What HIPAA Actually Is
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for protecting sensitive patient health information. As a healthcare provider, Maple ABA Therapy is required to comply with HIPAA's Privacy Rule and Security Rule regarding your family's protected health information (PHI).
What Counts as Protected Health Information
| Category | Examples |
|---|---|
| Identifying information | Name, address, date of birth, contact details |
| Clinical information | Diagnosis, treatment plans, session notes, progress data |
| Billing information | Insurance details connected to your child's care |
Your Specific Rights Under HIPAA
| Right | What It Allows |
|---|---|
| Right to access | Request and receive a copy of your child's health records |
| Right to request amendment | Request correction of inaccurate or incomplete information |
| Right to an accounting of disclosures | Request a list of certain instances your information was shared |
| Right to request restrictions | Ask us to limit certain uses or disclosures of your information |
| Right to confidential communications | Request that we communicate with you in a specific way or location |
| Right to file a complaint | Report a concern to us directly or to the U.S. Department of Health and Human Services |
When We Can Share Information Without Additional Authorization
HIPAA permits sharing PHI without separate authorization for treatment (coordinating your child's care among involved providers), payment (billing your insurance), and healthcare operations (internal quality and administrative functions) — but even within these categories, we limit sharing to the minimum necessary information.
Outside of these categories — such as sharing with a school, another therapy provider not directly involved in treatment coordination, or any other third party — we obtain your explicit written authorization first.
Exceptions Required by Law
Certain disclosures are required regardless of consent, most notably mandated reporting of suspected child abuse or neglect under Michigan law, and disclosures required by court order or other legal process.
How to File a HIPAA Complaint
If you believe your privacy rights have been violated, you can file a complaint directly with us, or with the U.S. Department of Health and Human Services' Office for Civil Rights, which oversees HIPAA compliance nationally. Filing a complaint will never affect the care your child receives.
Our HIPAA Obligations as a Provider
| Obligation | What It Requires |
|---|---|
| Designated Privacy Officer | A specific staff member responsible for privacy compliance |
| Workforce training | All staff trained on HIPAA requirements and confidentiality |
| Notice of Privacy Practices | A written notice describing how your information may be used, provided at intake |
| Business Associate Agreements | Contracts with any vendor handling PHI on our behalf, requiring equivalent protections |
Frequently Asked Questions
Do I need to sign anything for HIPAA protections to apply?
No — HIPAA protections apply automatically as a healthcare provider requirement. You will, however, be asked to sign an acknowledgment that you received our Notice of Privacy Practices.
Can I request my child's full records at any time?
Yes, this is a right guaranteed under HIPAA's right of access, generally with a response required within a specific legal timeframe.
What if I want my child's information kept from a specific family member?
This is worth discussing directly with us — we can accommodate reasonable requests about who is authorized to receive information about your child's care.
Does HIPAA cover communication by email or text?
Yes, and we take reasonable, HIPAA-consistent precautions for electronic communication involving PHI — ask us about our specific secure communication practices.
References
- Health Insurance Portability and Accountability Act (HIPAA) of 1996, 45 CFR Parts 160 and 164
- U.S. Department of Health and Human Services, Office for Civil Rights — HIPAA enforcement and complaint process