Privacy Policy

Salt & Sage Privacy & Confidentiality Policy  

Effective Date: August 14, 2026 Last Reviewed: August 14, 2026

Purpose  Salt & Sage is committed to protecting the privacy, confidentiality, and security of client information. All employees, clinicians, contractors, interns, and other authorized personnel must comply with HIPAA, applicable federal and state privacy and confidentiality laws, professional ethical requirements, and this policy.  When state law provides greater privacy protection than federal law, Salt & Sage will follow the applicable legal requirement.  

Confidentiality & Access  All client information—including identifying information, clinical records, communications, scheduling information, billing information, and health information—is confidential.  Personnel may access, use, or disclose client information only as necessary to perform authorized duties or as otherwise permitted or required by law. Client information must never be accessed for curiosity or personal purposes.  

Protecting Client Information  Personnel must use reasonable safeguards to protect client information. This includes using Salt & Sage-approved systems and communication methods, maintaining secure passwords and multifactor authentication when available, securing devices and paper records, protecting conversations from being overheard, confirming recipients before transmitting information, and securely disposing of confidential materials.  

Client information must not be stored in personal email, personal cloud storage, personal applications, or other unapproved locations.  Telehealth, Technology & AI  Telehealth services must be provided using Salt & Sage-approved technology and from reasonably private environments.  Identifiable client information, protected health information, clinical records, or psychotherapy content may not be entered into AI systems, transcription services, applications, or other external digital tools unless Salt & Sage has approved the technology for that purpose and all required privacy and security protections are in place.  

Client sessions may not be recorded without appropriate authorization and consent.  Communication, Social Media & Public Encounters  Staff should limit sensitive information communicated through email or text and use approved communication methods.  Personnel must never disclose information through social media that identifies, or could reasonably identify, an individual as a Salt & Sage client.  When encountering clients in public, personnel should generally allow the client to initiate acknowledgment to protect the client’s privacy.  Disclosure of Client Information  

Client information may be disclosed with appropriate authorization or when otherwise permitted or required by applicable law.  Requests involving subpoenas, court orders, law enforcement, mandatory reporting, safety concerns, or other unusual disclosures should be referred to the appropriate Salt & Sage supervisor or privacy representative whenever circumstances permit before information is released.  Vendors & Business Associates  Vendors and contractors with access to protected health information must be appropriately reviewed. 

Salt & Sage will obtain Business Associate Agreements when required.  Privacy Incidents  Any suspected unauthorized access, disclosure, loss, theft, or misuse of client information must be promptly reported to the designated Salt & Sage privacy representative.  Salt & Sage will investigate and respond to suspected privacy or security incidents in accordance with applicable federal and state requirements.  Client Rights  Salt & Sage will respect client privacy rights provided by applicable federal and state law, including applicable rights concerning access to records, amendments, confidential communications, restrictions, disclosures, and privacy complaints. 

 Detailed information regarding HIPAA privacy rights is provided in Salt & Sage’s Notice of Privacy Practices.  Staff Responsibilities  Personnel will receive appropriate privacy and security training and are responsible for maintaining client confidentiality.  Violations may result in corrective or disciplinary action. Salt & Sage prohibits retaliation against anyone who reports a privacy concern in good faith.  Questions regarding privacy, confidentiality, or disclosure should be directed to: