Brenton Kirschner, M.MFT, LMFT, LPC ARLMFT LLC | 5305 W Village Pkwy, Suite 8, Rogers, AR 72758
Phone: 479-383-3179 | Email: brentonk@arlmft.com
 

Effective Date: June 4, 2026 

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
 

1. My Pledge Regarding Health Information
 

Your health information is personal, and I am committed to protecting it. I create a record of the care and services you receive in order to provide quality care and to comply with legal requirements. This notice applies to all records of your care generated by this practice. It describes the ways I may use and disclose your health information, your rights, and my obligations.
 

Clinical services are provided by ARLMFT LLC. Administrative, scheduling, and billing services are provided by Regroup Counseling PLLC under contract; Regroup staff may access your information only as needed for those functions and are required to protect it under HIPAA.
 

I am required by law to:

• keep protected health information ("PHI") that identifies you private;

• give you this notice of my legal duties and privacy practices;

• follow the terms of the notice currently in effect; and

• notify you if a breach of your unsecured PHI occurs, in accordance with the HITECH Act and 45 CFR §§ 164.400–414.
   

I may change the terms of this Notice. If I do, the new Notice will be available on request, in my office, and on my website.
 

2. How I May Use and Disclose Health Information About You
 

Treatment, payment, or health care operations. Federal rules allow providers with a direct treatment relationship to use or disclose PHI without written authorization to carry out treatment, payment, and health care operations — for example, consulting another licensed provider about your condition, or working with Regroup to bill for services.
 

Lawsuits and disputes. If you are involved in a lawsuit, I may disclose health information in response to a court or administrative order, or in response to a subpoena or other lawful process only if efforts have been made to notify you or to obtain a protective order.
 

3. Uses and Disclosures That Require Your Authorization
 

Psychotherapy notes. I maintain psychotherapy notes as defined in 45 CFR § 164.501, kept separately from your medical record. Use or disclosure of these notes requires your written authorization, except for limited purposes permitted by law (for example, my own use in treating you, training/supervision, defending a legal action you bring, HHS compliance review, when required by law, or to avert a serious threat to health or safety).
 

Marketing and sale of PHI. I will not use or disclose your PHI for marketing purposes, and I will not sell your PHI.

Other uses and disclosures. Any use or disclosure of your PHI not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time by notifying me in writing. Revocation will stop future uses and disclosures, but it will not affect any use or disclosure already made in reliance on your authorization.
 

4. Uses and Disclosures That Do Not Require Your Authorization
 

Subject to limitations in the law, I may use and disclose your PHI without authorization to:

• comply with state or federal law;

• carry out public health activities, including mandated reporting. Under Arkansas law I am a mandated reporter and must report suspected child maltreatment (Ark. Code Ann. § 12-18-402); suspected adult maltreatment, including abuse, neglect, or exploitation of endangered or impaired adults (Ark. Code Ann. § 12-12-1708); and a serious and imminent threat to the health or safety of an identifiable person or the public;

• support health oversight activities (audits, investigations);

• respond to judicial and administrative proceedings, including a court or administrative order;

• support law enforcement purposes, including reporting crimes on my premises;

• respond to coroners or medical examiners performing authorized duties;

• support research, workers' compensation, and specialized government functions as permitted by law; and

• provide appointment reminders and information about treatment alternatives or health-related services.
   

5. Uses and Disclosures That Give You an Opportunity to Object
 

I may share PHI with a family member, friend, or other person you indicate is involved in your care or payment, unless you object.
 

6. Your Rights With Respect to Your PHI
 

• Request limits on uses and disclosures for treatment, payment, or operations. I am not required to agree if it would affect your care.

• Restrict disclosures to your health plan when you pay out of pocket in full. I will agree unless the law requires the disclosure.

• Choose how I contact you (for example, a specific phone or address). I will agree to all reasonable requests.

• See and get copies of your PHI (other than psychotherapy notes), generally within 30 days, for a reasonable, cost-based fee.

• Get a list of certain disclosures I have made (I will respond within 60 days).

• Correct or update your PHI. I may say no but will explain in writing within 60 days (or 90 with notice of extension).

• Get a paper or electronic copy of this Notice at any time.

• Be notified of a breach of your unsecured PHI, no later than 60 days after discovery (HITECH; 45 CFR §§ 164.400–414).
   

7. Electronic Records, Security, and Use of Upheal
 

I maintain client records in an electronic health record system protected by encryption, access controls, and other measures consistent with the HIPAA Security Rule (45 CFR Part 164, Subpart C). All electronic platforms used in your care operate under a signed Business Associate Agreement. Telehealth is provided through secure, HIPAA-compliant platforms. No electronic system is 100% secure.
 

I use Upheal, a HIPAA-compliant platform, as a Business Associate to help generate my clinical notes. Upheal processes PHI on my behalf under a signed Business Associate Agreement and does not provide healthcare services or make decisions about your care. By default, session audio is processed into a transcript and is not saved as a recording; transcripts are automatically deleted after 7 days; only my clinical note is retained as part of your record. Upheal uses contracted technical subprocessors (such as data processing and payment services) to operate its platform; those relationships are governed by Upheal's privacy policy at https://www.upheal.io/privacy. Clients provide separate written consent to the use of the AI scribe in a consent form included in the intake paperwork.
 

8. How to Complain About Privacy Practices
 

If you believe your privacy rights have been violated, you may file a complaint. You will not be retaliated against for filing.
 

To me: in writing at the address above.
 

To the Arkansas Board of Examiners in Counseling: 101 East Capitol Avenue, Suite 202, Little Rock, AR 72201; (501) 683-5800; https://healthy.arkansas.gov/boards-commissions/boards/examiners-in-counseling-arkansas-state-board/
 

To the U.S. Department of Health and Human Services, Office for Civil Rights: online at https://ocrportal.hhs.gov/ocr/cp/wizard_cp.jsf; by mail to Centralized Case Management Operations, U.S. Dept. of Health and Human Services, 200 Independence Ave., S.W., Room 509F, HHH Building, Washington, D.C. 20201; or OCRComplaint@hhs.gov