Your Information. Your Rights. Our Responsibilities.

This notice describes how medical, mental health, and substance use disorder information about you may be used and disclosed, how we protect that information, and how you can obtain access to it.

Please review this notice carefully.

Healing Hearts Foundation and The HART Center, LLC are committed to protecting the privacy and confidentiality of the people we serve.

Because we provide mental health and substance use disorder services, information about your treatment may be protected by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations, and, when applicable, the federal confidentiality regulations governing substance use disorder patient records, 42 CFR Part 2 ("Part 2").

Part 2 records receive additional protections described in this notice.

---

YOUR RIGHTS

You have rights concerning your health information. This section explains those rights and some of our responsibilities.

Obtain an Electronic or Paper Copy of Your Records

You may ask to see or obtain an electronic or paper copy of your medical record and other health information we maintain about you.

We will provide a copy or summary of your health information as required by applicable law. We may charge a reasonable, cost-based fee when permitted by law.

Certain information may be subject to special access rules or exceptions established by law.

Ask Us to Correct Your Records

If you believe health information we maintain about you is incorrect or incomplete, you may ask us to correct it.

We may deny your request in circumstances permitted by law. If we deny the request, we will explain the reason in writing and inform you of any additional rights you have.

Request Confidential Communications

You may ask us to contact you in a particular way or at a particular location.

For example, you may ask that we contact you only at a particular telephone number or email address.

We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment, or our operations.

We are generally not required to agree to every requested restriction, but if we agree, we will comply with the restriction except as otherwise permitted or required by law.

If you pay for a healthcare service or item in full out of pocket, you may ask us not to disclose information about that service to your health plan for payment or healthcare operations. We will honor such a request when required by law unless disclosure is otherwise required by law.

Additional restrictions may apply to substance use disorder records protected by Part 2.

Obtain an Accounting of Disclosures

You may request an accounting of certain disclosures we have made of your health information.

For HIPAA-protected information, the accounting generally covers disclosures made during the six years preceding your request, subject to exclusions established by law.

Different or additional accounting requirements may apply to records protected by Part 2.

We will provide an accounting as required by applicable law. We generally will provide one accounting during a 12-month period without charge and may charge a reasonable, cost-based fee for additional requests when permitted by law.

Obtain a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.

Choose Someone to Act for You

If you have given someone medical power of attorney, have a legal guardian, or another person is legally authorized to act as your personal representative, that person may exercise applicable privacy rights on your behalf.

We will verify that the person has appropriate authority before allowing the person to act for you.

File a Privacy Complaint

You may complain if you believe your privacy or confidentiality rights have been violated.

You may submit a complaint directly to us using the contact information at the end of this notice.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

We will not retaliate against you for filing a complaint or exercising your privacy rights.

---

YOUR CHOICES

For certain health information, you may tell us your preferences concerning what we disclose.

Depending upon the circumstances and applicable law, you may have choices regarding whether we:

• share certain information with family members, friends, caregivers, or others involved in your care;

• share information in a disaster-relief situation;

• contact you regarding certain services or treatment alternatives;

• use information for fundraising purposes; or

• make other disclosures requiring your authorization or consent.

If you cannot tell us your preference—for example, because you are unconscious or otherwise unable to communicate—we may disclose information when permitted by law and when we determine that doing so is in your best interest.

We may also disclose information when necessary to lessen a serious and imminent threat to health or safety when permitted by applicable law.

Additional and more restrictive rules may apply to substance use disorder information protected by 42 CFR Part 2.

---

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

Treatment

We may use your health information to provide, coordinate, or manage your healthcare and treatment.

When permitted by law, we may disclose appropriate information to physicians, therapists, counselors, laboratories, pharmacies, treatment facilities, and other healthcare professionals participating in your care.

Example: A counselor may share relevant information with another clinician participating in your treatment.

For information protected by 42 CFR Part 2, disclosures will be made only as permitted by Part 2, including pursuant to a valid consent when required.

Payment

We may use and disclose health information as permitted by law to obtain payment for services provided to you.

This may include communicating with insurers, government programs, responsible third-party payers, or other entities responsible for payment.

Part 2 information will be used or disclosed for payment only as permitted by applicable law and any required consent.

Healthcare Operations

We may use and disclose health information as permitted by law to operate our organizations and improve the quality of the services we provide.

Examples may include:

• quality assessment and improvement;

• staff training and supervision;

• credentialing;

• compliance activities;

• audits;

• program evaluation;

• business planning;

• administrative functions; and

• reviewing the effectiveness of our services.

Part 2 information will be used or disclosed for these purposes only as permitted by Part 2.

Appointment Reminders and Communications About Your Care

We may use your contact information to communicate with you about appointments, scheduling, treatment, account matters, or other services related to your care.

These communications may include telephone calls, voicemail, email, text messages, or other communication methods you have authorized or that are otherwise permitted by law.

Please tell us if you have specific requirements concerning how we should contact you.

---

REFERRING AGENCIES, COURTS, PROBATION, AND OTHER PROGRAMS

Some individuals receive services from us following referral by a court, probation or correctional authority, drug court, treatment program, government agency, employer, or another organization.

A referral to our program does not by itself authorize unrestricted disclosure of your treatment information to the referring organization.

We will disclose information to a referring agency only when the disclosure is permitted by applicable law and, when required, you have provided a valid written consent or authorization specifying the information that may be disclosed.

When appropriate, such disclosures may include limited information concerning matters such as:

• enrollment or participation;

• attendance;

• compliance with program requirements;

• drug-testing results;

• progress toward established treatment or program goals; or

• completion or termination of services.

The exact information disclosed depends upon applicable law, the terms of any valid authorization or consent, and the requirements of the applicable program.

Substance use disorder treatment records protected by 42 CFR Part 2 receive special federal protection.

---

SPECIAL PROTECTION FOR SUBSTANCE USE DISORDER RECORDS

Federal law provides special confidentiality protections for records identifying an individual as having or having had a substance use disorder when those records are maintained by a program subject to 42 CFR Part 2.

When Part 2 applies, we generally must obtain your consent before using or disclosing your Part 2 records except where federal law specifically permits the use or disclosure without consent.

Where permitted, you may provide consent allowing certain uses and disclosures for treatment, payment, and healthcare operations.

You may revoke a consent as permitted by law, although revocation will not undo disclosures that were already made in reliance on a valid consent.

Legal Proceedings and Investigations

Part 2 records are subject to particularly strong protection against use in legal proceedings against you.

Your Part 2 records generally may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you provide the specific consent required by law or an appropriate court order satisfying Part 2 requirements is obtained.

Part 2 records generally may not be used to initiate or substantiate a criminal charge against you or to conduct a criminal investigation of you except as specifically permitted by federal law.

A general consent for treatment or routine disclosure of records does not eliminate these protections.

Substance Use Disorder Counseling Notes

Certain separately maintained substance use disorder counseling notes receive additional protection.

When applicable, we will obtain the separate consent required by law before using or disclosing such notes unless an exception established by law applies.

Redisclosure of Part 2 Information

Recipients of Part 2 information may be subject to federal restrictions concerning further use and disclosure of that information.

The protections applicable to a particular disclosure depend upon the circumstances, the recipient, the consent provided, and applicable federal law.

---

OTHER USES AND DISCLOSURES PERMITTED OR REQUIRED BY LAW

Depending upon the circumstances, we may use or disclose health information without your authorization when permitted or required by law.

Examples may include disclosures:

• required by federal, state, or local law;

• concerning suspected abuse, neglect, or exploitation when applicable reporting requirements are satisfied;

• to prevent or reduce a serious threat to health or safety when permitted by law;

• for certain public-health activities;

• for appropriate health oversight activities;

• for workers' compensation purposes when permitted by law;

• to coroners, medical examiners, or funeral directors when permitted by law;

• for certain research purposes when applicable legal requirements have been satisfied;

• in response to lawful judicial or administrative processes when applicable requirements have been satisfied; and

• for certain law-enforcement purposes when specifically permitted by applicable law.

The fact that HIPAA permits a disclosure does not necessarily mean that Part 2 permits disclosure of substance use disorder records. When Part 2 or another law provides greater confidentiality protection, we will apply the more restrictive applicable requirement.

---

MARKETING, SALE OF INFORMATION, AND FUNDRAISING

We do not sell your health information.

We will obtain your written authorization before using or disclosing protected health information for purposes requiring authorization under HIPAA or Part 2.

We do not use text messaging to send marketing messages without any consent required by applicable law.

Healing Hearts Foundation is a nonprofit organization and may conduct fundraising activities.

If we use health information for a fundraising communication where permitted by law, you have the right to tell us not to contact you again for fundraising purposes.

If a proposed fundraising communication would use information protected by Part 2, we will provide the notice and choice required by applicable federal law before using Part 2 information for that purpose.

---

ELECTRONIC COMMUNICATIONS

If you provide us with a telephone number and agree to receive text messages, we may send messages concerning matters such as:

• appointments and reminders;

• account notifications;

• scheduling;

• customer or client care; and

• other transactional communications relating to your services.

Message frequency may vary. Message and data rates may apply.

You may opt out of text messaging by replying STOP. You may request assistance by replying HELP or contacting us.

Choosing not to receive text messages will not prevent you from receiving treatment, although it may affect our ability to provide reminders and other electronic communications.

We may also communicate with you by email or other electronic means when permitted by law and consistent with your communication preferences.

Electronic communications may involve privacy risks. We take reasonable measures to protect your information but cannot guarantee the security of communications transmitted through systems outside our control.

---

INFORMATION SECURITY

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of health information.

These safeguards may include access controls, authentication, encryption, security monitoring, workforce training, and other measures appropriate to the information and systems involved.

No information system can be guaranteed to be completely secure.

If a breach occurs that may have compromised the privacy or security of protected information, we will notify affected individuals and appropriate authorities as required by applicable law.

---

OUR RESPONSIBILITIES

We are required by law to maintain the privacy and security of protected health information and applicable Part 2 records.

We must:

• follow the duties and privacy practices described in the version of this notice currently in effect;

• provide you with a copy of this notice;

• safeguard protected information;

• notify you when required if a breach may have compromised the privacy or security of your information; and

• comply with HIPAA, Part 2, and other applicable privacy laws.

We will not use or disclose your information other than as described in this notice unless you authorize us to do so in writing or another applicable law permits or requires the use or disclosure.

When you provide an authorization or consent, you may revoke it as permitted by applicable law.

---

STATE LAW AND OTHER PRIVACY PROTECTIONS

Federal privacy laws establish important protections for your health information.

Tennessee law and other applicable laws may provide additional protections for mental health, substance use disorder, or other health information.

When another applicable law provides greater privacy protection than HIPAA, we will comply with the more protective applicable requirement.

---

CHANGES TO THIS NOTICE

We may change the terms of this Notice of Privacy Practices.

Changes may apply to information we already maintain as well as information we receive in the future.

When we make a material change, the revised notice will contain a new effective date and will be made available as required by law.

The current notice will be available:

• upon request;

• at our offices or treatment locations as applicable; and

• on our website.

---

QUESTIONS OR PRIVACY COMPLAINTS

If you have questions about this notice, want to exercise your privacy rights, or wish to file a privacy complaint, contact:

Privacy Officer
Healing Hearts Foundation & The HART Center, LLC
Telephone: +1 (901) 726-4913
Email: privacy-officer@thehartcenter.org
Mailing Address: Privacy Officer, 1384 Madison Ave, Memphis, TN 38104

You may also submit a complaint concerning HIPAA or 42 CFR Part 2 privacy rights to the:

U.S. Department of Health and Human Services
Office for Civil Rights

Information about filing a complaint is available from the U.S. Department of Health and Human Services Office for Civil Rights.

We will not retaliate against you for filing a complaint or exercising a privacy right.

---