Notice of Privacy Practices | Noor Pediatric Therapy
HIPAA

Notice of Privacy Practices

Effective date: May 11, 2026

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our commitment to your privacy

Noor Pediatric Therapy ("we," "us," or "our") is committed to protecting the privacy of the health information of every child and family we serve. We are required by law to:

  • Maintain the privacy of protected health information (PHI)
  • Give you this Notice describing our legal duties and privacy practices with respect to your child's PHI
  • Follow the terms of the Notice that is currently in effect
  • Notify you in the event of a breach of unsecured PHI

This Notice applies to all records of care generated by Noor Pediatric Therapy, whether kept by our team or by our business associates acting on our behalf.

About pediatric patients and personal representatives

Most of our patients are minor children. Under federal and Illinois law, a parent or legal guardian generally acts as the "personal representative" of a minor child and may exercise the child's privacy rights on their behalf — including signing authorizations, accessing records, and requesting amendments.

In specific circumstances allowed by Illinois law (for example, mental-health treatment for minors 12 and older, or certain reproductive-health services), the minor may hold privacy rights independently of the parent. We will explain how this applies if it ever does in your child's care.

In cases of separated, divorced, or shared custody, both parents generally retain access to a child's health information unless a court order specifies otherwise. Please provide us with any relevant custody documents so we can honor them correctly.

How we may use and disclose your child's health information

For treatment

We use PHI to provide, coordinate, and manage your child's care. Examples:

  • Sharing evaluation findings between your child's occupational therapist and speech-language pathologist when they treat together
  • Sending a treatment summary to your child's pediatrician, daycare, or school with your consent
  • Coordinating with another specialist your child sees outside our practice
  • Documenting session notes, treatment plans, and progress reports in our electronic medical record

For payment

We use PHI to bill and collect payment for services. Examples:

  • Verifying insurance coverage and obtaining prior authorizations
  • Submitting claims to BCBS Illinois PPO, Aetna, or other insurers
  • Issuing superbills for families using out-of-network benefits
  • Following up on outstanding balances or coordinating with collections (only after appropriate internal steps)

For healthcare operations

We use PHI to run our practice and improve the care we provide. Examples:

  • Internal quality reviews and case discussions among our clinical staff
  • Training new therapists and clinical staff
  • Licensing, accreditation, and credentialing activities
  • Business planning, scheduling, and administrative operations
  • Communicating appointment reminders to you

Other uses and disclosures that do not require your authorization

Federal and state law permit or require us to disclose PHI without your authorization in the following circumstances:

  • As required by law — including reporting obligations under federal, state, or local law
  • Public health activities — reporting communicable diseases, child abuse or neglect, vital statistics, or product recalls to authorized public-health authorities
  • Victims of abuse, neglect, or domestic violence — to the extent required or permitted by law
  • Health oversight activities — audits, investigations, inspections, and licensure actions by government oversight agencies
  • Judicial and administrative proceedings — in response to a court order, subpoena, or other lawful process, with appropriate safeguards
  • Law enforcement — when required by law, in response to a valid warrant or court order, or to identify a suspect, fugitive, witness, or missing person
  • To avert a serious threat to the health or safety of a person or the public
  • Coroners, medical examiners, and funeral directors — to assist them in carrying out their duties
  • Military and national security — to authorized federal officials for activities required by law
  • Workers' compensation — when required by workers' compensation laws
  • Research — only when approved by an Institutional Review Board (IRB) or privacy board and with appropriate safeguards
  • Inmates of correctional institutions — to the institution or law enforcement officials as required

Uses and disclosures with an opportunity to agree or object

Unless you object, we may share limited PHI in these situations:

  • With a family member, friend, or other person you identify as involved in your child's care
  • To notify a family member of your child's location, general condition, or care
  • To disaster relief organizations if needed during an emergency

Uses and disclosures that require your written authorization

We will only use or share your child's PHI for the purposes below with your written authorization, which you may revoke at any time in writing:

  • Marketing — most marketing communications, especially those for which we receive payment from a third party. Routine appointment reminders and information about our own services to current patients are not considered marketing under HIPAA.
  • Sale of PHI — we do not sell PHI
  • Psychotherapy notes — not typically applicable to our occupational and speech therapy services, but mentioned here for completeness
  • Any other use or disclosure not described in this Notice

How we communicate with you electronically

Modern therapy practices rely on secure technology. We want you to know how each channel is protected:

Email

Routine communications about appointments and general care coordination may be sent by email through HIPAA-compliant channels. We avoid including detailed clinical information in standard email — if a message would contain protected information, we direct you to log into our secure patient portal instead.

Text messages (SMS)

If you opt in, we may send appointment reminders and brief, non-clinical notifications via text. SMS is not fully encrypted and we keep messages limited to non-sensitive information. You can opt out at any time by replying STOP or notifying our front desk.

Patient portal and secure messaging

Clinical messages, progress updates, and documents that contain detailed PHI are shared through our authenticated patient portal. Access requires you to log in, which adds a layer of protection beyond standard email.

Electronic medical record (EMR)

Your child's health record is stored in our HIPAA-compliant electronic medical record system, hosted on infrastructure covered by a Business Associate Agreement with our cloud provider.

Telehealth

If telehealth sessions are offered, they are conducted over HIPAA-compliant video platforms with end-to-end encryption.

Your rights regarding your child's health information

As a parent or legal guardian, you have the following rights with respect to your child's PHI. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information below.

Right to inspect and copy

You have the right to inspect and obtain a copy of your child's PHI that we maintain. We will respond within 30 days (with a possible 30-day extension if needed) and may charge a reasonable, cost-based fee for copies. In rare circumstances permitted by law, access may be limited or denied; we will explain why and how to appeal if that happens.

Right to amend

If you believe information in your child's record is incorrect or incomplete, you may request that we amend it. We must act on your request within 60 days. We may deny the request in limited circumstances (for example, if the information was not created by us or is already accurate and complete); if denied, you have the right to submit a written statement of disagreement that will be included in your child's record.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures we have made of your child's PHI in the six years prior to your request, excluding disclosures made for treatment, payment, healthcare operations, or those made with your authorization.

Right to request restrictions

You have the right to request restrictions on how we use or disclose your child's PHI. We are not required to agree to most restrictions, but we will consider every request carefully. If we agree, we will honor the restriction (except in emergencies). You have the right to require us to restrict disclosures of PHI to a health plan when the disclosure is for payment or healthcare operations and the service has been paid for in full out of pocket.

Right to request confidential communications

You may request that we contact you at a specific phone number, address, or by alternative means (for example, only via the patient portal, never by text). We will accommodate reasonable requests.

Right to a paper copy

You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Right to be notified of a breach

You have the right to be notified if we (or one of our business associates) discover a breach of unsecured PHI involving your child's record.

Right to revoke an authorization

You may revoke any authorization you've given us in writing, except to the extent we have already acted in reliance on it.

Our duties

We are required by law to:

  • Maintain the privacy of your child's PHI
  • Provide you with this Notice and any required revisions
  • Abide by the terms of the Notice currently in effect
  • Notify you following a breach of unsecured PHI
  • Accommodate reasonable requests for confidential communications

Changes to this Notice

We reserve the right to change the terms of this Notice and to make the new Notice apply to all PHI we maintain, including information created or received before the change. When we make material changes, we will post the revised Notice on our website with an updated effective date, post a copy in our clinic, and provide a copy to patients on request or at their next visit.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against, penalized, or denied care for filing a complaint.

To complain to us

Contact our Privacy Officer:

To complain to the federal government

You may file a written complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

  • U.S. Department of Health and Human Services
  • Office for Civil Rights
  • 200 Independence Avenue, S.W.
  • Washington, D.C. 20201
  • Phone: 1-877-696-6775
  • Online complaint portal: hhs.gov/ocr/complaints/

Questions

If you have any questions about this Notice or our privacy practices, please contact our Privacy Officer using the information above. We are happy to walk you through any of it.

This Notice of Privacy Practices is provided in accordance with the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR §164.520, and applicable Illinois law. A copy of this Notice is also available at our clinic and will be provided to every patient at the start of care.