HIPAA Notice of Privacy Practices

1. Uses and Disclosures of PHI Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment: To coordinate or manage your care with clinicians, therapists, and medical professionals involved in your treatment.
• Payment: To bill and obtain payment from your insurance provider or other payers for services provided.
• Healthcare Operations: For internal quality assessment, staff training, accreditation, licensing, and business management.
• Required by Law: When disclosure is required by federal, state, or local law (e.g., reporting suspected child abuse, court orders).
• Public Health and Safety: To prevent or lessen a serious and imminent threat to a person or the public.

Note: Under 42 CFR Part 2, substance use disorder records require your written consent for most disclosures, even those routine under HIPAA. Exceptions are limited (e.g., medical emergencies, qualified service organization agreements).

2. Uses and Disclosures Requiring Your Authorization

The following uses and disclosures will be made only with your written authorization:

• Marketing communications
• Sale of PHI
• Disclosure of psychotherapy notes
• Most disclosures of substance use treatment records (per 42 CFR Part 2)
• Communication with family members, friends, or employers

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

3. Your Rights Regarding Your PHI

You have the right to:

• Access: Inspect and obtain a copy of your medical and billing records (with limited exceptions).
• Amend: Request that we amend PHI you believe is incorrect or incomplete.
• Accounting of Disclosures: Receive a list of certain disclosures we have made of your PHI.
• Restrict Uses or Disclosures: Request restrictions on how we use or disclose your PHI for treatment, payment, or operations.
• Confidential Communications: Request that we communicate with you in a specific way or at a specific location (e.g., only at your work number).
• Paper Copy: Receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
• File a Complaint: File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

4. Breach Notification

In the event of a breach of unsecured PHI, we will notify affected individuals as required by federal law, typically within 60 days of discovery.

5. Changes to This Notice

We reserve the right to change this Notice and apply the updated terms to all PHI we maintain. The current Notice will always be posted on our website and available at our facility.

6. How to Exercise Your Rights or File a Complaint

To exercise any rights described above or file a privacy complaint, contact our Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

7. Acknowledgment

Upon admission to our program, you will be asked to sign an acknowledgment that you have received this Notice. Your signature is for our records only and does not constitute consent for any specific use or disclosure of your PHI.