How your health information is used and disclosed
This notice describes what happens to the information you provide during an ESA or PSD evaluation: who inside the service can see it, the narrow circumstances in which it leaves, and the choices that remain yours throughout.
Three tiers of permission
Everything falls into one of three buckets
HIPAA is far less mysterious once you see that every use of your information sits in exactly one of these categories. The middle tier is where most confusion lives.
The clinician assigned to your case reviews your intake to reach a professional decision. Without this, no evaluation is possible.
Billing systems process the transaction for the plan you selected. Payment records connect to your account, not to your clinical content.
A limited number of administrative staff need access for scheduling, document delivery, verification and quality review.
Even the letter itself. You decide whether to send it, and to whom.
Campus housing and workplace accommodation requests are separate disclosures requiring their own authorisation.
Including a spouse or parent, unless they are a legally authorised representative.
Narrow, documented and limited to what the order specifies.
Where a genuine and imminent threat to you or another person exists.
Lawful audits by the bodies that supervise licensed clinicians.
What is never done with your information
- Sold to advertisers, data brokers or list vendors
- Used for marketing without your separate written permission
- Shared with a landlord because they asked directly
- Posted, published or used in testimonials with identifying detail
- Handed to an insurer that is not involved in your care
Changing your mind
An authorisation you have signed is not permanent. You may revoke it in writing at any time, and the revocation takes effect from the moment it is received.
What a revocation cannot do is reach backwards. A disclosure already made in reliance on a valid authorisation cannot be recalled — which is a good reason to think about scope before you sign rather than afterwards.
The minimum necessary principle
Where a disclosure is permitted, it still has to be limited to the minimum information needed for the purpose. This is why a landlord verification confirms that a licensed clinician issued a letter on a given date and nothing more — not because we are being cautious, but because sending more than the purpose requires would itself be a breach of the rule.
Frequently asked
Do I have to authorise disclosure to my landlord?
No. You choose whether to send your letter to a housing provider. Nothing is sent on your behalf without your instruction, and declining does not affect the evaluation itself.
Is my payment information part of my health record?
Payment records exist for the transaction and are held separately from clinical content. Card details are handled by the payment processor rather than stored alongside your intake answers.
Can I get a paper copy of this notice?
Yes. You are entitled to a paper copy on request, even where the entire process has been handled electronically.
What is the difference between consent and authorisation?
Consent generally covers the treatment relationship itself. Authorisation is the separate written permission needed before your information goes to a third party such as a landlord, employer or university.
How long does an authorisation last?
A properly drafted authorisation states an expiry date or event. Once it expires, it can no longer be relied on and a fresh authorisation would be needed.
Does the minimum necessary rule apply to my own requests?
No. When you ask for your own record, you are entitled to the whole of it. The minimum necessary principle limits disclosures to others, not access by you.
Your privacy is not an afterthought here
Start a free evaluation and see exactly what your landlord will — and will not — receive.
Start free evaluation All privacy topics