HIPAA compliance

In effect since September 2, 2026. Rather than list legal obligations in the abstract, this page walks through your information as it actually moves: what gets collected at each step, who can see it, and where it ends up.

Step one: booking

When you reserve an appointment we capture a name, an email address, a phone number and a chosen time slot. Payment card details go directly to our processor and never reach our servers. At this stage nothing about your health has been recorded, so nothing here is protected health information yet.

Step two: the screening form

The moment you describe a symptom, everything changes. From that point the record is protected health information under the Health Insurance Portability and Accountability Act, and the clinician evaluating you is a covered health care provider. The form travels over TLS with 256-bit encryption and is written to storage already encrypted.

Step three: the consultation

Your video or phone consultation runs on a platform operating under a business associate agreement, which binds that vendor to the same safeguards we are held to. Consultations are not recorded for marketing, training or any other secondary purpose. Your clinician takes notes; those notes are part of your clinical record.

Step four: the letter

An approved letter is generated, signed and emailed to you. Note what it deliberately leaves out: it confirms that a licensed New York clinician has evaluated you and that a disability-related need exists. It does not name your diagnosis, quote your notes or describe your treatment. That omission is intentional, because your landlord or co-op board is entitled to documentation of need and nothing beyond it.

Step five: storage

Your record sits encrypted at rest. Access is limited to the clinician who treated you and the small support team who need it to help you, and every access is logged and periodically reviewed. Clinical records are retained for the period New York law and professional standards require, generally at least six years for an adult record, then securely destroyed.

The people and companies who can see any of this

Nobody else, with four narrow exceptions

We disclose protected health information without your authorisation only where a valid court order or subpoena compels it, where a specific law requires reporting, where there is a serious and imminent threat to someone's safety, or where a health oversight authority is exercising lawful powers. We do not sell health information, we do not use it for advertising, and we do not volunteer it to your landlord, board or employer.

The rights you can exercise, and how

Email support@newyorkesaletter.org with the subject "Privacy request". We verify your identity first and respond within 30 days, usually sooner.

• Get a copy of your health record, electronically or on paper.
• Ask for a correction where you believe something is wrong.
• See an accounting of certain disclosures we have made.
• Request a restriction on how information is used or shared. We consider every request and tell you plainly when we cannot agree.
• Choose the channel we use to contact you.
• Complain to us or directly to the HHS Office for Civil Rights. Retaliation for filing a complaint is prohibited and would be an obvious breach of trust besides.

If something goes wrong

Under the Breach Notification Rule, a breach of unsecured protected health information obliges us to notify affected individuals without unreasonable delay and no later than 60 days from discovery, notify HHS, and notify media where more than 500 residents of a state are affected. In that situation you would hear what happened, which information was involved, what we did about it and what we recommend you do.