Book a free consult (opens in a new tab)

Privacy

Notice of Privacy Practices

Sagelight Counseling LLC

Tyler Marshall, MA, LPCC

7111 W Alameda Ave Unit J PMB 4131, Lakewood, CO 80226

Phone: (720) 514-9227

Email: [email protected]

Effective date: August 30, 2026

This document describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

I. MY PLEDGE REGARDING HEALTH INFORMATION

Health information about you and your health care is personal, and I am committed to protecting it. I keep a record of the care and services you receive here, both to serve you well and to meet certain legal requirements. This notice covers every record this practice generates about you, and it describes how I may use and disclose your health information, what rights you have regarding it, and what obligations I have. Health information that identifies you is what the federal standard calls protected health information, or PHI, and this notice uses both terms to mean the same thing.

Colorado law requires me to:

  • Not disclose the confidential communications you make to me or the advice I give you without your consent, except in the circumstances C.R.S. 12-245-220 itself allows or another law requires.
  • Keep and store your record so that only authorized people have access to it and its confidentiality is protected (4 CCR 737-1.16).
  • Make your record available for you to see and provide you with a copy of it (C.R.S. 25-1-802).
  • Keep your record for at least seven years after our work together ends or after our last contact, whichever is later, and, when I do destroy it, destroy it in a way that obliterates anything identifying you (4 CCR 737-1.16).
  • Notify you when a security breach involving your personal information meets the notice requirements of C.R.S. 6-1-716. Section VI item 8 sets out what that statute reaches, the deadlines, and the notice I give you even where it does not apply.

Beyond what Colorado requires, I hold this practice to the privacy standards of the Health Insurance Portability and Accountability Act, or HIPAA, the federal law that sets national rules for how health information is protected. Among other things, that means giving you this notice, following the terms of the notice in effect, and signing written privacy agreements with the vendors who handle your information on my behalf. I also commit to telling you about a breach of your health information even where the Colorado statute does not reach it or does not require notice, such as a breach of paper records.

Why I follow HIPAA when I am not required to. HIPAA’s privacy rule reaches providers who bill insurance electronically or conduct similar standard transactions. Sagelight is private pay and does none of those, so the rule does not reach this practice by its own force. I follow it anyway, because I believe it is the right standard for my practice. If that ever changes, I will tell you and update this notice.

I may need to revise this notice from time to time, whether because the law changes or because this practice changes how it operates. If I do, the revised notice will apply to all of your health information, including information I already hold. Any revised notice will be posted on my website and placed in your client portal, and I will provide a paper copy on request.

II. HOW I MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

Two sets of rules apply here: Colorado law and the HIPAA standards I follow voluntarily. Where they differ, I follow whichever protects you more. For ordinary disclosures, that is Colorado, because C.R.S. 12-245-220(1) bars me from disclosing your confidential communications or my advice to you without your consent, and HIPAA alone would permit more. On what counts as a serious enough threat to justify a disclosure I am permitted rather than required to make, HIPAA is stricter, so I follow it there. This section covers disclosures I am permitted to make, not the ones another law requires of me. Section IV describes those. The categories below do not list every use, but every permitted use falls within them.

For treatment, payment, and health care operations. What matters here is whether your information leaves this practice. Sending it outside this practice for treatment, payment, or operations happens with your consent or under one of the specific circumstances Colorado allows. C.R.S. 12-245-220 does not require separate consent for ordinary internal work, so writing and reviewing your record, billing, and scheduling go on without asking you each time. Internal work is not unregulated, though. Colorado imposes separate duties on how your record is stored and safeguarded, and only authorized people may see it.

What each of these categories covers.

  • Treatment: planning and providing your care. Coordinating with a provider you are already seeing, or one I refer you to, sends your information outside the practice, so I ask you first.
  • Payment: billing you, processing the payment method you have on file, and preparing a Good Faith Estimate of what your care is expected to cost.
  • Health care operations: reviewing my own records for quality and accuracy, and running the ordinary business of the practice, such as scheduling and record keeping.

Clinical supervision involves another counselor seeing your record, so it is a disclosure. Your Informed Consent describes how supervision works here and is where you consent to it.

Running this practice also means relying on outside services: the electronic health record, the telehealth platform, and the scheduling, payment, and messaging systems that go with them. Those companies receive your information only as needed to provide those services, they are bound by written privacy agreements with me, and they are not permitted to use your information for their own purposes. Your Informed Consent describes them and the agreements that bind them.

Once information leaves this practice, I cannot control what happens to it. Information I disclose may be redisclosed by whoever receives it, and at that point it may no longer be protected by the rules that govern me.

When I do disclose your information, I share only what the purpose requires. That is true even of disclosures to another health care provider for treatment, which federal rules exempt from that standard. Consultation that identifies you is a disclosure, because it sends your information outside this practice, so I ask you first. Consultation that does not identify you is not a disclosure, and I may seek it without asking.

Lawsuits and disputes. If you are involved in a lawsuit, a court or administrative body may order me to disclose health information. Federal rules would also permit disclosure in response to a subpoena or discovery request from someone else in the dispute. Colorado is stricter, and a subpoena on its own does not decide whether your record is released. When one arrives, I assert your privilege where it applies, tell you about it when I am permitted to, and take reasonable steps to protect your record before anything is released. Records I receive from a program covered by 42 C.F.R. Part 2 carry stricter protection in any proceeding against you. Neither those records nor testimony relaying what they contain may be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you have given written consent, or a court has ordered it after you or the holder of the record was given notice and an opportunity to be heard. A court order authorizing disclosure must also be accompanied by a subpoena or other legal requirement before anything is released.

III. CERTAIN USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION

  1. Psychotherapy notes. Federal law uses this term for a counselor’s private notes about a session, kept apart from the clinical record. I keep none. The record in my system is your whole record, and Section VI describes your right to see it and get a copy.

  2. Substance use disorder records. This practice is not a substance use disorder treatment program, so your record here is not covered by 42 C.F.R. Part 2. If I receive records from a program that is covered, those records carry protections beyond the ones described in this notice, and I will not redisclose them except as Part 2 itself allows, which in most cases means your specific written consent.

  3. Marketing. Using or disclosing your PHI for marketing requires your written authorization. I do not use your information for marketing.

  4. Sale of PHI. Selling your PHI requires your written authorization. I do not sell your information and will not.

  5. All other uses and disclosures. Any use or disclosure of your PHI not described in this notice will be made only with your written authorization. You may revoke that authorization in writing at any time, except to the extent I have already acted in reliance on it.

IV. CERTAIN USES AND DISCLOSURES DO NOT REQUIRE YOUR AUTHORIZATION

C.R.S. 12-245-220 determines when I may disclose your confidential communications without your consent, and its subsection (5) preserves any disclosure another law requires. Public health reporting demonstrates how this works. The federal standard would permit disclosures to a public health authority for purposes such as preventing or controlling disease, injury, or disability. Colorado supplies no basis for me to make them, and I do not. If another law ever required such a report, item 1 below would govern it. One report works the other way around and belongs here rather than below. Colorado urges professional counselors, without requiring it, to report known or suspected mistreatment or self-neglect of an at-risk adult (C.R.S. 26-3.1-102(1)(a) and (1)(b)(VII)). Item 2 below covers the reports Colorado requires of me. Because this one is only urged, it is not an exception to your confidentiality: where making it would disclose your information, I would ask you first. If a situation also involved a threat of serious harm, item 3 below would govern it, and that does not depend on your agreement. The circumstances below are the ones that can realistically arise in this practice:

  1. When disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of such law.
  2. For required reports of abuse, neglect, and exploitation, including suspected abuse or neglect of a child, and the mistreatment of an at-risk elder or an at-risk adult with an intellectual and developmental disability. Mistreatment there means abuse, caretaker neglect, or exploitation.
  3. To prevent serious harm. Colorado permits disclosure where there is an articulable and significant threat of substantial bodily harm, meaning a threat that can be explained. That includes a threat you make against someone or yourself, a threat that if carried out would cause such harm, or behavior that in my reasonable judgment creates one. Colorado also limits who may be told to appropriate school personnel, law enforcement, and the person threatened. Separately, Colorado law requires me to act if you communicate a serious threat of imminent physical violence against a specific person, including people identifiable by their connection to a specific place or organization. In that case I must make reasonable and timely efforts to warn them, or whoever is responsible for that place or organization, and to notify law enforcement, or take other appropriate action. The federal standard is narrower, and where I am permitted rather than required to disclose, I follow it: it reaches only a serious and imminent threat, permits telling only someone reasonably able to prevent or lessen it, and requires that I act in good faith. It does not limit the duty to warn described above, which Colorado law requires of me.
  4. For health oversight, which in Colorado means a review by the licensing board or a person or group the board authorizes to investigate, a review by the governing board of a licensed hospital, or a professional review committee under C.R.S. 12-245-212(1). That last route is available only if you have signed a release authorizing the review.
  5. For judicial and administrative proceedings, including responding to a court or administrative order, although my preference is to obtain an authorization from you first. A subpoena is not a court order. It requires a response from me, but it does not by itself let me release your record.
  6. For law enforcement, but only where Colorado supplies a basis: your consent, a court order or other legal process, a disclosure another law requires, or the threat circumstances above. A request from an officer is never enough on its own.
  7. To coroners or medical examiners, when they are performing duties authorized by law.
  8. For workers’ compensation purposes, to the extent workers’ compensation law requires it. My preference is still to obtain an authorization from you.
  9. If you bring a complaint or a legal action against me. If you file a complaint or a legal action against me arising out of or connected with your care, Colorado permits me to disclose confidential information in response (C.R.S. 12-245-220(2)(a)). I would disclose only what my defense required.

V. DISCLOSURES TO PEOPLE INVOLVED IN YOUR CARE

Federal rules would in some circumstances let me share information with a family member, friend, or other person involved in your care without asking, including where you are given a chance to object and do not. Colorado requires your consent, so I ask you first, and I do not treat silence as agreement. If a genuine safety emergency arises, what I may disclose is governed by the threat circumstances in Section IV, not by a general exception for emergencies.

VI. YOUR RIGHTS WITH RESPECT TO YOUR PHI

Two of the rights below are yours under Colorado law: the right to see and obtain a copy of your record (C.R.S. 25-1-802), and the right to be told if a breach compromises your personal information (C.R.S. 6-1-716). The others come from the federal HIPAA standards this practice follows by choice, and some go further than those standards require.

  1. The right to request limits on uses and disclosures of your PHI. You have the right to ask me not to use or disclose certain PHI for treatment, payment, or health care operations purposes, and also to ask me to limit what I share with a family member, friend, or other person involved in your care. I am not required to agree to either request, and I will tell you if I decline. The one exception is the pay-in-full restriction in item 2 below, which I will always agree to.

  2. The right to restrict disclosure to a health plan for care you paid for in full. If you pay out of pocket in full for a service and ask me not to disclose information about it to a health plan for payment or health care operations purposes, I will agree, unless the disclosure is required by law. This practice is private pay and bills no health plans, so in practice there is no plan for me to withhold anything from. The right is described here because it is yours regardless.

  3. The right to choose how I send PHI to you. You have the right to ask me to contact you in a specific way, or to send mail to a different address, and I will agree to all reasonable requests. What I contact you about is limited to your care: appointment reminders, a brief recap after a session, and telling you about treatment alternatives or other services related to your care. I keep any recap short and free of clinical detail, and you may ask me to stop sending them or to send them a different way.

  4. The right to see and get copies of your PHI. You have the right to see your record and to get an electronic or paper copy of it, along with other information I have about you. There is no charge to look at your own record. I will provide a copy, or a summary of it if you agree to receive a summary, within 30 days of your written request. If I need longer, I will tell you so in writing within those first 30 days and may take up to 30 days more. If I miss the deadline without sending you that written notice, there is no charge for the copy, unless something outside my control made the records impossible to produce in time. If you ask for your record in electronic form and I hold it electronically, I will provide it that way. A reasonable, cost-based fee may otherwise apply to copies. Colorado’s records statute allows part of a record to be withheld on the narrow grounds set out at 45 C.F.R. 164.524(a), which the statute incorporates by reference for inspection of your record (C.R.S. 25-1-802(1)(a)). If one ever applied to you, I would tell you in writing what I was holding back and why. For some of those grounds, federal law also gives you the right to have my decision reviewed by another licensed health care professional who was not involved in making it.

  5. The right to get a list of the disclosures I have made. You have the right to request a list of times I disclosed your PHI for purposes other than treatment, payment, or health care operations. Disclosures you authorized in writing are not included in that list, and neither are a few other categories federal law excludes. I will respond within 60 days. The list covers the six years before your request unless you ask for a shorter period. It is free once a year, and I may charge a reasonable, cost-based fee for any additional request in the same year.

  6. The right to correct or update your PHI. If you believe there is a mistake in your record, or that something important is missing, you may ask me to correct the information or add to it. Please make the request in writing and tell me the reason for it. I am not required to agree, and if I decline, I will tell you why in writing within 60 days.

  7. The right to get a paper or electronic copy of this notice. This notice is in your client portal, where you may read, download, or print it at any time. You also have the right to get a paper copy of this notice and to receive a copy by email. Even if you have received this notice electronically, you may still request a paper copy.

  8. The right to be told if your information is breached. Colorado law requires me to notify you when a security breach involving your personal information meets that statute’s notice requirements, as quickly as possible and without unreasonable delay, and no later than 30 days after I determine that the breach occurred, or, if law enforcement tells me notice would impede a criminal investigation, thirty days after they tell me it is appropriate to send it (C.R.S. 6-1-716). That statute reaches unencrypted computerized data, and it asks first whether the breach is likely to lead to misuse. If a breach may have compromised the privacy or security of your health information but falls outside what the statute reaches or requires notice for, such as a breach of paper records, I will still tell you without unreasonable delay and no later than 60 days after I discover it, unless I determine and document that there is a low probability your information was actually compromised, or law enforcement tells me that notifying you would impede a criminal investigation or harm national security, in which case I delay for as long as they require.

How to make any of these requests. Put it in writing and send it through the secure message function in your SimplePractice client portal, or by email to [email protected]. The portal is the more secure of the two and is the one I recommend.

QUESTIONS AND COMPLAINTS

If you have questions about this notice or about how your health information is handled, contact me at (720) 514-9227 or [email protected]. I am the Privacy Officer for this practice.

If you believe your privacy rights have been violated, you may raise it with me, and you may file a complaint with the Colorado State Board of Licensed Professional Counselor Examiners:

Division of Professions and Occupations

1560 Broadway, Suite 1350

Denver, CO 80202

303-894-7800

You do not need to raise it with me first. I will not retaliate against you for raising a concern with me or for filing a complaint.