Privacy Practices

This notice describes how health information about you may be used and disclosed, your rights with respect to your health information, how you can get access to your health information, and how to file a complaint concerning a violation of the privacy or security of your health information or of your rights concerning your information. You have a right to a copy of this notice (in paper or electronic form) and to discuss it with THE PRIVACY OFFICER if you have any questions.  Please review it carefully.

Cedar Crest Hospital & Residential Treatment Center will be referred to in this Notice of Privacy Practices (“Notice”) as “Facility.” This Notice is given to you by Facility to describe the ways in which Facility may use and disclose your medical information (called “protected health information” or “PHI”) and to notify you of your rights with respect to PHI in the possession of Facility. Facility protects the privacy of PHI, which also is protected by applicable state and federal law.  In certain circumstances, pursuant to this Notice, patient authorization, or applicable laws and regulations, PHI can be used by Facility or disclosed to other parties.  Below are categories describing these uses and disclosures, along with some examples to help you better understand each category. This Notice does not apply to health information that is not subject to HIPAA or similar state health information privacy laws, or information used or shared in a manner that cannot identify you. You may have additional rights under applicable state law. If state law provides greater privacy protections or broader privacy rights with respect to PHI, we will abide by such more stringent laws.

USES AND DISCLOSURE FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

Facility may use or disclose your PHI for the purposes of treatment, payment and health care operations, described in more detail below, without obtaining written authorization from you.

For Treatment: Facility may use and disclose PHI in the course of providing, coordinating, or managing your medical treatment, including the disclosure of PHI for treatment activities at another healthcare facility. These types of uses and disclosures may take place between physicians, nurses, technicians, students, and other health care professionals who provide you health care services or are otherwise involved in your care. For example, if you are being treated by a primary care physician, that physician may need to use/disclose PHI to a specialist physician whom he or she consults regarding your condition, or to a nurse who is assisting in your care.

For Payment: Facility may use and disclose PHI in order to collect payment for the health care services provided to you.  For example, Facility may need to give PHI to your health plan in order to be reimbursed for the services provided to you or to determine whether anticipated services will be covered by your health plan. Facility may also disclose PHI to other health care providers and health plans for the payment activities of such providers or health plans.

For Health Care Operations: Facility may use and disclose PHI as part of their operations, including for quality assessment and improvement, such as evaluating the treatment and services you receive and the performance of our staff in caring for you. We may share your health information for case management and care coordination purposes. Other activities include, but are not limited to, hospital training, underwriting activities, compliance and risk management activities, planning and development, and management and administration. Facility may disclose PHI to doctors, nurses, technicians, students, attorneys, consultants, accountants, and others for review and learning purposes.  These disclosures help make sure that Facility is complying with all applicable laws, and are continuing to provide health care to patients at a high level of quality.  Facility may also disclose PHI to other health care facilities plans for certain aspects of their operations, including their quality assessment and improvement activities, credentialing and peer review activities, and health care fraud and abuse detection or compliance, provided that those other facilities and plans have, or have had in the past, a relationship with the patient who is the subject of the information.

For Sharing PHI Among Facility and Professional Staff: Facility works together with physicians and other care providers on their professional staff to provide medical services to you when you are a patient at Facility.  Facility and members of their respective professional staff will share PHI with each other as needed to perform their treatment, payment and health care operations activities. If a provider provides you with services through their own private practice, they will use and disclose PHI pursuant to their own notice of privacy practice, which you should review. We may disclose your PHI to other health care providers, health care clearinghouses, or health plans in connection with their treatment, payment, or health care operations as permitted by law.

For Purposes of Health Information Networks or Exchanges: Facility may participate in certain health information networks or exchanges (“HIEs”) to facilitate the secure exchange of your PHI electronically between health care providers and healthcare entities for your treatment, payment, or other health care operations purposes.  This means that we may share information we obtain or create about you with outside entities (such as hospitals, doctor’s offices, and pharmacies) or we may receive information they create or obtain about you so that each of us can provide better treatment and coordinate your health care services. This type of sharing includes information exchanged with Surescripts, a national database of medication histories and prescriptions. You are automatically opted in to such HIEs. If you wish to opt out, please contact us. If you opt out of participating in these HIEs, your health information will no longer be provided through the exchange. However, your decision does not affect the information that was exchanged prior to the time you opted out of participation.

OTHER USES AND DISCLOSURES FOR WHICH AUTHORIZATION IS NOT REQUIRED

In addition to using or disclosing PHI for treatment, payment and health care operations, Facility may use and disclose PHI without your written authorization under the following circumstances as permitted or required by applicable law. However, laws governing sensitive information (including behavioral health information, substance use disorder information, and HIV status) may limit these disclosures.

As Required by Law and Law Enforcement: Facility may use or disclose PHI when required by law. Facility also may disclose PHI when ordered to in a judicial or administrative proceeding, in response to subpoenas or discovery requests, to identify or locate a suspect, fugitive, material witness, or missing person, when dealing with gunshot and other wounds, about criminal conduct, to report a crime, its location or victims, or the identify, description or location of a person who committed a crime, or for other law enforcement purposes.

For Public Health Activities and Public Health Risks: Facility may, consistent with applicable law, disclose PHI to government officials in charge of collecting information about births and deaths; preventing and controlling disease; reports of child abuse or neglect and of other victims of abuse, neglect, or domestic violence; reactions to medications or product defects or problems; or to notify a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.

For Health Oversight Activities: Facility may disclose PHI to the government for oversight activities authorized by law, such as audits, investigations, inspections, licensure or disciplinary actions, and other proceedings, actions or activities necessary for monitoring the health care system, government programs, and compliance with civil rights laws.

Corners, Medical Examiners, and Funeral Directors: Facility may disclose PHI to coroners, medical examiners, and funeral directors for the purpose of identifying a decedent, determining a cause of death, or otherwise as necessary to enable these parties to carry out their duties consistent with applicable law.

Organ, Eye, and Tissue Donation: Facility may release PHI to organ procurement organizations to facilitate organ, eye, and tissue donation and transplantation.

Research: Under certain circumstances, Facility may use and disclose PHI for research purposes. Generally, this would be pursuant to your written permission; however, in certain circumstances, we may be permitted to use or disclose PHI for research purposes without your permission.  Additionally, we may share your PHI with a Business Associate who will remove information that identifies you, so that the remaining information can be used for research.

To Avoid a Serious Threat to Health or Safety: Facility may use and disclose PHI to law enforcement personnel or other appropriate persons, to prevent or lessen a serious threat to the health or safety of a person or the public. In certain circumstance, state law may require such disclosure.

Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, Facility may disclose health information about you in response to a court or administrative order.

Specialized Government Functions: Facility may use and disclose PHI of military personnel and veterans under certain circumstances, and may also disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities, and for the provision of protective services to the President or other authorized persons or foreign heads of state or to conduct special investigations. If you are an inmate at a correctional institution, then under certain circumstances we may disclose your PHI to the correctional institution or law enforcement official. This may be necessary 1) for the institution to provide you with health care; 2) to protect your health and safety or the health and safety of others; or 3) for the safety and security of the correctional institution and its staff.

Workers’ Compensation: Facility may disclose PHI to comply with workers’ compensation or other similar laws that provide benefits for work-related injuries or illnesses.

De-Identified PHI: Facility may de-identify your health information as permitted by law. Facility may use or disclose to others the de-identified information for any purpose, without your further authorization or consent, including but not limited to research studies and healthcare operations improvement activities.

Business Associates: Facility may share PHI with certain of its vendors and contractors who need such PHI to perform their functions or services for or on behalf of Facility. These vendors and contractors are known as “business associates.” To protect your PHI, Facility requires that business associates agree in writing to appropriately safeguard your PHI and only use and disclose it for certain permissible purposes in accordance with applicable law.

Reminders: Facility may use or disclose your protected health information to contact you and remind you of important services or scheduled appointments. We may contact you by mail, e-mail, or telephone. We may use the telephone number(s) you provide us to leave voice messages or send text messages.

Health-Related Benefits and Services; Limited Marketing: Facility may use and disclose PHI to inform you of treatment alternatives or other health-related benefits and services that may be of interest to you, such as disease management programs.

Disclosures for HIPAA Compliance Investigations: Facility must disclose your PHI to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) when requested by the Secretary in order to investigate compliance with privacy regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

USES AND DISCLOSURE TO WHICH YOU MAY OBJECT

You may object to the following uses and disclosures of PHI that Facility may make:

Communication with Family and/or Individuals Involved in Your Care or Payment of Your Care: Unless you object, disclosures of your protected health information may be made to a family member, friend, or other individual, whom you have identified that is involved in your care or payment of your care. We may share your PHI with these persons if you are present or available before we share your PHI with them and you do not object to our sharing your PHI with them, or we reasonably believe that you would not object to this. If you are not present and certain circumstances indicate to us that it would be in your best interest to do so, we will share information with a friend or family member or someone else identified by you, to the extent necessary. This could include sharing information with your family or friend so that they could pick up prescriptions or medical supply. We may tell your family or friends that you are in our Facility and about your general condition.

Patient Directories: Your information may be included in a patient directory that is disclosed only to those individuals whom you have identified as contacts during your hospital stay. You will receive a unique patient code that can be provided to these contacts. If you would like to opt out of being in the patient directory, please inform the Facility staff.

Disaster Relief: Facility may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Fundraising: We may use or disclose your PHI to contact you for fundraising purposes. For example, you may receive a letter asking for a donation to support enhanced patient care, treatment, education or research. However, you have the right to opt-out of receiving such fundraising communications and any fundraising materials you receive will describe the opt-out process. If you opt-out, we will not contact you for further fundraising purposes unless you opt back in.

OTHER USES AND DISCLOSURE OF PHI FOR WHICH AUTHORIZATION IS REQUIRED

Other types of uses and disclosures of your PHI not described above will be made only with your written authorization/consent, which you have the right to revoke in writing. However, revocation does not apply to PHI or Part 2 Records that has already been used or disclosed with your permission. In addition, we are required to obtain your specific authorization/consent for the following purposes: (i) most uses and disclosures of psychotherapy notes; (ii) use and disclosure of PHI which result in our receiving financial payment from a third party whose product or services is being marketed (except compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you); or (iii) disclosures that constitute a sale of PHI.

Use and Disclosure of Reproductive Health Records:  Federal law recognizes and protects the confidentiality of comprehensive reproductive health care services, including abortion care, and places additional restrictions on the use or disclosure of PHI related to reproductive health care. Reproductive health care is defined as health care that affects the health of an individual in all matters related to the reproductive system and to its functions and processes. This includes, but is not limited to, contraception, including emergency contraception; preconception screening and counseling; management of pregnancy and pregnancy-related conditions, including pregnancy screening, prenatal care, miscarriage management, treatment for preeclampsia, hypertension during pregnancy, gestational diabetes, molar or ectopic pregnancy, and pregnancy termination; fertility and infertility diagnosis and treatment, including assisted reproductive technology and its components (e.g., in vitro fertilization (IVF)); diagnosis and treatment of conditions that affect the reproductive system (e.g., perimenopause, menopause, endometriosis, adenomyosis); and other types of care, services, and supplies used for the diagnosis and treatment of conditions related to the reproductive system (e.g., mammography, pregnancy-related nutrition services, postpartum care products). Facility is prohibited from using or disclosing any PHI potentially related to reproductive health care for the following activities: (i) to conduct criminal, civil or administrative investigation into a person for the mere act of seeking, obtaining, providing or facilitating reproductive health care, (ii) to impose criminal, civil or administrative penalties for the mere act of seeking, obtaining, providing or facilitating reproductive health care, or (iii) to identify a person for either of these purposes. Seeking, obtaining, providing, or facilitating reproductive health care includes, but is not limited to, any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same. Outside of these activities, Facility may continue to use and disclose PHI related to reproductive health care for all other purposes described in this Notice.

The prohibition on use and disclosure of reproductive health care information only applies where the relevant activity is in connection with a person seeking, obtaining, providing, or facilitating reproductive health care, and Facility has reasonably determined either that:

• The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided. For example, if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided.
• The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided. For example, if use of the reproductive health care, such as contraception, is protected by the Constitution.

Where the reproductive health care is provided by someone other than Facility, Facility may presume it is lawful unless either of the following is true:

• Facility has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided. For example, an individual discloses to their doctor that they obtained reproductive health care from an unlicensed person and the doctor knows that the specific reproductive health care must be provided by a licensed health care provider.
• The requestor provides factual information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided. For example, a law enforcement official provides a health plan with evidence that the information being requested is reproductive health care that was provided by an unlicensed person where the law requires that such health care be provided by a licensed health care provider.

When Facility receives a request for PHI potentially related to reproductive health care for purposes of health oversight activities, judicial and administrative proceedings, law enforcement purposes or regarding decedents, as described above, Facility will obtain a valid, signed attestation from the requestor that the use or disclosure is not for a prohibited purpose, as provided in this section.  For example, if Facility receives a subpoena from an attorney for medical records related to a civil lawsuit to which the patient is a party, it would obtain such an attestation from the attorney before providing the records. Facility is only permitted to disclose reproductive health information for law enforcement purposes where the disclosure is not subject to the prohibition above, the disclosure is required by law, and the disclosure meets all applicable conditions of HIPAA’s permission to use or disclose PHI as required by law.

Use and Disclosure of Substance Use Disorder Records Subject to Part 2: Federal law protects the confidentiality of substance use disorder patient records and places additional restrictions on the use or disclosure of such health information. A substance use disorder is a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance (such as drugs or alcohol, but not including tobacco or caffeine) despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. To the extent Facility offers a program covered by such laws, it complies with the federal Confidentiality of Substance Use Disorder Patient Records laws and regulations that protect information regarding substance use disorder diagnosis, treatment and referral for treatment. See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations (“Part 2”). Additionally, if Facility receives records containing information regarding substance use disorders, these records may also be protected by Part 2. Where Part 2 is applicable, Facility will not disclose your substance use disorder records, that you are enrolled in a Part 2 program, or any other information that would identify you as having or having had a substance use disorder to any other program (collectively “Part 2 Records”) except in compliance with this Section.

We will obtain your written consent to use and disclose your Part 2 Records unless we are permitted to use and disclose Part 2 Records without your written consent consistent with Part 2. The following categories describe the ways that we may use and disclose your Part 2 Records without your written consent under Part 2.

• Medical Emergencies. We may disclose your Part 2 Records to medical personnel to the extent necessary to meet a bona fide medical emergency in which your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. Facility will obtain your authorization prior to disclosing your information for non-emergency treatment. Facility may also disclose your Part 2 Records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your Part 2 Records will be used for the exclusive purpose of notifying you or your physicians of potential danger.
• Scientific Research. Under certain circumstances, Facility may use and disclose your Part 2 Records without your consent for research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your Part 2 Records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.
• Management and Financial Audits and Program Evaluation. Under certain circumstances we may use or disclose your Part 2 Records for purposes of the performance of certain program financial and management audits and evaluations. For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program. We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.
• Public Health. We may use or disclose to a public health authority your Part 2 Records for public health purposes. However, the contents of the information from the Part 2 Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.
• Fundraising. Consistent with provisions elsewhere in this Notice, we may also use or disclose your Part 2 Records for fundraising purposes.

Uses and Disclosures with the Patient Consent. We may use and disclose your records when you give your consent that specifically meets the requirements of the Part 2.

• Designated person or entities. We may use and disclose your Part 2 Records in accordance with the consent to any person or category of persons identified or generally designated in the consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.
• Single Consent for Treatment, Payment or Healthcare Operations. We may also use and disclose your Part 2 Records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.
• Central Registry or Withdrawal Management Program. We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For instance, if you consent to participating in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.
• Criminal Justice System. We may disclose information from your Part 2 Records to those persons within the criminal justice system who have made your participation in the Part 2 program a condition of the disposition of any criminal proceeding against you. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.
• PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law. We will first obtain your consent to a disclosure of Part 2 Records to a prescription drug monitoring program prior to reporting of such information.

Other Uses and Disclosures.

• Any Part 2 Record, or testimony relaying the content of such Part 2 Records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent), or a court issues an appropriate order. Your Part 2 Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, the Facility or other holder of the Part 2 Record in accordance with Part 2. A court order authorizing use or disclosure of Part 2 Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Records may be used or disclosed.
• Part 2 does not protect information about a crime committed on Facility’s premises or against any Facility personnel or about any threat to commit such crime. Part 2 also does not prohibit the disclosure of information by Facility to report suspected child abuse or neglect under state law to appropriate state or local authorities. The restrictions on use and disclosure in Part 2 do not apply to communications of Part 2 Records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within the program (or with an entity that has direct administrative control over the program the communications between a part 2 program) and to communications of Part 2 Records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of Facility (similar to provisions herein regarding Business Associates). To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.
• Please note that if Part 2 Records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

REGULATORY REQUIREMENTS

Facility is required by law to maintain the privacy of your PHI, to provide individuals with notice of Facility’s legal duties and privacy practices with respect to PHI, and to abide by the terms described in this Notice.  You have the following rights regarding your PHI and your Part 2 Records.

You may request the Facility restrict the use and disclosure of your PHI. Facility is not required to agree to any restrictions you request, but if the Facility does so it will be bound by the restrictions to which it agrees except in emergency situations. We are required and will agree to a request that we not disclose PHI about certain health care items and/or services to your health plan for purposes of payment or health care operations where you obtained those items and/or services from us and paid for those items and/or services in full and out-of-pocket. Your request must be in writing and sent to the Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply.

You have the right to request that communications of PHI to you from Facility be made by particular means or at particular locations. For instance, you might request that communications be made at your work address, or by e-mail rather than regular mail. Your requests must be in writing and sent to the Privacy Officer. Facility will accommodate your reasonable requests without requiring you to provide a reason.

Generally, you have the right to inspect and obtain a copy your PHI maintained in a designated record set by Facility if you make a request in writing to the Facility’s Medical Records Department. A “designated record set” is a group of records maintained by or for Facility which includes medical records, case management records, billing records, and records used in whole or in part to make decisions about you, but does not include psychotherapy notes or information gathered or prepared for a civil, criminal, or administrative proceeding. We are also not required to provide access or copies of PHI that is subject to laws that prohibit access. You have this right to inspect and obtain such records, for so long as the PHI is maintained in a designated record set. Within thirty (30) days of receiving your request (unless extended by an additional thirty (30) days), Facility will inform you of the extent to which your request has or has not been granted.  In some cases, Facility may provide you a summary of the PHI you request if you agree in advance to such a summary and any associated fees.  If you request copies of your PHI or agree to a summary of your PHI, Facility may impose a reasonable cost-based fee to cover copying, postage, and related costs. If you request an electronic copy of your PHI that Facility maintains electronically, Facility will, to the extent required by law, provide an electronic copy, and will do so in the electronic form or format you requested if the PHI is readily producible in that form or format. If Facility denies access to your PHI, it will explain the basis for denial and your opportunity to have the denial reviewed by a licensed health care professional (not involved in the initial denial decision) designated as a reviewing official. If Facility does not maintain the PHI you request, if it knows where that PHI is located it will tell you how to redirect your request.

If you believe that your PHI in a designated record set maintained by Facility contains an error or needs to be updated, you have the right to request that the entity correct or supplement your PHI. Your request must be made in writing to the Facility Medical Records Department, and it must explain why you are requesting an amendment to your PHI.  Within sixty (60) days of receiving your request (unless extended by an additional thirty (30) days), Facility will inform you of the extent to which your request has or has not been granted.  Facility generally can deny your request if your request relates to PHI: (i) not created by Facility; (ii) that is not part of the designated record set maintained by the Facility ; (iii) that is not subject to being inspected by you; or (iv) that is accurate and complete.  If your request is denied, Facility will give you a written denial that explains the reason for the denial and your rights to: (i) file a statement disagreeing with the denial; (ii) submit a request that any future disclosures of the relevant PHI be made with a copy of your request and Facility’s denial attached, if you do not file a statement of disagreement; and (iii) complain about the denial.

You generally have the right to request and receive a list of disclosures of your PHI Facility has made during the six (6) years prior to your request. The list will not include certain exempt disclosures, such as those (i) for which you have provided a written authorization; (ii) for treatment, payment, and health care operations; (iii) made to you; (iv) for an Facility patient directory or to persons involved in your health care; (v) for national security or intelligence purposes; (vi) to correctional institutions or law enforcement officials; or (vii) of a limited data set.  You should submit any such request in writing to the Privacy Officer, and within sixty (60) days of receiving your request (unless extended by an additional thirty (30) days), Facility will respond to you regarding the status of your request.  The entity will provide the list to you at no charge, but if you make more than one request in a year you will be charged a reasonable, cost-based fee for each additional request. We will notify you of the fee and you may choose to withdraw or modify your request at that time before any costs are incurred. If you are requesting an accounting of disclosures of Part 2 Records made pursuant to your written consent in the 3 years prior to the date of the request (or a shorter time period chosen by you), we will provide such accounting consistent with these HIPAA requirements and Part 2. When regulations are effective requiring such accountings pursuant to HIPAA and Part 2, we will provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record and during only the 3 years prior to the date on which the accounting is requested.

You have the right to receive a paper copy of this Notice upon request even if you have agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please contact the Privacy Officer (Contact information below).

You have the right to receive Notice in the event of a breach of confidentiality, which will be provided to you in accordance with applicable law.

You have the right to request or authorize that certain electronic health information be transmitted to you or another person or organization through an application programming interface (“API”). APIs are computer coding mechanisms that permit two or more electronic computer applications or software programs to communicate with each other and share information. Facility is required by law to comply with requests regarding API transmissions, subject to certain exceptions. You understand that health information transmitted through an API at your request will no longer be under Facility’s protection and control; will no longer be subject to the protections and rights outlined in this Notice; and may no longer be subject to the same laws, regulations, policies or procedures regarding its confidentiality, security, privacy, use, or disclosure. You understand and agree that you make requests to Facility to transmit your information through an API at your own risk and you assume all liability for the consequences of such action taken by Facility at your direction. Facility cautions you to confirm any confidentiality, security, or privacy protections with respect to your transmitted information with the recipient of the information prior to submitting a request to Facility to transmit your information through an API.

You have the right to appoint a personal representative, such as a medical power of attorney, to act on your behalf and exercise these rights when you are unable to. Your personal representative may be authorized to exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action based on their request.

NOTICE OF REDISCLOSURE: PHI that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Law applicable to the recipient may limit their ability to use and disclose the PHI received, such as if they are another covered entity subject to HIPAA or a program or entity subject to Part 2.

CHANGES TO THIS NOTICE: Facility reserves the right to change the terms of this Notice and of its privacy policies, and to make the new terms applicable to all of the PHI it currently maintains and any PHI it receives in the future. Before Facility makes an important change to its privacy policies, it will promptly revise this Notice and post a new Notice in registration and admitting areas. We will also post a copy of the new notice on our website. The Notice will contain the effective date on the last page.

COMPLAINTS: You may file a HIPAA complaint to Facility if you believe your privacy rights with respect to your PHI have been violated by contacting Facility’s Privacy Officer and submitting a written complaint.  To reach the Facility for any reason associated with this Notice, please write or call:

Privacy Officer
Cedar Crest Hospital & Residential Treatment Center
3500 Interstate 35 Frontage Rd
Belton, TX 76513
(833) 613-0875

Facility will not penalize you or retaliate against you for filing a HIPAA complaint regarding their privacy practices.  You also have the right to file a complaint with the Secretary of the Department of Health and Human Services at 200 Independence Avenue, S.W., Washington, DC., or by calling 1-877-696-6775, or by visiting www.hhs.gov/ocr/privacy/hipaa/complaints/

Violation of the federal law and regulations regarding substance use disorder records by a Part 2 program is a crime. You may report suspected violations of Part 2 to the Secretary of the United States Department of Health and Human Services in the same manner as HIPAA violations are reported or to the Substance Abuse and Mental Health Services Administration (SAMHSA) at:

SAMHSA Center for Substance Abuse Treatment (CSAT)
5600 Fishers Lane
Rockville, MD 20857

If you have any questions about this Notice, please contact the Facility as listed above or the Facility’s Compliance Hotline: 1 (833) 854-7417 or acadia.ethicspoint.com.

Effective 9/23/13;  Revision Date 6/4/2025