Healing Hearts Counseling San Diego, Inc.
Effective Date: October 20, 2026
Last Updated: October 20, 2026
Healing Hearts Counseling San Diego, Inc. (“Healing Hearts Counseling,” “we,” “us,” or “our”) is a mental health practice with offices in Encinitas and Rancho Bernardo, California, offering in-person and telehealth counseling. We are committed to protecting the privacy and confidentiality of everyone who visits our website, contacts our practice, or receives services from our clinicians.
This document has two parts:
- Part I: Website Privacy Policy explains how we handle information collected through our website and online inquiries.
- Part II: Notice of Privacy Practices explains how your health information may be used and disclosed, and your rights regarding that information, under HIPAA and California law.
PART I: WEBSITE PRIVACY POLICY
1. Scope
This Part applies to our website at https://healingheartscounselingsd.com/ and to information you send us through the website, by email, or by phone before you become a client. Once you are a client, the health information we hold about you is governed by Part II (our Notice of Privacy Practices) and by applicable federal and California law.
2. Information We Collect
Information you provide. If you contact us or submit a form, we collect what you choose to give us, such as your name, phone number, email address, preferred office or telehealth option, appointment availability, the general type of service you are looking for, and your message.
Please do not include detailed health information (for example, diagnoses, trauma history, medications, or details of what you are going through), Social Security numbers, or insurance ID numbers in website forms, ordinary email, or text messages. Call us at (760) 458-1600 and we will direct you to a secure method.
Information collected automatically. Like most websites, our website and hosting provider may automatically collect technical information such as IP address, approximate location, browser and device type, pages viewed, referring website, date and time of visit, and cookie identifiers.
3. How We Use Website Information
- To respond to your inquiries and help you schedule an appointment.
- To operate, maintain, and secure our website and fix technical problems.
- To understand overall website traffic and improve the site.
- To prevent fraud, abuse, and unauthorized access.
- To comply with the law and protect our legal rights.
We will not use your personal information for a materially different purpose without giving you notice and, where the law requires it, obtaining your consent.
4. Cookies, Analytics, and Do Not Track
We use cookies and similar technologies that are necessary to run and secure the website. We may also use basic analytics to measure website traffic and performance. We do not use analytics to collect or transmit information about your health, and we do not link website analytics data to your identity or to any clinical record.
We do not use advertising or retargeting trackers (such as social-media advertising pixels) on our website.
You can control cookies through your browser settings. We honor the Global Privacy Control (GPC) opt-out preference signal. Because there is no uniform industry standard for “Do Not Track” browser signals, our website does not respond to them other than as described in this section, and we do not track visitors across other websites.
5. Service Providers
We use vendors to host, secure, and support our website and practice operations, such as website hosting, scheduling, secure telehealth, billing, and email providers. These vendors may process the information described in this Part only to provide services to us. Vendors that handle protected health information for us are bound by business associate agreements as HIPAA requires. Websites and services operated by others, including sites we link to, are governed by their own privacy policies.
6. Disclosure of Website Information; No Sale or Sharing
We disclose website information only to the service providers described above, when required by law or legal process, to protect our rights and the security of our website, or in connection with a lawful sale or transfer of our business.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Visiting a mental health service page on our website is never treated as permission to disclose your identity or any health information to anyone.
7. California Privacy Rights
Health information that is protected under HIPAA or California’s Confidentiality of Medical Information Act (CMIA) is governed by Part II of this document and is generally exempt from the California Consumer Privacy Act (CCPA).
To the extent the CCPA applies to other personal information we collect through this website, California residents may have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to opt out of the sale or sharing of personal information (we do not sell or share it); to limit certain uses of sensitive personal information; and to be free from discrimination for exercising these rights. These rights are subject to legal exceptions.
To make a request, contact us using the information in the “Contact Us” section below. We may need to verify your identity, and we will respond within the time the law requires. You may use an authorized agent to submit a request on your behalf.
8. Children’s Privacy
Our practice provides counseling to children and adolescents, but our website is not directed to children under 13, and we do not knowingly collect personal information online from children under 13. If you believe a child under 13 has submitted information to us through the website, contact us and we will delete it. Information about a minor’s treatment is protected by the Notice of Privacy Practices in Part II.
9. Security, Email and Text Messages, and Retention
We use reasonable administrative, technical, and physical safeguards to protect personal information. No method of electronic transmission or storage is completely secure. Ordinary email and text messages are not encrypted and may be read by others. By giving us your email address or phone number, you agree we may use it to respond to you; if you want us to avoid email or text, tell us and we will use another method.
We keep website information only as long as reasonably necessary for the purposes described above and to meet legal and recordkeeping obligations. Clinical records are retained under separate legal requirements.
10. Changes to This Website Privacy Policy
We may update this Part from time to time. We will post the updated version on this website with a new “Last Updated” date and provide any additional notice the law requires.
PART II: NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
1. Our Duties
Healing Hearts Counseling San Diego, Inc. is a health care provider covered by the Health Insurance Portability and Accountability Act (HIPAA). We create and keep records about your mental health care. This notice describes how we may use and disclose your protected health information (“PHI”) and your rights regarding it. PHI is information about you that identifies you and relates to your health, your care, or payment for your care.
We are required by law to:
- Keep your PHI private and secure.
- Give you this notice of our legal duties and privacy practices, and follow the notice currently in effect.
- Notify you if there is a breach of your unsecured PHI. We will provide notice within the time required by HIPAA and California law.
- Use or disclose your PHI only as this notice describes, as the law permits, or with your written authorization.
California law, including the Confidentiality of Medical Information Act, protects mental health information in some ways that are stricter than HIPAA. When California law gives you greater protection, we follow California law.
2. How We May Use and Disclose Your Health Information
The following are the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure in a category is listed, but all of the ways we are permitted to use and disclose information fall within one of these categories.
Treatment. We use and share PHI to provide, coordinate, and manage your care. For example, our clinicians may consult with each other, with clinical supervisors, or, when the law permits, with another provider involved in your care. We will ask for your written authorization before sharing information with providers outside our practice unless the law allows the disclosure without it.
Payment. We use and share PHI to bill for and collect payment for your services. For example, we send information to your insurance plan to verify eligibility and benefits, submit claims, and resolve billing questions. We share only the information needed for the purpose.
Health Care Operations. We use and share PHI to run our practice. For example, for quality improvement, clinical supervision and training, credentialing with insurance plans, compliance and audits, and business planning and administration. We follow the “minimum necessary” standard.
Business Associates. We use outside companies to perform services for us, such as billing, scheduling, secure telehealth, and record-keeping. They may receive your PHI only as needed and only after agreeing in writing to protect it.
Appointment Reminders and Practice Communications. We may contact you about appointments, scheduling, billing, and treatment-related matters using the contact information you give us. You may tell us how and where you want us to contact you (see “Confidential Communications” below).
Family and Others Involved in Your Care. We may share limited PHI with a family member, friend, or other person you identify as involved in your care or payment for care, if you agree or do not object. In an emergency or if you cannot agree, we may share limited information if we believe it is in your best interest. We do not assume that anyone has an automatic right to your mental health information.
Disclosures Required or Permitted by Law Without Your Authorization. We may disclose PHI without your authorization in these situations, but only as far as the law allows or requires:
- Abuse and neglect reporting. We are required to report suspected child abuse or neglect and suspected abuse of an elder or dependent adult to the appropriate agencies.
- Serious threats. If you communicate a serious threat of physical violence against a reasonably identifiable person, we may be required to warn or protect that person and notify law enforcement. We may also disclose information as needed to protect you or others if we believe there is a serious and imminent danger to health or safety, including a risk of suicide.
- Legal proceedings. In response to a court order, or in some circumstances a subpoena or other lawful process. California’s psychotherapist-patient privilege protects your therapy communications, and we will assert it on your behalf unless you waive it or an exception applies, such as when you put your mental condition at issue in a lawsuit. We may ask for legal advice before responding.
- Law enforcement as permitted by law, for example in response to a valid court order or to report certain crimes.
- Health oversight. To government agencies and licensing boards that oversee our practice and clinicians, including audits, investigations, and licensing matters.
- Public health activities permitted by law.
- Coroners, medical examiners, and funeral directors where permitted by law.
- Workers’ compensation programs, as permitted by law.
- Research only when the law’s privacy safeguards are met.
- Government functions authorized by law, such as national security.
- Otherwise required by law.
California law restricts some of these disclosures more than federal law does. Where it does, we follow the stricter rule.
3. Uses and Disclosures That Require Your Written Authorization
We will get your written authorization before using or disclosing your PHI for any purpose not described in this notice. We must also get your authorization for:
- Psychotherapy notes. Psychotherapy notes are a special category of notes a therapist keeps separate from the rest of your record that document or analyze the contents of counseling sessions. They are not the same as your diagnosis, treatment plan, progress notes, or billing and appointment information. We will use or disclose them only with your written authorization, except where the law specifically permits it (for example, our own use for your treatment, supervised training, defending ourselves in a legal action, or as required by law).
- Marketing. We do not use your PHI for marketing without your authorization.
- Sale of PHI. We do not sell your PHI.
- Fundraising. We do not use your PHI for fundraising.
You may cancel an authorization at any time by giving us a written request. Cancelling will not affect anything we already did in reliance on it. We will not make your treatment conditional on signing an authorization except where HIPAA expressly allows it.
4. Substance Use Disorder (SUD) Treatment Records
Federal law (42 CFR Part 2) gives extra protection to records of substance use disorder treatment from programs covered by that law. Our practice is not a Part 2 program, but we may receive Part 2 records from another program, for example with your consent for treatment, payment, and health care operations. If we do:
- We may use and disclose those records only as HIPAA and Part 2 allow.
- Those records, and testimony relaying their content, may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you give your written consent or a court issues an order after notice to you and an opportunity to be heard.
- Information we disclose under HIPAA may be redisclosed by the person who receives it and may no longer be protected by the HIPAA Privacy Rule.
5. Your Rights Regarding Your Health Information
To exercise any of these rights, submit a written request to our Privacy Officer using the information under “Contact Us” below.
Right to inspect and get a copy. You may inspect and obtain a copy of your medical and billing records in your designated record set, including an electronic copy if we keep the records electronically, and you may ask us to send a copy to another person you designate. We will respond within the time HIPAA and California law require. Under California law, that is generally within 5 business days to let you inspect and 15 days to provide copies. We may charge a reasonable, cost-based fee permitted by law. We may deny access in limited situations, and in some cases you can ask for a review of that decision. Special rules apply to psychotherapy notes, and in limited circumstances California law lets us provide a summary of mental health records instead of the full record.
Right to request an amendment. If you believe something in your record is incorrect or incomplete, you may ask us to amend it and explain why. We may deny the request in certain cases, and if we do we will explain why and tell you how to submit a statement of disagreement. Under California law you also have the right to give us a written addendum of up to 250 words for each item you believe is incomplete or incorrect, and we will attach it to your record.
Right to an accounting of disclosures. You may ask for a list of certain disclosures we made of your PHI in the six years before your request. The list does not include disclosures for treatment, payment, or health care operations, disclosures to you or made with your authorization, and certain others the law excludes.
Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to people involved in your care. We are not required to agree, except that we must agree to your request not to disclose information to your health plan for payment or operations when the information relates solely to a service you paid for in full out of pocket and the disclosure is not required by law.
Right to confidential communications. You may ask us to contact you in a particular way or at a particular place, for example only by cell phone or at a different mailing address. We will accommodate reasonable requests.
Right to a paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive this notice electronically.
Right to choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will confirm they have this authority before we act.
Right to be notified of a breach. You have the right to be notified if there is a breach of your unsecured PHI.
6. Minors
Under California law, some minors may consent to their own outpatient mental health treatment. When a minor legally consents to their own treatment, the minor, not the parent, generally controls access to and disclosure of that treatment information, and we may limit what we share with a parent or guardian. When a parent or guardian consents to a minor’s treatment, the parent or guardian generally has the right to access the minor’s records, subject to limits in the law, including where we determine that access would be detrimental to the minor. We handle these situations case by case under applicable law and our clinical procedures.
7. Telehealth, Email, and Text Messages
We provide telehealth services using secure, HIPAA-compliant technology. We do not record telehealth or in-person sessions without your written consent. Ordinary email and text messages are not fully secure, so we ask that you not use them for clinical details. If you ask us to communicate with you by email or text, we will do so, but you accept the added risk that others may be able to access those messages.
8. Changes to This Notice
We may change this notice and our privacy practices at any time as the law permits. A revised notice will apply to all PHI we keep, including information we created or received before the change. When we make a material change, we will post the revised notice on our website and in our offices and make copies available to you on request.
9. Acknowledgment of Receipt
We will ask you (or your legally authorized representative) to sign an acknowledgment that you received this notice at the start of services. The acknowledgment only confirms you received it. It does not authorize any disclosure of your health information and does not waive any of your rights. If we cannot obtain your signature, we will document our good-faith effort and the reason.
10. Contact Us and How to File a Complaint
If you have questions about this notice, want to exercise your rights, or believe your privacy rights have been violated, contact our Privacy Officer:
Healing Hearts Counseling San Diego, Inc.
Attention: Privacy Officer
Telephone: (760) 458-1600
Email: Jhill@healingheartscounselingsd.com
Website: https://healingheartscounselingsd.com/
Encinitas Office
317 N El Camino Real, Suite 508 & 306
Encinitas, CA 92024
Rancho Bernardo Office
16776 Bernardo Center Drive, Suite 203
San Diego, CA 92128
Please do not include detailed health information in ordinary email.
You may file a complaint with our practice by contacting our Privacy Officer using the information above. Describe your concern and tell us how to reach you if you would like a response.
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR):
Website: https://www.hhs.gov/ocr/complaints/index.html
Mail: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201
Telephone: 1-800-368-1019
We will not retaliate against you for filing a complaint.
Effective Date of This Notice: October 20, 2026