personal process notes maintained separately from the rest of your record. They receive additional protection under HIPAA and are not routinely included in disclosures. Your written authorization is required for most disclosures of psychotherapy notes.

​

6.6 Adolescent behavioral health records (RCW 71.34.530)

If you are a minor age 13 to 17 and have consented to your own outpatient behavioral health treatment under RCW 71.34.530, your parent or guardian does not have automatic access to your treatment record. We will not disclose your treatment information to a parent or guardian without your written authorization except as specifically permitted or required by law.

​

7. Your Rights Regarding Your Health Information

You have the following rights regarding PHI we maintain about you. To exercise any of these rights, submit a written request to our Privacy Officer at the contact information in Section 12.

​

7.1 Right to inspect and copy (Ch. 70.02 RCW; 45 CFR § 164.524)

You have the right to inspect and copy your health record, with limited exceptions. Under Washington's Uniform Health Care Information Act, we will respond to your request within fifteen (15) working days — a shorter timeframe than federal HIPAA law requires. We may charge reasonable fees for copies as permitted under RCW 70.02.010 and the Washington Department of Health's fee schedule.

​

7.2 Right to request amendment (RCW 70.02.100)

If you believe information in your record is incorrect or incomplete, you may request an amendment. If we deny your request, you have the right to add a written statement of disagreement to your record.

​

7.3 Right to an accounting of disclosures

You have the right to a list of certain disclosures of your PHI made in the six years prior to your request (or a shorter period if you specify). Some disclosures — for treatment, payment, health care operations, disclosures you specifically authorized, and certain others — are not included in the accounting.

​

7.4 Right to request restrictions

You have the right to request that we restrict certain uses or disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except in one specific case: if you pay for a service or item out-of-pocket in full and request that we not share information about that service with your health plan, we must honor that request (45 CFR § 164.522(a)(1)(vi)).

​

7.5 Right to confidential communications

You have the right to request that we contact you at a specific address, phone number, or method (for example, no voicemails, use of an alternative address, communication by portal only). We will accommodate reasonable requests without requiring you to explain why (45 CFR § 164.522(b)).

​

7.6 Right to a paper copy of this Notice

You have the right to receive a paper copy of this Notice on request, even if you previously agreed to receive it electronically.

​

7.7 Right to be notified of a breach

You have the right to be notified in the event of a breach of your unsecured PHI, consistent with 45 CFR §§ 164.400–414 and RCW 19.255.010.

​

7.8 Right to receive this Notice in an accessible format

If you need this Notice in a large-print, Braille, translated, or other accessible format, contact our Privacy Officer. Interpreter and translation services are available at no cost.

​

7.9 Right to file a complaint

You have the right to file a complaint with Blu Orchard and with regulatory authorities without retaliation. See Section 12.

​

8. Records Retention

We retain adult client records for a minimum of six (6) years after the most recent date of service, discharge, or transfer, consistent with WAC 246-341-0425(4). We retain the records of youth and child clients for at least six (6) years after the most recent discharge, transfer, or termination of services, or until the client's 21st birthday, whichever is longer, consistent with WAC 246-341-0425(5).

​

9. Electronic Health Record and Security

We use an electronic health record ("EHR") system operating under a signed Business Associate Agreement with Blu Orchard. The EHR uses encryption in transit and at rest and maintains access logs. Access to your record is restricted to workforce members with a need to know. The name of our current EHR vendor is available on request from our Privacy Officer.

​

10. How We Communicate With You

We communicate with you through the following channels by default. You may change how we contact you at any time — see Section 7.5 (Right to confidential communications).

• Portal messages are our preferred method of non-urgent written communication and are encrypted through our electronic health record system.

• Email and text are not secure and are used only for brief logistical communication such as appointment scheduling and reminders. Please do not use email or text to share detailed clinical information.

• Voicemail — if you have not requested confidential communications restrictions, we may leave brief voicemail messages containing only appointment reminders and a callback number.

 

11. Changes to This Notice

We reserve the right to change this Notice. Any change applies to PHI we already maintain and to PHI we receive in the future. The current Notice will be posted in our office, on our website, and provided to you on request. Material changes will be communicated to active clients.​