THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT
CAREFULLY!
Updated Notice Effective Date: August 26, 2021
Indiana Center for Recovery is a provider of treatment for substance use disorder and is obligated to the highest
levels of confidentiality. Accordingly, Indiana Center for Recovery, is subject to the confidentiality
requirements of 42 CFR Part 2, a federal regulation that requires the highest levels of privacy for patients of
substance use disorder treatment programs. For a thorough resource regarding the confidentiality of
protected health information, please see The Confidentiality of Alcohol And Drug Abuse Client Records Regulation
and the HIPAA Privacy Rule: Implications For Alcohol And Substance Abuse, which was issued by the United
Statements Department of Health and Human Services Substance Abuse and Mental Health Services
Administration (SAMHSA). This document explains how Federal regulations restrict communications that
could identify an individual by “programs” that provide substance use and/or mental health diagnosis,
treatment, or referral for treatment.
Specifically, 42 CFR Part 2 protects any and all information that could reasonably be used to identify an
individual and requires that disclosures be limited to the information necessary to carry out the purpose of the
disclosure. See 42 CFR §§2.11 and 2.13(a). Under the Privacy Rule, a program may not use or disclose
“protected health information” (PHI) except as permitted or required by the Rule. See 45 CFR §164.502(a).
Purpose
The purpose is to decrease the risk that information about individuals in recovery will be disseminated and
that they will be subjected to discrimination and to encourage people to seek treatment for substance abuse
disorders. A complete version of the HIPAA regulations can be found in Title 45 and Title 42 Part 2 of the Code
of Federal Regulations. If you have questions about any part of this Notice or if you want more information
about the privacy practices at Indiana Center for Recovery or would like to request a paper copy of the most
recent version, please contact:
Haven Health Management
Attn: Quality Assurance Dept.
2925 10th Ave. N.
Palm Springs, FL 33461
Phone: (561) 516-0734
Email: qualityassurance@havendetoxnow.com
Understanding Protected Health Information and Your Medical Record
Protected Health Information is also called PHI and typically includes your name, address, date of birth, billing
arrangements, care, services, treatments, laboratory and assessment results, medications, and other
information that relates to your health, health care provided to you, or payment for health care provided to
you. PHI does NOT include information that is de-identified or cannot be linked to you.
Indiana Center for Recovery obtains most of its PHI directly from you by asking questions and through care
applications, and assessments, and when allowed from family or collateral sources. We may collect additional
personal information depending on the nature of your needs and consent to make additional referrals and
inquiries. We may also obtain PHI from community health care agencies, other governmental agencies, or
health care providers as we set up your service arrangements. Substance abuse treatment records may also
contain mental health diagnoses, information on STD’s, and HIV status.
Each time a service is provided, there is electronic documentation of the service by the provider. Your
electronic medical records contain, but is not limited to, screenings, assessment, symptoms, diagnosis, progress
notes treatment plan, medications, laboratory results, follow-up care, discharge planning, and treatment
recommendations. This Protected Health Information (PHI), often referred to as your medical record, serves
as a basis for planning your treatment, a means to communicate between service providers involved in your
care, as a legal document describing your care and services, and verification for you and/or a third-party payer
that the services billed were provided to you. It can also be used as a source of data to assure that we are
continuously monitoring the quality of services and measuring outcomes. Understanding what is in your
medical record and how, when, and why we use the information helps you make informed decisions when
authorizing disclosure to others. Your health information will not be disclosed without your authorization
unless otherwise required or allowed by State and Federal laws, rules, or regulations.
All reasonable efforts to use, disclose, and request only the amount of PHI needed to accomplish the intended
purpose of the use, disclosure, or request will be made. Access to PHI by staff will be on a need-to-know basis
and only those who have a need for the information in connection with their duties that arise out of the
provision of diagnosis, treatment or referral for treatment of alcohol or drug abuse shall have access to the
information needed to carry out the service.
Limits of Confidentiality/Use and Disclosure of PHI Without Consent
Federal laws require or allow that we share your health information, including alcohol and drug abuse records,
with others in specific situations in which you do not have to give consent, authorize or have the opportunity
to agree or object to the use and disclosure. Prior to disclosing your health information under one of these
exceptions, we will evaluate each request to ensure that only necessary information will be disclosed. All other
disclosures will be made only with written consent or authorization. Under the following situations, the types
of uses and disclosures Indiana Center for Recovery may make without consent or authorization are:
- In connection with treatment, payment, or healthcare operations;
- To qualified service organizations or business associates who provide services to the program’s
treatment, payment, or health care operations; - In medical emergencies;
- When there is a court order;
- To auditors and evaluators;
- To research if the information will be protected as required by Federal regulations;
- To report suspected child or elderly abuse or neglect; and
- To report a crime or threat to commit a crime on program premises or against program personnel.
Federal law and regulations do not protect any information about a crime committed by a Client either
at the program or against any person who works for the program or about any threat to commit such
a crime.
Federal laws and regulations do not protect any information about elderly abuse, suspected child abuse
or neglect, threats to harm to self or others from being protected or leased to under State law to
appropriate State or local authorities beyond Federal CFR 42-Regulations. (See 42 U.S.C. 290dd-3 and 42
U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations)
How Indiana Center for Recovery May Use or Disclose Your Health Information
Any disclosure of PHI will be made with expressed written consent of the client, except where otherwise
permitted by law (see Limits of Confidentiality/Use and Disclosure of PHI Without Consent above). The
authorization may be revoked at any time, unless the program has taken action in reliance on the consent or
authorization. Once information is disclosed, Indiana Center for Recovery can no longer guarantee the
protections under federal confidentiality laws as there is always the potential for the recipient to re-disclose
information
Indiana Center for Recovery will release protected health information only when a valid release of
information complies with the applicable requirements of 45 CFR §164.508. A proper consent form must
contain, at minimum, these elements:
• Name or general designation of the program or person permitted to make the disclosure
• Name or title of the individual or name of the organization to which disclosure is to be made
• Name of the client
• Purpose of the disclosure
• How much and what kind of information is to be disclosed
• Signature of client
• Date on which consent is signed
• Date, event, or condition upon which consent will expire if not previously revoked
• A statement that the consent is subject to revocation at any time except to the extent that the
program has already acted on it
• A statement that the information disclosed cannot be re-disclosed
• A statement that the patient will be provided a copy of the signed release
A general medical release form, or any consent form that does not contain all the elements listed above,
is not acceptable.
The following categories describe all the ways that Indiana Center for Recovery may use or disclose your health
information. Any use or disclosure of your health information will be limited to the minimum information
necessary to carry out the purpose of the use or disclosure. Note that we can only use or disclose alcohol and
drug abuse records with your consent or as specifically permitted under federal law unless the use falls within
the “Limits of Confidentiality” (see below). Remember: You can revoke your authorization at any time;
however, we will be unable to take back any disclosures that have already been made with your
permission.
To Obtain Payment – Indiana Center for Recovery may use or disclose your health information to insurance
companies to determine eligibility for plan benefits, obtain authorizations, facilitate payment for the treatment
and services you receive, and/or determine plan responsibility for benefits. Health information may be shared
with private insurance to determine medical necessity of services or determine whether a specific service or
treatment is covered under your plan.
Treatment/Healthcare Operations – Indiana Center for Recovery may use and disclose health information
about you to carry out necessary quality assurance checks and improvement activities such as handling and
investigating complaints, reviewing charts for compliance, competency of providers, auditing, etc. Indiana
Center for Recovery may use and disclose your health information to provide and coordinate appropriate
treatment services, formulate treatment plans, set up referrals with other providers, etc. We may also share
your health information with emergency treatment providers when you need emergency services. We may also
communicate and share information with other behavioral health service Providers who have Contracts with
Indiana Center for Recovery with whom we have Business Associate Agreements. We require the contractor to
appropriately safeguard your information. Prior to sharing PHI with other providers, not contracted with
Indiana Center for Recovery, you will be asked to complete a Release of Information which you can choose to
sign or decline.
Required by Law – Indiana Center for Recovery may use and disclose your health information when required
by statute, regulation, court order, government agency, we reasonably believe an individual to be a victim of
abuse, neglect or domestic violence, for judicial and administrative proceedings, and enforcement purposes.
However, no information obtained from a provider–even with the client’s consent–may be used in a criminal
investigation or prosecution of a client unless a court order also has been issued in accordance with §2.65 We
may disclose PHI regarding deceased clients as mandated by state law, or to a family member that was involved
in your care or payment for care prior to death, based on your prior consent. A release of information regarding
deceased clients may be limited to an executor or administrator of a deceased person’s estate or the person
identified as next-of-kin.
Public Health – Your health information may be reported to a public health authority or other appropriate
government authority authorized by law to collect or receive information for purposes related to preventing
or controlling disease, injury or disability; reporting to the Food and Drug Administration problems with
products and reactions to medications, and reporting disease or infection exposure.
Health Oversight Activities – We may disclose your health information to health, regulatory and/or oversight
agencies during audits, investigations, inspections, licensure, and other proceedings related to oversight of the
health care system. Information may be reviewed by investigators, auditors, accountants or lawyers who make
certain that we comply with various laws or to audit your file to make sure that no information about you was
given to someone in a way that violated this Notice.
Judicial and Administrative Proceedings – We may disclose your health information in response to a
subpoena or court order in the course of any administrative or judicial proceeding, in the course of any
administrative or judicial proceeding required by law (such as a licensure action), for payment purposes (such
as a collection action), or for purposes of litigation that relates to health care operations where Indiana Center
for Recovery is a party to the proceeding. However, a subpoena must be attached to a release with the federally
required information prior to releasing PHI.
Public Safety/ Law Enforcement – We may disclose your health information to appropriate persons in order
to prevent or lessen a serious or imminent danger or threat to the health or safety of a particular person or the
general public or when there is likelihood of the commission of a felony or violent misdemeanor.
Research – Under certain circumstances, and only after a special approval process, we may use and disclose
your health information to help conduct research.
Incidental Uses and Disclosures – Incidental uses, and disclosures of PHI are those that cannot be reasonably
prevented, are limited in nature and that occur as a by-product of a permitted use or disclosure. Such incidental
disclosures are permitted if Indiana Center for Recovery uses reasonable safeguards and use to disclose only
the minimum amount of PHI necessary.
Disclosures of Health-Related Benefits or Services – Indiana Center for Recovery may want to contact you
regarding service reminders, alumni meetings, coordination of care, follow-up services, or for other reasons
that may be of interest to you. You will be asked to sign a consent for follow-up in cases where you may be
contacted post-discharge. You have the right to decline contact or revoke your release at any time.
To Personal Representatives – Indiana Center for Recovery may disclose your health information to a person
you have designated to act on your behalf and make decisions about your care in accordance with state law.
We will act according to your written instructions in your chart and will require anyone claiming to be your
personal representative to provide proof/verification.
To Family and Friends – Indiana Center for Recovery may disclose your health information to persons that
you indicate are involved in your care or the payment of care. These disclosures may occur when you are not
present if you agree and do not express objection. These disclosures may also occur if you are unavailable,
incapacitated, or facing an emergency medical situation and we determine that a limited disclosure may be in
your best interest. We may also disclose limited PHI to a public or private entity that is authorized to assist in
disaster relief efforts in order for that entity to locate a family member or other person that may be involved in
caring for you. You have the right to limit or stop these disclosures.
Restricting Uses and Disclosures of Protected Health Information.
45 CFR § 164.522 details your right to request privacy protection for protected health information (PHI). Be
advised that restrictions on disclosure of information cannot be accepted except when the individual, family
member, or other person has provided payment in full by sources other than the insurance company for all
services on behalf of the individual. If the individual is paying privately for treatment and no insurance
company is being billed, all services must be paid in full prior to accepting a restriction. All restrictions must be
documented in accordance with 45 CFR §160.530(j) of Subchapter C in Title 45 of the Code of Federal
Regulations.
Indiana Center for Recovery must permit an individual to request that we restrict:
a. Uses or disclosures of PHI about the individual to carry out treatment, payment, or healthcare
operations; and
b. Disclosures permitted under 45 CFR §164.510(b) – see above Notice of Privacy Practices
Indiana Center for Recovery must agree to the request of an individual to restrict disclosure of PHI to a health
plan, if:
a. The disclosure is for the purpose of carrying out payment or healthcare operations and is not
otherwise required by law; and
b. The PHI pertains to a service for which the individual, family member, or person other than the health
plan on behalf of the individual, has paid Indiana Center for Recovery in full.
If Indiana Center for Recovery agrees to a restriction, we may not use or disclose PHI in violation of the
restriction, except when the individual who requested the restriction is in need of emergency treatment and
the restricted PHI is needed to provide that treatment. In this case, we may use or disclose the PHI to the health
care provider to provide such treatment to the individual. If restricted information is disclosed to a health care
provider for emergency treatment Indiana Center for Recovery must request that the healthcare provider not
further use or disclose the information.
Indiana Center for Recovery may terminate a restriction, if:
a. the individual agrees to or requests termination in writing;
b. the individual orally agrees to the termination and the oral agreement is documented; or
c. Indiana Center for Recovery informs the individual that it is terminating its agreement to a restriction,
except that such termination is: - not effective for PHI restricted as noted above; and
- only effective with respect to PHI created or received after it has so informed the individual
If you would like to request a restriction on the use or disclosure of PHI, please advise staff and it will be
submitted for approval. You must provide specific information as to what you would like restricted.
Statement of Your Health Information Rights
Although your health information is the physical property of Indiana Center for Recovery, the information
belongs to you. You have the right to request, in writing, certain uses and disclosures of your health information.
There are special circumstances in which Indiana Center for Recovery may deny a request even though it falls
under the rights of the individual. Once you have initiated a request to act upon your rights, Indiana Center for
Recovery will either provide the requested information to the individual or provide a reason in writing
explaining the reason for denial within 30 days. If an extension is needed, the individual will be notified in
writing.
You may exercise any of the rights below by contacting the Quality Assurance Department using the
contact information at the end of this document.
Your rights with respect to protected health information are:
Right to Inspect and Copy – You have the right to inspect and copy your PHI in a designated record set except
where State law may prohibit client access. A designated record set contains medical, clinical, billing, and case
management information. If we do not have your PHI record set but know who does, we will inform you how
to get it. If our PHI is a copy of information maintained by another health care provider, we may direct you to
request the PHI from them. Should we deny your request for access to information contained in your designated
record set, you have the right to ask for the denial to be reviewed by another healthcare professional designated
by Indiana Center for Recovery.
Right to Request Amendment – You have the right to request certain amendments to your PHI if, for example,
you believe a mistake has been made or a vital piece of information is missing. Indiana Center for Recovery is
not required to make the requested amendments and will inform you in writing of our response to your
request.
Right to Accounting of Disclosures – You have the right to receive an accounting of disclosures of your PHI
that were made by Indiana Center for Recovery for a period of six (6) years prior to the date of your written
request. This list of PHI that has been disclosed does not include disclosures for purposes of treatment,
payment, health care operations or certain other excluded purposes, but includes other types of disclosures,
including disclosures for public health purposes or in response to a subpoena or court order.
Revoke Authorizations – You have the right to revoke any authorization you have provided, except to the
extent that Indiana Center for Recovery has already relied upon the authorization.
Right to Receive Confidential Communications – You have the right to receive your health information
through a reasonable alternative means or at an alternate location. To request confidential communications,
you must submit your request in writing to the Quality Assurance Department at the address listed below. We
are not required to agree to your request.
Right to be Notified of a Breach – You have the right to be notified if we (or one of our Business Associates)
discover a breach of your unsecured protected health information. Notice of any such breach will be made in
writing and in accordance with federal requirements.
Right to Request Restriction of Use and Disclosure – You have the right to request privacy protection of your
PHI. Indiana Center for Recovery will accommodate reasonable requests under a specific circumstance which
can be found under the section “Restricting Uses and Disclosures of Protected Health Information” in this Notice
of Privacy Practices. Indiana Center for Recovery is not required to agree to your request, and you cannot place
limits on uses and disclosures that we are legally required or allowed to make.
Right to a Copy of Privacy Practices and Paper Copy – You have a right to receive an electronic copy of this
Notice of Privacy Practices and any revised notices at any time.
Responsibilities and Obligations of Facility
Indiana Center for Recovery is required by law to maintain the privacy and security of Protected Health
Information that we collect, create, and receive about your past, present, or future health condition including
health care we provide to you and payment for services. Indiana Center for Recovery is also required to provide
clients with notice of the facility’s legal duties and privacy practices, including any changes to our policies. We
are only allowed to use and disclose protected health information in the manner described in this Notice. To
comply with these state and federal laws, Indiana Center for Recovery has adopted policies and procedures
that require its employees, contractors, and business associates to obtain, maintain, use and disclose PHI in a
manner that protects client privacy. In the case of a breach of unsecured protected health information, all
affected individuals will be notified in writing via mail. Clients are encouraged to keep their address up to date
by contacting the Quality Assurance Department. The contact information can be found below.
Changes to This Notice and Distribution
Indiana Center for Recovery is required by law to provide you with this notice which includes our legal duties,
privacy practices, and process for changing our policies. Indiana Center for Recovery must abide by the terms
of the Notice currently in effect. Indiana Center for Recovery reserves the right to amend this Notice of Privacy
Practices at any time in the future and to make the new Notice provisions effective for all health information
that it maintains. If we have more than one Notice of Privacy Practices, the individual will be provided with the
Notice that pertains to them. The most recent Notice of Privacy Practices will always be posted in a common
area of each facility and facility building and entered into the EMR to ensure the recent version is reviewed and
signed by clients upon admission. The Client Handbook will be updated as needed. You may submit a written
request at any time using the contact information at the end of this form and the most recent notice will be
provided to you.
Complaints
Complaints about this Notice of Privacy practices or about how we handle your health information should be
directed to the Haven Health Management Quality Assurance Department at 2925 10th Ave. N. Palm Springs, FL - You may also contact the Director of Quality Assurance via email at
qualityassurance@havendetoxnow.com or by phone at (561) 516-0734. Indiana Center for Recovery will not
retaliate against you in any way for filing a complaint. All complaints to Indiana Center for Recovery must be
submitted in writing.
If you believe your privacy rights have been violated, you may also file a complaint with the Secretary of the
Department of Health and Human Services online at www.hhs.gov/ocr/privacy/hipaa/complaints/ or call
(800) 368-1019. You may also submit your complaint in writing to:
The U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free: 1-877-696-6775
Contact
If you would like to have a more detailed explanation of these rights, or if you would like to exercise one or
more of these rights, or if you have a complaint, please contact the Quality Assurance Department at:
Haven Health Management
Attn: Quality Assurance Dept.
2925 10th Ave. N.
Palm Springs, FL 33461
Phone: (561) 516-0734
Email: qualityassurance@havendetoxnow.com