Notice of Privacy Practices (NPP)

Your Rights

You have the right to:

• Access and obtain a copy of your health records, including Substance Use Disorder (SUD) treatment records and mental health records. If you request a copy of your medical record, your first copy is free. We may charge a fee for additional copies.
• Request corrections to your health records.
• Receive a list of certain disclosures we have made of your health information.
• Request restrictions on certain uses and disclosures of your health information.
• Request confidential communications.
• File a complaint if you believe your privacy rights have been violated.
• Be protected from retaliation for exercising any of these rights.

Correcting or Amending Your Health Information

If you believe that your health information is incorrect or incomplete, you have the right to request an amendment to your record. Your request must be in writing and include a reason for the requested change. We may deny your request if the information was not created by us, is not part of the health information kept by our organization, or if we determine the existing information is accurate and complete. If we deny your request, you have the right to submit a statement of disagreement, which will be included in your record.

Your Choices

You have some choices regarding how we use and disclose your health information. For example, you can:

• Request that we limit what we disclose to family members or others involved in your care.
• Ask us not to share certain health information for treatment, payment, or healthcare operations.

Our Uses and Disclosures

We are permitted or required to use and disclose your health information without your authorization in the following circumstances:

For Treatment: To coordinate your care with other healthcare providers, including business associates involved in your treatment.

For Payment: To bill and receive payment for the services you receive.

For Healthcare Operations: To evaluate and improve our services.

As Required by Law: To comply with legal obligations, including Kentucky state laws and federal regulations.

For Public Health Activities: To report public health information as required by law.

For Law Enforcement Purposes: Only with your written consent, a valid court order, or as required by Kentucky law, particularly regarding SUD and mental health treatment records.

To Avert a Serious Threat: To prevent a serious threat to your health and safety or the safety of others.

For Business Associates: We may share your health information with third-party business associates who perform healthcare-related functions on our behalf, ensuring they also comply with HIPAA and 42 CFR Part 2 protections.

Special Protections for SUD and Mental Health Treatment Records

Your SUD and mental health treatment records are protected under federal law (42 CFR Part 2) and Kentucky state law. These records may only be disclosed as follows:

• With your written consent.
• For treatment, payment, and healthcare operations (TPO) as permitted under HIPAA, 42 CFR Part 2 (Final Rule 2024), and Kentucky law.
• In response to a valid court order.
• To report crimes on the premises of the treatment program or against program personnel.
• To medical personnel in a medical emergency.

Redisclosure Permissions: Recipients of your SUD treatment records may only redisclose this information in accordance with HIPAA regulations and the Final Rule of 42 CFR Part 2 (2024), ensuring continued privacy protections.

Psychotherapist-Patient Privilege: Communications between you and your psychotherapist are privileged under Kentucky law and cannot be disclosed in legal proceedings without your consent, except under specific circumstances outlined by law (KRS Rule of Evidence 507).

State-Specific Confidentiality Protections

In addition to federal regulations, Kentucky law provides enhanced confidentiality protections for your mental health records. We will not disclose your records without your consent, except as permitted or required by Kentucky law. Additionally, disclosures for emergency mental health services must comply with Kentucky statutes regarding hospitalization and crisis intervention.

Breach Notification

We are required to notify you in the event of a breach of your health information, including SUD and mental health treatment records, in accordance with HIPAA, 42 CFR Part 2, and Kentucky law requirements.