Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective Date: September 1, 2026
Practice Contact for Privacy Questions
Breonna McFarland, LMFT, LCMHC, LPCC | Phone: 661-475-6746 | Portal: Secure Message
At Victorious Light Within P.L.L.C. (the “Practice”), we are deeply committed to protecting your personal and medical information. This Notice of Privacy Practices describes how we may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or health care operations, and for other purposes that are permitted or required by law.
1. Our Legal Duty and Responsibilities
We are required by federal and state law to maintain the privacy of your health information, provide you with this Notice of our legal duties and privacy practices, abide by the terms of the Notice currently in effect, and notify you following a breach of your unsecured protected health information, by first-class mail or, if you have agreed to electronic notice, by email, without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
Authorization and Revocation: We will not use or disclose your health information in ways other than those described in this Notice unless you give us your written authorization. You may revoke an authorization at any time by notifying us in writing, except to the extent we have already acted on it. No Retaliation: We will not retaliate against you for filing a complaint or for exercising any of your rights described in this Notice. No Marketing Policy: We will never sell your health information, and will not use or disclose it to contact you for marketing or fundraising purposes without your written authorization.
2. How We May Use and Disclose Health Information About You
For Treatment: We may use or disclose your health information to coordinate your care. For example, your therapist may consult with your primary care physician or another treating provider, with your authorization unless the law allows otherwise, to ensure safe, comprehensive care. We may also discuss your care with a clinical supervisor or consultant, including Laura McLaughlin, using information that does not identify you, unless you have signed an authorization that allows us to share identifiable information.
For Payment: We may use and disclose your health information to process billing, process card payments through Stripe/SimplePractice, our payment processor, handle insurance claims or superbills (if applicable), or verify self-pay accounts.
For Health Care Operations: We may use your health information for administrative management, quality assessment, practice improvement, and operational support, including clinical supervision and training that uses information that does not identify you. All digital practice tools, electronic health record platforms (SimplePractice), and AI clinical scribing/secretary tools (Simple Practice Note Taker and DeepCura) are used under your clinician’s direction and review. Where a vendor acts as our business associate, we use that vendor only under a written business associate agreement, as HIPAA requires, and we apply the safeguards that the HIPAA Security Rule requires. You may decline audio recording and AI documentation tools, as explained in your Client Psychotherapy Agreement.
3. Special Protection for Psychotherapy Notes and Other Uses That Require Your Authorization
Psychotherapy Notes: Notes recorded by your mental health clinician documenting the contents of a private counseling session are given a higher level of privacy protection under federal law (HIPAA) and state guidelines. Psychotherapy notes are kept separate from the rest of your medical record and generally require your specific, written authorization for any use or disclosure, with the limited exceptions described below.
Limited Exceptions: We may use or disclose psychotherapy notes without your authorization only (a) for treatment by the clinician who wrote them; (b) in our own training programs in which students, trainees, or practitioners learn under supervision to practice or improve their counseling skills; (c) to defend ourselves in a legal action or other proceeding you bring; (d) as required by law, including to the Secretary of Health and Human Services to determine our compliance; (e) for health oversight of the clinician who wrote them; (f) to a coroner or medical examiner; or (g) to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
Other Uses That Require Your Authorization: We must also have your written authorization for most uses and disclosures of health information for marketing and for any sale of your health information. You may revoke an authorization at any time in writing, except to the extent we have already acted on it. Redisclosure: Information that we disclose under the HIPAA Privacy Rule may be redisclosed by the person who receives it and may no longer be protected by the Privacy Rule. Substance Use Disorder Records: The Practice is not a substance use disorder treatment program. If we ever receive records that are protected by 42 CFR Part 2, we will handle them as that rule requires.
4. Other Permitted Uses and Disclosures Without Your Authorization
Under federal and state law, we may disclose your health information without your written authorization in specific circumstances, including:
Required by Law: When another federal or state law requires us to disclose information, we will disclose only what the law requires. Child or Incapacitated Adult Abuse or Neglect: If we have reason to suspect that a child has been abused or neglected, or that an incapacitated adult has been abused, neglected, or exploited, we are required to report it to the appropriate state agency (RSA 169-C:29; RSA 161-F:46). Harm to Self or Others: If a client communicates a clear and imminent threat of severe physical harm to themselves or an identifiable third party, and we believe in good faith that disclosure is necessary to prevent or lessen the threat.
Judicial and Administrative Proceedings: If we receive a valid court order, we will disclose the information that the order requires. Communications with us are privileged under New Hampshire law (RSA 330-A:32), which in this respect is more protective than HIPAA. If we receive a subpoena that is not accompanied by a court order, we will assert the privilege and will release your information only with your written authorization or after a court orders us to. Legal Compliance: When required by applicable state licensing boards or federal health oversight agencies for oversight activities such as audits, investigations, and licensing actions, including a complaint made about the clinician.
Public Health: To a public health authority as permitted or required by law, for example to report a disease or to prevent or control a health risk. Law Enforcement: To law enforcement officials only as required by law or in response to a court order or court-ordered warrant. Workers’ Compensation: As needed to comply with workers’ compensation laws, if they apply. Coroners, Medical Examiners, and Funeral Directors: To a coroner or medical examiner to identify a deceased person or determine a cause of death, and to funeral directors as needed to carry out their duties. Appointment Reminders and Treatment Alternatives: To contact you with appointment reminders and to tell you about treatment alternatives or other health-related services that may interest you, using the contact information and communication preferences you have given us.
5. Your Rights Regarding Your Health Information
To use any of these rights, contact the Practice Contact listed at the top of this Notice. You have the following rights regarding the health information we maintain about you:
Right to Inspect and Copy: You have the right to inspect and obtain a copy of your mental health record pursuant to New Hampshire law (RSA 332-I:1) and HIPAA guidelines (all records are legally deemed the property of the patient). Complete records will be provided within 30 days of a written request (Mhp 502.01(m)). We may charge a reasonable, cost-based fee for copies, which will not be more than New Hampshire law allows. If you ask for an electronic copy of records we keep electronically, we will provide it in electronic form if it can readily be produced that way, and you may ask us to send a copy directly to a person you designate in writing. Psychotherapy notes are not included in this right of access. In limited circumstances we may deny access; if we do, we will tell you why in writing and explain any right you have to have the denial reviewed.
Right to Amend: If you feel that health information we have is incorrect or incomplete, you may ask us to amend the information. If we deny your request, we will explain why in writing, and you may submit a statement of disagreement that we will add to your record. Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your health information in the six years before your request (excluding standard treatment, payment, and operations disclosures, disclosures you authorized, and certain others the law excludes).
Right to Request Restrictions: You have the right to request a restriction or limitation on the health information we use or disclose for treatment, payment, or operations. Note: If you pay for a service or item out-of-pocket in full, you have the right to restrict information regarding that service from being shared with your health insurer, and we are legally required to honor that request unless mandated otherwise by law. We are not required to agree to any other request for a restriction, but we will consider it; if we do agree, we will follow our agreement except in an emergency.
Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location (e.g., via secure portal, on telehealth). We will accommodate reasonable requests. Right to a Paper Copy of This Notice: You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. Right to Be Notified of a Breach: You have the right to be notified if a breach of your unsecured protected health information occurs, as described in Section 1.
6. Changes to This Notice and Where To Find It
We reserve the right to change this notice and make the new notice apply to all health information we already have as well as any information we receive in the future. If we make a material change, we will post the revised Notice and make it available to you on request. The effective date at the top of this Notice shows when the current version took effect. This Notice is posted on the Practice’s website (www.victoriouslightwithin.org) and in the client portal, and you may ask for a paper or electronic copy at any time.
7. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our practice (using the Practice Contact above) or with the Secretary of the Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint. You may also contact the New Hampshire licensing board listed below.
Agency: U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) | Website: HHS OCR Complaint Portal | Phone (Toll-Free): 1-800-368-1019 | TDD: 1-800-537-7697 | Email: OCRMail@hhs.gov or OCRComplaint@hhs.gov
Agency: New Hampshire Office of Professional Licensure and Certification (OPLC) – Board of Mental Health Practice | Address: 7 Eagle Square, Concord, NH 03301 | Website: oplc.nh.gov | Phone: (603) 271-2152 | Email: enforcement.complaints@oplc.nh.gov