← Home

Notice of Privacy Practices

Privacy & HIPAA

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices applies to Mathew Brigante, PhD, New York State Licensed Psychologist, License No. 026659, doing business as Brigante Psychology (hereinafter, “the Practice”).

Revised date: August 22, 2026

This Notice describes the uses and disclosures of protected health information (“PHI”) that may be made by the Practice, your rights with respect to PHI, and the Practice’s legal duties with respect to PHI.

Official sources: 45 C.F.R. § 164.520 ↗ · HHS — February 2026 Model NPP for Health Care Providers ↗

New York State Confidentiality and Privilege

New York State Board of Regents Rule § 29.1(b)(8) provides that revealing personally identifiable facts, data, or information obtained in a professional capacity without the prior consent of the patient or client, except as authorized or required by law, constitutes unprofessional conduct.

Under New York Civil Practice Law and Rules § 4507, confidential relations and communications between a psychologist and patient are placed on the same basis as confidential communications between an attorney and client. A patient who, for the purpose of obtaining insurance benefits, authorizes disclosure of a privileged communication is not deemed to have waived the privilege created by § 4507.

When a use or disclosure permitted by HIPAA is prohibited or materially limited by a more stringent applicable law, the Practice follows the applicable more stringent requirement.

Official sources: NYSED Board of Regents Rule § 29.1(b)(8) ↗ · New York CPLR § 4507 ↗ · 45 C.F.R. § 164.520(b)(1)(ii)(C)–(D) ↗

Your Rights

Access your health information

You may ask to inspect or obtain an electronic or paper copy of PHI in the Practice’s designated record set. The Practice will act on a request within the time required by HIPAA and may charge only a fee permitted by law. HIPAA’s access right generally does not include psychotherapy notes as that term is defined by HIPAA.

Request an amendment

You may ask the Practice to amend PHI that you believe is incorrect or incomplete. The Practice may deny an amendment request only on grounds permitted by HIPAA and, if the request is denied, will provide the written response required by law.

Request confidential communications

You may ask the Practice to communicate with you in a particular way or at a particular location. The Practice will accommodate reasonable requests as required by HIPAA.

Request restrictions

You may ask the Practice to restrict certain uses or disclosures of PHI for treatment, payment, or health care operations. The Practice is not required to agree to every requested restriction. If you pay in full out of pocket for a particular health-care item or service and ask the Practice not to disclose information about that item or service to a health plan for payment or health-care operations, the Practice will honor the request unless disclosure is required by law.

Receive an accounting of certain disclosures

You may request an accounting of certain disclosures of PHI made during the six years before your request. HIPAA excludes specified categories from an accounting, including many disclosures for treatment, payment, and health-care operations. One accounting in a 12-month period is provided without charge; a reasonable, cost-based fee may be charged for additional accountings during the same 12-month period as permitted by HIPAA.

Receive a paper copy of this Notice

You may request a paper copy of this Notice at any time, including if you previously agreed to receive it electronically.

Have a personal representative act for you

A person with legal authority to act as your personal representative may exercise applicable HIPAA rights on your behalf. The Practice may verify that authority before acting.

File a privacy complaint without retaliation

You may complain to the Practice or to the U.S. Department of Health and Human Services Office for Civil Rights if you believe your HIPAA privacy rights have been violated. The Practice will not retaliate against you for filing a complaint or exercising a HIPAA right.

Official sources: HHS — 2026 Provider Model NPP, Your Rights ↗ · HHS — Your Medical Records ↗

Your Choices

For certain uses and disclosures, HIPAA gives you a choice. New York State confidentiality requirements may impose additional limits.

  • Family, friends, and other persons involved in care or payment. The Practice will obtain your prior consent before revealing personally identifiable information to family members, friends, or other persons involved in your care or payment unless disclosure is otherwise authorized or required by law.
  • Disaster-relief disclosures. The Practice will make a disaster-relief disclosure only when permitted by HIPAA and applicable New York State law.
  • Hospital directory. The Practice does not maintain a hospital directory.
  • Marketing and sale of PHI. The Practice will obtain written authorization whenever HIPAA requires authorization for marketing or sale of PHI.
  • Psychotherapy notes. Most uses or disclosures of psychotherapy notes require a specific written authorization, subject to the limited exceptions in HIPAA and any more protective applicable law.
  • Fundraising. The Practice does not use PHI for fundraising.

Official sources: HHS — 2026 Provider Model NPP, Your Choices ↗ · HHS — Mental Health Information and Psychotherapy Notes ↗

Treatment, Payment, and Health Care Operations

Treatment

The Practice may use PHI to assess, diagnose, plan, and provide psychological treatment. For example, the Practice may use information from your history and current symptoms to formulate and provide psychotherapy.

When consultation with another professional would reveal personally identifiable information, the Practice obtains the patient’s informed consent unless the disclosure is otherwise authorized or required by law. NYSED advises psychologists in independent practice that consultation information must be de-identified so the patient cannot be identified unless informed consent has been obtained.

Payment

The Practice may use and disclose PHI as permitted by law to obtain payment for services. For example, when you authorize or request submission of information to a health plan or other payer, the Practice may provide information lawfully required for payment, such as identifying information, dates of service, service or diagnosis codes, and other information permitted by law.

Authorization of a privileged communication for the purpose of obtaining insurance benefits does not, by itself, waive the privilege created by New York CPLR § 4507.

Health care operations

The Practice may use and disclose PHI as permitted by law for health-care operations necessary to operate the Practice, including record administration, billing administration, compliance, quality review, legal services, and secure technology services. For example, SimplePractice may maintain Practice information and records as a business associate under the applicable Business Associate Agreement.

Official sources: 45 C.F.R. § 164.506 — Treatment, Payment, and Health Care Operations ↗ · NYSED — Consultation With Other Professionals ↗ · HHS — Business Associates ↗ · SimplePractice Business Associate Agreement ↗

Uses and Disclosures Without Written Authorization

HIPAA permits or requires uses and disclosures without written authorization in specified circumstances. A HIPAA permission does not override a more stringent applicable New York State confidentiality requirement. The Practice will make a disclosure only when the legal conditions governing that disclosure are satisfied.

Required by law

The Practice will use or disclose PHI when a federal or New York State law requires the use or disclosure and only to the extent required by that law. For example, New York Social Services Law § 413 identifies psychologists as mandated reporters when the statutory standard for suspected child abuse or maltreatment is met.

Public health and safety

HIPAA permits specified disclosures for public-health activities and, in specified circumstances, to prevent or lessen a serious and imminent threat to health or safety. Any such disclosure by the Practice must also satisfy applicable New York State law and professional ethical requirements.

Health oversight

The Practice may disclose PHI for health-oversight activities authorized by law, including lawful professional-licensing, disciplinary, audit, and HIPAA-enforcement activities.

Workers’ compensation, law enforcement, and specified government functions

HIPAA permits specified disclosures for workers’ compensation, law-enforcement purposes, and specified government functions when the regulatory conditions are met. The Practice will disclose only information that may lawfully be disclosed under HIPAA and applicable New York State confidentiality and privilege law.

Judicial and administrative proceedings

HIPAA permits specified disclosures in response to judicial or administrative process only when the applicable legal conditions are satisfied. New York CPLR § 4507 separately protects confidential psychologist–patient relations and communications. The Practice evaluates the authority for a demand, any applicable privilege, authorization, court order, subpoena, and other governing law before disclosing privileged or confidential information.

Research

HIPAA permits specified uses and disclosures of PHI for research when a valid authorization or another Privacy Rule pathway and all required conditions are satisfied. Applicable New York State confidentiality law continues to apply.

Coroners, medical examiners, funeral directors, and organ procurement

HIPAA permits specified disclosures to coroners, medical examiners, funeral directors, and organ-procurement organizations when the applicable regulatory conditions are met. Any disclosure must also comply with applicable New York State law.

Official sources: 45 C.F.R. § 164.512 — Uses and Disclosures Without Authorization ↗ · New York Social Services Law § 413 ↗ · New York CPLR § 4507 ↗

Uses and Disclosures Requiring Written Authorization

The Practice obtains a valid written authorization when HIPAA requires one, including for most uses or disclosures of psychotherapy notes, for marketing uses or disclosures when the HIPAA authorization requirement applies, and for sale of PHI when the HIPAA authorization requirement applies. Other uses or disclosures not described in this Notice will be made only with your written authorization unless another law permits or requires the use or disclosure. You may revoke an authorization in writing as permitted by HIPAA, except to the extent the Practice has already acted in reliance on it.

Official sources: 45 C.F.R. § 164.508 ↗ · HHS — Summary of the HIPAA Privacy Rule ↗

Substance Use Disorder Records Protected by 42 C.F.R. Part 2

To the extent the Practice creates or maintains substance use disorder patient records that are subject to 42 C.F.R. Part 2, those records receive the additional protections required by Part 2. Such Part 2 records, or testimony relaying their content, will not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless the use or disclosure is permitted by Part 2, including where the required written consent or qualifying court order and subpoena or other legal requirement exists.

This provision does not state that the Practice is a Part 2 substance use disorder treatment program. It addresses Part 2-protected records only to the extent the Practice creates or maintains such records.

Official sources: HHS — Understanding 42 C.F.R. Part 2 ↗ · HHS — February 2026 Model Notices ↗

The Practice’s Legal Duties

  • Maintain the privacy and security of PHI as required by applicable law.
  • Provide you with notice of the Practice’s legal duties and privacy practices with respect to PHI.
  • Notify affected individuals following a breach of unsecured PHI when notification is required by law.
  • Follow the duties and privacy practices described in the Notice currently in effect.
  • Make the current Notice available to any person who asks for it and prominently post it on a website that provides information about the Practice’s services.
  • Provide the Notice no later than the first service delivery in a direct treatment relationship, including electronically delivered service, and make the good-faith effort to obtain written acknowledgment required by HIPAA.
  • Promptly revise the Notice when a material change to a use, disclosure, individual right, legal duty, or stated privacy practice requires revision.

Official sources: 45 C.F.R. § 164.520 ↗

Changes to This Notice

The Practice reserves the right to change the terms of this Notice as permitted by HIPAA and to make a revised Notice effective for all PHI maintained by the Practice when the requirements for doing so are satisfied. The current Notice will be available on this website and upon request.

Privacy Questions and Complaints

Privacy Officer
Telephone: (631) 208-7748

The telephone number above is for privacy, HIPAA, legal, and accessibility issues ONLY. It is not for psychotherapy inquiries. It is not for scheduling or cancellations. It is not for referrals. It is not for clinical advice or clinical communications. It is not for risk assessment. It is not for crisis services. It is not for emergency assistance. For crisis support, call or text 988⁠. For an emergency, call 911 or go to the nearest emergency department.

You may also file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights. HHS — File a HIPAA complaint ↗. The Practice will not retaliate against you for filing a complaint.