HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Duties

Valley Spring Recovery Center is required by law to maintain the privacy of your protected health information (PHI), to provide you with this notice of our legal duties and privacy practices with respect to your PHI, and to notify you following a breach of your unsecured PHI. We are required to abide by the terms of this notice while it is in effect. We reserve the right to change the terms of this notice and to make new provisions effective for all PHI that we maintain.

42 CFR Part 2, Confidentiality of Substance Use Disorder Records

Federal law (42 CFR Part 2) provides special protections for records related to substance use disorder treatment that are more stringent than general HIPAA protections. Valley Spring Recovery Center will not disclose your SUD treatment records without your written consent, except as specifically permitted by federal law. Permitted exceptions include medical emergencies, research with appropriate protections, and audits or program evaluations.

How We May Use and Disclose Your Health Information

We may use and disclose your PHI for the following purposes without your written authorization:

• Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services, including sharing information with physicians or other providers involved in your care.
• Payment: We may use and disclose your PHI to obtain payment for your treatment, including billing insurance companies, verifying coverage, and obtaining prior authorizations.
• Healthcare Operations: We may use and disclose your PHI for our internal operations, including quality assessment, staff training, audits, and business planning.
• Business Associates: We may share your PHI with business associates (e.g., billing services, IT vendors) who perform services on our behalf, provided they agree to protect your information under a Business Associate Agreement.
• Public Health Activities: We may disclose your PHI to public health authorities as required to prevent or control disease, injury, or disability.
• Abuse Reporting: We may disclose PHI to government authorities authorized to receive reports of child abuse or neglect, or elder abuse, as required by law.
• Health Oversight: We may disclose your PHI to government agencies for audit, investigation, inspection, or licensing activities.
• Law Enforcement: We may disclose your PHI to law enforcement officials in limited circumstances, such as in response to a court order or subpoena.
• Research: We may use or disclose your PHI for research purposes when an Institutional Review Board (IRB) has approved a waiver of authorization.
• Workers' Compensation: We may disclose your PHI to comply with workers' compensation laws.
• Required by Law: We will disclose your PHI when required to do so by applicable federal or state law.

Uses and Disclosures Requiring Your Authorization

The following uses and disclosures require your written authorization:

• Psychotherapy Notes: We will not use or disclose your psychotherapy notes without your written authorization, except for limited treatment, training, and legal purposes.
• Marketing: We will not use your PHI for marketing purposes without your written authorization.
• Sale of PHI: We will not sell your PHI without your written authorization.

You may revoke any authorization you have given at any time, in writing. Revocation will not apply to information already used or disclosed in reliance on your authorization.

Your Individual Rights

1. Right to Notice

You have the right to receive this Notice of Privacy Practices. You may request a paper copy at any time, even if you have agreed to receive it electronically.

2. Right to Access, Inspect, and Copy

You have the right to inspect and obtain a copy of your PHI that we maintain in your designated record set. We may charge a reasonable fee for copies. We may deny access in limited circumstances; if denied, you may request a review of the denial.

3. Right to Amend

You have the right to request that we amend PHI that you believe is incorrect or incomplete. We may deny your request if the information was not created by us, is not part of the records we maintain, is not information you would be permitted to inspect, or is accurate and complete. If denied, you may submit a written statement of disagreement.

4. Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI we have made for purposes other than treatment, payment, healthcare operations, or disclosures you authorized. The accounting covers disclosures made in the six years prior to your request.

5. Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to restrictions, except that we must agree to restrict disclosures to a health plan when you pay out-of-pocket in full for a specific service.

6. Out-of-Pocket Payments

If you pay out-of-pocket in full for a specific service, you may request that we not disclose PHI related to that service to your health plan for payment or healthcare operations purposes, and we will honor that restriction.

7. Right to Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at an alternative location (e.g., only by mail to a specific address, or only by phone at a specific number). We will accommodate reasonable requests.

8. Right to Notification of Breach

You have the right to receive notice if we discover a breach of your unsecured PHI. We will notify you as required by law, including information about what happened, the PHI involved, and steps you should take to protect yourself.

9. Right to Voice Concerns

You have the right to file a complaint if you believe your privacy rights have been violated. You may complain to us directly or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Contact Our Privacy Officer

To exercise any of your rights, ask questions, or file a complaint, contact our Privacy Officer: