Notice of Privacy Practices

This notice describes the privacy practices of [ENTITY LEGAL NAME] (doing business as Ambience Recovery Center), located at 5200 S W S Young Dr, Killeen, TX 76542, and applies to all of our workforce members, clinicians, staff, students, and volunteers, and to every level of care we provide at this facility.

We are required by law to maintain the privacy of your health information, to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach of your unsecured health information occurs.

Because we are a federally assisted substance use disorder treatment program, your records receive protection in addition to the protection HIPAA provides. Those additional protections come from 42 U.S.C. § 290dd-2 and its implementing regulations at 42 C.F.R. Part 2.

• We generally may not disclose records that identify you as someone who has sought or received substance use disorder treatment without your written consent, except in the narrowly limited circumstances described in Sections 4 and 5.
• We may not even acknowledge to an outside party — including a family member, an employer, or a caller asking for you by name — that you are or ever were a patient here, unless you have given us written permission or a specific exception applies.
• Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program, or about any threat to commit such a crime.
• Federal law and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.

Violation of these federal rules and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with federal regulations.

We use and disclose your health information to provide your care, to obtain payment for it, and to run our program. Examples:

• Treatment — your counselor, physician, nurse, and other members of your care team share information with each other, and with providers we coordinate with, to plan and deliver your treatment.
• Payment— we verify benefits, obtain authorization, and submit claims to your health plan so your care can be paid for.
• Health care operations — we use information for quality assessment, clinical supervision, staff training, licensing, accreditation, and business management.

Single consent for treatment, payment, and health care operations

Under the 2024 final rule implementing Section 3221 of the CARES Act, you may give one written consent that permits us to use and disclose your Part 2 records for all future treatment, payment, and health care operations, rather than signing a separate consent for each disclosure. If you give that consent, a recipient who is a HIPAA covered entity or business associate may then redisclose the information as permitted by the HIPAA Privacy Rule, with the exception described in Section 6 below.

You may revoke your consent at any time, in writing. Revocation takes effect when we receive it and does not undo disclosures we already made in reliance on it. Consenting is your choice; we will tell you what services, if any, are conditioned on a consent.

In the situations below we may use or disclose information without a separate written authorization, subject in each case to the stricter limits Part 2 places on substance use disorder records:

• Appointment and treatment reminders — sent in a way that does not reveal that you are a substance use disorder patient, using the contact method you have approved.
• Medical emergencies — to medical personnel treating a condition that poses an immediate threat to your health and requires immediate medical intervention. We document each such disclosure.
• Reports of suspected child abuse or neglect — as required by Texas law.
• Crimes on our premises or against our staff — to law enforcement, limited to the circumstances of the incident, the status of the person as a patient, and identifying details.
• Court orders — only under a court order that meets the specific findings and procedures required by 42 C.F.R. Part 2, which are stricter than HIPAA. A subpoena, search warrant, or discovery request alone is not sufficient.
• Audit and evaluation — to auditors and evaluators who agree in writing to the Part 2 restrictions, including licensing surveys, accreditation reviews, and government audits.
• Business associates and qualified service organizations — vendors such as our electronic health record, laboratory, billing, and secure communication providers, each of which must sign an agreement binding it to protect your information under HIPAA and Part 2.
• Public health — to public health authorities as permitted by law, in de-identified form where Part 2 requires it.
• Health oversight — to agencies overseeing the health care system, in the limited manner Part 2 permits.
• Research— under the conditions Part 2 and HIPAA impose, including review and approval by an institutional review board or privacy board.
• Deceased patients — as permitted by Part 2 and by Texas law, and to coroners and medical examiners as required.

We will obtain your written authorization before we use or disclose your information for:

• Marketing — including any communication that encourages you to buy a product or service where we receive payment from a third party for making it. We will never use your identity in advertising or on this website without your specific, separate written authorization.
• Sale of your information — we do not sell your health information. Any disclosure in exchange for payment would require your authorization.
• Psychotherapy notes — the separately maintained notes of a mental health professional documenting a counseling session, with the narrow exceptions HIPAA allows.
• Most other uses and disclosures not described in this notice.

You may revoke an authorization in writing at any time. Revocation stops future uses and disclosures but does not undo those already made.

Your records may not be used against you in legal proceedings

Your Part 2 records, and any testimony conveying information contained in them, may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding conducted by a federal, state, or local authority against you — including to investigate or prosecute you — unless you give written consent or a court issues an order that meets the specific requirements of 42 C.F.R. Part 2. This prohibition follows the records into the hands of anyone who receives them from us.

Breach notification

Part 2 records are now covered by the HIPAA Breach Notification Rule. If your unsecured information is breached, we will notify you as that rule requires.

Limits on redisclosure

Anyone who receives your Part 2 records from us receives, with them, a notice that federal law prohibits further disclosure except as expressly permitted by your written consent or as otherwise permitted by 42 C.F.R. Part 2.

• Get an electronic or paper copy of your record — you may inspect and receive a copy of your health information, usually within 15 days under Texas law. We may charge a reasonable, cost-based fee.
• Ask us to correct your record — you may request an amendment if you believe information is incorrect or incomplete. We may deny the request, and you may file a statement of disagreement that becomes part of your record.
• Get a list of those with whom we have shared your information — you may request an accounting of disclosures, including, under the Part 2 final rule, an accounting of disclosures made under a single consent for treatment, payment, and health care operations.
• Ask us to limit what we use or share — you may request a restriction on uses or disclosures. We must agree to a request to withhold information from your health plan when you pay for a service in full out of pocket. Under the Part 2 final rule you may also request a restriction on disclosures for treatment, payment, and health care operations.
• Ask for confidential communications — you may ask us to contact you at a specific phone number or address, or to avoid contacting you in a particular way. We will accommodate reasonable requests.
• Get a paper copy of this notice — at any time, on request, even if you agreed to receive it electronically.
• Choose someone to act for you — a personal representative with legal authority, such as a guardian or a person holding a medical power of attorney, may exercise these rights on your behalf once we verify that authority.
• Be notified of a breach — you will be notified if a breach of your unsecured health information occurs.
• File a complaint without retaliation — see Section 9.

To exercise any of these rights, contact our Privacy Officer: [PRIVACY OFFICER NAME AND CONTACT]

• We are required by law to maintain the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us in writing that we may. If you tell us we may, you may change your mind at any time in writing.
• We limit uses and disclosures to the minimum necessary for the purpose, except for disclosures for treatment and those you authorize.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer: [PRIVACY OFFICER NAME AND CONTACT]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• By mail: 200 Independence Avenue SW, Washington, DC 20201
• By phone: 1-877-696-6775
• Online: hhs.gov/ocr/complaints

We will not retaliate against you for filing a complaint, and filing one will not affect your treatment here in any way.

We may change this notice, and the changes will apply to all information we hold about you, including information we already have. The revised notice will be posted on this page, made available in our facility, and provided to you on request. The effective date of the current version appears at the top of this page.

For how we handle information collected through this website that is not protected health information, see our Website Privacy Policy.