Notice of Privacy Practices
Timmy Marrinan Counseling PLLC
Effective date: July 17, 2026
Last updated: July 17, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
About this Notice
Timmy Marrinan Counseling PLLC, referred to in this Notice as “the Practice,” “we,” “our,” or “us,” is committed to protecting the privacy and security of your health information.
This Notice explains:
How we may use and disclose your protected health information;
Your rights concerning that information;
Our legal responsibilities;
How to ask questions or make a complaint; and
How to contact our Privacy Officer.
“Protected health information,” or “PHI,” generally means individually identifiable information concerning your past, present, or future physical or mental health, healthcare services, or payment for healthcare.
This Notice applies to PHI created or maintained by Timmy Marrinan Counseling PLLC in connection with counseling, consultation, scheduling, payment, supervision, telehealth, and related practice activities.
It also applies to people and organizations working on behalf of the Practice when they are required to protect your information, including authorized administrative providers, technology providers, professional consultants, and the Practice’s Board-approved clinical supervisor.
Your Rights
You have the following rights concerning your health information.
Obtain an electronic or paper copy of your record
You may ask to inspect or receive an electronic or paper copy of the health information maintained about you in a designated record set.
This generally includes:
Intake information;
Assessments;
Diagnoses;
Treatment plans;
Progress notes;
Billing and payment records;
Correspondence maintained as part of your clinical record; and
Other records used to make decisions about your care.
To request access, contact the Privacy Officer or submit a written request through the secure client portal.
We will ordinarily provide access or a copy within 30 days after receiving your request. When permitted by law, we may take one additional 30-day extension and will explain the reason for the delay in writing.
We may charge a reasonable, cost-based fee for copying, labor, supplies, postage, or preparing an agreed-upon summary.
In limited circumstances, we may deny some or all of your request. If the denial is reviewable, we will explain how to request a review by another qualified healthcare professional.
Psychotherapy notes maintained separately from the rest of the clinical record may not be included in your general right of access.
Ask us to correct or amend your record
You may ask us to amend information that you believe is incorrect or incomplete.
Your request must be made in writing and should explain why you believe the information should be changed.
We may deny the request when, for example:
We did not create the information;
The information is not part of the records maintained by the Practice;
The information is not available for inspection under applicable law; or
We determine that the record is accurate and complete.
If we deny your request, we will generally explain the reason in writing within 60 days. You may submit a written statement of disagreement to be included with your record as permitted by law.
Request confidential communications
You may ask us to contact you in a particular way or at a particular location.
For example, you may ask us to:
Call only a specified telephone number;
Leave only a limited voicemail message;
Use or avoid text messaging;
Communicate through the client portal;
Use a particular email address; or
Send correspondence to an alternative address.
We will accommodate reasonable requests. You do not have to explain why you are making the request.
Although we will make reasonable efforts to follow your communication preferences, ordinary email, telephone, voicemail, and text messaging may carry privacy risks that are outside the Practice’s complete control.
Ask us to limit what we use or disclose
You may ask us not to use or disclose certain information for treatment, payment, or healthcare operations.
We are generally not required to agree to your request. We will consider it carefully and will notify you of our decision.
If we agree to a restriction, we will follow it except when disclosure is necessary to provide emergency treatment or when disclosure is otherwise required by law.
If you pay for a healthcare service completely out of pocket, you may ask us not to disclose information about that service to a health plan for payment or healthcare-operations purposes. We will agree unless the disclosure is required by law.
Because the Practice is private pay and does not routinely bill insurance or provide superbills, disclosures to health insurers are not part of its ordinary billing practices.
Receive an accounting of disclosures
You may request an accounting of certain disclosures of your health information made during the six years before your request.
The accounting generally will not include:
Uses or disclosures for treatment, payment, or healthcare operations;
Disclosures made directly to you;
Disclosures you authorized;
Disclosures to people involved in your care when permitted;
Certain national-security, intelligence, correctional, or law-enforcement disclosures; or
Other disclosures excluded by law.
We will provide one accounting during any 12-month period without charge. We may charge a reasonable, cost-based fee for additional accountings during the same 12-month period after notifying you of the cost.
Receive a paper copy of this Notice
You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
We will provide a paper copy promptly.
Choose someone to act on your behalf
A person legally authorized to act as your personal representative may exercise your privacy rights and make choices concerning your health information.
This may include a person with an applicable healthcare power of attorney or a court-appointed legal guardian.
Before allowing another person to act for you, we may request documentation confirming that person’s legal authority.
Revoke an authorization
When you have signed a written authorization allowing us to use or disclose your information, you may revoke that authorization in writing at any time.
The revocation will not affect actions already taken in reliance on the authorization and may not apply in other circumstances permitted by law.
Receive notification of a breach
We will notify you as required by law if a breach of unsecured protected health information occurs and compromises the privacy or security of your information.
File a complaint
You may file a complaint with the Practice if you believe your privacy rights have been violated.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
We will not retaliate against you, refuse services, or treat you differently because you made a good-faith privacy complaint.
Contact information appears at the end of this Notice.
Your Choices
For certain uses and disclosures, you may tell us what you want us to do.
People involved in your care or payment
You may give us permission to share relevant information with:
A spouse or partner;
Family members;
Close friends;
A caregiver;
Another person involved in your care; or
Someone assisting with payment for your care.
Whenever reasonably possible, we will ask for your preference before making such a disclosure.
If you are unable to communicate your preference, we may disclose limited information when permitted by law and when, in our professional judgment, doing so is in your best interest.
Disaster-relief situations
We may disclose limited information to an organization assisting with disaster-relief efforts when necessary to notify or assist in notifying family members or others involved in your care.
We will follow your stated preferences when reasonably possible.
Patient directories
The Practice does not maintain a hospital or facility patient directory and does not publicly confirm whether a particular person is receiving counseling services.
Marketing
We will not use or disclose your PHI for marketing when HIPAA requires your written authorization.
We will not use your identity, diagnosis, treatment information, photographs, statements, reviews, or testimonials in advertising without a specific written authorization when such authorization is required.
Choosing to leave a public review does not authorize us to confirm that you are or were a client. Because responding could disclose PHI, the Practice may be unable to respond publicly to the substance of a review.
Sale of information
The Practice does not sell PHI.
We will obtain written authorization before any disclosure that constitutes a sale of PHI under applicable law.
Fundraising
The Practice does not use PHI for fundraising and does not conduct fundraising communications directed to clients based on their treatment information.
Psychotherapy notes
Psychotherapy notes are a mental-health professional’s notes analyzing or documenting the contents of counseling conversations that are maintained separately from the regular clinical record.
Routine progress notes, diagnoses, treatment plans, symptoms, functional status, test results, prognosis, and summaries of progress generally are not psychotherapy notes under HIPAA.
Most uses or disclosures of separately maintained psychotherapy notes require your written authorization. Limited exceptions may apply when the use or disclosure is:
By the professional who created the notes for your treatment;
For certain supervised training activities;
Necessary for the Practice to defend itself in a legal or administrative matter you initiated;
Required for lawful health oversight;
Required by law; or
Otherwise specifically permitted by applicable privacy law.
Substance-use-disorder counseling notes
When applicable, separately maintained notes analyzing the contents of a substance-use-disorder counseling session may receive additional protection under 42 CFR Part 2.
A separate, specific consent may be required before those notes may be used or disclosed.
How We May Use and Disclose Your Information
The following sections describe common ways that we may use or disclose your PHI without obtaining a separate authorization.
Not every example will apply to every client.
Treatment
We may use your information to provide, coordinate, or manage your counseling and related healthcare.
For example, we may:
Assess your concerns;
Develop and review a treatment plan;
Diagnose a behavioral-health condition;
Document your progress;
Evaluate risk and safety;
Coordinate with another provider;
Consult with another qualified professional;
Refer you to another provider or level of care; or
Communicate with a healthcare professional involved in your treatment.
We may disclose relevant information to another healthcare provider for treatment when permitted by law.
Arizona law may provide greater protection for behavioral-health information than HIPAA. When a more protective law applies, we will follow that law.
Clinical supervision and professional consultation
Timmy Marrinan is a Licensed Associate Counselor practicing under Board-approved clinical supervision.
The Practice may use or disclose relevant PHI to its Board-approved clinical supervisor for purposes such as:
Reviewing clinical services;
Discussing diagnosis and treatment planning;
Evaluating risk and ethical concerns;
Reviewing or countersigning documentation;
Monitoring compliance with supervision requirements;
Supporting continuity and quality of care; and
Meeting Arizona licensing and supervised-practice requirements.
The Practice may also consult with qualified healthcare, legal, ethical, or risk-management professionals. When reasonably possible, information will be limited or de-identified.
Supervisors and consultants are expected to maintain confidentiality and are subject to applicable professional, contractual, and legal requirements.
Payment
We may use or disclose your information to receive payment for services and administer financial matters.
This may include:
Processing a payment card;
Charging a card kept on file;
Providing a receipt;
Documenting payment;
Preparing a Good Faith Estimate;
Responding to a payment dispute or chargeback;
Processing an HSA or FSA payment;
Collecting an overdue balance;
Maintaining tax and accounting records; or
Working with payment-processing or accounting providers.
The Practice is private pay. It does not routinely bill health insurers, submit insurance claims, or provide superbills.
If these practices change, this Notice will be updated when required.
Healthcare operations
We may use and disclose PHI to operate the Practice and improve the quality and safety of its services.
Healthcare operations may include:
Scheduling and appointment management;
Clinical supervision;
Quality assessment and improvement;
Reviewing treatment effectiveness;
Professional consultation;
Licensing and credentialing activities;
Compliance reviews;
Documentation review;
Business planning;
Risk management;
Legal and accounting services;
Information-security activities;
Audits;
Complaint investigation;
Training;
Record storage and management;
Telehealth administration;
Client-portal administration;
Payment administration; and
Contacting you when reasonably necessary.
Business associates and service providers
We may use outside companies or professionals to perform services for the Practice.
These may include:
Sessions Health or another electronic health-record provider;
Telehealth and client-portal providers;
Secure data-storage or backup providers;
Payment processors such as Stripe;
Information-technology and cybersecurity providers;
Accountants;
Attorneys;
Records custodians;
Billing or collection providers; and
Other professional or administrative vendors.
When HIPAA requires it, business associates must enter into written agreements requiring them to appropriately safeguard PHI.
Appointment reminders and care-related communications
We may use your contact information to:
Confirm or remind you of an appointment;
Notify you of a schedule change;
Send client-portal notifications;
Provide administrative instructions;
Follow up regarding treatment;
Discuss available services;
Recommend treatment alternatives; or
Provide information about services that may be relevant to your care.
We will make reasonable efforts to communicate according to your stated privacy preferences.
Required by law
We will use or disclose information when federal, state, or local law requires us to do so.
Examples may include:
Mandatory reporting;
Compliance with a valid court order;
Responding to an authorized health-oversight investigation;
Reporting certain threats or safety concerns;
Reporting certain communicable diseases when legally required; or
Complying with other statutory or regulatory obligations.
Abuse, neglect, or domestic violence
We may disclose information to an authorized government agency when we reasonably believe a child, vulnerable adult, or another person has been the victim of abuse or neglect and disclosure is required or permitted by law.
When applicable, we will limit the disclosure to information required or permitted by law.
Serious threats to health or safety
We may use or disclose information when necessary and permitted by law to prevent or reduce a serious and imminent threat or a clear and imminent danger to you or another person.
Disclosures will be made only to people reasonably able to prevent or reduce the threat, such as:
Emergency responders;
Law-enforcement authorities;
A potential victim;
A parent or legal representative;
Another healthcare provider; or
Another appropriate person.
Public-health activities
When authorized by law, we may disclose information for public-health purposes, such as:
Preventing or controlling disease;
Reporting legally required information;
Reporting adverse events;
Supporting product recalls;
Preventing injury; or
Reporting abuse or neglect.
Health-oversight activities
We may disclose PHI to an authorized health-oversight agency for activities permitted by law.
This may include:
Audits;
Investigations;
Inspections;
Licensing actions;
Disciplinary proceedings;
Compliance reviews; and
Other activities necessary for government oversight of healthcare or professional practice.
The Arizona Board of Behavioral Health Examiners may be legally authorized to inspect or obtain client records relevant to a complaint, investigation, supervision matter, or other Board proceeding.
The Practice will provide only the information legally required or authorized and will expect the receiving agency to maintain confidentiality as required.
Legal proceedings
We may disclose PHI in response to:
A valid court or administrative order;
A subpoena;
A discovery request;
A lawful process; or
Another legal demand.
Before disclosing information, we will consider applicable federal law, Arizona law, counselor-client privilege, psychotherapy-note protections, and any other legal requirements.
A subpoena alone may not always be sufficient to require disclosure. The Practice may seek legal advice, require a valid authorization, request satisfactory assurances, object to the request, or seek a protective order when appropriate.
Law enforcement
We may disclose limited PHI to law enforcement when permitted or required by law, including in certain circumstances involving:
A court order, warrant, subpoena, or summons;
Identification or location of a suspect, fugitive, missing person, or witness;
A possible crime on Practice premises;
A death that may have resulted from criminal conduct;
A serious threat to health or safety;
Abuse or neglect; or
Another legally authorized request.
Arizona privilege and confidentiality protections may impose additional limitations.
Workers’ compensation
We may disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation laws or similar programs providing benefits for work-related injuries or illnesses.
Coroners, medical examiners, and funeral directors
We may disclose PHI to a coroner or medical examiner when authorized by law for purposes such as identifying a deceased person or determining cause of death.
We may also disclose relevant information to a funeral director when legally permitted and reasonably necessary to perform the person’s duties.
Organ and tissue donation
When applicable and permitted by law, we may disclose relevant health information to organizations involved in organ, eye, or tissue donation and transplantation.
Research
The Practice does not currently use client PHI for research.
If that changes, we will use or disclose PHI for research only with your written authorization or when another lawful approval, waiver, or exception applies.
Military, national-security, and protective services
When applicable and authorized by law, we may disclose health information concerning:
Members of the armed forces;
Foreign military personnel;
National-security or intelligence activities; or
Protective services for authorized government officials.
Correctional institutions and law-enforcement custody
If you are in lawful custody or incarcerated, we may disclose information to a correctional institution or law-enforcement official when permitted by law and necessary for:
Your healthcare;
The health and safety of another person;
Institutional safety and security; or
Administration of the institution.
Deceased individuals
We may continue to protect information after death as required by law.
We may disclose information to a personal representative or another person involved in the deceased person’s care or payment when permitted by law and consistent with any known preferences expressed by the individual.
Arizona Confidentiality and Privilege
Arizona law generally provides that medical and payment records are privileged and confidential.
Arizona law also generally places the confidential relationship between a licensed behavioral-health professional and a client on the same basis as the relationship between an attorney and client.
Accordingly, we generally will not disclose information received through the counseling relationship unless:
You authorize the disclosure in writing;
The disclosure is permitted or required by state or federal law;
A valid legal process requires disclosure;
A mandatory-reporting requirement applies;
There is a legally recognized safety exception;
Disclosure to the Arizona Board of Behavioral Health Examiners is authorized or required; or
Another lawful exception applies.
When Arizona law is more protective of your information than HIPAA, we will follow the more protective requirement.
Substance-Use-Disorder Records and 42 CFR Part 2
Some records concerning substance-use-disorder diagnosis, treatment, or referral may be protected by the federal confidentiality regulations commonly known as 42 CFR Part 2.
Part 2 does not apply to every record that mentions alcohol or substance use and does not automatically apply to every mental-health provider.
To the extent the Practice creates, receives, or maintains records protected by Part 2:
We will comply with the additional protections applicable to those records;
We will not use or disclose those records in a civil, criminal, administrative, or legislative investigation or proceeding against you without your specific written consent or a qualifying Part 2 court order accompanied by a subpoena or similar legal mandate;
A general authorization or consent for treatment, payment, or healthcare operations may not authorize use of those records against you in a legal proceeding;
Separately maintained SUD counseling notes may require a specific consent;
Disclosures made with consent will be handled according to the scope of that consent and applicable redisclosure rules; and
You may file a complaint concerning a Part 2 violation with the Practice or the U.S. Department of Health and Human Services Office for Civil Rights.
If the Practice determines that it is itself a federally assisted Part 2 program, it will provide a separate or combined Part 2 Patient Notice and obtain any additional consents required by Part 2.
Our Responsibilities
The Practice is responsible for:
Maintaining the privacy and security of PHI as required by applicable law;
Using reasonable administrative, physical, and technical safeguards;
Limiting uses, disclosures, and requests to the minimum necessary information when that standard applies;
Providing you with this Notice;
Following the privacy practices described in the current Notice;
Providing access to your health information as required by law;
Correcting or amending records when required;
Documenting applicable disclosures;
Honoring agreed-upon restrictions;
Providing required breach notifications;
Maintaining appropriate agreements with business associates when required; and
Refraining from retaliation when you exercise a privacy right or make a complaint.
We will not use or disclose your information in a way that is not described in this Notice unless you authorize us in writing or another law permits or requires the use or disclosure.
If you provide written authorization, you may revoke it in writing, subject to the limitations described in this Notice.
Changes to This Notice
We may revise this Notice when our practices, services, technologies, vendors, or legal obligations change.
A revised Notice may apply to PHI that we already maintain as well as information created or received after the revision.
The current Notice will be:
Available upon request;
Posted prominently at the Practice’s physical office;
Available through the client portal when practicable; and
Prominently available on the Practice website.
The effective date at the beginning of the Notice will identify the current version.
Questions and Complaints
Practice Privacy Officer
Timmy Marrinan, LAC, NCC
Privacy Officer
Timmy Marrinan Counseling PLLC
6909 West Ray Road
Chandler, Arizona 85226
Telephone: (602) 935-4287
Email: [email protected]
Please do not send emergency information or extensive clinical details through ordinary email.
You may contact the Privacy Officer to:
Ask questions about this Notice;
Exercise a privacy right;
Request a form;
Report a privacy concern;
Report a suspected security incident; or
Make a complaint.
U.S. Department of Health and Human Services
You may also submit a complaint to:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Telephone: 1-877-696-6775
You may also use the HHS Office for Civil Rights online complaint portal.
Timmy Marrinan Counseling PLLC will not retaliate against you for filing a complaint with the Practice, the Office for Civil Rights, or another legally authorized agency.