Treatment Privacy Practices | Skyrocket Therapy

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL AND HEALTH INFORMATION ABOUT YOUR CHILD MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: February 19, 2021

Last Revised / Updated: August 10, 2026

I. OUR LEGAL DUTY & PLEDGE REGARDING HEALTH INFORMATION

Skyrocket Pediatric Therapy Foundation is committed to protecting the privacy and confidentiality of your child’s Protected Health Information ("PHI"). PHI includes individually identifiable clinical, medical, demographic, and billing information created or received by our clinicians and administrative staff.

We create a clinical record of the evaluations, therapy sessions, treatment plans, and care your child receives at our clinic. We require this record to provide high-quality pediatric care, bill for services, and comply with state and federal laws.

We are required by law to:

Maintain the privacy and security of your child’s PHI in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA).
Provide you with this Notice of Privacy Practices detailing our legal duties and privacy protocols.
Notify you promptly following a breach of unsecured PHI affecting your child.
Abide by the terms of the Privacy Notice currently in effect.

We reserve the right to revise or change the terms of this Notice at any time. Any changes will apply to all PHI we currently maintain as well as any information created or received in the future. Updated notices will be posted in our clinic lobby, available on our client portal, and provided upon request.

II. HOW WE MAY USE AND DISCLOSE PHI WITHOUT YOUR WRITTEN AUTHORIZATION

Federal and state privacy laws permit us to use and disclose your child's PHI without your explicit written authorization for the following primary purposes:

1. Treatment

We may use and disclose PHI to coordinate, manage, and provide healthcare services for your child.

Examples: Our Speech-Language Pathologists, Occupational Therapists, and Behavior Analysts (BCBAs/RBTs) share information within our clinical team to co-treat your child. We may also share PHI with external healthcare providers involved in your child's care, such as their referring pediatrician, neurologist, or ordering physician

2. Payment

We may use and disclose PHI to bill and collect payment from health insurance plans, commercial payers, managed care organizations (e.g., IEHP), regional centers (e.g., Inland Regional Center), or you directly.

Examples: We send electronic claim files containing diagnosis codes (ICD-10) and treatment procedure codes (CPT) to clearinghouses (such as Office Ally) and insurance companies to verify benefits, obtain prior authorizations, and receive reimbursement.

3. Healthcare Operations

We may use and disclose PHI to support the daily operational, administrative, legal, and quality-improvement functions of our non-profit clinic.

Examples: Conducting clinical peer reviews, internal audits, staff training, client satisfaction surveys, software system maintenance, and licensing compliance reviews.

4. Business Associates

We contract with third-party service providers (known as "Business Associates") to perform specialized functions on our behalf (e.g., electronic health record software like TherapyLake, electronic billing clearinghouses, collection agencies, and IT security consultants). All Business Associates are legally bound by signed Business Associate Agreements (BAAs) requiring them to safeguard your child's PHI to the same strict standards required by HIPAA.

5. Appointment Reminders & Service Communications

We may use PHI to contact you via phone call, automated text message (SMS), secure portal message, or email to remind you of scheduled evaluations, therapy sessions, or upcoming administrative requirements.

III. SPECIAL USES AND DISCLOSURES PERMITTED OR REQUIRED BY LAW

We may disclose PHI without your consent or authorization under the following specific circumstances required or permitted by California or federal law:

Child Abuse & Neglect Reporting: Under the California Child Abuse and Neglect Reporting Act (CANRA), all licensed healthcare clinicians and staff at Skyrocket Pediatric Therapy Foundation are legally Mandated Reporters. We are strictly required to report suspected child abuse, neglect, sexual abuse, or emotional abuse to protective services or law enforcement authorities.
Public Health & Safety Hazards: To public health authorities for preventing or controlling disease, injury, or disability, or to avert a serious and imminent threat to the health or safety of your child, our staff, or the general public.
Health Oversight Activities: To state licensing boards (e.g., California Speech-Language Pathology & Audiology Board, California Board of Occupational Therapy), health department auditors, or regulatory agencies conducting investigations, audits, or inspections.
Judicial & Administrative Proceedings: In response to a valid court order, administrative judge mandate, or properly issued legal subpoena. When served with a subpoena, our practice policy is to make reasonable efforts to notify you in advance or seek a protective order before releasing records, whenever permitted by law.
Law Enforcement: To law enforcement officials for specific statutory purposes, such as reporting crimes occurring on clinic premises or responding to legal warrants.
Workers' Compensation: As necessary to comply with California Workers' Compensation laws if therapy services relate to an open workers' compensation or employment-related claim.

IV. USES AND DISCLOSURES REQUIRING YOUR EXPLICIT WRITTEN AUTHORIZATION

For any purpose not covered in Sections II and III above, we will obtain your explicit, written Authorization before using or releasing your child’s PHI. Specific examples include:

School & IEP Coordination: Sharing treatment plans, progress notes, or evaluations with your child’s public school district, teachers, or IEP team requires a signed Release of Information (ROI).
External Multidisciplinary Specialists: Releasing clinical records to private tutors, outside psychologists, advocates, or non-treating specialists.
Marketing & Sales: Skyrocket Pediatric Therapy Foundation does not sell PHI or use PHI for commercial marketing purposes.
Psychotherapy Notes: If specialized psychotherapy notes (as defined by HIPAA) are generated, their release requires a separate, specific written authorization.

You may revoke any written Authorization at any time in writing delivered to billing@skyrockettherapy.org. Revocation takes effect upon receipt but does not affect disclosures previously made under that authorization.

V. ELECTRONIC COMMUNICATIONS & UNENCRYPTED MEDIA DISCLOSURE

Our clinic utilizes modern electronic systems, including HIPAA-compliant client portals, secure cloud servers, and encrypted email systems. However, standard text messaging (SMS) and standard personal emails are inherently unencrypted transmission channels.

Risks of Unencrypted Communications: Unencrypted emails or text messages can potentially be intercepted, viewed, altered, or stored by unauthorized third parties or mobile network carriers.
Parent Preference: If you choose to communicate clinical details, schedule updates, or personal health information via standard text message or unencrypted email, you acknowledge and accept these inherent security risks. We encourage all primary document sharing and sensitive clinical communications to occur through our secure client portal.

VI. PARENTAL ACCESS & LEGAL CUSTODY PROVISIONS

Under California law, parents and legal guardians generally possess the right to access the medical records of their minor children.

Custody Disputes: In cases involving legal separation, divorce, or court-ordered custody arrangements, both legal parents retain equal rights to access the child's medical records unless a binding court order or custody decree explicitly terminates or restricts those rights.
Requirement to Provide Orders: It is the responsibility of the parent/guardian providing intake to supply Skyrocket Pediatric Therapy Foundation with current, signed court documentation if legal custody restrictions apply to any parent.

VII. YOUR RIGHTS REGARDING YOUR CHILD'S PHI

You have the following rights regarding the PHI maintained by our clinic:

Right to Inspect and Copy: You have the right to inspect and obtain an electronic or paper copy of your child's clinical record, evaluation reports, and billing histories. Requests must be submitted in writing to billing@skyrockettherapy.org. We will provide access within 30 calendar days. A reasonable, cost-based fee may apply for paper printing and postage.
Right to Request Restrictions: You have the right to request restrictions on how we use or disclose PHI for treatment, payment, or clinic operations. While we will carefully consider all requests, we are not legally required to agree to a requested restriction if it impacts clinical care, safety, or legal obligations.
Right to Restrict Disclosures for Out-of-Pocket Services: If you pay for a service entirely out-of-pocket (Private Pay) in full, you have the right to request that PHI regarding that specific service not be disclosed to a health insurance plan. We will honor this request unless disclosure is required by law.
Right to Confidential Communications: You have the right to request that we communicate with you regarding your child’s care through specific channels or at an alternative location (e.g., requesting calls to a specific cell number or mailing to a P.O. Box). We will accommodate all reasonable requests.
Right to Request Amendments: If you believe clinical information in your child's record is inaccurate or incomplete, you may submit a written request to amend the record. We may deny your request under certain circumstances (e.g., if the record was not created by us or is determined to be accurate and complete). If denied, we will provide a written explanation within 60 days.
Right to an Accounting of Disclosures: You have the right to request a list (an "accounting") of certain instances where we disclosed your child's PHI for reasons other than routine treatment, payment, operations, or disclosures authorized by you.
Right to a Paper Copy: You have the right to receive a physical paper copy of this Notice at any time upon request, even if you previously agreed to receive it electronically.

VIII. COMPLAINTS & PRIVACY CONTACT INFORMATION

If you believe your privacy rights or your child's PHI protections have been violated, or if you disagree with a decision made regarding access to records:

File an Internal Complaint: Contact our Privacy Officer directly in writing at billing@skyrockettherapy.org or by mail at:
Skyrocket Pediatric Therapy Foundation
Attn: Privacy Officer
26856 Adams Ave., Suite 100A, Murrieta, CA 92562
Phone: (909) 475-7002
File a Federal Complaint: You may file a formal complaint with the Secretary of the U.S. Department of Health and Human Services through the Office for Civil Rights (OCR):
Office for Civil Rights | U.S. Department of Health and Human Services
90 7th Street, Suite 4-100, San Francisco, CA 94103
Customer Response Center: (800) 368-1019 | TDD: (800) 537-7697
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

VIIII. Skyrocket Pediatric Therapy Foundation – SMS Privacy Policy & Terms of Service

Last Updated: August 2026

1. Program Overview & Scope

Skyrocket Pediatric Therapy Foundation ("we," "us," or "our") offers a mobile messaging service to communicate with parents, legal guardians, clients, and community supporters.

By opting into our text messaging system, you consent to receive recurring automated or transactional SMS/MMS messages at the phone number you provided. Text messaging is used primarily for:

Appointment reminders, confirmations, and schedule adjustments
Therapy progress updates and home practice instructions
Account, billing, and administrative alerts
Foundation news, community program announcements, and organizational updates

Consent to receive text messages is completely voluntary and is not a condition of receiving therapy services or participating in foundation programs.

2. Opt-In & Consent Methods

Mobile phone numbers are collected through the following opt-in channels:

Digital Intake & Web Forms: Selecting the optional SMS consent checkbox on our online intake forms or contact requests.
Paper Intake Paperwork: Checking the SMS consent box on our physical registration forms during clinic onboarding.
Keyword Opt-In: Texting a designated keyword (e.g., SKYROCKET) to our official phone number from your mobile device.
Verbal Opt-In: Verbally opting in after being provided with standard disclosure information.

3. Mobile Privacy Policy & Third-Party Data Non-Sharing

Skyrocket Pediatric Therapy Foundation respects your privacy and is dedicated to protecting your personal and family information.

Mobile Data Privacy Statement (10DLC Mandate)

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. If you wish to stop receiving text messages from Skyrocket Pediatric Therapy Foundation, you can reply STOP to any message or contact us directly.

4. Message Frequency, Cost, & Rates

Message Frequency: Message frequency varies based on your child's therapy schedule, appointment frequency, active care plans, and administrative needs.
Message and Data Rates: Standard message and data rates may apply depending on your mobile carrier and wireless service plan. Skyrocket Pediatric Therapy Foundation does not charge a fee for sending or receiving text messages, but you are solely responsible for any charges assessed by your mobile carrier.

5. How to Opt-Out or Get Support

To Stop Receiving Messages (Unsubscribe)

You have the right to revoke consent and opt out of receiving text messages at any time:

Reply STOP, CANCEL, END, UNSUBSCRIBE, or QUIT to any text message sent from our system.
You will receive a single automated confirmation message verifying that you have been unsubscribed. No further messages will be sent unless you explicitly re-subscribe.

To Get Help or Technical Support

If you experience issues or need assistance with our messaging service:

Reply HELP or INFO to any message you receive.
Email our administrative team directly at info@skyrockettherapy.org.
Call our office at (909) 475-7002.

6. Health Information & Privacy Notice

While text messaging provides a convenient way to coordinate care and scheduling, standard SMS is not an end-to-end encrypted communication channel.

Skyrocket Pediatric Therapy Foundation takes significant precautions to minimize Protected Health Information (PHI) sent via SMS. We ask that detailed clinical reports, diagnostic information, or sensitive personal records be communicated through our secure client portal or directly with your therapy team.

7. Carrier Disclaimers & Liability

Wireless carriers (e.g., AT&T, T-Mobile, Verizon, etc.) are not liable for delayed, misdirected, or undelivered messages. SMS delivery depends on your mobile provider's network coverage and transmission efficiency.

8. Updates & Modifications

Skyrocket Pediatric Therapy Foundation reserves the right to update or modify these SMS Privacy Policy & Terms of Service at any time. Any changes will take effect immediately upon being posted to our website at https://www.skyrockettherapy.org/privacy-practices. Continued participation in our text messaging service constitutes acceptance of the revised terms.

9. Contact Information

If you have questions regarding this policy or our privacy practices, please contact us:

Skyrocket Pediatric Therapy Foundation

Attn: Administrative & Compliance Department

Email: info@skyrockettherapy.org

Phone: (909) 475-7002

SMS Privacy Policy & Terms of Service

Privacy Practices