1. Who We Are

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Andrea L. Bross, Ph.D. and the South Shore Counseling and Psychological Services (“We”, “Us”). It applies to services furnished to you at 195 Whiting Street, Suite 4B, Hingham, Massachusetts 02043, and any other medically appropriate location.


  1. Our Privacy Obligations

We are required by the Health Insurance Portability and Accountability Act (“HIPAA”) and applicable state law to maintain the privacy of your individually identifiable health information (“Protected Health Information”, “PHI”).   PHI constitutes information created or noted by us that can be used to identify you. It contains data about your past, present, or future health or mental conditions, the health care services we provide, or the payment for such health care. We will let you know promptly if a breach (as defined by HIPAA) occurs that may have compromised the privacy or security of your PHI.

We are also required to provide you with this Notice about our privacy procedures. This Notice must explain when, why, and how we use and/or disclose your PHI. “Use” means when we share, apply, utilize, examine, or analyze your PHI within the practice. “Disclosure” means when we release, transfer, give, or otherwise reveal your PHI to a third party outside of our practice. We may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made, except in some limited circumstances. However, we are always legally required to follow the privacy practices described in this Notice.


  • How We Will Use and Disclose Your PHI

We will use and disclose your PHI for many different reasons. Some of the uses or disclosures require your prior written authorization, but others do not.   Different categories of our uses and disclosures, along with some examples, are discussed below.


  1. Uses and Disclosures Related to Treatment, Payment, or Health Care Operations Do Not Require Your Prior Written Consent or Authorization


We may use and disclose your PHI without your consent and/or authorization for the following reasons:


  1. Treatment. We can use your PHI in our practice to provide you with mental health treatment, including discussing or sharing your PHI with any trainees and interns. We also may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care. Example: If a psychiatrist is treating you, we may disclose your PHI to her/him in order to coordinate your care.
  2. Health care operations. We may use and/or disclose your PHI to facilitate the operation of our practice. Examples: We might use your PHI to evaluate the quality of health care services that you receive and the performance of the health care professionals who provided these services. We may also provide your PHI to our attorneys, accountants, consultants, and others to make sure that we comply with applicable laws.


  1. To obtain payment for treatment. We may use and/or disclose your PHI to bill and collect payment for the treatment and services we provided. Example: We may send your PHI to your insurance company or health plan in order to get payment for the health care services that have been provided. We could also provide your PHI to business associates, such as billing companies, claims processing companies, or others, that process health care claims for our office.


  1. Other disclosures. Your consent isn't required if you need emergency treatment provided that we attempt to get your consent after treatment is rendered. If you are unable to communicate with us to offer consent (for example, if you are unconscious or in severe pain) but we think that you would consent to such treatment if you were able, we may disclose your PHI.


  1. Certain Other Uses and Disclosures Also Do Not Require Your Consent Or Authorization

We also may use and/or disclose your PHI without your consent or authorization for the following reasons:

  1. Required by law: We may disclose your PHI to the extent required by federal or state law and the use/disclosure complies with and is limited to the relevant legal requirements. This includes but is not limited to disclosure to the Department of Health and Human Services for HIPAA compliance purposes.
  2. Public Health Activities: We may disclose your PHI for public health activities, such as information for the purposes of preventing or controlling disease, helping with product recalls, reporting adverse reactions to medications, and other similar public health activities.
  3. Victims of Abuse, Neglect or Domestic Violence: We may disclose PHI about an individual whom we reasonably believe to be a victim of abuse, neglect or domestic violence, including to a social service or protective services agency authorized by law to receive reports of such abuse, neglect, or domestic violence. If we have reasonable cause to believe that a child, elderly person or disabled person is the victim of abuse, we are required to report this abuse to the appropriate government agency, unless you are the disabled person and do not consent to the abuse being reported.
  4. Health Oversight Activities: We may disclose your PHI to a state or federal health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; and other similar activities necessary for government oversight of the health care system, government benefit systems, government regulatory systems, and civil rights compliance.
  5. Judicial and Administrative Proceedings: We may disclose your PHI in the course of any judicial or administrative activity in response to a court order or in response to a subpoena, discovery request, or other lawful process to the extent permitted by professional ethics and applicable state and federal confidentiality laws.
  6. Law Enforcement Purposes: We may disclose PHI to a law enforcement official in limited circumstances to the extent permitted by professional ethics and applicable federal and state laws.
  7. Decedents: We may disclose PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law. We may also disclose PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
  8. Cadaveric organ, eye or tissue donation purposes: We may use or disclose PHI to organ procurement organizations or other similar entities for the purpose of facilitating organ and tissue donation requests.
  9. Research Purposes: We may use or disclose your PHI for research. We currently have no ongoing research and do not plan to conduct any research in the future. If we conduct any future research that involves your PHI, we will obtain your authorization or take sufficient anonymizing steps under the law to protect your identity.
  10. To Avert a Serious Threat to Health or Safety: We may use or disclose PHI if we in good faith reasonably believe, consistent with applicable laws and the standards of ethical conduct, that it (i) is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person (including yourself) or the public; and (ii) is to a person or persons (including the appropriate law enforcement agency, your family, or other individuals) reasonably able to prevent or lessen the threat, including the target of the threat.
  11. Specialized Government Functions: In certain circumstances and only to the extent required by applicable federal and state laws, we may use and disclose PHI for specialized government functions, which include but are not limited to (i) PHI of Armed Forces personnel to the extent needed to fulfill a military mission; (ii) for the conduct of lawful national security and intelligence activities; (iii) for the provision of protective services for the President and others; or (iv) for correctional institutions and other law enforcement custodial circumstances.
  12. Disclosure for Workers’ Compensation: We may disclose PHI, as authorized by and to the extent necessary, to comply with laws relating to workers’ compensation or other similar programs that provide benefits for work-related injuries or illness without regard to fault.
  13. Certain Uses and Disclosures Require You to Have the Opportunity to Object

We may provide your PHI to a family member, friend, or any other individual who you indicate is involved in your care or responsible for the payment for your health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.

  1. Other Uses and Disclosures Require Your Prior Written Authorization

In any other situation not described in Sections III.A., III.B, or III.C, we will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization in writing to stop any future use or disclosure of your PHI by us.

  1. Your Rights Regarding Your PHI

When it comes to your PHI, you have certain rights under HIPAA. This section explains your rights and some of our responsibilities to help you.

  1. Get an electronic or paper copy of your medical record

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this. We will provide a copy or a summary of your PHI, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

  1. Ask us to correct your medical record

You can ask us to correct PHI about you that you think is incorrect or incomplete. Ask us how to do this. We may deny your request, but we will explain our reasoning to you in writing within 60 days.

  1. Request confidential communications

You can ask us to contact you in a specific way (for example, at home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests.

  1. Ask us to limit what we use or share

You can ask us not to use or share certain PHI for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

  1. Get a list of those with whom we’ve disclosed your PHI

You can ask for a list (accounting) of the times we’ve disclosed your health information for the past six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

  1. Get a copy of this privacy notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

  1. Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will make sure the person has this authority and can act for you before we take any action.

  1. File a complaint if you feel your rights are violated

You can complain to us if you feel we have violated your privacy rights. The person to contact and the procedure to follow is discussed in Section V below. You can also file a complaint with the U.S. Department of Health and Human Services Office if you feel that we have violated your privacy rights. The address and the procedure to follow is also discussed in Section V below.

  1. Questions and Complaints

If you have questions about this Notice, disagree with a decision we make about access to your records or have other concerns about your privacy rights, you may contact the following by email, phone call, or a written complaint:


Andrea L. Bross, Ph.D.

South Shore Counseling and Psychological Services

195 Whiting Street, Suite 4B

Hingham, MA 02043



If you believe that your privacy rights have been violated, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/


We will not retaliate against your for exercising your rights to file a complaint.

  1. Effective Date, Restrictions and Changes to Privacy Policy

This notice will go into effect on March 20, 2015. We reserve the right to change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our website: southshorecaps.com.