Privacy Policy | Healthy Foundations Group

Healthy Foundations Group, LLC (HFG) and The Heartwood Program, LLC (THP)

Effective date: November 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL AND MENTAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your privacy

The information you provide to HFG or THP, including information submitted through our website and online forms, is transmitted and stored securely and is handled in compliance with HIPAA. We use secure, access-controlled systems covered by business associate agreements with our technology vendors, and only staff who need the information to do their jobs can see it.

Who this notice covers

This notice applies to Healthy Foundations Group, LLC and The Heartwood Program, LLC, including all clinicians, trainees and staff who work at our offices in Bethesda, Maryland; Washington, DC; and Fairfax, Virginia, and through telehealth. We are required by law to protect the privacy of your protected health information (PHI), to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach affects your unsecured PHI.

How we may use and share your information without your written authorization

Treatment. To provide, coordinate and manage your care, including sharing information with other clinicians involved in your care within HFG and THP.
Payment. To bill and collect payment from you, your insurer or another payer, including verifying eligibility and obtaining prior authorization.
Health care operations. To run our practice: quality review, training and supervision of clinicians and trainees, accreditation, licensing, audits and business planning.
Business associates. With vendors who perform services for us, such as our electronic health record, billing and secure communication providers. Each signs an agreement requiring them to protect your information.
Appointment reminders and care options. To contact you about appointments, treatment alternatives or health-related services we offer.

Other uses and disclosures permitted or required by law

Required by law. When federal, state or local law requires it.
Public health and safety. To prevent or lessen a serious and imminent threat to your health or safety or that of others, and to report suspected abuse or neglect of a child or vulnerable adult as required by law.
Health oversight. To agencies that oversee health care, such as licensing boards and auditors.
Legal proceedings. In response to a court order, or a subpoena or other lawful process when the required legal protections are met.
Law enforcement. In limited circumstances permitted by law.
Specialized government functions and workers' compensation. As permitted by law.
Coroners and medical examiners. As permitted by law.

Uses that require your written authorization

We will not use or share your information for the following purposes without your written permission: most uses and disclosures of psychotherapy notes, marketing communications, and any sale of your information. Any other use or disclosure not described in this notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

Mental health, substance use and state law protections

Maryland, the District of Columbia and Virginia have mental health confidentiality laws that in some cases are stricter than HIPAA. Records of substance use disorder treatment may also be protected by federal regulations (42 CFR Part 2). When a stricter law applies, we follow it. For minors, parents or guardians generally act on the minor's behalf, except where state law allows a minor to consent to care on their own.

Your rights

Access. You may see or get an electronic or paper copy of your records. We will respond within 30 days and may charge a reasonable, cost-based fee.
Amendment. You may ask us to correct information you believe is incorrect or incomplete. We may decline, and will tell you why in writing.
Confidential communications. You may ask us to contact you in a specific way or at a specific address. We will accommodate reasonable requests.
Restrictions. You may ask us to limit what we use or share. We are not required to agree, except that if you pay for a service in full out of pocket, you may ask us not to share that information with your health plan, and we will agree unless the law requires otherwise.
Accounting of disclosures. You may request a list of certain disclosures we have made in the six years before your request.
Copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.
Personal representative. If someone has your medical power of attorney or is your legal guardian, that person can exercise your rights.

Website and online forms

Information you submit through our website or online forms, such as referral and intake forms, is collected through secure, encrypted services and stored in our protected Microsoft 365 environment, which is covered by a business associate agreement. Please share only the minimum information needed. We do not sell personal information, and we do not use form submissions for advertising.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The current notice will be available on our website and at our offices.

Questions and complaints

If you have questions, want to exercise your rights, or believe your privacy rights have been violated, contact our Privacy Officer:

Corrinne A. Wilson, Privacy Officer
Healthy Foundations Group and The Heartwood Program
4350 East West Highway, Suite 200, Bethesda, MD 20814
Phone: (571) 587-3995
Email: PrivacyOfficer@hfg.team

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints or 1-877-696-6775. We will not retaliate against you for filing a complaint.