Little Spero provides autism therapy services and, in that capacity, may be a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). HIPAA governs how we handle “protected health information” (“PHI”) — information relating to a client’s past, present, or future physical or mental health condition, the provision of care, or payment for care, that identifies the individual or could reasonably be used to do so.

• Scope: This Section 10 applies to PHI collected in connection with therapy intake, assessment, treatment planning, session notes, billing, and related clinical operations. It does not apply to the general website analytics, advertising, or marketing-related information described elsewhere in this Policy, which is not treated as PHI unless you voluntarily include health-related details in a general inquiry form.
• Notice of Privacy Practices: Clients and the parents or guardians of clients receive a separate HIPAA Notice of Privacy Practices, which describes in detail how PHI may be used and disclosed for treatment, payment, and healthcare operations, and explains the circumstances in which we may share PHI without additional authorization (e.g., as required by law, for public health activities, or in response to a valid court order).
• Uses and Disclosures: We use and disclose PHI only as permitted or required by HIPAA — primarily to provide and coordinate therapy services, to bill for services rendered, and to support the day-to-day operations of our practice. Any use or disclosure of PHI beyond what HIPAA permits requires your (or your child’s parent or guardian’s) written authorization.
• Client Rights Under HIPAA: Clients and, where applicable, parents or guardians acting on behalf of a minor client, have the right to: request access to and copies of their PHI; request amendment of PHI believed to be inaccurate or incomplete; request an accounting of certain disclosures of PHI; request restrictions on certain uses or disclosures; request confidential communications by an alternative means or at an alternative location; and receive a copy of our Notice of Privacy Practices.
• Safeguards: We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI in accordance with the HIPAA Security Rule, and we train staff on their obligations to protect client information.
• Breach Notification: In the event of a breach involving unsecured PHI, we will provide notification to affected individuals and, where required, to the U.S. Department of Health and Human Services and the media, in accordance with the HIPAA Breach Notification Rule.
• Filing a Complaint: If you believe your privacy rights under HIPAA have been violated, you may file a complaint with us using the contact information in Section 14, or with the U.S. Department of Health and Human Services, Office for Civil Rights.

For full details on our HIPAA practices, please request a copy of our current Notice of Privacy Practices using the contact information in Section 14.