HIPAA Privacy Policy

Introduction

Valley Spring Recovery Center ("we," "us," or "our") is committed to protecting the privacy of your protected health information (PHI) as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and 42 CFR Part 2, which governs the confidentiality of substance use disorder patient records.

This Notice of Privacy Practices describes how medical information about you may be used and disclosed, and how you can access this information. As a CARF-accredited outpatient treatment facility, we hold ourselves to the highest standards of patient privacy and data security.

We are required by law to maintain the privacy of your PHI, to provide you with this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

Protected Health Information We Collect

In the course of providing you with addiction treatment and mental health services, we may collect and maintain the following types of protected health information:

• Demographic information — name, date of birth, address, phone number, email, emergency contacts, and insurance information
• Medical history — past and current medical conditions, medications, allergies, prior treatment episodes, and family medical history
• Treatment records — assessments, treatment plans, progress notes, group therapy attendance, medication-assisted treatment records, and discharge summaries
• Substance use information — substance use history, drug screening results, and related clinical documentation
• Mental health records — psychiatric evaluations, psychological assessments, and therapy session notes
• Insurance and billing data — insurance claims, billing records, payment history, and prior authorization documentation
• Communication records — correspondence with you, your family (with consent), other providers, and insurers

How We Use and Disclose Your PHI

We may use and disclose your protected health information for the following purposes without your written authorization:

• Treatment — To coordinate and manage your healthcare, including sharing information among members of your treatment team (therapists, counselors, medical staff, psychiatrists) to provide integrated care across our Partial Care, IOP, and outpatient programs
• Payment — To bill and collect payment for the services we provide, including submitting claims to your insurance company, verifying coverage, and processing prior authorizations
• Healthcare operations — To support our internal operations including quality improvement, clinical audits, staff training, CARF accreditation compliance, and business management
• Required by law — When required by federal, state, or local law, including reporting suspected child abuse or neglect, and responding to court orders
• Public health activities — To report disease, injury, vital events, and to conduct public health surveillance, investigations, or interventions as required by law
• Health and safety — To prevent or lessen a serious and imminent threat to the health or safety of a person or the public

Special protections for substance use disorder records: Under 42 CFR Part 2, information about your substance use disorder treatment is subject to additional federal protections. We cannot disclose this information without your specific written consent, except in limited circumstances permitted by law (medical emergencies, qualified audits, court orders with specific requirements, research, or reporting of suspected child abuse or neglect).

For all other uses and disclosures not described in this notice, we will ask for your written authorization before using or sharing your PHI. You may revoke any authorization at any time in writing, except to the extent we have already acted in reliance upon it.

Your Rights Regarding Your PHI

Under HIPAA, you have the following rights concerning your protected health information:

• Right to access — You have the right to inspect and obtain a copy of your PHI maintained in our records. We may charge a reasonable, cost-based fee for copies. Requests must be made in writing.
• Right to amend — You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny the request under certain circumstances, and will explain the reason in writing.
• Right to an accounting of disclosures — You have the right to request a list of certain disclosures we have made of your PHI for purposes other than treatment, payment, healthcare operations, and certain other activities, for the prior six years.
• Right to request restrictions — You may request that we limit how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree, except in cases where you pay for a service entirely out-of-pocket and request restriction of disclosure to a health plan.
• Right to request confidential communications — You may request that we contact you in a specific way or at a specific location (for example, only at a certain phone number or by mail to a P.O. box).
• Right to a paper copy — You have the right to obtain a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.
• Right to file a complaint — If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Our Responsibilities

Valley Spring Recovery Center is required to:

• Maintain the privacy of your protected health information and substance use disorder records
• Provide you with this notice describing our privacy practices, legal duties, and your rights regarding your PHI
• Follow the terms of this notice currently in effect
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI, as required by the HITECH Act
• Obtain your written consent before using or disclosing your PHI for purposes not covered by this notice or permitted by law
• Train all staff and workforce members on HIPAA compliance and patient privacy requirements
• Maintain appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of electronic PHI

We will not use or disclose your PHI without your authorization except as described in this notice. We reserve the right to change this notice and to make the revised notice effective for PHI we already have about you as well as any information we receive in the future.

Contact Information

If you have questions about this notice, wish to exercise any of your rights, or want to file a complaint about our privacy practices, please contact our Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by visiting www.hhs.gov/ocr/privacy/hipaa/complaints or calling 1-877-696-6775.

Effective Date and Updates

This Notice of Privacy Practices is effective as of January 1, 2026. We reserve the right to change the terms of this notice at any time. Any changes will apply to all PHI we maintain, including information created or received prior to the date of the revision.

If we make a material change to this notice, we will post the revised version on our website and make paper copies available at our facility upon request. The effective date of the most recent revision will be noted at the top of the notice.

We encourage you to review this notice periodically to stay informed about how we protect your health information.