Consumer Health Data Privacy Policy

NW Psychotherapy PLLC
Required by Washington My Health My Data Act (RCW 19.373)
Effective Date: August 3, 2025
Last Updated: August 3 2025

Notice Required by Washington State Law

This Consumer Health Data Privacy Policy is required by the Washington My Health My Data Act (RCW 19.373) and applies to all Washington residents whose consumer health data we collect. This policy is in addition to our general Privacy Policy and HIPAA Notice of Privacy Practices.

This policy must be prominently linked on our website homepage as required by Washington State law.

1. Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data as defined by Washington State law:

Mental Health Information

  • Individual mental health conditions, treatment history, and diagnoses

  • Psychological and behavioral assessments and interventions

  • Mental health symptoms, treatment progress, and outcomes

  • Therapy session notes and treatment plans

Personal Health Information

  • Past, present, and future physical or mental health status

  • Social, psychological, and behavioral health information

  • Health-related procedures and treatments (including EMDR therapy)

  • Mental health medications and their usage

Identity and Care Information

  • LGBTQ+ affirming care information and services

  • Gender identity and expression information (when relevant to treatment)

  • Information related to marginalized identity support and therapy

  • Body-positive therapy and related health information

Location and Contact Data

  • Precise location information that could indicate seeking mental health services

  • Contact information for appointment scheduling and telehealth services

  • Data identifying you as someone seeking mental health care services

Digital Health Data

  • Information collected through our website and telehealth platforms

  • Data about your research or attempts to obtain mental health services

  • Digital communications related to your mental health care

2. Purposes for Collecting Consumer Health Data

We collect consumer health data for the following specific purposes:

Primary Treatment Purposes

  • Individual Therapy Services: Providing personalized mental health treatment

  • EMDR Therapy: Delivering specialized trauma therapy services

  • Crisis Intervention: Addressing immediate mental health concerns

  • Treatment Planning: Developing and updating your care plan

Practice Operations

  • Appointment Scheduling: Managing telehealth and consultation appointments

  • Care Coordination: Coordinating with other healthcare providers (with your consent)

  • Quality Improvement: Enhancing our therapeutic services and approaches

  • Legal Compliance: Meeting Washington State licensing and regulatory requirements

Communication and Support

  • Telehealth Services: Delivering therapy through secure video platforms

  • Crisis Communication: Providing emergency mental health support

  • Follow-up Care: Conducting wellness checks and treatment follow-ups

  • Resource Provision: Sharing mental health resources and educational materials

3. Categories of Sources from Which We Collect Data

We collect consumer health data from the following sources:

Direct Collection from You

  • Information you provide during intake and assessment forms

  • Data shared during therapy sessions (in-person or telehealth)

  • Communications through secure messaging and email

  • Information provided during phone consultations

Healthcare Providers

  • Previous mental health treatment records (with your authorization)

  • Referral information from other healthcare professionals

  • Medical records relevant to your mental health treatment (with consent)

Digital Platforms

  • Data collected through our HIPAA-compliant telehealth platform

  • Website usage information when you research our services

  • Online scheduling and appointment management systems

Family Members or Partners

  • Information provided by family members or partners (with your consent)

  • Collateral information for treatment purposes (when authorized)

4. Categories of Consumer Health Data We Share

We may share the following categories of consumer health data:

Clinical Consultation Data

  • Anonymous case information for professional consultation

  • Treatment approach discussions with other mental health professionals

  • Training and supervision information (de-identified when possible)

Legal and Safety Requirements

  • Information required by Washington State mandatory reporting laws

  • Data necessary for duty to warn situations

  • Court-ordered information (when legally required)

Healthcare Coordination

  • Treatment information shared with other healthcare providers (with authorization)

  • Referral information for specialized services

  • Insurance information for billing purposes (if applicable)

Emergency Situations

  • Crisis intervention information shared with emergency responders

  • Safety-related information shared with family members (when appropriate)

5. Third Parties and Affiliates with Whom We Share Data

We may share consumer health data with the following categories of entities:

Healthcare Providers

  • Licensed Mental Health Professionals: For consultation and referrals

  • Medical Doctors: When coordinating integrated care (with your consent)

  • Psychiatric Providers: For medication management coordination

  • Specialist Therapists: For specialized treatment referrals

Technology Service Providers

  • HIPAA-Compliant Telehealth Platforms: For secure video therapy sessions

  • Secure Communication Services: For encrypted email and messaging

  • Practice Management Software: For appointment scheduling and records

  • Backup and Security Services: For secure data storage and protection

Legal and Regulatory Entities

  • Washington State Department of Health: For licensing compliance

  • Courts and Legal System: When legally required by court order

  • Child/Adult Protective Services: For mandatory reporting requirements

  • Emergency Services: During crisis situations requiring immediate intervention

Professional Organizations

  • Professional Liability Insurance: For coverage and claims processing

  • Licensing Boards: For regulatory compliance and investigations

  • Professional Associations: For ethics consultations and training

Current Specific Affiliates: None at this time. Any future affiliates will be updated in this policy.

6. Your Rights Under Washington State Law

Under the Washington My Health My Data Act, you have the following rights:

Right to Know and Access

  • Confirm Data Collection: Request confirmation of what consumer health data we collect about you

  • Access Your Data: Request a copy of your consumer health data

  • Third Party List: Receive a list of all third parties with whom we've shared your data

  • Contact Information: Obtain contact information for third parties who have your data

Right to Control Your Data

  • Withdraw Consent: Withdraw consent for collection and sharing of your health data

  • Limit Sharing: Request restrictions on how we share your information

  • Delete Data: Request deletion of your consumer health data from our records

Right to Appeal

  • Appeal Decisions: Appeal our refusal to honor your requests

  • Attorney General Contact: Contact the Washington State Attorney General if appeals are denied

7. How to Exercise Your Rights

Submitting Requests

You may exercise your rights by:

Primary Contact Method:

  • Email: nw.psychotherapy.pllc@gmail.com (use "WA Consumer Health Data Request" in subject line)

  • Phone: (206) 210-2850

  • Mail: NW Psychotherapy PLLC, 412 Center Rd, Everett, WA 98204

Required Information for Requests

To process your request, please provide:

  • Your full name and contact information

  • Specific type of request (access, deletion, withdrawal of consent, etc.)

  • Specific data or time period you're referencing

  • Verification of your identity (we may request additional verification)

Response Timeline

  • Initial Response: Within 45 days of receiving your request

  • Possible Extension: Up to 45 additional days if complexity requires (we'll notify you)

  • Authentication Time: We may take reasonable time to verify your identity

Appeal Process

If we deny your request:

  1. You may appeal within a reasonable time period

  2. We'll respond to appeals within 45 days

  3. If appeal is denied, we'll provide contact information for the Washington State Attorney General

8. Data Security Practices

We maintain comprehensive security practices including:

Administrative Safeguards

  • Access Controls: Limited access to employees and contractors with legitimate need

  • Staff Training: Regular training on Washington State privacy laws and data security

  • Policies and Procedures: Written protocols for data handling and security

  • Incident Response: Procedures for addressing data breaches and security incidents

Technical Safeguards

  • Encryption: All consumer health data encrypted in transit and at rest

  • Secure Platforms: HIPAA-compliant telehealth and communication systems

  • Access Authentication: Multi-factor authentication for all systems

  • Regular Updates: Ongoing security assessments and system updates

Physical Safeguards

  • Secure Storage: Physical records stored in locked, secure locations

  • Equipment Controls: Secure handling of all devices containing consumer health data

  • Disposal Procedures: Secure destruction of consumer health data when no longer needed

9. Consent Requirements

Collection Consent

Before collecting consumer health data, we will:

  • Clearly explain what data we're collecting and why

  • Describe how the data will be used

  • Obtain your specific, informed consent

  • Allow you to refuse consent without discrimination

Sharing Consent

Before sharing consumer health data, we will:

  • Obtain separate consent distinct from collection consent

  • Explain who we're sharing with and why

  • Describe the specific data being shared

  • Allow you to withdraw consent at any time

Ongoing Consent Management

  • You may withdraw consent for future collection or sharing at any time

  • Withdrawal of consent does not affect data already lawfully collected

  • We will honor withdrawal requests within required timeframes

10. No Sale of Consumer Health Data

We do not and will not sell your consumer health data. Under Washington State law:

  • Selling consumer health data requires separate, specific authorization

  • We do not engage in any activities that constitute "sale" under the law

  • We do not exchange consumer health data for monetary consideration

  • We do not provide consumer health data to third parties for their commercial benefit

11. Geofence Restrictions

We comply with Washington State restrictions on geofencing:

  • We do not use geofencing technology around healthcare facilities

  • We do not track or identify consumers seeking healthcare services through location data

  • We do not send targeted advertisements based on location near healthcare facilities

12. Retention and Deletion

Data Retention Periods

  • Active Treatment Records: Maintained per Washington State professional standards

  • Digital Communications: Retained as part of clinical record

  • Website Analytics: Retained only as long as necessary for operational purposes

  • Backup Systems: Consumer health data in backups deleted within 6 months of deletion request

Deletion Process

When you request deletion:

  1. We delete data from all active systems immediately

  2. We notify all third parties who received your data

  3. Third parties are required to delete your data as well

  4. Backup system deletion may take up to 6 months

13. Updates to This Policy

Notification of Changes

We will notify you of material changes to this policy by:

  • Posting updates on our website

  • Sending notice to your last known contact information

  • Providing notice during your next appointment

Your Continued Rights

  • Changes to this policy do not diminish your rights under Washington State law

  • You may always exercise your rights under the most current version

  • Major changes may require new consent for continued data collection

14. Contact Information

For questions about this Consumer Health Data Privacy Policy or to exercise your rights:

NW Psychotherapy PLLC
Anne Rochon, LMHC
412 Center Rd
Everett, WA 98204
Phone: (425) 296-2622
Email: nw.psychotherapy.pllc@gmail.com

Consumer Health Data Privacy Officer: Anne Rochon, LMHC

15. Complaints and Enforcement

Filing Complaints

If you believe your rights under the Washington My Health My Data Act have been violated:

Washington State Attorney General
Consumer Protection Division
800 5th Avenue, Suite 2000
Seattle, WA 98104
Phone: 1-800-551-4636
Website: www.atg.wa.gov

You will not face retaliation for filing a complaint.

16. Relationship to Other Policies

This Consumer Health Data Privacy Policy supplements:

  • Our HIPAA Notice of Privacy Practices

  • Our general Website Privacy Policy

  • Our informed consent documents

In case of conflicts, the most restrictive privacy protection applies.

This policy complies with the Washington My Health My Data Act (RCW 19.373) effective March 31, 2024.