Privacy Policies | Daniel Fulton, LMFT

Notice of Privacy Practices

D. Fulton Family Therapy Inc. · Daniel Fulton, LMFT CA Lic. # 124641 · IL Lic. # 166.001589 1040 North Blvd Ste 225, Oak Park, IL 60301 · (626) 460-0707 · daniel@dfultontherapy.com

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. My Pledge and Legal Duties Regarding Your Health Information

I understand that health information about you and your health care is personal, and I am committed to protecting it. I create a record of the care and services you receive from me; I need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all records of your care generated by this mental health practice. I am required by law to:

Maintain the privacy of protected health information (“PHI”) that identifies you;
Give you this notice of my legal duties and privacy practices with respect to that information;
Notify you following a breach of your unsecured PHI; and
Abide by the terms of the notice currently in effect.

I reserve the right to change the terms of this notice; any new notice will apply to all PHI I maintain, including information created before the change. The current notice is available in my office, on my website (dfultontherapy.com), and on request.

II. How I May Use and Disclose Health Information About You

The categories below describe the ways I may use and disclose health information, with examples. Not every use or disclosure in a category is listed, but all permitted uses and disclosures fall within one of the categories.

For Treatment, Payment, or Health Care Operations. Federal privacy rules allow a health care provider with a direct treatment relationship to use or disclose the client’s personal health information without written authorization to carry out the provider’s own treatment, payment, or health care operations. I may also disclose your PHI for the treatment activities of another health care provider. For example, if I consult with another licensed health care provider about your condition, I am permitted to use and disclose your personal health information, which is otherwise confidential, to assist in your diagnosis and treatment. “Treatment” includes coordination and management of your care with third parties, consultations between providers, and referrals. Disclosures for treatment purposes are not limited to the minimum-necessary standard, because providers need complete information in order to provide quality care.

Lawsuits and Disputes. If you are involved in a lawsuit, I may disclose health information about you in response to a court or administrative order. I may respond to a subpoena, discovery request, or other lawful process only where the law allows and only if efforts have been made to notify you of the request or to obtain an order protecting the information. Illinois clients: under the Illinois Mental Health and Developmental Disabilities Confidentiality Act, your mental health records are not released in a judicial or administrative proceeding on a subpoena alone — a court order or your written consent is also required (740 ILCS 110/10).

III. Uses and Disclosures Requiring Your Authorization

Psychotherapy Notes. I do keep “psychotherapy notes” as defined in 45 CFR § 164.501, and any use or disclosure of such notes requires your authorization, unless the use or disclosure is: (a) for my use in treating you; (b) for my use in training or supervising mental health practitioners; (c) for my use in defending myself in legal proceedings instituted by you; (d) for use by the Secretary of Health and Human Services to investigate my compliance with HIPAA; (e) required by law and limited to that law’s requirements; (f) required by law for certain health oversight activities pertaining to the originator of the notes; (g) required by a coroner performing duties authorized by law; or (h) needed to avert a serious threat to health and safety.
Marketing. I will not use or disclose your PHI for marketing purposes.
Sale of PHI. I will not sell your PHI.

IV. Uses and Disclosures Not Requiring Your Authorization

Subject to legal limitations, I may use and disclose your PHI without authorization:

When required by state or federal law, limited to the relevant requirements;
For public health activities, including reporting suspected child, elder, or dependent-adult abuse, or preventing or reducing a serious threat to anyone’s health or safety;
For health oversight activities, including audits and investigations;
For judicial and administrative proceedings as described in Section II (my preference is to obtain your authorization before doing so);
For law enforcement purposes, including reporting crimes occurring on my premises;
To coroners or medical examiners performing duties authorized by law;
For research purposes, subject to the privacy safeguards required by law;
For specialized government functions (military missions, protection of the President, intelligence activities, safety in correctional institutions);
For workers’ compensation purposes (my preference is to obtain your authorization);
To contact you with appointment reminders or to tell you about treatment alternatives and health-related services I offer.

Substance-use-disorder (SUD) treatment records. If I receive records protected by federal SUD confidentiality law (42 CFR Part 2) — for example, records transferred from an SUD treatment program — additional protections apply: you may give a single written consent for all future uses and disclosures of those records for treatment, payment, and health care operations; you may revoke that consent in writing at any time; and those records may not be re-disclosed or used in legal proceedings against you without your consent or a court order meeting Part 2’s requirements.

V. All Other Uses and Disclosures Require Your Written Authorization

Uses and disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization at any time by notifying me in writing; revocation will not affect uses or disclosures already made in reliance on it.

VI. Disclosures Requiring an Opportunity to Object

I may share your PHI with a family member, friend, or other person you indicate is involved in your care or the payment for your care, unless you object in whole or in part. In an emergency, I may make such a disclosure and give you the opportunity to object when it is practicable to do so.

VII. Your Rights Regarding Your PHI

Right to request limits. You may ask me not to use or disclose certain PHI for treatment, payment, or operations. I am not required to agree, and may say “no” if I believe it would affect your care —
except for out-of-pocket services: if you (or someone on your behalf, other than a health plan) have paid for a service in full and you ask me not to disclose PHI about that service to your health plan for payment or operations purposes, I must agree.
Right to confidential communications. You may ask me to contact you in a specific way (e.g., only at a certain phone number) or at a different address; I will agree to all reasonable requests.
Right to see and get copies. Other than psychotherapy notes, you have the right to inspect and receive a copy of your medical record and other PHI I hold about you, in electronic form if you request it and it is readily producible. I will respond within the time required by law (no more than 30 days under HIPAA; California and Illinois law may require faster responses ), and may charge only a reasonable, cost-based fee.
Right to an accounting of disclosures. You may request a list of disclosures I have made of your PHI for purposes other than treatment, payment, operations, or those you authorized, covering up to the six years before your request. I will respond within 60 days. The first list in any 12-month period is free; I may charge a reasonable, cost-based fee for additional requests in the same year.
Right to correct or update. If you believe your PHI contains a mistake or is missing important information, you may request in writing that I amend it. I may deny the request in certain circumstances; if so, I will tell you why in writing within 60 days, and you may submit a statement of disagreement for the record.
Right to a copy of this notice. You may receive a paper copy of this notice at any time, even if you agreed to receive it electronically.
Right to breach notification. You have the right to be notified, as required by law, if a breach of your unsecured PHI occurs.

VIII. Complaints

If you believe your privacy rights have been violated, you may complain to me directly: Daniel Fulton, LMFT (Privacy Official), D. Fulton Family Therapy Inc., 1040 North Blvd Ste 225, Oak Park, IL 60301, (626) 460-0707, daniel@dfultontherapy.com. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights: hhs.gov/ocr/complaints or 1-800-368-1019. You will not be penalized or retaliated against in any way for filing a complaint.

For any questions about this notice or my privacy practices, contact Daniel Fulton at the phone or email above.

IX. State Law

Where state law provides greater protection for your health information than HIPAA, I follow state law. Illinois clients: the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110) provides protections beyond HIPAA — including the court-order requirement described in Section II — and, where stricter, is followed. California clients: California’s Confidentiality of Medical Information Act and record-access laws provide additional rights, including access deadlines.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties

EFFECTIVE DATE

This notice is effective as of July 27, 2026.