Privacy Policy | Treehouse Child Psychiatry

Information we collect

This website does not use advertising trackers, sell data, or require an account. We only collect information you choose to send us, mainly through the new patient request form: the patient's name and date of birth, a parent or guardian's name, phone number, email address and home address, and a short description of your concerns.

How we use it

We use this information only to review your request, contact you about it, and, if Treehouse can help, to set up care. We do not sell, rent or share it for marketing. We share it only with service providers who help us run the practice (such as our scheduling, email, Google Workspace and electronic health record services), each of which is bound by a Business Associate Agreement or similar confidentiality obligations, or when the law requires it.

How we protect it

New patient requests are sent over an encrypted connection directly to Treehouse's Google Workspace account, which is covered by a HIPAA Business Associate Agreement, and are not delivered as plain email. Nothing you type is stored in your browser. Access is limited to Dr. Heck and authorized staff. No method of sending information over the internet is perfectly secure, so please share only what the form asks for.

Email and phone

Regular email and text messages are not fully secure. Please don't send detailed medical information by email. Once you are a patient, use the Charm patient portal for clinical messages.

Requests that don't become patients

If we are unable to accept a request, we keep the information only as long as needed for our records and as required by law, then securely delete it.

Children's information

This site is meant to be used by parents and legal guardians. Information about a child should be submitted by the child's parent or guardian.

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: October 12, 2026

In this notice, "you" means the patient, or the parent or legal guardian acting for a patient who is a minor.

Our responsibilities

Treehouse Child Psychiatry is required by law to:

maintain the privacy of your protected health information (PHI);
give you this notice of our legal duties and privacy practices;
notify you if a breach occurs that may have compromised the privacy or security of your PHI; and
follow the terms of the notice currently in effect.

We will not use or share your information other than as described here unless you give us written permission. You may revoke that permission in writing at any time, except to the extent we have already acted on it.

How we may use and disclose your health information

We may use and disclose your PHI without your written authorization for the following purposes.

Treatment. To provide, coordinate or manage your care. For example, we may share information with your child's pediatrician or therapist, or send a prescription to your pharmacy.

Payment. To bill and collect payment for services. For example, we use your information to process payment and to prepare superbills you can submit to your insurance company.

Health care operations. To run the practice, such as quality review, training, licensing and customer service. For example, we may contact you to remind you of an appointment.

Business associates. We use outside companies that help run the practice and handle PHI for us. Each one signs a business associate agreement (BAA) requiring it to protect your information. At the time of this notice they include Acuity Scheduling (scheduling), CharmHealth (electronic health record and patient portal), Google Workspace (email and our website's new patient request form), Zoom (telehealth visits) and Square (payments). This list may change.

Family and others involved in care. We may share information with a family member or other person involved in your care or payment for it, or to notify them of your location or condition. If you are present and able, we will give you the chance to object first. In an emergency, or if you are unable to agree or object, we will use professional judgment about what is in your best interest.

To prevent a serious threat to health or safety. We may share information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you, another person or the public, including as required by Virginia law.

As required or permitted by law. We may also share information:

when required by federal, state or local law;
for public health activities, such as reporting disease or adverse reactions to medications;
to report suspected abuse, neglect or domestic violence;
for health oversight activities, such as audits and inspections;
in response to a court order, subpoena or other lawful process;
for law enforcement purposes, as limited by law;
to coroners, medical examiners and funeral directors;
for organ and tissue donation;
for research, under conditions the law sets;
for specialized government functions, such as military and national security activities;
for workers' compensation claims;
about a person in lawful custody, to the correctional institution or law enforcement official; and
to the Secretary of the U.S. Department of Health and Human Services, to show that we comply with HIPAA.

Substance use disorder records. To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Redisclosure. After we share information in a permitted way, the person or organization that receives it may share it again, and once it does, it may no longer be protected by federal privacy law.

Uses that require your written authorization

We will not do the following without your written authorization:

use or share psychotherapy notes, except in the limited cases the law allows;
use or share your information for marketing; or
sell your information.

Children and parents

A parent or legal guardian generally acts for a minor patient and may exercise the rights in this notice on the child's behalf. Virginia law sets some exceptions. For example, a minor may consent to certain outpatient mental health care on their own, and a parent's access to records may be limited if a physician determines that access is reasonably likely to cause substantial harm to the patient or another person. We follow Virginia law in these situations.

Your rights

Right to see and get a copy of your records. You may ask to see or get a paper or electronic copy of your medical record. We will respond as the law requires and may charge a reasonable, cost-based fee. This right does not cover psychotherapy notes or information prepared for legal proceedings.

Right to ask for a correction. You may ask us to correct information you believe is wrong or incomplete. If we say no, we will tell you why in writing, and you may submit a statement of disagreement.

Right to request confidential communications. You may ask us to contact you in a particular way or at a particular place, such as a different phone number or address. We will agree to reasonable requests.

Right to ask us to limit what we use or share. You may ask us not to use or share certain information for treatment, payment or operations. We are not required to agree, but we will consider your request. If you pay for a service out of pocket in full, you may ask us not to share information about that service with your health insurer, and we will agree unless the law requires us to share it.

Right to a list of disclosures. You may ask for a list of certain times we shared your information in the six years before your request. The list will not include disclosures for treatment, payment or operations, or disclosures you authorized. One list per year is free.

Right to a paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.

Right to choose someone to act for you. If someone has medical power of attorney or is your legal guardian, that person can exercise your rights and make choices about your health information.

Changes to this notice

We may change this notice, and the changes will apply to all information we have about you. The current notice is posted on our website at treehousechildpsychiatry.com/privacy.html and is available on request.

Questions and complaints

If you have questions or believe your privacy rights have been violated, contact our Privacy Officer:
Michael K. Heck, D.O., Treehouse Child Psychiatry
1410 Incarnation Drive, Suite 206, Charlottesville, VA 22901
(434) 260-1296

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints, by calling 1-877-696-6775, or by writing to 200 Independence Avenue S.W., Washington, D.C. 20201.

We will not retaliate against you for filing a complaint.

Contact

Questions about privacy can be directed to our Privacy Officer at (434) 260-1296 or 1410 Incarnation Drive, Suite 206, Charlottesville, VA 22901.