Notice of Privacy Practices (NPP)

Your Rights

You have the right to:

• Access and obtain a copy of your health records, including Substance Use Disorder (SUD) treatment records and mental health records. If you request a copy of your medical record, your first copy is free. We may charge a fee for additional copies.
• Request corrections to your health records.
• Receive a list of certain disclosures we have made of your health information.
• Request restrictions on certain uses and disclosures of your health information.
• Request confidential communications.
• File a complaint if you believe your privacy rights have been violated.
• Be protected from retaliation for exercising any of these rights.

Correcting or Amending Your Health Information

If you believe that your health information is incorrect or incomplete, you have the right to request an amendment to your record. Your request must be in writing and include a reason for the requested change. We may deny your request if the information was not created by us, is not part of the health information kept by our organization, or if we determine the existing information is accurate and complete. If we deny your request, you have the right to submit a statement of disagreement, which will be included in your record.

Your Choices

You have some choices regarding how we use and disclose your health information. For example, you can:

• Request that we limit what we disclose to family members or others involved in your care.
• Ask us not to share certain health information for treatment, payment, or healthcare operations.

Our Uses and Disclosures

We are permitted or required to use and disclose your health information without your authorization in the following circumstances. Note: if your health information contains substance use disorder (SUD) information, it may be subject to special protections (as detailed below in the section titled “Special Protections for SUD Treatment Records”):

For Treatment: To coordinate your care with other healthcare providers, including business associates involved in your treatment.

For Payment: To bill and receive payment for the services you receive.

For Healthcare Operations: To evaluate and improve our services.

As Required by Law: To comply with legal obligations, including Kentucky state law, as well as federal law

For Public Health Activities: To report public health information as required or permitted by Kentucky state law or federal law.

For Law Enforcement Purposes: To comply with valid court order, administrative subpoena, or as otherwise required by Kentucky state law or federal law.

To Avert a Serious Threat: To prevent a serious threat to your health and safety or the safety of others.

For Business Associates and Qualified Services Organizations: We may share your health information with third-party business associates who perform healthcare-related functions on our behalf, ensuring they also comply with federal law via HIPAA and 42 CFR Part 2 protections.

Special Protections for Substance Use Disorder (SUD) Records

Your SUD treatment records are protected under federal law (42 CFR Part 2). You may provide a single consent for all future uses or disclosures of your health information for treatment, payment, and health care operations purposes. If you provide us with such consent, we may use and disclose your health information records for treatment, payment, and health care operations as permitted by the HIPAA regulations, until the consent expires or is revoked in writing. Additionally, we may use and disclose your SUD treatment records for other purposes with your written consent.

The following list provides some examples of how we may potentially use and disclose your SUD treatment records without your written consent:

• In response to a valid court order.
• To report crimes on the premises of the treatment program or against program personnel.
• To medical personnel in a medical emergency.
• To conduct certain audit and evaluation activities.
• To exchange among New Vista personnel for activities such as diagnosis, treatment, or referral.

Redisclosure Permissions: SUD records that are disclosed to a program covered by 42 C.F.R. Part 2, a HIPAA covered entity, or a business associate pursuant to a patient’s written consent for treatment, payment, and health care operations may be further disclosed by that Part 2 program, covered entity, or business associate, without the patient’s written consent, to the extent the HIPAA regulations permit such disclosure. Note that, in certain circumstances, the information disclosed may be subject to redisclosure by the recipient and may no longer be protected by federal law.

Psychotherapist-Patient Privilege: Communications between you and your psychotherapist are privileged under Kentucky law and cannot be disclosed in legal proceedings without your consent, except under specific circumstances outlined by law (KRS Rule of Evidence 507).

State-Specific Confidentiality Protections

In addition to federal law/regulations, Kentucky law provides enhanced confidentiality protections for your mental health records. We will not disclose your records without your consent, except as permitted or required by Kentucky law. Additionally, disclosures for emergency mental health services must comply with Kentucky statutes regarding hospitalization and crisis intervention.

Breach Notification

We are required to notify you in the event of a breach of your unsecured health information, including SUD records, in accordance with HIPAA and 42 CFR Part 2.