We are required by law to maintain the privacy and confidentiality of your PHI; provide you with this notice of our legal duties and privacy practices with respect to PHI; also, to notify you following a breach of unsecured PHI related to you. When we use or disclose this information, we are required to abide by the terms of this notice (or other notice in effect at the time of the use or disclosure). You may request a paper copy of this notice.
We reserve the right to change our privacy policy and practices and the terms of this Notice of Privacy Practices, consistent with applicable law and our current business processes, at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time. Notification of revisions of this Notice of Privacy Practices will be provided as follows:
We have a duty to respond to your requests (e.g., those corresponding to your rights) in a timely and appropriate manner. We support and value your right to privacy and are committed to maintaining reasonable and appropriate safeguards for your PHI.
42 CFR Part 2 protects your health information if you are applying for or receiving services (including diagnosis or treatment, or referral) for substance use disorder.
The confidentiality of alcohol and drug abuse patient records maintained by us is protected by Federal law and regulations. Generally, we may not say to a person outside the treatment center that you are a patient of the treatment center, or disclose any information identifying you as an alcohol or drug abuser unless:
Violation of the Federal law and regulations by the treatment center is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.
Federal law and regulations do not protect any information about a crime committed by you either at the treatment center or against any person who works for the treatment center or about any threat to commit such a crime (as discussed below in “Uses and Disclosures”).
Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities (as discussed below in “Uses and Disclosures”).
We may use or disclose your PHI for the purposes of health care operations that include internal administration, planning, and various activities that improve your client experience, quality, and effectiveness of care.
We are required to disclose PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy Rules.
Other allowable uses and disclosures without your authorization, aside from treatment and health care operations, include:
Appointments Contacting you with reminders for future appointments of your treatment.
Emergency Situations We may disclose your PHI to medical personnel. Incompetent and/or Deceased Patients. In such cases, authorization of a personal representative, guardian or other person authorized by applicable state law may be given in accordance with 42 CFR Part 2.
Reporting of Death We may disclose protected health information to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.
Court Order We may disclose your PHI in response to a court order that meets the requirements of federal regulations, 42 CFR Part 2 concerning Confidentiality of Substance Use Disorder Patient Records. Note also that if your records are not actually “patient records” within the meaning of 42 CFR Part 2 (e.g., if your records are created because of your participation in the family program or another non-treatment setting), your records may not be subject to the protections of 42 CFR Part 2.
Crimes on Premises We may disclose your PHI to the police or other law enforcement officials if you commit a crime on premises or against program personnel or threaten to commit such a crime.
Child Abuse We may disclose your PHI for the purpose of reporting child abuse, neglect, or prenatal exposure to controlled substances, including alcohol, to public health authorities or other government authorities authorized by law to receive such reports.
Threats Where the program learns that a patient has made a specific threat of serious physical harm to another specific person or the public, and disclosure is otherwise required under statute and/or common law, the program will carefully consider appropriate options that would permit disclosure.
We may disclose protected health information to those who perform audit or evaluation activities for certain health oversight agencies, e.g., state licensure or certification agencies, the Joint Commission on Accreditation of Healthcare Organizations, which oversees the health care system and ensures compliance with regulations and standards, or those providing financial assistance to the program.
Research We may use or disclose PHI without your consent or authorization if our research privacy board approves a waiver of authorization for disclosure.
Communications We may contact you with information about ThriveNow Recovery Centers ™ health-related services and products that may be beneficial to you. Such communications are a part of Health care operations, and examples of these communications are invitations to continuing care programs, alumni events and catalogs of recovery and self-help materials such as books, videos, and other items.
If you are not applying for or receiving services for substance use disorder, the rules governing the use and disclosure of PHI are different from and less restrictive than the rules governing information involving substance use disorder diagnosis, treatment, and referral.
The next section lists the additional allowable disclosures that may be made without your authorization if you are not applying for or receiving services for substance use disorder. (This list does NOT apply to those persons applying for or receiving services for substance use disorder):
Right to Receive Confidential Communications. Normally we will communicate with you through the phone number and /or address you provide. You may request, and we will accommodate, any reasonable, written request for you to receive your PHI by alternative means of communication or at alternative locations.
Right to Request Restrictions. At your request, we will not disclose health information to your health plan if the disclosure is for payment of a health care item or service for which you have paid ThriveNow Recovery Centers ™ out of pocket in full. You may request additional restrictions on our use and disclosure of PHI for treatment, payment, and health care operations. While we will consider requests for additional restrictions carefully, we are not required to agree to a requested restriction. If you wish to request additional restrictions and you are currently receiving services, please contact your counselor.
Once you are no longer receiving services, contact the Health Information Department in writing. We will send you a written response.
Right to Access, inspect, and copy. You may request access to your medical record maintained by us to inspect and request copies of the records. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records and you are currently receiving services, please ask your counselor for the records. Once you are no longer receiving services, contact the Health Information Department.
Right of request amendments. You have the right to request that we amend PHI maintained in your clinical file or billing records. If you desire to amend your records and you are currently receiving services, please contact your counselor. Once you are no longer receiving services, contact the Health Information Department. Under certain circumstances, ThriveNow Recovery Centers has the right to deny your request to amend your records and will notify you of this denial as provided in the HIPAA regulations. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend,” a record, we may append information to the original record, as opposed to physically removing or changing the original record. If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical record.
Upon request, you may obtain a list of instances that we have disclosed your PHI other than when you gave written authorization OR those related to your treatment and payment for services, or our health care operations. The accounting will apply only to covered disclosures prior to the date of your request provided such period does not exceed six years. If you request an accounting more than once during a twelve (12) month period, there will be a charge. You will be told the cost prior to the request being filled.
You will be notified in the event we discover a breach has occurred such that your PHI may have been compromised. A risk analysis will be conducted to determine the probability that PHI has been compromised. Notification will be made no more than 60 days after the discovery of the breach, unless it is determined by a law enforcement agency that the notification should be delayed.
Upon request, you may obtain a paper copy of this notice.
For Further Information and Complaints.
If you desire further information about your privacy and confidentiality rights, you may contact the ThriveNow Recovery Centers ™’s business development office at 515-824-5154. You may call this number if you are concerned that we have violated your privacy rights, if you disagree with a decision that we made about access to your PHI, or if you wish to complain about our breach notification process.
Right to Voice Concerns
You may also file a written complaint with the Secretary of the United States Department of Health and Human Services. Upon request, we will provide you with the correct address. We will not retaliate against you if you file a complaint.
Violation of federal law and regulations on Confidentiality of Substance Use Disorder Patient Records is a crime and suspected violations of 42 CFR Part 2 may be reported to the United States Attorney in the district where the violation occurs. Upon request, we will provide you with the appropriate agency contact information.
Effective Date. This notice is effective on October 17, 2024.
Right to Change Terms of This Notice. We may change the terms of this notice at any time. If we change this notice, we may make the new notice terms effective to all PHI that we maintain, including any information created or received prior to issuing the new notice. If we change this notice, we will post the new notice in public access areas at our service sites and on our Internet site at www.thrivenowrc.com You may also obtain any new notice by contacting the ThriveNow Recovery Centers ™ Privacy Office.