Sign In
Get Started

District and School Selection Form

District Short Form

Add Your Heading Text Here

×
District and School Selection Form

Student Information

Service Type Requested

Consent & Privacy

Privacy Policy

Virtual Peace of Mind (VPM) and Affiliated Practices

Combined Privacy Policy & Notice of Privacy Practices

(Last reviewed and updated October 2025)

Virtual Peace of Mind (VPM) and its affiliated practices are committed to protecting the confidentiality, integrity, and security of the personal and health information of every student, parent, and school partner we serve. This combined Privacy Policy and Notice of Privacy Practices explains how we collect, use, disclose, and safeguard information through our websites, telehealth platforms, referral systems, and associated digital tools.

VPM provides school-based and community telehealth services across Virginia, Maryland, the District of Columbia, Florida, Alabama, and North Carolina. All VPM operations comply with the Health Insurance Portability and Accountability Act (HIPAA), the Family Educational Rights and Privacy Act (FERPA), and applicable state confidentiality laws governing mental health and student services.

  1. Scope and Purpose

This notice applies to:

  • All VPM-operated websites (including www.vpmforschools.org and www.avirtualpeaceofmind.com)
  • Our HIPAA-compliant telehealth and referral platforms
  • Any third-party service providers or subcontractors that perform authorized functions on our behalf

The purpose of this notice is to inform families, students, and district partners how VPM collects, protects, and uses personal and health information and how individuals may exercise their privacy rights.

  1. Information We Collect

VPM collects information in two main categories:

a. Protected Health Information (PHI)

PHI includes any identifiable information related to a student’s physical or mental health, treatment, or payment for services. Examples include:

  • Student’s name, date of birth, and contact details
  • Health, developmental, or mental health history
  • School and counselor referral details
  • Session documentation and clinical progress notes
  • Insurance or Medicaid identification information
  • Parent or guardian contact information

VPM receives PHI through referrals, consent forms, telehealth sessions, and communications with authorized individuals.

b. Personally Identifiable Information (PII)

PII refers to information collected through our websites or digital forms that identifies you personally but is not health-related. Examples include:

  • Email addresses, phone numbers, and user-submitted contact forms
  • Device, browser, and IP address information
  • Cookies and analytics data that help us improve site function

VPM collects only the minimum necessary information required to deliver services and improve user experience.

  1. How We Use Information

VPM uses collected information for the following lawful purposes:

a. Treatment

To provide, coordinate, or manage health care and related services. This includes sharing information with authorized providers, school counselors, or case managers involved in the student’s care.

b. Payment

To process claims, verify coverage, and coordinate billing through Medicaid, school-funded programs, or authorized insurers.

c. Health Care Operations

To conduct internal quality reviews, supervision, staff training, compliance monitoring, and auditing activities designed to improve clinical care and administrative efficiency.

d. Parental and School Collaboration

To support the student’s academic and emotional success, VPM may communicate limited, educationally relevant updates (such as attendance and participation) to school representatives, consistent with FERPA and parental consent. Detailed therapy or psychiatric session content is never shared without written authorization.

  1. Use of Information Without Authorization

Certain disclosures are permitted or required by law even without your written consent. These may include:

  • Public health reporting: Such as reporting communicable diseases or suspected child abuse/neglect.
  • Health oversight: Disclosures to licensing or accrediting agencies for audits, compliance reviews, or investigations.
  • Legal and law enforcement: Disclosures to comply with a court order, warrant, or lawful subpoena.
  • Threat prevention: When necessary to prevent or lessen a serious and imminent threat to a person’s health or safety.
  • National security: As required for national defense or security activities.

VPM follows a minimum necessary standard, meaning only essential information is disclosed in such cases.

  1. How We Protect Your Information

VPM employs a multi-layered approach to data security, including:

  • Encryption: All PHI transmitted or stored is encrypted using AES-256 and SSL/TLS standards.
  • Access controls: Access to health data is limited to authorized personnel through multi-factor authentication.
  • Secure servers: All data is stored on HIPAA-compliant servers with continuous monitoring and intrusion detection systems.
  • Training: All staff and contractors receive annual HIPAA and FERPA training.
  • Incident response: We maintain written procedures for breach response, mitigation, and notification.

We also partner only with technology vendors who sign Business Associate Agreements (BAAs) confirming their compliance with HIPAA standards.

  1. Family Engagement Across K–12

We understand that the role of parents and guardians evolves as students mature:

  • Elementary-level students: Parents are fully engaged in consent, scheduling, progress updates, and treatment decisions.
  • Middle school students: Parents remain active partners, while the student may begin to develop a degree of therapeutic autonomy.
  • High school students: Parents maintain oversight and receive coordination updates, but the student may take more responsibility in goal-setting and participation.

At every level, our Care Coordinator ensures open communication and appropriate parental involvement.

  1. Website and Digital Privacy

VPM’s websites collect limited analytics to improve performance and accessibility.

Cookies and Analytics

Cookies are small text files stored on your device to help recognize returning visitors and track usage trends. VPM uses cookies only for performance and functionality—not for marketing.
You can disable cookies through your browser, though certain features may not work optimally.

Third-Party Integrations

VPM may use secure, HIPAA-compliant integrations (e.g., Jotform, SimplePractice, LuxSci) for referral forms or telehealth sessions. These vendors are contractually bound to maintain privacy and security standards equivalent to ours.

Advertising and Tracking

VPM does not use third-party advertising networks or behavioral tracking on any of its websites.

  1. Your Rights Regarding Your Information

Under HIPAA and FERPA, you have the right to:

  1. Access – Request a copy of your or your child’s medical or telehealth records.
  2. Amend – Request corrections to inaccurate or incomplete information.
  3. Restrict Disclosures – Request limits on how your information is shared.
  4. Confidential Communications – Request contact through specific channels (e.g., alternate email or phone).
  5. Accounting of Disclosures – Request a list of disclosures made outside treatment, payment, or operations.
  6. Paper Copy – Obtain a printed copy of this Notice at any time.

All requests must be submitted in writing to:
Privacy Officer
Virtual Peace of Mind (VPM)
Email: admin@vpmforschools.org
Phone: 888-663-2475

  1. Breach Notification

If VPM identifies a breach of unsecured Protected Health Information, affected individuals will be notified in writing within 60 days of discovery. Notifications will include a description of the breach, what data was involved, potential impacts, and steps taken to mitigate future risk.

  1. Children’s Privacy

Our services are designed for K–12 students, and we comply with all relevant child privacy laws, including COPPA.

  • Children under 18 cannot independently consent to services except where state law allows limited adolescent consent.
  • Parents/guardians must sign consent forms before treatment begins, except in states that allow minor-initiated therapy for specific age ranges.
  1. Non-Discrimination and Accessibility

VPM provides equitable care regardless of race, color, national origin, religion, gender, sexual orientation, disability, or socioeconomic status.
Translation and interpretation services are available for families who prefer communication in languages other than English.

VPM’s websites are designed to comply with WCAG 2.1 accessibility standards to ensure usability for all users.

  1. State-Specific Information

VPM follows all applicable state laws in its service areas.

  • Virginia: Licensed counselors comply with Board of Counseling regulations (18VAC115).
  • Florida: Clinicians adhere to Chapter 491 F.S. and related telehealth statutes.
  • Maryland/DC/NC/AL: Follow telehealth, supervision, and mental health disclosure laws for minors.

State-specific reporting or complaint resources are available upon request from the Privacy Officer.

  1. Changes to This Notice

VPM reserves the right to update this notice as required by law or operational needs. Revised policies will be posted on our websites with a new effective date. The new policy applies to all information in our possession, past and present.

  1. Contact for Questions or Complaints

If you have questions about this policy, concerns about your privacy rights, or wish to file a complaint, contact:

Virtual Peace of Mind (VPM) Privacy Office
Email: admin@vpmforschools.org
Phone: 888-663-2475
Mailing Address: Virtual Peace of Mind (VPM), 4897  Bennetts Pasture Rd #5354 Privacy Department, Suffolk, VA

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at:
www.hhs.gov/ocr/privacy/hipaa/complaints/
We will never retaliate against anyone for filing a privacy complaint.