Notice of Privacy Practices

Stone Ridge Behavioral Health, PLLC
Effective date: October 8, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our responsibilities

We must protect your health information, provide this notice, follow the notice currently in effect and notify affected individuals of breaches of unsecured protected health information as required by law. This notice covers health information the practice maintains about your care, including psychiatric evaluations, medication management, telehealth and billing.

How we may use and disclose information

Where permitted by applicable federal and Virginia law, we may use or share information for:

  • Treatment: For example, communicating relevant medication information with your pharmacy or another treating clinician.
  • Payment: For example, providing diagnoses and visit information to your insurer or billing service to process a claim or prior authorization.
  • Health care operations: For example, reviewing care quality, coordinating services, maintaining records and supporting practice administration. Service providers handling protected health information on our behalf must meet applicable privacy requirements.
  • Contact about care: Appointment reminders, treatment options and other communications related to your services.
  • Public health and safety: Legally permitted or required reporting of suspected abuse or neglect, communicable disease, medication-related safety issues, and disclosures to prevent or lessen a serious and imminent threat.
  • Legal and oversight purposes: Required legal disclosures; authorized audits and licensing oversight; qualifying court orders, subpoenas and law-enforcement requests; workers’ compensation and authorized government functions. A request alone does not automatically permit disclosure; applicable conditions and protections must be met.
  • Other legally authorized purposes: Qualifying research, organ donation, and disclosures to coroners, medical examiners or funeral directors, subject to applicable safeguards.

We follow more protective laws when they apply, including protections for certain mental health and substance-use records. The fact that HIPAA permits a disclosure does not override a stricter applicable law.

Your choices and written permission

We may share relevant information with people involved in your care or payment when you agree, do not object where the law allows, or another lawful basis applies. In certain circumstances when you cannot express a preference, relevant information may be shared based on professional judgment and applicable law. School, employer and other third-party requests are evaluated separately; an appropriate authorization is obtained when required.

Most disclosures of separately maintained psychotherapy notes require written authorization, with limited legal exceptions. Ordinary medication-management and progress notes are not automatically psychotherapy notes. Uses and disclosures requiring authorization, including certain marketing and sales of protected health information, will not occur without the required authorization. We do not sell your health information or use it for third-party marketing.

Other uses and disclosures not described in this notice require your written authorization unless the law permits or requires them. You may revoke an authorization in writing, except to the extent we have already acted on it.

Substance-use records with additional protection

If we receive or maintain substance-use disorder records protected by 42 CFR Part 2, additional restrictions apply. Those records, and testimony describing their contents, may not be used or disclosed in civil, criminal, administrative or legislative proceedings against you without the required written consent or an appropriate court order after notice and an opportunity to be heard. A qualifying court order must also be accompanied by a subpoena or other legal requirement compelling disclosure. These protections apply even when another disclosure might otherwise be allowed under HIPAA.

Information lawfully disclosed may be redisclosed by its recipient and may no longer have the same protections. A recipient subject to HIPAA or Part 2 must still comply with the requirements that apply to it.

Your rights and how to request them

Contact our privacy officer using the information below. We may need to verify identity and ask for a written request.

  • Access: Ask to inspect or receive electronic or paper copies of medical and billing records. We respond within applicable deadlines, generally within 30 days under HIPAA unless a permitted extension applies; a shorter applicable deadline controls. Limited exceptions apply. Any permitted fee must comply with applicable law. Access is not denied simply because a treatment bill is unpaid.
  • Amendment: Ask us to correct information you believe is wrong or incomplete. If a request is denied, we explain why and how to submit a statement of disagreement.
  • Confidential communication: Request reasonable alternative contact methods or a different mailing address.
  • Restrictions: Ask us to limit certain uses or disclosures. We do not have to agree to every request. If you pay out of pocket in full for an item or service and request it, we must restrict disclosure to your health plan for payment or operations unless disclosure is required by law.
  • Accounting: Request a list of disclosures covered by the accounting right for the preceding six years. Treatment, payment, operations and certain other disclosures are excluded. The first accounting in a 12-month period is free; any additional permitted fee is explained in advance.
  • Notice: Request a paper copy at any time, even if you receive this notice electronically.
  • Representative: A legally authorized representative may exercise rights to the extent permitted by law. We verify the person’s authority.

For minors, consent, confidentiality and parental access depend on Virginia law, the service involved and the circumstances. A minor’s ability to consent to certain outpatient mental health services does not mean parental record access is automatically excluded. Ask us to explain the rules applicable to your situation.

Questions, complaints and changes

Privacy Officer: Gurjot Toor, DNP, PMHNP-BC
Stone Ridge Behavioral Health, PLLC
2 Cardinal Park Dr SE, Suite 201B, Leesburg, VA 20175
Phone: 571-626-7051 • Fax: 571-977-3016
Email: info@stoneridgebh.com

You may submit a privacy complaint to the practice by phone or in writing. Ask for a secure method before sending sensitive details. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

We may revise this notice and apply revised terms to all health information we maintain, as permitted by law. The current notice will be available on our website, in our office and on request.