Notice of Privacy Practices

We must protect the privacy and security of protected health information (“PHI”); provide this Notice; follow its current terms; and notify you after a breach of unsecured PHI as required by law. We comply with stricter federal or Arkansas confidentiality rules when applicable. We may change this Notice and apply revised terms to information we maintain. Updated notices will be available at the Clinic, on our website, and on request.

Treatment. We may use or share PHI to provide or coordinate healthcare, including with treating clinicians, laboratories, pharmacies, and referral providers.

Payment. We may use or share PHI to determine eligibility, verify insurance, submit claims, collect payment, or obtain coverage authorization from Medicare, Medicaid, or other payers.

Healthcare operations. We may use or share PHI for quality improvement, staff supervision, professional review, auditing, licensing, credentialing, compliance, and management of the Clinic.

Business associates. We may share PHI with contractors performing services for the Clinic under legally required privacy and security arrangements. These may include administrative management, billing, records and technology services, and Google Workspace used for Clinic-approved patient intake and verification.

Other permitted or required purposes. Subject to applicable restrictions, PHI may be disclosed when required by law; for public health, abuse or neglect reporting, health oversight, lawful judicial or administrative proceedings, law enforcement, coroner and medical-examiner functions, organ procurement, research permitted by law, workers’ compensation, specialized government functions, or to prevent a serious threat to health or safety. Applicable restrictions, including those governing behavioral-health and substance-use records, remain in force.

People involved in your care. Where permitted, we may share information relevant to your care or payment with family, friends, or persons involved in your care, consistent with your preferences and applicable law. We may make permitted disaster-relief disclosures.

Except when a legal exception applies, we will obtain written authorization for most uses and disclosures of psychotherapy notes, marketing uses requiring authorization, sales of PHI, and other uses or disclosures not permitted by law or this Notice. You may revoke an authorization in writing prospectively, except for actions already taken in reliance on it. If we use PHI for permitted fundraising, you will receive a clear opportunity to opt out.

Special federal confidentiality rules may apply to records created or maintained by a federally assisted Part 2 substance-use-disorder program and to protected Part 2 records received by the Clinic. We apply those protections where applicable. An ordinary reference to substance use in a general medical record does not by itself make the Clinic a Part 2 program.

Part 2 records may be used or disclosed for treatment, payment, and healthcare operations based on valid patient consent, and recipient covered entities and business associates may subsequently use or disclose those records as HIPAA permits, subject to the continuing Part 2 restrictions on their use in proceedings against the patient. Part 2 records or testimony concerning their contents generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific consent or the court-order and other legal process required by Part 2. A consent to such proceedings must be separate from a consent for other purposes. Additional protections may apply to separately maintained SUD counseling notes. If the Clinic itself operates a Part 2 program, the Clinic will provide the additional Part 2 patient notice and obtain consents required for that program.

Access. You may inspect or obtain paper or electronic copies of PHI in your designated record set, subject to narrow exceptions. We generally respond within 30 days and may take a permitted extension. Only legally permitted, reasonable cost-based fees will be charged.

Amendment. You may ask us to correct PHI you believe is incorrect or incomplete. If we deny a request as permitted by law, we will explain the basis and available disagreement rights. We generally act within 60 days, subject to a permitted extension.

Restrictions. You may ask us to restrict treatment, payment, or operations uses or disclosures. We are generally not required to agree, except that we generally must restrict disclosure to a health plan for payment or operations regarding an item or service paid for in full out of pocket if you request that restriction, unless law requires disclosure.

Confidential communications. You may request that we contact you in a particular way or at a different location. We will accommodate reasonable requests.

Accounting. You may request an accounting of certain disclosures during the preceding six years, subject to applicable exclusions and any special rules concerning Part 2 records. The first accounting in a 12-month period is generally free.

Paper notice. You may request a paper copy of this Notice at any time.

Personal representative. A person legally authorized to act for you may generally exercise your HIPAA rights, subject to applicable safeguards and law.

Choice regarding sharing. When law gives you a choice about disclosures to family, friends, or other caregivers, we will honor your direction and applicable exceptions.

Complaints. You may complain to us or to the HHS Office for Civil Rights without retaliation.

HHS Office for Civil Rights: https://www.hhs.gov/ocr/complaints/index.html

For sensitive record requests, call us for the designated secure submission method rather than including PHI in ordinary email.