Jennifer A. Kodrik, PsyD
Clinical Psychologist
NOTICE OF PRIVACY PRACTICES
Jennifer Kodrik, PsyD
Effective Date: August 17, 2025
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I, Dr. Jennifer KODRIK, am committed to protecting your privacy and am required by law to safeguard your Protected Health Information (PHI). PHI is information that identifies you and relates to your past, present, or future physical or mental health, health care services (including Michigan telehealth and telehealth via the Psychology Interjurisdictional Compact [PSYPACT]), or payment for those services. This Notice of Privacy Practices (NPP) explains how I may use and disclose your PHI, your rights regarding your PHI, and my legal obligations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. Parts 160 and 164, Michigan laws (e.g., Michigan Mental Health Code, MCL 330.1750), and applicable laws in PSYPACT states where you receive telehealth services. This Notice applies to all PHI I maintain, including medical records from in-person or telehealth sessions. If you have questions, please contact me at:
Jennifer Kodrik, PsyD
1098 Ann Arbor Rd W #200
Plymouth, MI 48170
(734) 634-7941
A. UNDERSTANDING YOUR MEDICAL RECORD
Each time you visit me for psychological services, whether in person or via telehealth, I create a medical record documenting your name, symptoms, health history, diagnoses, treatment, and plan for future care. This record, which includes psychotherapy notes (kept separately), is used to plan your treatment and serves as a source of your PHI. Your PHI is protected by federal laws (HIPAA and 42 C.F.R. Part 2 for substance use disorder records, if applicable), Michigan laws, and the laws of your state if you receive telehealth services under PSYPACT.
B. YOUR HEALTH INFORMATION RIGHTS
Your medical record belongs to me, but the information within it is yours. You have the following rights under federal, Michigan, and applicable PSYPACT state laws regarding your PHI:
1. Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time, even if you received it electronically (e.g., via email, telehealth portal, or my website), by contacting me.
2. Right to Request Restrictions: You may request restrictions on how I use or disclose your PHI for treatment, payment, or health care operations, or to certain individuals (e.g., family members). Submit a written request to me. I am not required to agree unless you paid out-of-pocket in full for services and request that I not disclose PHI to your health plan, provided disclosure is not required by law (e.g., mandatory reporting).
3. Right to Inspect and Copy: You may inspect or obtain a copy of your medical records, excluding psychotherapy notes or information compiled for legal proceedings. Submit a written request to me. I may charge a reasonable fee for copying or mailing. In rare cases, I may deny access, but you can request a review of the denial. Michigan law (MCL 333.26269) allows access to mental health records, subject to limitations if disclosure could harm you or others.
4. Right to an Accounting of Disclosures: You may request a list of disclosures of your PHI made in the past six years, except for treatment, payment, health care operations, or authorized disclosures. Submit a written request to me. The first accounting in a 12-month period is free; additional requests may incur a fee.
5. Right to Request Amendments: You may request changes to your medical record if you believe it is inaccurate or incomplete. Submit a written request to me with your reasons. I may deny the request if the information is accurate, not created by me, or not part of your record, but I will provide a written explanation and allow you to submit a statement of disagreement.
6. Right to Confidential Communications: You may request that I communicate with you about your health care at a specific phone number, email, or address (e.g., secure telehealth portal or work number). Submit a written request to me. I will accommodate reasonable requests.
7. Right to Revoke Authorization: You may revoke a written authorization to use or disclose your PHI in writing at any time, except to the extent I have already acted on it.
8. Right to Breach Notification: If I discover a breach of your unsecured PHI (e.g., unauthorized access to my telehealth platform), I will notify you as required by HIPAA (45 C.F.R. § 164.404), Michigan law (MCL 445.63 et seq.), and applicable PSYPACT state laws, unless a risk assessment shows a low probability of compromise.
C. MY RESPONSIBILITIES
I am required by law to:
• Maintain the privacy and security of your PHI.
• Provide you with this Notice explaining my legal duties and privacy practices.
• Follow the terms of this Notice or any updated Notice in effect.
• Notify you if I cannot agree to a requested restriction on PHI disclosures.
• Accommodate reasonable requests for confidential communications.
• Obtain your written authorization for uses or disclosures not described in this Notice, except as permitted by law.
I reserve the right to change my privacy practices and update this Notice. If I make material changes, I will provide the revised Notice at your next telehealth visit, and make it available on my website (drkodrik.com) or upon request.
D. HOW I MAY USE AND DISCLOSE YOUR PHI
I may use or disclose your PHI for various purposes, whether from in-person or telehealth sessions in Michigan or other PSYPACT states. Below are the categories of uses and disclosures, including examples.
1. Uses and Disclosures Without Your Authorization
• For Treatment: I may use and disclose your PHI to provide, coordinate, or manage your mental health care. For example, I may share your PHI with a psychiatrist or therapist involved in your care, with your consent as required by Michigan law (MCL 330.1750) or your state’s law under PSYPACT.
• For Payment: I may use and disclose your PHI to bill and collect payment for services. For example, I may share your name, diagnosis, and treatment details with your insurance company to process claims or obtain pre-approval, including for telehealth services.
• For Health Care Operations: I may use and disclose your PHI to operate my practice. For example, I may use your PHI to evaluate service quality or comply with audits by the Michigan Department of Licensing and Regulatory Affairs (LARA) or other state agencies under PSYPACT.
• Appointment Reminders and Communications: I may use your PHI to contact you for appointment reminders or follow-up on services (via phone, secure email, or text), unless you object.
• Business Associates: I may share your PHI with third parties (e.g., billing services, telehealth platform providers like Doxy.me, electronic health record vendors) that perform services for me. These business associates are required by contract to protect your PHI under HIPAA Security Rule standards (45 C.F.R. Part 164, Subparts C and E).
• Other Permitted or Required Disclosures (subject to federal, Michigan, and PSYPACT state laws):
• Public Health Activities: To report child abuse, neglect, or domestic violence as required by Michigan law (MCL 722.623) or the laws of your state if receiving telehealth in a PSYPACT state.
• Health Oversight Activities: To agencies like LARA or equivalent agencies in PSYPACT states for audits or investigations.
• Judicial and Administrative Proceedings: In response to a valid court order or subpoena, complying with Michigan law (MCL 330.1750) or your state’s laws for mental health records.
• Law Enforcement: To comply with legal requests (e.g., reporting a crime during a session), if permitted by Michigan or your state’s law.
• Coroners, Medical Examiners, or Funeral Directors: To assist with identifying a deceased person or determining cause of death.
• Serious Threat to Health or Safety: To prevent a serious threat to you or others (e.g., imminent harm disclosed in a session).
• Workers’ Compensation: To comply with Michigan Workers’ Compensation laws (MCL 418.101 et seq.) or equivalent laws in your state.
• Government Functions: For specialized functions, such as military or veterans’ activities, if applicable.
• U.S. Department of Health and Human Services (HHS): To comply with HIPAA compliance investigations, including telehealth security practices.
• Limits of Confidentiality: I may disclose your PHI to authorities or medical professionals if I suspect child or elder abuse/neglect, or if I believe you are at risk of suicide or harming others, as required by Michigan law or the laws of your state under PSYPACT.
2. Uses and Disclosures Requiring Your Authorization
• Psychotherapy Notes: Psychotherapy notes (my personal notes, separate from your medical record) require your written authorization for most uses or disclosures, except for my use, supervision, or legal purposes (e.g., to prevent harm). Michigan law (MCL 330.1750) and some PSYPACT state laws impose additional restrictions on mental health records.
• Marketing: I must obtain your written authorization to use or disclose your PHI for marketing, except for face-to-face communications.
• Sale of PHI: I must obtain your written authorization for any disclosure of your PHI that constitutes a sale.
• Other Uses and Disclosures: Any use or disclosure not described in this Notice requires your written authorization. You may revoke an authorization in writing at any time, except to the extent I have already acted on it.
• Highly Confidential Information: Federal and Michigan laws require your written authorization to disclose Highly Confidential Information, unless allowed or required by law (e.g., child abuse reporting under MCL 722.623). Examples include mental health treatment information, substance use disorder (SUD) records, developmental disability services, HIV/AIDS testing and treatment, sexually transmitted infection treatment, sexual assault treatment, and genetic testing or treatment. For mental health or developmental disability disclosures, an Authorization for Release of Information form must be co-signed by a witness verifying your identity (MCL 330.1750). Other PSYPACT states may have similar requirements, and I will comply with the stricter standard.
3. Notification to Relatives, Friends, or Caregivers
I may disclose your PHI to individuals you identify as involved in your care or payment (e.g., family members) only with your written authorization. In emergencies where you cannot consent, I may use professional judgment to disclose limited PHI in your best interest, identifying the appropriate person and relevant information, subject to Michigan or your state’s laws.
E. MICHIGAN AND PSYPACT PRIVACY PROTECTIONS
Michigan law provides additional protections for your PHI, particularly for mental health and other sensitive records, whether from in-person or telehealth services:
• Mental health records require your written consent for disclosure, except for specific exceptions (e.g., court orders, child abuse reporting under MCL 722.623) (MCL 330.1750).
• Michigan law protects reproductive health information from certain out-of-state disclosures (2023 PA 60), ensuring privacy for lawful care.
• For telehealth services in Michigan, I comply with Michigan’s requirements, including obtaining your informed consent (MCL 333.16284).
• If you receive telehealth services in another PSYPACT state, I comply with that state’s privacy and telehealth laws, which may be stricter than HIPAA or Michigan law. I verify your location at the start of each telehealth session to ensure compliance.
• If any state law is more protective than HIPAA, I follow the stricter standard.
F. TELEHEALTH PRIVACY AND SECURITY
For telehealth services, whether in Michigan or other PSYPACT states, I take additional steps to protect your PHI:
• Secure Platforms: I use HIPAA-compliant platforms (e.g., Doxy.me) with encryption to safeguard your PHI during video or audio sessions.
• Session Privacy: I conduct sessions in a private, secure environment and ask you to do the same (e.g., avoid public Wi-Fi or shared spaces).
• No Recording: I do not record sessions without your written consent, and you must not record sessions without my permission, per Michigan’s two-party consent law (MCL 750.539c) or your state’s equivalent.
• PSYPACT Compliance: I provide telehealth services under PSYPACT authority, ensuring compliance with the licensing and privacy laws of the state where you are located during the session.
G. FILING A COMPLAINT
If you believe your privacy rights have been violated, you may file a complaint without fear of retaliation:
• Contact Me: Jennifer Kodrik, PsyD, 1098 Ann Arbor Rd W #200, Plymouth, MI 48170
(734) 634-7941, jkodrik@drkodrik.com
• Federal Government: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201, (800) 368-1019, www.hhs.gov/ocr/privacy/hipaa/complaints.
• PSYPACT States: You may also contact the psychology board in your state for telehealth-related complaints.
H. CHANGES TO THIS NOTICE
I may update this Notice to reflect changes in my practices or legal requirements. The updated Notice will be available on my website (drkodrik.com) and provided at your next telehealth visit following a material change.
I. ADDITIONAL INFORMATION
For more information, visit:
• U.S. Department of Health and Human Services: www.hhs.gov/hipaa
• Michigan Department of Health and Human Services: www.michigan.gov/mdhhs
• Office for Civil Rights Telehealth Guidance: www.hhs.gov/hipaa/for-professionals/special-topics/telehealth
• PSYPACT: www.psypact.org
