Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
At Step By Step, protecting your privacy and safeguarding your Protected Health Information (“PHI”) is important to us. We are required by federal and state law, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), to maintain the privacy and security of your PHI and to provide you with this Notice of Privacy Practices.
This notice explains:
How we may use and disclose your health information
Your privacy rights regarding your health information
Our legal duties concerning your health information
We are required to follow the privacy practices described in this Notice (which may be amended from time to time). For more information about our privacy practices, or to obtain additional copies of this Notice, please contact us using the information listed at the end of this Notice.
Permissible Uses and Disclosures of Your Health Information Without Your Written Authorization
We may use or disclose your PHI without your written authorization for the following purposes:
1. Treatment
We may use and disclose your PHI to provide, coordinate, or manage your care and related services. This may include communication with physicians, therapists, early intervention providers, schools, specialists, or other healthcare professionals involved in your care.
2. Payment
Although clients are not directly billed in some circumstances, we may disclose necessary PHI to First Steps, Medicaid, insurance providers, or other funding entities for reimbursement, eligibility determination, claims processing, utilization review, or related payment activities. We may also inform your health plan about a treatment you are going to receive in order to determine whether the plan will cover the treatment.
3. Health Care Operations
We may use and disclose your PHI for healthcare operations, including:
Quality assessment and improvement activities
Care coordination and case management
Licensing and credentialing activities
Staff supervision and training
Administrative, legal, and business activities necessary to operate our practice
Business Associates
We may share your PHI with third-party “Business Associates” who perform services on our behalf, such as billing, electronic records management, legal, accounting, or technology services. These parties are required by law and contract to protect your PHI.
Appointment Reminders and Communications
We may contact you regarding appointments, scheduling, treatment follow-up, or other healthcare-related services using the contact information you provide us and/or through the electronic portal if you sign up for access.
Permitted by Law
We may disclose PHI when required to prevent or lessen a serious threat to your health or safety or the health or safety of another person, consistent with applicable law.
Abuse, Neglect, or Domestic Violence
We are required by law to report suspected abuse, neglect, exploitation, or abandonment of a child, vulnerable adult, or developmentally disabled person to appropriate authorities.
We may disclose your PHI when required by law, court order, subpoena, warrant, or other lawful process. We may also disclose limited PHI to law enforcement officials as permitted or required by law. However, consistent with Washington State law, we will not share your health information with entities from other states for the purpose of enforcing out-of-state laws that impose penalties or liability related to healthcare services that are lawful in Washington State.
We may use or disclose your PHI when required by federal, state, or local law.
Permissible Uses and Disclosures That May Be Made Without Your Authorization, But For Which You Have An Opportunity to Object
1. Family and Other Persons Involved in Your Care
Unless you object, we may disclose your PHI to a family member, close friend, or other person you identify who is involved in your care or who helps pay for your care. If you are unable to object due to incapacity or an emergency, we will use our professional judgment to determine whether disclosure is in your best interest based on any prior preferences you have expressed to us. You may object to these disclosures at any time by notifying us in writing.
2. Disaster Relief Efforts
We may disclose your PHI to a public or private disaster relief organization to assist in notifying your family members or personal representative of your location, general condition, or death in the event of a disaster.
Uses and Disclosures Requiring Your Written Authorization
1. We will obtain your written authorization before:
Using or disclosing psychotherapy notes when required
Using or disclosing your PHI for marketing purposes is not permitted by HIPAA
Selling your PHI
Using and disclosing PHI for purposes not otherwise described in this notice
To the extent we are considered a legal holder of substance use disorder treatment records received from programs subject to 42 CFR Part 2, we will use or disclose such information when required, unless disclosure without authorization is otherwise permitted or required by 42 CFR Part 2.
You may revoke your authorization in writing at any time, except to the extent we have already acted upon it.
2. Washington State Privacy Protections
Washington State law provides additional protections for your health information. Consistent with RCW 7.115 and other applicable Washington law, we will not disclose your health information in response to out-of-state legal process – including subpoenas, court orders, or law enforcement inquiries originating outside Washington, if the purpose is to investigate or impose liability on any person for seeking, providing, or facilitating healthcare services that are lawful in Washington State. We will assert applicable Washington law protections in response to any such requests.
3. Redisclosure
PHI we disclose to third parties in accordance with this Notice may be subject to redisclosure by the recipient and may no longer be protected under HIPAA or this Notice once it leaves our control.
Your Rights Regarding Your Health Information
You have the following rights regarding your PHI:
1. Right to Access and Obtain Copies
You may request to inspect or receive a copy of your health records and billing records in paper or electronic format, subject to limited legal exceptions. We may charge a reasonable, cost-based fee for copies. If you request an electronic copy of records we maintain electronically, we will provide that copy in the electronic format you request if readily producible, or in a readable electronic format if not. You also have the right to direct us to transmit a copy of your records to a designated third party, provided your request is in writing and clearly identifies the designated recipient.
2. Right to Request Amendments
You may request corrections or amendments to your records if you believe information is incorrect or incomplete.
3. Right to Request Restrictions
You may request restrictions on certain uses or disclosures of your PHI. While we are not always required to agree, we are required by law to agree to a requested restriction when: (1) the restriction is on disclosure of your PHI to a health plan for purposes of payment or health care operations; (2) the disclosure is not otherwise required by law; and (3) the health care item or service at issue has been paid in full out of pocket by you or on your behalf. All other restriction requests will be considered, but are not guaranteed.
4. Right to Confidential Communications
You may request that we contact you at a specific phone number, email address, mailing address, or by alternative means.
5. Right to an Accounting of Disclosures
You may request a list of certain disclosures we have made of your PHI, excluding disclosures for treatment, payment, healthcare operations, and certain other exempt purposes.
6. Right to Notification of a Breach
You have the right to be notified if there is a breach involving your unsecured PHI.
7. Right to a Paper Copy of This Notice
You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
Our Responsibilities
We are required by law to:
Maintain the privacy and security of your PHI
Provide you with this notice of our legal duties and privacy practices
Notify you following a breach of unsecured PHI when required
Follow the terms of the notice currently in effect
We reserve the right to revise this Notice of Privacy Practices at any time. Any revised notice will apply to all information we maintain. Revised notices will be posted at our office and on our website, and you may request a current copy at any time.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, D.C. 20201
Telephone: 1-800-368-1019 | TDD: 1-800-537-7697
Filing a complaint will not result in retaliation or affect your care in any way.
Contact Information
Step By Step
3303 8th Ave SE #A
Puyallup, WA 98372
Phone: (253) 896-0903
UPDATED 5/21/2026