1. Notice of Privacy Practices (HIPAA)

As a licensed mental health provider, Stacie Wentling McKee is required by HIPAA to maintain the privacy of your Protected Health Information (PHI) and to provide you with a Notice of Privacy Practices. This notice describes your rights and our obligations regarding your health information.

Your PHI may include:

• Information you provide during intake, assessment, or treatment
• Clinical notes, treatment plans, and progress records
• Billing and insurance information
• Any other information that identifies you and relates to your health or treatment

A full Notice of Privacy Practices will be provided to you at the start of services and is available upon request by contacting stacie.lcsw@gmail.com.

2. How We Use Your Health Information

Your PHI is used only as permitted or required by law. Primary uses include:

• Treatment — to provide, coordinate, and manage your mental health care
• Payment — to bill your insurance or process payments for services rendered
• Healthcare operations — for quality assurance, licensing, and practice administration

Your information will not be sold, rented, or shared for marketing purposes. Disclosures beyond treatment, payment, and operations require your written authorization, except where disclosure is required or permitted by law (such as mandatory reporting obligations or a court order).

3. Mandatory Reporting & Limits of Confidentiality

Confidentiality has legal and ethical limits. We are required by law to disclose information without your consent in the following circumstances:

• If there is reason to believe a child, elder, or dependent adult is being abused or neglected
• If you present a serious and imminent threat of harm to yourself or another identifiable person
• If disclosure is ordered by a court of law
• As otherwise required by Oregon or Washington state law

These limits of confidentiality will be discussed with you at the beginning of services.

4. Information Collected Through This Website

This website (urwell.org) is hosted on Squarespace. When you visit the site, certain technical information may be automatically collected, including:

• IP address and browser type
• Pages visited and time spent on the site
• Referring website or search terms

This information is collected by Squarespace and is used for site analytics and security. It is not linked to your identity and is not used for clinical purposes. For more information, see Squarespace's Privacy Policy.

If you submit a contact form or inquiry through this website, the information you provide (such as your name, email address, and message) will be received by Stacie Wentling McKee and used only to respond to your inquiry. This information is not stored in your clinical record unless you become a client.

5. Email & Electronic Communication

Email and standard electronic communications are not fully secure and may not be appropriate for transmitting sensitive health information. By contacting us via email, you acknowledge this risk.

Current clients communicate through a HIPAA-compliant client portal. Unencrypted email is used for scheduling and general inquiries only — not for clinical communication.

If you have concerns about electronic communication, please raise them at the start of services or contact us directly.

6. Your Rights Regarding Your Health Information

Under HIPAA and applicable state law, you have the right to:

• Request access to and a copy of your health records
• Request corrections to information you believe is inaccurate
• Request restrictions on how your information is used or disclosed
• Request an accounting of disclosures made without your authorization
• Receive a copy of this Privacy Policy and the Notice of Privacy Practices
• File a complaint if you believe your privacy rights have been violated

To exercise any of these rights, contact Stacie Wentling McKee at stacie.lcsw@gmail.com. Requests will be responded to within 30 days.

7. Minor Clients

Upriver Wellness provides services to adults only (18 years and older). We do not knowingly collect personal information from minors through this website.

8. Data Security

We take reasonable steps to protect your information from unauthorized access, disclosure, or misuse. Clinical records are stored in a HIPAA-compliant electronic health records system. Physical records, if any, are stored securely and access is limited to authorized personnel.

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Third-Party Services

This practice may use third-party services to support operations, including scheduling, billing, and secure client communication. Any third-party service providers who handle PHI are required to enter into a Business Associate Agreement (BAA) with Upriver Wellness, LLC, as required by HIPAA.

This website is hosted by Squarespace, Inc. Squarespace's use of data is governed by their own privacy policy and terms of service.

10. Filing a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with:

• Upriver Wellness, LLC — contact Stacie Wentling McKee at stacie.lcsw@gmail.com
• U.S. Department of Health & Human Services, Office for Civil Rights — hhs.gov/ocr/complaints
• Oregon Health Authority — for Oregon-specific complaints
• Washington State Department of Health — for Washington-specific complaints

You will not be retaliated against for filing a complaint.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes will be reflected by the "Last updated" date at the top of this page. Continued use of this website or our services after changes are posted constitutes acceptance of the updated policy.