HIPAA and Substance Use Disorder Confidentiality Notice

3.1 Who and what this notice covers

This notice describes the privacy practices of the legal entity and program identified above, its workforce, and persons acting on its behalf within the scope of their duties. It applies to protected health information we create, receive, maintain, or transmit in providing or arranging health care, including admissions information, assessments, diagnoses, prescriptions and medication records, counseling and group records, treatment plans, laboratory results, insurance and billing information, and relevant care coordination records. Information may be electronic, written, spoken, or in another form.

Our services may involve mental health care, substance use disorder treatment, medication treatment, intensive outpatient services, case management, peer support, and coordination with supportive housing or community resources. Sharing information for those services must meet applicable privacy requirements. A referral, insurance relationship, housing placement, or family relationship does not by itself give another person unrestricted access to your records.

Supportive housing is operated by UnityBridge Recovery LLC, a separate legal entity with shared ownership. This notice governs AriseVida Care LLC's health records and privacy practices. Shared ownership does not by itself combine the organizations' privacy notices or authorize unrestricted access to information. Coordination with UnityBridge Recovery LLC requires the consent, authorization, agreement, or other legal permission applicable to the information and purpose. Health information AriseVida Care LLC creates or receives in that coordination remains subject to its applicable confidentiality duties; UnityBridge Recovery LLC's separate housing records are not brought within this notice merely because of shared ownership.

The Health Insurance Portability and Accountability Act and related regulations, referred to as HIPAA, protect health information. Federal law, including 42 U.S.C. 290dd-2 and 42 CFR Part 2, provides additional protection for qualifying substance use disorder records. Part 2 can protect information identifying someone as having applied for, received, or been referred for substance use disorder services, including intake and referral information. It does not apply to every mention of substance use in every medical record.

Our Website Privacy Policy explains general website data practices. Where website submissions constitute protected health information or Part 2 records, the applicable health privacy laws and this notice govern their use and disclosure. Browsing our website or acknowledging this notice does not provide a HIPAA authorization or Part 2 consent.

3.2 Our legal responsibilities

We are required by law to maintain the privacy of protected health information and Part 2 records; provide notice of our legal duties and privacy practices; comply with the terms of the notice currently in effect; and notify affected individuals following a breach of unsecured protected information when the law requires notification. We apply legally required safeguards and limit information to the minimum necessary where that standard applies.

When another applicable law provides stronger protection, we follow that law. Arizona imposes confidentiality requirements for medical, mental health, communicable disease, and HIV-related information. Those laws include both restrictions and authorized exceptions. When an authorization is required for disclosure of confidential HIV-related information, a general medical-record release is insufficient unless it specifically meets Arizona's HIV authorization requirements. A general HIPAA permission does not override a stronger Part 2 or Arizona restriction.

3.3 Treatment, payment, and health care operations

For information governed by HIPAA without a stricter consent requirement, HIPAA generally permits these activities without a separate written authorization:

Treatment. We may use information to assess your needs, develop and carry out treatment, manage medications, coordinate services, and consult or communicate with other treating professionals. For example, a prescriber may review medication and laboratory information to avoid a harmful drug interaction, or a clinician may share relevant information with a hospital providing follow-up care.

Payment. We may use and share information to verify coverage, request authorization, submit claims, respond to coverage reviews, and collect lawful payment. For example, a health plan may need diagnosis, service, and treatment information to evaluate a claim for intensive outpatient care. Your right to restrict certain disclosures for services paid in full is explained below.

Health care operations. We may use and share information for activities such as reviewing care quality, evaluating staff performance, training personnel, credentialing, compliance, auditing, fraud prevention, and managing our practice. For example, an authorized quality reviewer may examine documentation to assess whether follow-up occurred. These permissions do not allow unrestricted public disclosure.

Additional Part 2 requirements. Most uses and disclosures of Part 2 records outside the program require a valid written consent unless a specific Part 2 exception applies. You may provide a single consent for all future treatment, payment, and health care operations uses and disclosures. For example, your consent may permit sharing medication treatment information with your treating physician and health plan. You may ask about a narrower consent and how it may affect coordination or payment. Internal communications and certain service arrangements have separate rules described below.

Further sharing after consent. Part 2 records disclosed with consent for treatment, payment, and health care operations to a HIPAA covered entity or business associate may be disclosed again as HIPAA permits, without a new consent for each disclosure. A recipient Part 2 program that is not a covered entity or business associate remains limited by the applicable consent and Part 2. The special restrictions on using records in proceedings against you continue to apply. More generally, information we disclose to a recipient outside AriseVida Care LLC may be redisclosed by that recipient and may no longer be protected by HIPAA, except where Part 2 or another law continues to restrict the recipient.

3.4 Your consent, authorization, and special choices

For uses and disclosures not described in this notice, we will obtain your written authorization or Part 2 consent, as applicable. A consent identifies the information, permitted purpose, authorized recipients, and other legally required terms. We do not treat a general website agreement as permission to release your treatment records.

You may revoke an authorization or consent in writing by contacting the Privacy Officer. Revocation applies going forward; it cannot reverse actions already taken in reliance on a valid authorization or consent. Special Part 2 consents connected with a criminal justice referral may limit revocation until a stated date or event under 42 CFR 2.35. Any such limitation must be explained in that particular consent; it does not apply automatically to every patient involved with the justice system.

Psychotherapy notes and SUD counseling notes. Separately maintained psychotherapy notes and qualifying separately maintained substance use disorder counseling notes receive special protection. Most uses and disclosures require a specific authorization or consent, subject to narrow legal exceptions. Routine treatment, payment, and operations consent does not authorize disclosure of SUD counseling notes. Consent for SUD counseling notes may be combined only with another consent for those notes. We do not condition treatment, payment, health plan enrollment, or benefit eligibility on consent to use or disclose SUD counseling notes. Ordinary progress notes, diagnoses, medications, treatment plans, and session times are not automatically psychotherapy notes or SUD counseling notes merely because counseling occurred.

Marketing, sale, and publicity. Uses or disclosures requiring authorization under HIPAA's marketing or sale-of-information rules require that authorization and any applicable Part 2 consent. Patient photographs, testimonials, or identifiable treatment stories require appropriate permission before we use them publicly. Agreeing to care or posting a public review does not authorize us to disclose your records in response.

Fundraising. You have the right to decline fundraising communications. If we propose to use Part 2 records for fundraising for our program, we must first give you a clear and conspicuous opportunity to elect not to receive any fundraising communications and satisfy other applicable consent requirements. Declining fundraising communications does not affect your treatment or payment arrangements. Contact the Privacy Officer to communicate your preference.

3.5 Family, representatives, support services, and communications

When HIPAA and Arizona law permit, we may share information directly relevant to the involvement of a family member, friend, caregiver, or other person you identify, with your agreement, an opportunity to object, or other legally permitted circumstances. When you cannot make a choice, HIPAA may allow limited sharing based on professional judgment and your best interests. These general HIPAA rules do not independently authorize disclosure of Part 2 records; the required consent or Part 2 exception must also apply.

A legally authorized personal representative may exercise rights on your behalf within the scope of that authority. We verify authority and apply rules concerning minors, incapacity, deceased patients, and circumstances involving abuse, neglect, or endangerment. Being listed as an emergency contact does not automatically confer authority to obtain all records.

Case managers, peer staff, housing personnel, referral sources, probation officers, employers, and outside community organizations receive information only when their role and the applicable law permit it. We do not disclose records merely because someone asks whether you attend treatment or live in a particular residence.

We may contact you about appointments, care coordination, treatment alternatives, and related services using permitted communication methods. Tell us if a telephone number, mailing address, email account, voicemail, or device is unsafe or shared. You may request a reasonable alternative method or location. Do not use an ordinary website contact form for an emergency; contact emergency services when immediate assistance is needed.

Email and text messages can be accessed or displayed through shared accounts, devices, carriers, or service providers. Use only the information needed for your initial request and ask us about an appropriate method before sending detailed health records. Choosing email or text does not waive our privacy obligations or provide a Part 2 consent to share your records with other people. We apply applicable safeguards and consider reasonable requests for another communication method.

3.6 Other HIPAA uses and disclosures

Subject to applicable conditions and stronger laws, HIPAA permits or requires certain other uses and disclosures. For information also protected by Part 2, the following HIPAA categories are insufficient by themselves; Section 3.7 or another valid Part 2 basis must apply.

• Public health and legally authorized reports: preventing or controlling disease; reporting births or deaths; reporting product problems, recalls, or medication reactions; and making required abuse, neglect, or domestic violence reports when legal criteria are met.
• Health oversight and compliance: authorized audits, inspections, licensing, investigations, and other oversight activities, including disclosures required to the U.S. Department of Health and Human Services to determine compliance.
• Legal requirements and proceedings: disclosures required by applicable law and legally permitted responses to judicial or administrative process. We assess the authority, scope, and required safeguards before disclosing information.
• Law enforcement: disclosures allowed under specific legal conditions, such as certain legally required reports or qualifying requests. A badge, request, or subpoena does not automatically establish a right to every record.
• Serious threats: disclosures permitted to prevent or lessen a serious and imminent threat to health or safety, consistent with applicable law and professional standards. Part 2 contains different, narrower exceptions.
• Research: disclosures under a valid authorization or a legally permitted research pathway, including required privacy review and safeguards.
• Deceased persons and donations: authorized disclosures to coroners, medical examiners, funeral directors, and organizations involved in organ, eye, or tissue donation.
• Special government functions and workers' compensation: disclosures for qualifying military, national security, protective-service, correctional health or safety, and workers' compensation purposes, only to the extent applicable law permits.

We may use appropriately de-identified information that no longer identifies you under applicable legal standards. Removing only a name may not be sufficient to de-identify information. Any limited data set or other identifiable information remains subject to applicable legal conditions.

3.7 Part 2 uses and disclosures without your written consent

Part 2 allows specific exceptions; it does not create a general permission to share substance use disorder records whenever sharing might be useful.

Within the program and direct administration. Personnel within the Part 2 program, and personnel of an entity with direct administrative control over it, may communicate information needed for duties arising from substance use disorder diagnosis, treatment, or referral. Employment by a related organization does not by itself establish access rights.

Qualified service organizations. We may share information needed by a qualifying service organization that provides services to or on behalf of the program under the required agreement. Applicable HIPAA business associate requirements also apply. A routine vendor contract alone does not remove these protections.

Medical emergencies. We may disclose necessary information to medical personnel responding to a bona fide medical emergency when prior informed consent cannot be obtained. Part 2 also permits qualifying disclosures to the Food and Drug Administration for unsafe-product notifications. The applicable conditions and documentation requirements must be met.

Scientific research. Qualifying research disclosures may occur under Part 2's research requirements and applicable HIPAA and human-subject protections. Researchers must comply with safeguards and may not identify individual patients in published research reports.

Audits and evaluations. Information may be provided for authorized audits or evaluations, including qualifying oversight, payment, or accreditation activities, subject to recipient restrictions, required agreements, and rules for handling records. This exception does not authorize investigators to use audited records to pursue proceedings against patients.

Public health. Records may be disclosed to a public health authority under Part 2's public-health provision after de-identification that meets the applicable HIPAA standard. A general public-health purpose does not itself authorize disclosure of identifiable Part 2 records.

Crimes on program premises or against personnel. We may report a patient's commission or threatened commission of such a crime to law enforcement within the narrow Part 2 exception. Information is limited to the incident circumstances, including permitted identifying and location information; the exception does not open the entire treatment record.

Suspected child abuse or neglect. We may make reports required or permitted under the Part 2 exception and applicable state reporting law. The original substance use disorder records remain protected, including in proceedings arising from the report. Part 2 does not provide the same blanket exception for every type of adult-abuse or safety report.

Cause of death. Identifying information may be disclosed as permitted by laws requiring vital statistics or inquiries into cause of death. Other records of a deceased patient remain subject to applicable confidentiality rules.

Required federal compliance and qualifying court orders. We must provide information to federal authorities when Part 2 requires it for compliance review. Qualifying Part 2 court orders may authorize limited disclosures, subject to the protections below. Separate rules can apply to investigations of the program or a records holder, including circumstances where advance patient notice is not required and later challenge rights apply.

3.8 Legal proceedings, justice referrals, and medication reporting

Part 2 records, and testimony relaying their contents, may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a court order meeting Part 2 requirements, except for the narrow disclosures expressly permitted by Part 2 and described in this notice. The separate court-process safeguards below also apply. Consent for use in such proceedings must be separate from consent for other purposes. A routine treatment consent does not waive this protection.

When reliance is placed on a court order, notice and an opportunity to be heard must be provided to you or the record holder where Part 2 requires them. An order authorizing use or disclosure must be accompanied by a subpoena or similar legal mandate compelling disclosure before the requested record is used or disclosed. An ordinary subpoena alone is not enough. These restrictions continue to apply to recipients of Part 2 records.

If treatment is connected to a criminal justice referral, any permitted progress reporting follows the specific consent and Part 2 requirements, including limits on recipients and purposes. Where applicable, disclosures to prevent multiple enrollments in withdrawal-management or maintenance-treatment programs, and disclosures of covered medication information to prescription drug monitoring programs, must satisfy their particular Part 2 consent requirements. State reporting requirements do not by themselves eliminate federal Part 2 protections.

3.9 Your rights and how to exercise them

Contact the Privacy Officer using the details at the beginning of this notice. We may request information reasonably needed to verify your identity or a representative's authority. We will explain any required request format and provide appropriate assistance or accommodation.

Inspect and receive copies. You may request access to information in the designated record set used to make decisions about you, including relevant medical and billing records. You may request paper or electronic copies in a readily producible form and format, or an agreed alternative. HIPAA generally requires action within 30 calendar days; one additional 30-day extension is permitted with timely written explanation. A shorter applicable legal deadline controls. We will not deny access because you owe for care. Any permitted copying fee must meet applicable law. Narrow exclusions or denial grounds may apply, including separately maintained psychotherapy notes. If we deny access, we will explain the reason and any available review and complaint rights. Ordinary behavioral health records are not excluded merely because they concern mental health or substance use.

Request amendment. You may ask us in writing to correct or amend inaccurate or incomplete information in the designated record set and explain the reason. We generally act within 60 days; one additional 30-day extension is permitted with a timely written explanation. We may deny a request on grounds allowed by law, such as when information is accurate and complete. We explain a denial and your right to submit a statement of disagreement. Amendment does not ordinarily mean deleting the original record.

Request restrictions. You may ask us to limit certain uses or disclosures for treatment, payment, or operations, including Part 2 disclosures made after consent, and certain disclosures to persons involved in your care. We generally are not required to agree. If we agree, we follow the restriction subject to legally permitted exceptions, including necessary emergency treatment.

Restrict fully paid services from your health plan. We must agree to your request not to disclose information about a particular item or service to your health plan for payment or health care operations when the information relates solely to that item or service, you or someone other than the plan paid in full, and disclosure is not otherwise required by law. Request this before billing or disclosure whenever possible. The restriction does not automatically bind another provider; you may need to request it separately there.

Request confidential communications. You may request reasonable communication by an alternative method or at another location. For example, you may ask us to call a specified number or send mail to a different address. We accommodate reasonable requests and do not require you to explain the reason, although we may need practical details to fulfill the request.

Receive an accounting. You may request an accounting of disclosures covered by HIPAA's accounting rule for up to six years before the request. This generally excludes treatment, payment, operations, disclosures to you, authorized disclosures, and other regulatory exceptions. We generally respond within 60 days, with one permissible 30-day extension and written notice. The first accounting in a 12-month period is free; permitted fees for additional requests are disclosed in advance.

Part 2 establishes additional accounting rights covering certain disclosures made with consent during the preceding three years, including treatment, payment, and operations disclosures through an electronic health record. HHS has deferred the compliance date for these expanded requirements until the corresponding HIPAA accounting rule is revised. They apply when the federal compliance requirement takes effect; existing HIPAA accounting rights remain available in the meantime.

Intermediary disclosure list. If your Part 2 consent uses a general designation of treating providers through an intermediary covered by 42 CFR 2.24, you may request in writing the intermediary's list of recipients for the preceding three years. The intermediary must respond within 30 days with the information the regulation requires. Ask the Privacy Officer for assistance identifying the relevant intermediary, if any.

Receive and discuss this notice. You may obtain a paper or electronic copy without charge and discuss it with our designated contact, even if you previously accepted electronic delivery. You may exercise the consent, fundraising, representative, and complaint rights described elsewhere in this notice.

3.10 Privacy complaints and protection from retaliation

You may complain to us if you believe your privacy or security rights were violated. Contact Privacy Officer Arthur Allayev at 602-899-1229 or arthur@arisevida.com, or write to Arthur Allayev, Privacy Officer, AriseVida Care LLC, 4040 East McDowell Road, Suite 107, Phoenix, AZ 85008. Describe what happened, when it happened, and how you would like us to contact you. You may request help submitting a complaint or communicating in an accessible format.

Clinic hours are Monday through Friday, 6:00 a.m. to noon; Saturday, 6:00 a.m. to 9:00 a.m.; and closed Sunday, in Phoenix local time. Our 24/7 nonemergency text contact is 602-851-6964. You may text outside clinic hours, but a message does not guarantee an immediate response or immediate review by the Privacy Officer or a clinician. Call 911 for a medical emergency or immediate danger; call or text 988 for crisis support. Do not wait for an email, text, or privacy complaint response in an emergency.

General administrative questions may also be sent to info@arisevida.com and admissions inquiries to admissions@arisevida.com. Direct privacy questions, rights requests, and sensitive privacy complaints to Arthur Allayev using the privacy contact above. These email addresses and text contact are communication channels; their inclusion here is not a representation that every message is encrypted. Ask about an appropriate method before sending detailed records or sensitive attachments.

If your concern involves Arthur Allayev, contact Mike Fagan at mike@arisevida.com or call the clinic and ask to submit the concern directly to Mike Fagan. If your concern involves Mike Fagan, contact Arthur Allayev directly. A person whose conduct is at issue will not be the sole decision-maker on that complaint. If the concern involves both, or you prefer an outside review, you may use the external complaint options below without first completing an internal process.

You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights, about HIPAA or Part 2. You do not need to complain to us first. Use the OCR Complaint Portal, follow the HHS complaint instructions, or write to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201. Complaints generally must be filed within 180 days after you knew the act or omission occurred; OCR may extend that period for good cause.

We will not intimidate, threaten, discriminate against, or retaliate against you for filing a complaint, participating in an investigation, or exercising privacy rights. You do not waive these rights by receiving care, signing an acknowledgment, or using our website.

3.11 Changes, availability, and acknowledgment

We reserve the right to revise this notice and make lawful revised practices apply to information we already hold and information we receive later. Material changes will be reflected in a revised notice before implementation when required by law. We will make the current notice available on our website and at applicable service locations, and provide or distribute it as legally required. The effective date appears at the beginning.

We inform you at admission that federal law protects the confidentiality of substance use disorder patient records. If you lack capacity to understand your medical status at admission, we inform you as soon as you regain that capacity. We provide this written notice no later than your first service, or as soon as reasonably practicable after emergency treatment. Except in an emergency treatment situation, we make a good-faith effort to obtain your written acknowledgment of receipt. If we cannot obtain it, we document our efforts and the reason. You are not required to sign. An acknowledgment documents receipt; it is not permission to release information or a waiver of your rights.

This notice is available to anyone who requests it. We prominently post it on our website and make electronic copies available there. At our service locations, copies are available to take away and the notice is posted where patients can read it without being identified as receiving substance use disorder services. If your first service is delivered electronically, we provide the notice automatically with your first request for that service. We may email the notice with your agreement; if we know delivery failed, we provide a paper copy. You may request a paper copy even after agreeing to electronic delivery.