Notice of Privacy Practices

Notice of Privacy Practices

The Creative Sanctuary, LLC

Kailey Krupar, MS, ATR-BC, LMHC, LPC

954-998-2538 | kailey.krupar.art.therapy@gmail.com

__________________________________________________________________________

This Notice of Privacy Practices describes how your health information may be used and disclosed and how you can access this information. Please review it carefully.

I. My Commitment to Your Privacy

I understand that information about you and your mental health care is personal, sensitive, and deserving of care. I am committed to protecting the privacy and confidentiality of your protected health information (PHI). I create and maintain clinical records to support quality care, continuity of treatment, and compliance with legal and ethical requirements.

In my documentation practices, I intentionally use clinically appropriate and protective language. This means records are written thoughtfully to accurately reflect treatment while minimizing unnecessary detail and reducing the risk of misinterpretation or misuse. Documentation focuses on therapeutic process, clinical themes, progress toward goals, and professional observations rather than exhaustive personal narratives. This approach is intended to help protect client privacy, dignity, and safety while still meeting clinical, ethical, and legal standards. It is consistent with best practices in mental health care and art therapy, particularly when working with expressive, symbolic, or creative material.

This Notice applies to all records of your care created or maintained by The Creative Sanctuary LLC. It explains how your health information may be used and disclosed, outlines your rights regarding your information, and describes my responsibilities related to privacy.

I am required by law to:

  • Maintain the privacy of your PHI

  • Provide you with this Notice of Privacy Practices

  • Follow the terms of the Notice currently in effect

I reserve the right to change this Notice. Any changes will apply to all PHI I maintain. An updated Notice will be available upon request and, when applicable, through my practice materials or website.

II. How I May Use and Disclose Your Health Information

The following sections describe the ways in which your protected health information (PHI) may be used or disclosed without your written authorization. These uses and disclosures are permitted under federal and state privacy laws and are limited to what is clinically and legally appropriate. Not every possible use or disclosure is listed; however, all permitted uses fall within these categories.

Treatment

I may use and disclose your PHI to provide, coordinate, or manage your mental health care. This includes activities necessary for assessment, treatment planning, intervention, and continuity of care.

Examples of treatment-related uses and disclosures include:

  • Consulting with other licensed mental health providers, medical professionals, or treatment team members involved in your care

  • Coordinating care with other providers at your request

  • Making referrals or receiving consultation related to your treatment

When sharing information for treatment purposes, disclosures are made thoughtfully and with attention to client privacy. Only information relevant to your care is shared.

Payment

I may use and disclose PHI for payment-related purposes, including billing, claims submission, payment processing, and determining eligibility or coverage when applicable.

Examples include:

  • Providing necessary information to insurance companies or third-party payers

  • Processing payments for services rendered

  • Collecting fees or responding to payment-related inquiries

Health Care Operations

I may use and disclose PHI for health care operations, which are administrative, legal, and quality-related activities necessary to operate the practice.

Examples include:

  • Clinical supervision and professional consultation

  • Quality assurance and case review

  • Practice administration, scheduling, and record management

  • Legal, auditing, and compliance activities

Art Therapy–Specific Uses

As an art therapist, I document treatment in ways that reflect clinical process rather than artistic interpretation. Records may include observations about engagement with materials, emotional themes, or therapeutic progress. Images of artwork are not included in the clinical record unless you have provided explicit permission. When artwork or case material is shared for supervision, training, or education, identifying information is removed whenever possible, and names are redacted or replaced with pseudonyms.

Legal and Administrative Requirements

I may disclose PHI when required by law or in response to lawful processes such as court orders, subpoenas, or administrative requests. Whenever possible and appropriate, I will make reasonable efforts to notify you prior to such disclosures.

III. Uses and Disclosures Requiring Your Authorization

Certain uses and disclosures of PHI require your written authorization, including:

Session Notes

I maintain brief session notes as part of your clinical record. These notes are intended for professional use and support continuity of care, treatment planning, and ethical documentation. Session notes focus on therapeutic process, clinical themes, progress toward goals, and professional observations rather than detailed personal narratives. These notes are not released without your written authorization, except as required by law or permitted under applicable privacy regulations (such as health oversight activities or legal obligations).

Marketing and Sale of Information

Your PHI will not be used for marketing purposes, and I do not sell your health information.

IV. Uses and Disclosures Permitted Without Authorization

Subject to legal limitations, I may use or disclose your PHI without your authorization for the following purposes:

  • When required by state or federal law

  • To report suspected abuse, neglect, or exploitation of a child, elderly person, or vulnerable adult

  • To prevent or lessen a serious and imminent threat to health or safety

  • For health oversight activities such as audits or investigations

  • For judicial or administrative proceedings

  • For law enforcement purposes as required by law

  • For coroners or medical examiners performing authorized duties

  • For workers’ compensation claims

  • For appointment reminders or information about services I offer

V. Disclosures Involving Family or Others

With your consent, I may share limited PHI with a family member, caregiver, or other individual involved in your care or payment. You may object to or limit these disclosures at any time, except in emergency or legally required situations.

VI. Your Rights Regarding Your Health Information

You have specific rights regarding your protected health information (PHI). These rights are outlined below and may be exercised by submitting a written request unless otherwise noted. Requests will be addressed within the timeframes required by law.

You have the right to:

  • Request restrictions on how your PHI is used or disclosed for treatment, payment, or health care operations. While I am not required to agree to all requested restrictions, your request will be carefully considered and discussed.

  • Request restrictions for services paid out-of-pocket in full, meaning information related to those services will not be disclosed to a health plan for payment or health care operations purposes.

  • Request confidential communications, such as being contacted at a specific phone number, email address, or mailing address. Reasonable requests will be honored whenever possible.

  • Inspect and obtain a copy of your clinical record, excluding personal session notes kept for professional use. Requests must be made in writing. Copies may be provided in paper or electronic format, and a reasonable, cost-based fee may be charged as permitted by law.

  • Request amendments to your PHI if you believe information is inaccurate or incomplete. Requests must be submitted in writing and include the reason for the requested change. If a request is denied, you will be provided with a written explanation.

  • Receive an accounting of certain disclosures of your PHI made by this practice, excluding disclosures for treatment, payment, health care operations, or those made with your authorization. The accounting will cover disclosures made within the previous six years unless a shorter period is requested.

  • Receive a paper or electronic copy of this Notice of Privacy Practices at any time, even if you have previously agreed to receive it electronically.

VII. Effective Date

This Notice of Privacy Practices is effective as of the first date of services.

VII. Acknowledgement of Receipt 

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have certain rights regarding the use and disclosure of your protected health information. By checking the box below, you are acknowledging that you have received a copy of HIPAA Notice of Privacy Practices.

VIII. Changes to Privacy Policy

This document may be updated periodically to reflect changes in practice and updates that best reflect The Creative Sanctuary’s practice, and protect both the individual client and clinicican.