Notice of Privacy Practices
Tall Grass Therapy LLC
Effective date: October 4, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice covers the clinical services of Tall Grass Therapy LLC, provided by Dr. Corrine Buchanan, a Florida licensed mental health counselor and marriage and family therapist and an Oregon licensed professional counselor. It explains how I use and protect your health information and how to exercise your rights.
Protected health information, or PHI, identifies you and relates to your health, care, or payment for care. I am required by law to protect its privacy, explain my duties and privacy practices, follow the notice in effect, and notify affected individuals after a breach of unsecured PHI as required by law.
Questions and privacy requests
Privacy contact: Dr. Corrine Buchanan, Tall Grass Therapy LLC • 352-647-9696
For written requests or a privacy complaint, use the SimplePractice client portal or https://next.paubox.com/public/tallgrasstherapy/upload. Call 352-647-9696 to request a paper copy of this notice or arrange another way to submit a written request if you cannot use the portal or secure form. You do not need to describe private clinical information in voicemail.
How I use information for your care and the practice
Applicable federal and state confidentiality laws govern every use and disclosure below. I follow any applicable law that provides greater privacy protection. A general HIPAA permission does not remove a stricter written-authorization requirement.
Treatment
I use information to assess your needs, provide therapy, and plan and coordinate care. For example, I review your history and session notes to plan treatment. I seek authorization before discussing identifiable clinical information with another treating or referral provider, except when disclosure is otherwise permitted or required by applicable law. I may consult using properly de-identified information.
Payment
I use information about services and payment to charge for sessions, maintain payment records, and prepare receipts or superbills. For example, a superbill may include your diagnosis, service dates, procedure codes, provider information, and payments.
Tall Grass Therapy does not submit insurance claims for you. SimplePractice makes superbills available for you to submit to your insurer or a reimbursement service you choose. The optional Mentaya benefits checker is used to check potential benefits; it is not a practice claims-submission service. Whether a claim or reimbursement is permitted depends on applicable law and your plan; a superbill does not guarantee coverage.
Health care operations
I use information to run the practice, maintain records, review care quality, and meet professional obligations. For example, I may review a record to evaluate care or use a service provider to maintain electronic records. Business associates must have legally required safeguards and written agreements. Their access is limited to their authorized role and applicable legal requirements.
I may contact you about appointments and follow-up care using your communication preferences.
Where permitted by applicable law, I may use properly de-identified clinical information for professional supervision, consultation, teaching, and training. De-identification follows applicable legal standards and considers identifying details and context; removing your name alone is not enough. I use identifiable information for these purposes only with your written authorization.
Other circumstances in which information may be shared
Some disclosures are required; others are allowed only when legal conditions are met. I limit disclosures to what is authorized or required, with applicable confidentiality and privilege protections.
People involved in your care
For confidential communications protected by Florida law, I obtain your written authorization before sharing them with people involved in your care or payment, unless a legal exception described in this notice applies. When applicable law permits, I may share information directly relevant to a family member’s, friend’s, or other person’s involvement in your care or payment, with your permission or after giving you an opportunity to object. Verbal permission or a lack of objection does not replace written authorization when Florida or another applicable law requires it. If you cannot express a choice, limited disclosures may be made in your best interests only when applicable law allows.
For couples or family treatment, I obtain each participant’s written authorization when the law requires it. This does not eliminate an individual’s legally protected access rights or disclosures otherwise required or permitted by law. A partner or relative does not automatically have access to your information.
Reporting and oversight
I make reports of suspected abuse or neglect and other public-health or safety disclosures when applicable law requires or permits them. I may provide information for legally authorized licensing-board or health-oversight activities. I must provide information to the U.S. Department of Health and Human Services when required to determine compliance with federal privacy law.
Serious threats and emergencies
I may disclose information to prevent or lessen a serious and imminent threat when applicable law and professional standards permit, to someone reasonably able to help. Florida law specifically requires a report to law enforcement when a client communicates a specific threat of serious bodily injury or death to an identified or readily available person and I judge that the client has the apparent intent and ability to carry it out imminently or immediately. Under that law, a warning to the potential victim is permitted. Other emergency disclosures must meet their own applicable legal conditions.
Legal proceedings and other legal duties
I may disclose information when required by law or by a legally sufficient court order, subject to applicable privilege and confidentiality protections. A subpoena or request for records does not automatically authorize release. If you bring a complaint or legal action against me, applicable law may allow information needed for my defense, limited to that matter. Any other legally required disclosure is limited to the requirements of that law. The special protections for substance use disorder records described below also apply.
When written authorization is needed
Uses and disclosures not described in this notice require your written authorization. I obtain written authorization for marketing or selling PHI except for limited exceptions allowed by law, and for other uses or disclosures when applicable law requires it. The treatment and confidentiality commitments above apply.
You may revoke an authorization in writing through the privacy contact above. Revocation applies going forward and does not undo actions already taken in reliance on it or another legal exception. Reading or acknowledging this notice does not authorize unrelated disclosures or waive your privacy rights.
Your rights and how to use them
Use the contact options above to exercise these rights. Please make requests for access, amendment, an accounting, restrictions, or confidential communications in writing. I can help with an accessible request method. Identity and representative-authority checks will not create unreasonable barriers.
Inspect or receive your records
You may request to inspect or receive a paper or electronic copy of your clinical and billing records maintained by or for me, and other information in the designated record set used to make decisions about you, subject to limited exceptions allowed by law. My completed progress notes are maintained as part of your clinical record.
I may offer a treatment summary first, but will substitute a summary for records you are entitled to access only if you agree in advance to the summary and any fee. You do not have to accept a summary to receive therapy or to exercise your access rights. Choosing a summary does not eliminate your right to request the underlying accessible records later.
I will act on an access request within 30 calendar days, or sooner if applicable law requires. If a lawful extension is needed, I will give you written reasons and a completion date before the deadline; HIPAA permits one extension of up to 30 days. I will provide the requested format when readily producible or agree with you on an allowed alternative. Any fee will be limited to what applicable law permits. I will not withhold access because you have an unpaid treatment bill.
Any denial will explain its legal basis in writing, identify available review and complaint rights, and provide access to remaining information where required. You may also request delivery to another person, subject to applicable access, authorization, and confidentiality rules.
Federal and state requirements may both apply. Neither record ownership nor a state narrative-report option removes an access right protected by applicable federal law.
Request an amendment
You may ask me to amend information you believe is incorrect or incomplete. Please explain the reason for your request. I may deny it only for a reason permitted by law. I will respond within 60 days, with one additional 30-day extension only when allowed and explained in writing before the original deadline. A denial will explain why and how you may submit a statement of disagreement and complain.
Ask for limits on use or disclosure
You may ask me to limit certain uses or disclosures for treatment, payment, or health care operations, or to people involved in your care. I generally do not have to agree. However, I must honor a request not to disclose information to a health plan for payment or health care operations when the information relates solely to an item or service paid in full by you, or by someone other than the plan on your behalf, unless disclosure is required by law. Tell me about this request before the disclosure occurs.
Request confidential communications
You may ask to be contacted in a particular way or at a different location. I will accommodate reasonable requests, and you do not have to explain why. Please tell me how or where you want to be contacted. You may also update appointment-reminder preferences. Ordinary email or text can be accessible to people who have access to your device or account; the client portal and secure form are available for sensitive information.
Receive an accounting of disclosures
You may request a list of certain disclosures made during up to six years before your request. The list excludes disclosures that the law exempts, including most treatment, payment, and health care operations disclosures and those made with your authorization. The first accounting in any 12 months is free. Before charging a reasonable cost-based fee for another during that period, I will tell you the fee and allow you to withdraw or change the request.
Get a paper notice or use a representative
You may request a paper copy of this notice at any time, even if you agreed to receive it electronically. A person legally authorized to act as your personal representative may exercise rights on your behalf, subject to applicable exceptions. I will verify that person’s authority and the scope of that authority.
Special protections for substance use disorder records
If I receive or maintain records protected by 42 CFR Part 2, those additional protections apply to the records and to testimony about their contents. Such information may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a qualifying court order under Part 2. The court-order process includes notice and an opportunity to be heard for you or the holder of the records, as Part 2 requires; an order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure.
Record continuity
Records remain protected during retention and any authorized custodial transfer. The separate Records Retention Policy explains retention periods, required notices, and how to request records. If I close the practice or relocate while remaining able to manage records, I remain responsible for their retention and lawful access as described in that policy.
For Oregon client records, my designated standby records custodian is Karl Reichert, LPC (Oregon licensed professional counselor). If I die or become unable to manage these records because of incapacity, he may receive and access information needed to safeguard the records, respond to lawful requests, and provide referral information. He has no routine access while I remain able to manage records. Planned closure alone does not activate his role, and this designation does not make him your treating therapist.
For Florida client records, my appointed emergency records custodian is Sean Buchanan. If I die, become unable to manage the practice, or activate the continuity plan in writing, he will safeguard the records and handle lawful records requests within the authority of his appointment. Use the ordinary request methods listed above until the continuity plan is activated; section 5 of the Records Retention Policy explains requests after activation or if I otherwise become unavailable. His role is records administration; this appointment does not make him your treating clinician. Required notices and any eventual disposal will follow the Florida procedures described in the Records Retention Policy. Karl’s Oregon designation does not cover Florida records. Any separate authorization required by law for either state’s records will be obtained.
If I become unavailable, follow the records-request instructions in section 5 of the Records Retention Policy and any notice from the practice. After my death or incapacity, Oregon clients may contact Karl at karl@rficounseling.com or 360-448-1417. If you cannot identify or reach the person responsible for your records, ask the Oregon Board of Licensed Professional Counselors and Therapists at 503-378-5499, or the Florida Board of Clinical Social Work, Marriage & Family Therapy and Mental Health Counseling at 850-245-4292, as applicable, for guidance on locating records or addressing an access concern. The Boards do not serve as the practice’s record-storage service. Do not send clinical details or records in an initial unencrypted message.
Complaints
If you believe your privacy rights have been violated, you may complain to me in writing through the contact options above, or call for help with another submission method. You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights: visit https://www.hhs.gov/hipaa/filing-a-complaint/index.html, call 1-800-368-1019 for assistance, or write to Centralized Case Management Operations, HHS, 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201. I will not retaliate against you for filing a complaint.
Changes to this notice
I may change this notice and make the revised terms apply to all PHI I maintain, including information already in my records, as permitted by law. The current notice will be available on the practice website and on request. I will also provide a revised copy at your next appointment or mail a copy on request. A revised notice will show its effective date.