Privacy Policy

Effective date: August 2026

Felicia Caulk, Behavioral Health LLC ("we," "our," or "the practice") is committed to protecting your privacy and safeguarding your personal and health information. This Privacy Policy describes how we collect, use, disclose, and protect information in connection with this website and our clinical services.

This policy works alongside our Notice of Privacy Practices, which you will receive at the start of treatment and which governs the use and disclosure of your Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).

Information we collect

Through this website

This website uses Vercel Web Analytics, a privacy-friendly analytics service that collects anonymous, aggregated page view data (pages visited, referrer, country, browser, and device type). Vercel Analytics does not use cookies, does not track individual users across sessions, does not collect IP addresses, and does not build visitor profiles. No personally identifiable information is gathered. We use this data solely to understand which pages are helpful and how visitors find the site.

We do not use tracking pixels, advertising technology, or any other analytics services.

If you use our contact form, we collect only the information you voluntarily provide: your name, email address, phone number (if offered), preferred contact method, and the brief message you write. This information is used solely to respond to your inquiry.

If you use our self-assessment tools (GAD-7, PHQ-9, breathing exercise), all processing happens entirely in your browser. No answers, scores, or results are transmitted to our servers or stored anywhere. These tools are completely private.

Through clinical services

When you become a client, we collect Protected Health Information (PHI) as necessary to provide treatment, including:

  • Contact and demographic information
  • Mental health history and treatment records
  • Clinical notes and treatment plans
  • Insurance and billing information (if applicable)
  • Emergency contact information

The collection, use, and disclosure of PHI is governed by HIPAA and described in detail in our Notice of Privacy Practices, which you receive before or at the start of treatment.

How we use your information

We use information collected through this website and clinical services for the following purposes:

  • Treatment: To provide, coordinate, and manage your mental health care
  • Payment: To process payments and provide superbills for insurance reimbursement
  • Health care operations: To support quality assurance, professional development, and practice management
  • Communication: To respond to inquiries submitted through the contact form, and to communicate with you about appointments and care

We do not sell, rent, or share your personal information or PHI with third parties for marketing purposes. We will never use your information for advertising.

HIPAA and Protected Health Information

As a licensed clinical social worker providing mental health services, we are a HIPAA-covered entity. We comply with all requirements of:

  • The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule
  • The HITECH Act (Health Information Technology for Economic and Clinical Health Act)
  • The Virginia Consumer Data Protection Act (VCDPA)
  • Virginia state laws governing mental health records and confidentiality

Your HIPAA rights

Under HIPAA, you have the right to:

  • Access your PHI and obtain copies of your health records
  • Request amendments to your health records if you believe they are inaccurate
  • Request restrictions on certain uses and disclosures of your PHI
  • Request confidential communications (e.g., contact at a specific number or address)
  • Receive an accounting of disclosures of your PHI
  • Receive a copy of our Notice of Privacy Practices
  • File a complaint if you believe your privacy rights have been violated, without fear of retaliation

When we may disclose PHI without your consent

Under limited circumstances required or permitted by law, we may disclose PHI without your written authorization:

  • Imminent danger: If there is a serious and imminent threat to your health or safety, or the health or safety of another person or the public
  • Mandatory reporting: Suspected child abuse or neglect, elder abuse, or abuse of incapacitated adults, as required by Virginia law
  • Court orders: In response to a valid court order or subpoena, within the limits of Virginia law
  • Public health: To prevent or control disease, injury, or disability as required by public health authorities
  • Workers' compensation: As necessary to comply with workers' compensation laws

In all other cases, we will obtain your written authorization before disclosing your PHI.

How we protect your information

We implement appropriate administrative, technical, and physical safeguards to protect your information:

  • Telehealth platform: All virtual sessions are conducted through Doximity Dialer, a HIPAA-compliant, end-to-end encrypted video platform with a signed Business Associate Agreement (BAA)
  • Electronic records: Clinical records are maintained in HIPAA-compliant systems with encryption, access controls, and audit logging
  • Physical safeguards: Any paper records are stored in locked, secure locations
  • Workforce training: Staff and contractors with access to PHI receive HIPAA privacy and security training
  • Breach notification: In the unlikely event of a breach of unsecured PHI, we will notify affected individuals and the U.S. Department of Health and Human Services as required by the HITECH Act

Telehealth and electronic communication

Our practice uses HIPAA-compliant technology for virtual sessions and secure communication. Please be aware:

  • Standard email and text messaging are not secure methods of communication and should not be used to share sensitive health information
  • Session links sent via text or email contain no clinical content
  • We recommend using a private, secure internet connection for virtual sessions
  • Virtual sessions should be attended from a private location where you cannot be overheard

Minors and parental access

We provide therapy services to teens ages 14 and older. For minor clients:

  • A parent or legal guardian must consent to treatment
  • Virginia law grants minors specific confidentiality protections in mental health treatment
  • We balance parental involvement with the teen's therapeutic privacy, as discussed and agreed upon at the start of treatment
  • Parents will be informed if there is an imminent safety concern

Record retention

Clinical records are retained in accordance with Virginia law. Adult client records are maintained for a minimum of six years from the date of the last service. Records for minor clients are retained for at least six years after the client reaches the age of 18, or six years from the last date of service, whichever is longer.

Records are securely destroyed at the end of the retention period using methods that prevent recovery or reconstruction.

Third-party services

This website is hosted on Vercel. Vercel may collect standard server logs (IP address, browser type, page requested) as part of normal web hosting operations. We do not add any analytics, tracking, or advertising services to this site.

Our contact form is processed by Formspree, a third-party form handling service. Formspree receives only the information you voluntarily submit through the contact form (name, email, phone number, and message). Formspree is not HIPAA-compliant, which is why the contact form explicitly instructs you not to include sensitive health information, diagnoses, medications, or treatment history. Detailed health information is collected only through secure, HIPAA-compliant channels after you become a client.

If we begin accepting insurance through Headway or similar platforms, those platforms operate under their own privacy policies and BAAs. We will only share information necessary for billing and claims processing, with your consent.

Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. Material changes to how we handle PHI will be communicated through our Notice of Privacy Practices.

Filing a complaint

If you believe your privacy rights have been violated, you may file a complaint with:

You will not be retaliated against for filing a complaint.

Contact

For questions about this Privacy Policy, to exercise your HIPAA rights, or to request a copy of our Notice of Privacy Practices:

Felicia Caulk, Behavioral Health LLC
Chantilly, Virginia 20152
Contact form