Privacy Policy, Federal Part 2 Notice, and Consumer Protections

​Practice Identity & Commitment to Privacy

This practice operates as a virtual-only private practice: CMG Therapy, PLLC, owned and operated by Cherisse Guerrero, MA, LPC.

Your privacy is safeguarded through encrypted, HIPAA-compliant, and 42 CFR Part 2-compliant telehealth technologies. Any information that can identify you, your physical or mental health condition, or your substance use disorder (SUD) treatment history is treated with strict confidentiality.

​​

​​

​​

Special Federal Protections for Substance Use Disorder Records (42 CFR Part 2)

The confidentiality of substance use disorder (SUD) patient records maintained by this practice is protected by federal law and regulations (42 U.S.C. § 290dd-2 and 42 CFR Part 2).

Generally, this practice may not acknowledge to a person outside the practice that you receive services for a substance use disorder, or disclose any information identifying you as having an SUD, unless:

1. Written Consent: You provide a specific written consent/authorization (including unified Treatment, Payment, and Health Care Operations authorizations);

2. Court Order: The disclosure is authorized by a specialized court order issued under 42 CFR Part 2 Subpart E after specific legal criteria are met; or

3. Emergency or Administrative Operations: The disclosure is made to medical personnel in a medical emergency, or to qualified personnel for medical audits, financial audits, or program evaluation.

​

​

​

Strict Prohibition on Use in Legal Proceedings

Federal law (42 CFR Part 2) strictly prohibits the use or disclosure of your Part 2-protected SUD records, clinical disclosures, or therapist testimony to initiate or substantiate any criminal charges against you, or to conduct any investigation, civil proceeding, administrative hearing, or legislative action against you, unless a specific Part 2-compliant court order is issued by a court of competent jurisdiction or you provide explicit, separate written authorization.
 

​

​

SUD Counseling Notes

If detailed notes analyzing or summarizing the contents of our conversations during individual or group SUD counseling sessions are maintained separately from the rest of your medical record, they are classified as "SUD Counseling Notes." These notes receive heightened legal protection under federal regulations and require a separate, specific written authorization from you for almost all third-party uses or disclosures.
 

​

​

Standard Uses and Disclosures (HIPAA & 42 CFR Part 2)

With your signed consent/authorization obtained at intake, CMG Therapy, PLLC may use and disclose your Protected Health Information (PHI) and SUD record information for Treatment, Payment, and Health Care Operations (TPO):

• Treatment: Directing and coordinating your virtual mental health and substance use care, or consulting with external healthcare providers who are members of your interdisciplinary care team.

• Payment: Processing electronic fee payments, issuing invoicing receipts, or preparing itemized billing statements (superbills) for out-of-network health insurance reimbursement.

• Health Care Operations: Administrative activities necessary to run this practice, including secure cloud platform encryption backups, legal compliance reviews, quality assurance audits, and technical system maintenance.
  
  
   

Disclosures Permitted or Required Without Consent

Federal (HIPAA / 42 CFR Part 2) and Texas state laws permit or mandate the disclosure of limited information without your prior written consent ONLY under the following strict circumstances:

• Child Abuse or Neglect: Mandatory reporting under Texas Family Code Chapter 261 if there is a reasonable suspicion or cause to believe that a child has been or is at risk of abuse or neglect.

• Abuse or Exploitation of Vulnerable Adults: Mandatory reporting under Texas Human Resources Code Chapter 48 if there is cause to believe an elderly person or an adult with a disability is being abused, neglected, or exploited.

• Imminent Risk of Serious Harm: Disclosures permitted to law enforcement or potential victims if you communicate an explicit, imminent threat of serious physical harm or violence against yourself or an identifiable third party.

• Subpoenas & Court Orders: Disclosures in response to a court order signed by a judge. (Note: For SUD records, a standard administrative or attorney subpoena is insufficient without a specialized 42 CFR Part 2 court order).

• Crimes on Practice Premises: Reporting a crime committed by a client against practice personnel or on virtual practice infrastructure.

• Public Health and Communicable Diseases: In accordance with the Texas Communicable Disease Prevention and Control Act (Texas Health and Safety Code Chapter 81), health professionals are required to report certain mandatory notifiable conditions to state or local public health authorities to protect public safety. If you are receiving general mental health care, necessary information may be reported as permitted by state law.

  • Important Note for Substance Use Clients: If your records fall under 42 CFR Part 2, federal regulations prohibit disclosing your identifying information to public health authorities for communicable disease reporting unless you grant explicit written consent, or unless the report can be submitted completely anonymously without identifying you as a substance use treatment client.
    
    
     

Summary of Your Rights as a Consumer & Patient

Under HIPAA, 42 CFR Part 2, Texas Occupations Code, and Texas Health and Safety Code Chapter 181, you hold the following statutory rights:

1. Right to Request and Inspect Clinical Records: You have the right to inspect and obtain an electronic copy of your clinical records. Submit all written requests to cmg@cmg-therapy.com.

2. Right to Request Restrictions: You may request restrictions on how your health information is used or shared for treatment, payment, or operations. While the practice is not required to agree to all restriction requests, we will comply with mandatory restrictions regarding out-of-pocket services paid in full.

3. Right to an Accounting of Disclosures: You may request a record listing instances where your electronic health information was disclosed for purposes outside standard care operations.

4. Right to Revoke Consent: You may revoke any written authorization or consent for information disclosure at any time in writing, except to the extent that action has already been taken in reliance on it.

5. Right to File a Privacy Complaint: If you believe your privacy rights have been infringed, you may file a formal complaint without fear of retaliation or service interruption. Complaints may be directed to:

   • US Department of Health and Human Services (HHS) – Office for Civil Rights (OCR): https://www.hhs.gov/ocr

   • Office of the Texas Attorney General – Consumer Protection Division: https://www.texasattorneygeneral.gov/consumer-protection

   • Texas Behavioral Health Executive Council (BHEC): https://bhec.texas.gov/