Privacy Policy

Effective Date: July 2026

 

Welcome to the private practice of En Thēa. This Privacy Policy explains how I collect, use, protect, and manage your personal data and Protected Health Information (PHI) in compliance with state and federal laws. I am deeply committed to maintaining the highest standards of clinical integrity, confidentiality, and professional stewardship.

​

1. Commitment to Privacy and PHI

​

As a licensed psychotherapist operating in both New Mexico and Colorado, I serve as a "Covered Entity" under the Health Insurance Portability and Accountability Act (HIPAA). This means your clinical records, personal identity, and any information relating to your physical or mental health care are strictly protected under federal law.

​

2. Information Collected and Manner of Collection

​

I collect information to provide safe, effective clinical care and professional consultation:

• Voluntary Clinical Data: Intake forms, developmental histories, clinical assessments, and session notes regarding your therapeutic or integration care.

• Psychotherapy Notes: In accordance with state licensing regulations and HIPAA, my personal process notes are kept separate from the rest of your medical record and receive an elevated layer of statutory privacy protection.

• Website & Administrative Data: Contact information submitted through my site, IP addresses, and standard usage analytics collected via cookies to optimize website functionality.

• Billing Information: Financial details processed through encrypted, HIPAA-compliant merchant portals.

 

3. Why Your Information is Collected & How It Is Used

​

Your data is used solely for Treatment, Payment, and Healthcare Operations (TPO). This includes coordinating your clinical treatment, facilitating integration protocols, executing contract services, and ensuring the ethical management of my practice. I will not sell, rent, or share your data with third parties for commercial marketing purposes.

​

4. Third-Party Sharing and Business Associate Agreements (BAAs)

​

To protect your privacy, any software vendor I utilize (e.g., electronic health records, secure telehealth systems, encrypted billing portals) must strictly adhere to HIPAA regulations. I enforce formal Business Associate Agreements (BAAs) with these vendors, legally binding them to safeguard your electronic Protected Health Information (ePHI).

​

5. Artificial Intelligence (AI) Data Safeguards

​

In modern clinical practice, technology changes rapidly. I strictly adhere to federal and state updates regarding Artificial Intelligence in healthcare:

• No Public AI Interactivity: I do not input identifiable client details or clinical session notes into public or non-HIPAA-compliant generative AI tools, as they do not secure data privacy.

• Encrypted Internal Infrastructure: Any administrative or clinical software that utilizes predictive algorithms or assistive tools is rigidly vetted, operates exclusively on encrypted, private servers, and is fully covered under a signed BAA.

• Human Clinical Sovereignty: I maintain absolute clinical oversight. Technology is never permitted to replace human diagnostic reasoning, clinical interpretation, or relational care.

• ​

6. State Jurisdictional Legislation (NM & CO)

​

This practice operates in absolute compliance with the regional laws governing my licensure and location:

• New Mexico Frameworks: I comply with state healthcare privacy laws, including specific statutory protections that safeguard electronic medical records and individual health autonomy.

• Colorado Frameworks & the CPA: While the Colorado Privacy Act (CPA) grants comprehensive consumer rights regarding standard personal data, it explicitly exempts Protected Health Information (PHI) managed by HIPAA-covered healthcare entities. Your clinical data is therefore fully protected under the more stringent mandates of federal health law and state mental health codes. Non-clinical data (such as general website contact forms) is processed in complete alignment with data minimization requirements.

 

7. Mandatory Disclosure Boundaries

​

Under state laws, confidentiality is legally protected, but has strict statutory boundaries. I am required by law to disclose specific health information without your written authorization only under the following emergency or legal circumstances:

• Suspected child abuse or neglect, or abuse/neglect of a vulnerable adult.

• A serious threat of imminent physical violence against a specific, identified person (Duty to Warn mandates).

• An imminent risk of self-inflicted harm where disclosure is necessary to protect your safety.

• A formal, lawful court order issued by a judge.

8. Data Retention Security

Client records are securely stored for a minimum of seven years following the termination of services, adhering to standard behavioral health regulations. I employ administrative, physical, and technical safeguards—including role-based access, multi-factor authentication (MFA), and data encryption—to defend your records against unauthorized access.

 

 

How to Contact Us

​

If you have questions regarding this Privacy Policy please contact me directly at:

​

En Thēa Private Practice

Email: MarisaC@EnThea.org

​

If you believe your privacy rights have been violated, you have the right to file a formal complaint with this practice or directly with the US Department of Health and Human Services Office for Civil Rights. There will be no retaliation for filing a complaint.

​

 

Updates to this policy will be posted transparently on this webpage in accordance with evolving state and federal healthcare mandates.