Notice of Privacy Practices

Effective Date: [November, 2025]

This Notice of Privacy Practices (“Notice”) describes how medical information about you may be used and disclosed and how you can get access to this information.
Please review it carefully.

This Notice applies to Detox & Recovery (“we”, “us”, “our”) and to all of our staff, professionals,
and affiliated entities that are required to follow the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and, where applicable,
the federal confidentiality regulations for substance use disorder treatment records at 42 C.F.R. Part 2 (“Part 2”).

This Notice explains your rights and our legal duties regarding your Protected Health Information (PHI) and, when applicable,
your substance use disorder treatment records protected under Part 2.

Our Responsibilities

We are required by law to:

  • Maintain the privacy and security of your PHI and, when applicable, your Part 2-protected substance use disorder treatment records.
  • Provide you with this Notice describing our legal duties and privacy practices.
  • Follow the terms of the Notice that is currently in effect.
  • Notify you if a breach occurs that may have compromised the privacy or security of your information, as required by law.

We may change the terms of this Notice at any time. Any changes will apply to all PHI we maintain. The updated Notice will be posted at our facility and on our website,
and you may request a paper copy at any time.

Your Rights Regarding Your Health Information

You have certain rights regarding your health information. These rights may be subject to limitations under HIPAA, Part 2, and applicable state laws.
To exercise any of these rights, please contact our Privacy Officer using the information in the Contact Us section below.

1. Right to Inspect and Obtain a Copy

You have the right to inspect and receive a copy of certain health information we maintain about you, including records related to your care and billing.
We may charge a reasonable fee for copies and mailing, as permitted by law.

In limited circumstances, we may deny your request (for example, if access is reasonably likely to endanger your life or the life or physical safety of another person).
If we deny your request, we will explain the reason in writing and, in some cases, you may have the right to have the denial reviewed by another healthcare professional.

2. Right to Request an Amendment

If you believe that health information we have about you is incorrect or incomplete, you have the right to request that we amend your record.
We may deny your request if we believe the information is accurate and complete, was not created by us, or is not part of the information we maintain.

If we deny your request, we will explain the reason in writing. You may submit a written statement of disagreement, which we will include in your record.

3. Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures” – a list of certain disclosures of your PHI we have made in the past (typically up to six years),
excluding disclosures for treatment, payment, healthcare operations, and certain other disclosures (such as those you asked us to make or those made with your written authorization).

If applicable, Part 2 may limit disclosures of substance use disorder treatment records, and additional restrictions may apply.

4. Right to Request Restrictions

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations.
We are not required to agree to such restrictions, except in certain cases where you have paid out-of-pocket in full for a service and you request that we not
disclose information about that service to your health plan for payment or healthcare operations.

If we agree to a restriction, we will comply with it except in an emergency or where the law requires otherwise.

5. Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a certain way (for example, at a specific address or phone number)
or that we contact you only at work or through mail. We will accommodate reasonable requests when possible.

6. Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.

7. Right to Revoke Authorization

If you have signed a written authorization permitting us to use or disclose your PHI for a specific purpose, you may revoke that authorization at any time in writing.
Your revocation will not affect actions we have already taken in reliance on your authorization.

How We May Use and Disclose Your Health Information

HIPAA and, where applicable, Part 2 permit us to use and disclose your PHI in certain ways. In some cases, we may use or disclose your information
without your written authorization; in other cases, we will obtain your written authorization before using or disclosing your information.

Note: For records protected under 42 C.F.R. Part 2 (substance use disorder treatment records), we are generally required to obtain your written authorization
before disclosing your information, except in specific circumstances allowed by Part 2 (e.g., medical emergencies, audits, court orders that meet Part 2 requirements).

1. Uses and Disclosures for Treatment, Payment, and Healthcare Operations (HIPAA)

Under HIPAA, we may use and disclose your PHI as follows, subject to any additional restrictions under Part 2 and state law:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services.
For example, we may share information with doctors, nurses, therapists, case managers, or other providers involved in your care.

Payment

We may use and disclose your PHI to obtain payment for services we provide to you.
For example, we may share information with your health plan, Medicaid, or other payers to determine coverage, obtain prior authorizations, or process claims.

Healthcare Operations

We may use and disclose your PHI for healthcare operations, such as quality assessment and improvement activities, staff training, licensing, accreditation,
legal and auditing functions, and business management.

When possible, we will use or disclose only the minimum necessary information required to accomplish the intended purpose, as required by law.

2. Additional Uses and Disclosures Permitted or Required by Law

Subject to any stricter requirements under Part 2 and state law, we may also use or disclose your PHI in the following circumstances:

  • As required by law: We may disclose your PHI when required to do so by federal, state, or local law.
  • Public health activities: To public health authorities for purposes such as reporting certain diseases, injuries, or adverse events.
  • Health oversight activities: To health oversight agencies for activities authorized by law, such as audits, inspections, or investigations.
  • To avert a serious threat: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with the law.
  • Judicial and administrative proceedings: In response to a court or administrative order, or in certain circumstances in response to a subpoena, discovery request, or other lawful process, subject to HIPAA and Part 2 requirements.
  • Law enforcement: In limited circumstances and as permitted by law, such as to report certain types of injuries or to comply with court orders. Part 2 may impose stricter restrictions for substance use treatment records.
  • Coroners, medical examiners, and funeral directors: To these professionals as necessary to carry out their duties.
  • Organ and tissue donation: To organizations involved in organ, eye, or tissue procurement, if applicable.
  • Workers’ compensation: As authorized by and to the extent necessary to comply with workers’ compensation or similar programs.

3. Uses and Disclosures Requiring Your Written Authorization

In most cases, we will obtain your written authorization before using or disclosing your PHI for purposes such as:

  • Marketing communications (except for certain limited face-to-face communications or nominal gifts).
  • Sale of your PHI.
  • Most uses and disclosures of substance use disorder treatment records protected under Part 2.
  • Most uses and disclosures of psychotherapy notes (if applicable).

You may revoke your authorization at any time in writing, except to the extent we have already acted in reliance on it.

Substance Use Disorder Treatment Records (42 C.F.R. Part 2)

If you receive substance use disorder diagnosis, treatment, or referral for treatment at Detox & Recovery, certain information about your care may be subject to
additional protections under the federal confidentiality regulations at 42 C.F.R. Part 2 (“Part 2”).

Under Part 2:

  • We generally may not disclose information that identifies you as having a substance use disorder or as a patient of a substance use disorder program without your written consent, except in specific circumstances allowed by Part 2 (for example, certain medical emergencies, audits, or court orders that meet Part 2 requirements).
  • We may not use or disclose Part 2-protected records in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order that complies with Part 2.

HIPAA and Part 2 work together to protect your privacy. Where Part 2 is more protective than HIPAA, we will follow Part 2.

Privacy and Security of Electronic Communications

If you choose to communicate with us by email, web form, text message, or other electronic means, please be aware that such communications may not always be fully secure.
We will take reasonable precautions to protect your information, but we cannot guarantee that electronic communications will be free from interception or unauthorized access.

Please avoid including highly sensitive information in unencrypted emails or general website forms.
If we need to exchange sensitive information, we may offer a secure portal or other secure methods.

Questions, Concerns, or Complaints

Contacting Us

If you have questions about this Notice or our privacy practices, or if you wish to exercise your rights regarding your PHI, please contact:

Detox & Recovery
Attn: Privacy Officer
Email: [email protected]

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information above. You may also file a complaint with:

  • The U.S. Department of Health and Human Services, Office for Civil Rights (OCR). Instructions for filing a complaint are available at
    https://www.hhs.gov/ocr/privacy/hipaa/complaints/.
  • In certain cases, if Part 2 applies, you may also raise concerns with the Substance Abuse and Mental Health Services Administration (SAMHSA) or other appropriate agencies.

We will not retaliate against you for filing a complaint or exercising your rights related to your privacy.