Effective Date: 2/16/2026
These changes are intended to make clear that not all protected health information (PHI) is treated the same under federal law and place particular emphasis on the heightened protections that apply to Substance Use Disorder (SUD) treatment records.
Federal law has long provided special protections for SUD records. What is new is that HIPAA’s Notice of Privacy Practices (NPP) rule has been amended to require providers to clearly explain those protections in their NPP.
1. When another law is more restrictive than HIPAA, the stricter law applies.
2. Special Protections and Consent Requirements for SUD Records
SUD records are governed by stricter federal law and are not treated the same as other medical information. Like all PHI, you have the right to request your SUD records, and if any disclosures have been made. Unlike most PHI, SUD records generally cannot be used or disclosed for treatment, payment, or healthcare operations without the client’s specific written authorization.
3. Limits on Use in Legal Proceedings
SUD records, or testimony describing them, generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a client unless:
- The client gives written consent, or
- A court issues a special order after notice and an opportunity to be heard.
4. Redisclosure Warning
Once a client’s information is disclosed, it may be redisclosed by the recipient and may no longer be protected by HIPAA.
5. Accessibility and Nondiscrimination
As a covered entity, we must comply with all federal nondiscrimination laws, including laws addressing language access and disability accommodations.
- Our NPP can be provided in large print, or screen reader compatible format, upon request.
This notice describes how your medical information may be used and disclosed and how you can access this information. Please review it carefully.
We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to protect the privacy of your medical records and other Protected Health Information (PHI). This notice explains how we may use or disclose your PHI, your rights regarding that information, and our legal responsibilities.
Your Rights
When it comes to your health information, you have the following rights:
1. Access Your Records: You can request to see or get a copy of your medical records (electronic or paper) within 30 days of your request. We may charge a reasonable fee for copies or staff time.
2. Request Corrections: You may request corrections to your medical records if you believe there are errors. lf we deny your request, we will provide a written explanation within 60 days.
3. Confidential Communications: You may ask us to contact you through specific methods (e.g., home phone, office phone, or a different mailing address). We will accommodate all reasonable requests.
4. Restrict Disclosures: You may request that we not share certain health information for treatment, payment, or operational purposes. If you pay for a service out-of-pocket in full, you can request that we not share this information with your health insurer. We will comply unless required by law.
5. Receive an Accounting of Disclosures: You may request a list of instances in which your information was shared in the past six years (excluding disclosures related to treatment, payment, or operations). The first report within 12 months is free; subsequent requests may incur a fee.
6. Paper Copy of Notice: You can request a paper copy of this notice, even if you agreed to receive it electronically.
7. Delegate Rights: If you have assigned someone medical power of attorney or have a legal guardian, they may exercise your rights regarding your health information.
8. File Complaints: You can file a complaint if you feel your rights have been violated. Contact us or the U.S. Department of Health and Human Services at 1-877-696-6775 or visit https://www.hhs.gov/ocr/privacy/hipaa/complaints/.
- For concerns about your rights or services received, you may refer to the Grievance Information and Procedures form sent to you along with this form, which further outlines how to submit complaints, suggestions, or questions.
Your Choices
You have control over certain uses and disclosures of your health information:
Share Information:
- You may choose to allow sharing of information with family, close friends, or others involved in your care.
- You may also direct us to share information in disaster relief situations.
- If you are unable to share your preference, for example, if you are unconscious, we may share your information when we believe it is in your best interest. We may also share your information if it is necessary to lessen a serious and imminent threat to health or safety.
- Collaborations with Universities or Researchers: With your explicit consent, which would be obtained separately, you may be asked to consider participating in research collaborations or university partnerships aimed at enhancing learning and/or improving programs.
Marketing, Fundraising, and Psychotherapy Notes:
- We will never share your information for marketing or the sale of PHI without your written consent.
- For fundraising, you can opt out of further communications.
How We Use and Disclose Your PHI
We may use and disclose your health information as follows:
1. Treatment: To provide, coordinate, or manage your healthcare services. Example: Sharing information with other providers treating you.
2. Payment: To obtain payment for healthcare services. Example: Sharing information with your insurance provider.
3. Healthcare Operations: To conduct business operations and improve quality of care. Example: Evaluating staff performance.
4. Public Health and Safety: To report disease outbreaks, adverse reactions, suspected abuse, or to prevent a serious threat to health or safety.
5. Health Oversight Activities: To comply with oversight activities such as audits or investigations.
6. Legal Obligations: To comply with court orders, subpoenas, or legal requirements.
7. Research, Evaluation, and Funding: Your health information may be shared for purposes such as annual agency reviews, public and private grants, collaborations, program improvement, training, research, funding, or related activities. In these cases, only non-identifiable data will be used to ensure your identity is protected. In terms of public/government related programs, identifiable data might be submitted when mandated.
- Additionally, with explicit consent, your identifiable information may be shared with specific research or evaluation teams for approved projects.
8. Workers’ Compensation: To process claims related to workplace injuries.
9. Government Functions: To fulfill government requests for national security, military activities, or law enforcement purposes.
10. Deceased Individuals: To provide information to coroners, medical examiners, or funeral directors.
When We Are Required to Disclose Your Information
We will use and disclose your Protected Health Information as required by federal, state, or local law. There are certain situations where we may be ethically and legally obligated to disclose information to other persons or agencies, even without your consent. These situations may include:
1. If we determine that you are a danger to yourself or others.
2. If you disclose abuse, neglect, or exploitation of a child, elderly, or disabled person.
3. If we are ordered by a court of law to disclose information.
4. If you direct us to release your records.
5. If we are otherwise legally required to disclose information.
Special Situations
Referrals by Courts or Government Agencies: If you are referred by probation, court, or child welfare agencies, you may be required to provide consent for us to share treatment summaries.
Internal Clinical Teams: Information shared within internal clinical teams will be protected and only disclosed externally as legally required or permitted.
Our Responsibilities
1. Maintain Privacy: We are legally required to maintain the privacy of your PHI.
2. Notify of Breaches: We will notify you promptly if a breach occurs that compromises the security of your PHI.
3. Follow this Notice: We will follow the practices described in this notice.
4. Limit Use of Information: We will not use or share your information beyond what is outlined here without your written consent. You may withdraw consent in writing at any time.
Changes to This Notice
We may update this notice, and the changes will apply to all PHI we maintain. The updated notice will be available upon request and when applicable, within our electronic health records (EHR) system.
Contact Information
If you have questions or need assistance regarding this form, please ask the Recovery Resource Council staff who is providing services to you.
For concerns about your rights or services received, you may refer to the Grievance Information and Procedures form sent to you along with this form, which further outlines how to submit complaints, suggestions, or questions.
Thank you for trusting Recovery Resource Council with your care and privacy.