Notice of HIPAA Privacy Practices
This notice describes how your health information is handled by the licensed mental health professionals in our network, and how Pro ESA Letter, as the administrative platform connecting you with them, safeguards information as part of that process.
Pro ESA Letter
HIPAA-Aligned Privacy Practices
Pro ESA Letter connects you with independent, licensed mental health professionals (LMHPs) for ESA and PSD letter evaluations. As explained in our Terms and Conditions and Privacy Policy, Pro ESA Letter itself is not a HIPAA covered entity — the LMHP who evaluates you is typically the covered entity responsible for your clinical health information, and will provide you with their own required Notice of Privacy Practices directly. This page explains how Pro ESA Letter, as the platform connecting you, handles information that passes through our systems.
Pro ESA Letter operates a telehealth-based platform connecting individuals with independent licensed mental health professionals for ESA and PSD letter evaluations. Your clinical relationship — including your evaluation, diagnosis discussion, and the resulting letter — is with the LMHP directly, not with Pro ESA Letter.
Who Is Responsible for What
Your LMHP, as the covered entity, is legally required to maintain the privacy of your protected health information (PHI) and to provide you with their own Notice of Privacy Practices. Pro ESA Letter, as the platform facilitating that connection, maintains its own privacy and security safeguards for the intake, scheduling, and administrative information that passes through our systems, consistent with HIPAA principles even where we are not directly bound as a covered entity.
Protected Health Information (PHI)
Protected Health Information (PHI) is information that may identify you and relates to your past, present, or future physical or mental health, condition, or related health care services.
1. To Facilitate Your Evaluation
We may use and disclose the information you provide for the following purposes without additional authorization, consistent with our Privacy Policy:
Connecting You to Care
We share your intake information with the licensed mental health professional matched to conduct your evaluation, so they can provide their independent clinical assessment.
Payment Processing
We use billing information to process payment for platform services through our third-party payment processors, as described in our Privacy Policy.
Platform Operations
We may use de-identified or aggregated information to evaluate and improve our platform, matching process, and quality of service.
2. Other Permitted Disclosures
Both Pro ESA Letter and the LMHPs in our network may disclose information without additional authorization in the following circumstances, consistent with applicable law:
| Purpose | Description | Examples |
|---|---|---|
| Required By Law | When required by federal, state, or local law | Court orders, subpoenas, mandatory reporting |
| Public Health Activities | For public health reporting as required by law | Disease control, vital statistics, regulatory reporting |
| Health Oversight | To oversight agencies for audits and licensing review | State licensing boards, compliance audits |
| Judicial Proceedings | In response to court orders or subpoenas | Legal proceedings where required by law |
| Serious Threat | To prevent a serious threat to health or safety | Imminent risk of harm to self or others |
3. Uses Requiring Your Authorization
For any other purpose, we or your LMHP will obtain your written authorization before using or disclosing your information. You may revoke authorization in writing at any time, except to the extent action has already been taken based on it.
Special Authorizations Required
The following require specific written authorization: marketing communications, sale of your information, most uses of psychotherapy notes held by your LMHP, and research uses not covered by a waiver.
Because your evaluation happens remotely, a few additional privacy points are worth understanding:
- Video and messaging consultations with your LMHP take place through secure, encrypted platforms designed to meet HIPAA security standards.
- You are responsible for taking reasonable steps to protect your own privacy during a telehealth session — for example, participating in a private location and using a secure internet connection.
- As with in-person care, telehealth records are subject to the same confidentiality obligations as traditional clinical records.
- If a technical issue disrupts a session, your LMHP will follow their own protocol for rescheduling or continuing securely — this does not compromise the confidentiality of information already shared.
Regarding the clinical PHI held by your LMHP, and the administrative information held by Pro ESA Letter, you generally have the following rights:
Right to Inspect and Copy
You have the right to inspect and obtain a copy of your records. Your LMHP may charge a reasonable fee for copying and mailing clinical records.
Right to Request Amendments
You have the right to request that inaccurate or incomplete information be amended. Requests regarding clinical records should go directly to your LMHP.
Right to an Accounting of Disclosures
You have the right to receive an accounting of certain disclosures made in the six years prior to your request, excluding routine treatment/payment/operations disclosures.
Right to Request Restrictions
You have the right to request restrictions on certain uses and disclosures. Neither we nor your LMHP are required to agree to every restriction requested.
Right to Confidential Communications
You have the right to request that we or your LMHP communicate with you in a particular way or at a particular location. We will accommodate reasonable requests.
Right to a Paper Copy
You have the right to obtain a paper copy of any Notice of Privacy Practices, even if you previously agreed to receive it electronically.
How to Exercise Your Rights
For requests related to your clinical evaluation, contact your LMHP directly. For requests related to information held by Pro ESA Letter as the platform operator, contact our Privacy Officer using the details in the Contact Information section below.
If a breach of unsecured protected health information occurs that affects you, applicable law requires notification to affected individuals without unreasonable delay. Depending on the nature and source of the breach:
- If the breach occurs at the level of your LMHP’s own systems or records, your LMHP is responsible for providing breach notification as the covered entity.
- If the breach occurs within Pro ESA Letter’s own platform or systems, we will notify affected individuals and, where required, relevant regulatory authorities, in accordance with applicable breach notification laws.
- Notifications will describe what happened, what information was involved, and steps you can take to protect yourself.
HIPAA sets a federal baseline, but many states impose additional, sometimes stricter, confidentiality protections for mental health records specifically. Where a state law provides greater privacy protection than HIPAA, the stricter state standard generally applies to the clinical records held by your LMHP.
Because our network includes LMHPs licensed across all 50 states, the specific confidentiality rules that apply to your evaluation depend on the state where your LMHP is licensed and where you reside. Your LMHP can explain any state-specific protections that apply to your records.
Platform Commitments
As the platform connecting you with independent LMHPs, Pro ESA Letter is committed to:
- Maintaining reasonable administrative, technical, and physical safeguards for information in our systems
- Sharing your intake information only with the LMHP matched to your evaluation and other parties described in our Privacy Policy
- Notifying you of a breach involving our own systems, as described above
- Providing this Notice and keeping it current
Changes to This Notice
We may update this Notice from time to time. The revised Notice will be posted on this page with an updated revision date, and will apply to information we maintain going forward.
Minimum Necessary Standard
We follow a “minimum necessary” approach — using, disclosing, or requesting only the amount of information reasonably needed to accomplish the intended purpose.
If you believe your privacy rights have been violated, you may file a complaint with your LMHP directly (for clinical matters), with Pro ESA Letter’s Privacy Officer (for platform-related matters), or with the Secretary of the Department of Health and Human Services.
No Retaliation
You will not be penalized or retaliated against for filing a complaint about privacy practices. We are committed to addressing any concerns about the privacy of your information.
How to File a Complaint
- Contact your LMHP directly for concerns about your clinical evaluation
- Contact Pro ESA Letter’s Privacy Officer for concerns about our platform (see Contact Information below)
- File directly with the Office for Civil Rights (OCR)
Contact Information
If you have questions about this Notice or our platform-level privacy practices, please contact our Privacy Officer:
Privacy Officer
Pro ESA Letter Privacy Officer