NOTICE OF PRIVACY PRACTICES AND LIMITS OF CONFIDENTIALITY

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT
CAREFULLY!

Updated Notice Effective Date: August 26, 2021
The Recovery Team is a provider of treatment for substance use disorder and is obligated to the highest levels
of confidentiality. Accordingly, The Recovery Team, is subject to the confidentiality requirements of 42 CFR
Part 2, a federal regulation that requires the highest levels of privacy for patients of substance use disorder
treatment programs. For a thorough resource regarding the confidentiality of protected health information,
please see The Confidentiality of Alcohol And Drug Abuse Client Records Regulation and the HIPAA Privacy Rule:
Implications For Alcohol And Substance Abuse, which was issued by the United Statements Department of Health
and Human Services Substance Abuse and Mental Health Services Administration (SAMHSA). This document
explains how Federal regulations restrict communications that could identify an individual by “programs” that
provide substance use and/or mental health diagnosis, treatment, or referral for treatment.
Specifically, 42 CFR Part 2 protects any and all information that could reasonably be used to identify an
individual and requires that disclosures be limited to the information necessary to carry out the purpose of the
disclosure. See 42 CFR §§2.11 and 2.13(a). Under the Privacy Rule, a program may not use or disclose
“protected health information” (PHI) except as permitted or required by the Rule. See 45 CFR §164.502(a).
Purpose
The purpose is to decrease the risk that information about individuals in recovery will be disseminated and
that they will be subjected to discrimination and to encourage people to seek treatment for substance abuse
disorders. A complete version of the HIPAA regulations can be found in Title 45 and Title 42 Part 2 of the Code
of Federal Regulations. If you have questions about any part of this Notice or if you want more information
about the privacy practices at The Recovery Team or would like to request a paper copy of the most recent
version, please contact:
Haven Health Management
Attn: Quality Assurance Dept.
2925 10th Ave. N.
Palm Springs, FL 33461
Phone: (561) 516-0734
Email: [email protected]
Understanding Protected Health Information and Your Medical Record
Protected Health Information is also called PHI and typically includes your name, address, date of birth, billing
arrangements, care, services, treatments, laboratory and assessment results, medications, and other
information that relates to your health, health care provided to you, or payment for health care provided to
you. PHI does NOT include information that is de-identified or cannot be linked to you.
The Recovery Team obtains most of its PHI directly from you by asking questions and through care
applications, and assessments, and when allowed from family or collateral sources. We may collect additional
personal information depending on the nature of your needs and consent to make additional referrals and
inquiries. We may also obtain PHI from community health care agencies, other governmental agencies, or
health care providers as we set up your service arrangements. Substance abuse treatment records may also
contain mental health diagnoses, information on STD’s, and HIV status.
Each time a service is provided, there is electronic documentation of the service by the provider. Your
electronic medical records contain, but is not limited to, screenings, assessment, symptoms, diagnosis, progress
notes treatment plan, medications, laboratory results, follow-up care, discharge planning, and treatment
recommendations. This Protected Health Information (PHI), often referred to as your medical record, serves
as a basis for planning your treatment, a means to communicate between service providers involved in your
care, as a legal document describing your care and services, and verification for you and/or a third-party payer
that the services billed were provided to you. It can also be used as a source of data to assure that we are
continuously monitoring the quality of services and measuring outcomes. Understanding what is in your
medical record and how, when, and why we use the information helps you make informed decisions when
authorizing disclosure to others. Your health information will not be disclosed without your authorization
unless otherwise required or allowed by State and Federal laws, rules, or regulations.
All reasonable efforts to use, disclose, and request only the amount of PHI needed to accomplish the intended
purpose of the use, disclosure, or request will be made. Access to PHI by staff will be on a need-to-know basis
and only those who have a need for the information in connection with their duties that arise out of the
provision of diagnosis, treatment or referral for treatment of alcohol or drug abuse shall have access to the
information needed to carry out the service.
Limits of Confidentiality/Use and Disclosure of PHI Without Consent
Federal laws require or allow that we share your health information, including alcohol and drug abuse records,
with others in specific situations in which you do not have to give consent, authorize or have the opportunity
to agree or object to the use and disclosure. Prior to disclosing your health information under one of these
exceptions, we will evaluate each request to ensure that only necessary information will be disclosed. All other
disclosures will be made only with written consent or authorization. Under the following situations, the types
of uses and disclosures The Recovery Team may make without consent or authorization are:

1. In connection with treatment, payment, or healthcare operations;
2. To qualified service organizations or business associates who provide services to the program’s
   treatment, payment, or health care operations;
3. In medical emergencies;
4. When there is a court order;
5. To auditors and evaluators;
6. To research if the information will be protected as required by Federal regulations;
7. To report suspected child or elderly abuse or neglect; and
8. To report a crime or threat to commit a crime on program premises or against program personnel.
   Federal law and regulations do not protect any information about a crime committed by a Client either
   at the program or against any person who works for the program or about any threat to commit such
   a crime.
   Federal laws and regulations do not protect any information about elderly abuse, suspected child abuse
   or neglect, threats to harm to self or others from being protected or leased to under State law to
   appropriate State or local authorities beyond Federal CFR 42-Regulations. (See 42 U.S.C. 290dd-3 and 42
   U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations)
   How The Recovery Team May Use or Disclose Your Health Information
   Any disclosure of PHI will be made with expressed written consent of the client, except where otherwise
   permitted by law (see Limits of Confidentiality/Use and Disclosure of PHI Without Consent above). The
   authorization may be revoked at any time, unless the program has taken action in reliance on the consent or
   authorization. Once information is disclosed, The Recovery Team can no longer guarantee the protections
   under federal confidentiality laws as there is always the potential for the recipient to re-disclose information
   The Recovery Team will release protected health information only when a valid release of information
   complies with the applicable requirements of 45 CFR §164.508. A proper consent form must contain, at
   minimum, these elements:
   • Name or general designation of the program or person permitted to make the disclosure
   • Name or title of the individual or name of the organization to which disclosure is to be made
   • Name of the client
   • Purpose of the disclosure
   • How much and what kind of information is to be disclosed
   • Signature of client
   • Date on which consent is signed
   • Date, event, or condition upon which consent will expire if not previously revoked
   • A statement that the consent is subject to revocation at any time except to the extent that the
   program has already acted on it
   • A statement that the information disclosed cannot be re-disclosed
   • A statement that the patient will be provided a copy of the signed release
   A general medical release form, or any consent form that does not contain all the elements listed above,
   is not acceptable.
   The following categories describe all the ways that The Recovery Team may use or disclose your health
   information. Any use or disclosure of your health information will be limited to the minimum information
   necessary to carry out the purpose of the use or disclosure. Note that we can only use or disclose alcohol and
   drug abuse records with your consent or as specifically permitted under federal law unless the use falls within
   the “Limits of Confidentiality” (see below). Remember: You can revoke your authorization at any time;
   however, we will be unable to take back any disclosures that have already been made with your
   permission.
   To Obtain Payment – The Recovery Team may use or disclose your health information to insurance companies
   to determine eligibility for plan benefits, obtain authorizations, facilitate payment for the treatment and
   services you receive, and/or determine plan responsibility for benefits. Health information may be shared with
   private insurance to determine medical necessity of services or determine whether a specific service or
   treatment is covered under your plan.
   Treatment/Healthcare Operations – The Recovery Team may use and disclose health information about you
   to carry out necessary quality assurance checks and improvement activities such as handling and investigating
   complaints, reviewing charts for compliance, competency of providers, auditing, etc. The Recovery Team may
   use and disclose your health information to provide and coordinate appropriate treatment services, formulate
   treatment plans, set up referrals with other providers, etc. We may also share your health information with
   emergency treatment providers when you need emergency services. We may also communicate and share
   information with other behavioral health service Providers who have Contracts with The Recovery Team with
   whom we have Business Associate Agreements. We require the contractor to appropriately safeguard your
   information. Prior to sharing PHI with other providers, not contracted with The Recovery Team, you will be
   asked to complete a Release of Information which you can choose to sign or decline.
   Required by Law – The Recovery Team may use and disclose your health information when required by
   statute, regulation, court order, government agency, we reasonably believe an individual to be a victim of abuse,
   neglect or domestic violence, for judicial and administrative proceedings, and enforcement purposes. However,
   no information obtained from a provider–even with the client’s consent–may be used in a criminal
   investigation or prosecution of a client unless a court order also has been issued in accordance with §2.65 We
   may disclose PHI regarding deceased clients as mandated by state law, or to a family member that was involved
   in your care or payment for care prior to death, based on your prior consent. A release of information regarding
   deceased clients may be limited to an executor or administrator of a deceased person’s estate or the person
   identified as next-of-kin.
   Public Health – Your health information may be reported to a public health authority or other appropriate
   government authority authorized by law to collect or receive information for purposes related to preventing
   or controlling disease, injury or disability; reporting to the Food and Drug Administration problems with
   products and reactions to medications, and reporting disease or infection exposure.
   Health Oversight Activities – We may disclose your health information to health, regulatory and/or oversight
   agencies during audits, investigations, inspections, licensure, and other proceedings related to oversight of the
   health care system. Information may be reviewed by investigators, auditors, accountants or lawyers who make
   certain that we comply with various laws or to audit your file to make sure that no information about you was
   given to someone in a way that violated this Notice.
   Judicial and Administrative Proceedings – We may disclose your health information in response to a
   subpoena or court order in the course of any administrative or judicial proceeding, in the course of any
   administrative or judicial proceeding required by law (such as a licensure action), for payment purposes (such
   as a collection action), or for purposes of litigation that relates to health care operations where The Recovery
   Team is a party to the proceeding. However, a subpoena must be attached to a release with the federally
   required information prior to releasing PHI.
   Public Safety/ Law Enforcement – We may disclose your health information to appropriate persons in order
   to prevent or lessen a serious or imminent danger or threat to the health or safety of a particular person or the
   general public or when there is likelihood of the commission of a felony or violent misdemeanor.
   Research – Under certain circumstances, and only after a special approval process, we may use and disclose
   your health information to help conduct research.
   Incidental Uses and Disclosures – Incidental uses, and disclosures of PHI are those that cannot be reasonably
   prevented, are limited in nature and that occur as a by-product of a permitted use or disclosure. Such incidental
   disclosures are permitted if The Recovery Team uses reasonable safeguards and use to disclose only the
   minimum amount of PHI necessary.
   Disclosures of Health-Related Benefits or Services – The Recovery Team may want to contact you regarding
   service reminders, alumni meetings, coordination of care, follow-up services, or for other reasons that may be
   of interest to you. You will be asked to sign a consent for follow-up in cases where you may be contacted postdischarge. You have the right to decline contact or revoke your release at any time.
   To Personal Representatives – The Recovery Team may disclose your health information to a person you have
   designated to act on your behalf and make decisions about your care in accordance with state law. We will act
   according to your written instructions in your chart and will require anyone claiming to be your personal
   representative to provide proof/verification.
   To Family and Friends – The Recovery Team may disclose your health information to persons that you indicate
   are involved in your care or the payment of care. These disclosures may occur when you are not present if you
   agree and do not express objection. These disclosures may also occur if you are unavailable, incapacitated, or
   facing an emergency medical situation and we determine that a limited disclosure may be in your best interest.
   We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts
   in order for that entity to locate a family member or other person that may be involved in caring for you. You
   have the right to limit or stop these disclosures.
   Restricting Uses and Disclosures of Protected Health Information.
   45 CFR § 164.522 details your right to request privacy protection for protected health information (PHI). Be
   advised that restrictions on disclosure of information cannot be accepted except when the individual, family
   member, or other person has provided payment in full by sources other than the insurance company for all
   services on behalf of the individual. If the individual is paying privately for treatment and no insurance
   company is being billed, all services must be paid in full prior to accepting a restriction. All restrictions must be
   documented in accordance with 45 CFR §160.530(j) of Subchapter C in Title 45 of the Code of Federal
   Regulations.
   The Recovery Team must permit an individual to request that we restrict:
   a. Uses or disclosures of PHI about the individual to carry out treatment, payment, or healthcare
   operations; and
   b. Disclosures permitted under 45 CFR §164.510(b) – see above Notice of Privacy Practices
   The Recovery Team must agree to the request of an individual to restrict disclosure of PHI to a health plan, if:
   a. The disclosure is for the purpose of carrying out payment or healthcare operations and is not
   otherwise required by law; and
   b. The PHI pertains to a service for which the individual, family member, or person other than the health
   plan on behalf of the individual, has paid The Recovery Team in full.
   If The Recovery Team agrees to a restriction, we may not use or disclose PHI in violation of the restriction,
   except when the individual who requested the restriction is in need of emergency treatment and the restricted
   PHI is needed to provide that treatment. In this case, we may use or disclose the PHI to the health care provider
   to provide such treatment to the individual. If restricted information is disclosed to a health care provider for
   emergency treatment The Recovery Team must request that the healthcare provider not further use or disclose
   the information.
   The Recovery Team may terminate a restriction, if:
   a. the individual agrees to or requests termination in writing;
   b. the individual orally agrees to the termination and the oral agreement is documented; or
   c. The Recovery Team informs the individual that it is terminating its agreement to a restriction, except
   that such termination is:
9. not effective for PHI restricted as noted above; and
10. only effective with respect to PHI created or received after it has so informed the individual
    If you would like to request a restriction on the use or disclosure of PHI, please advise staff and it will be
    submitted for approval. You must provide specific information as to what you would like restricted.
    Statement of Your Health Information Rights
    Although your health information is the physical property of The Recovery Team, the information belongs to
    you. You have the right to request, in writing, certain uses and disclosures of your health information. There
    are special circumstances in which The Recovery Team may deny a request even though it falls under the rights
    of the individual. Once you have initiated a request to act upon your rights, The Recovery Team will either
    provide the requested information to the individual or provide a reason in writing explaining the reason for
    denial within 30 days. If an extension is needed, the individual will be notified in writing.
    You may exercise any of the rights below by contacting the Quality Assurance Department using the
    contact information at the end of this document.
    Your rights with respect to protected health information are:
    Right to Inspect and Copy – You have the right to inspect and copy your PHI in a designated record set except
    where State law may prohibit client access. A designated record set contains medical, clinical, billing, and case
    management information. If we do not have your PHI record set but know who does, we will inform you how
    to get it. If our PHI is a copy of information maintained by another health care provider, we may direct you to
    request the PHI from them. Should we deny your request for access to information contained in your designated
    record set, you have the right to ask for the denial to be reviewed by another healthcare professional designated
    by The Recovery Team.
    Right to Request Amendment – You have the right to request certain amendments to your PHI if, for example,
    you believe a mistake has been made or a vital piece of information is missing. The Recovery Team is not
    required to make the requested amendments and will inform you in writing of our response to your request.
    Right to Accounting of Disclosures – You have the right to receive an accounting of disclosures of your PHI
    that were made by The Recovery Team for a period of six (6) years prior to the date of your written request.
    This list of PHI that has been disclosed does not include disclosures for purposes of treatment, payment, health
    care operations or certain other excluded purposes, but includes other types of disclosures, including
    disclosures for public health purposes or in response to a subpoena or court order.
    Revoke Authorizations – You have the right to revoke any authorization you have provided, except to the
    extent that The Recovery Team has already relied upon the authorization.
    Right to Receive Confidential Communications – You have the right to receive your health information
    through a reasonable alternative means or at an alternate location. To request confidential communications,
    you must submit your request in writing to the Quality Assurance Department at the address listed below. We
    are not required to agree to your request.
    Right to be Notified of a Breach – You have the right to be notified if we (or one of our Business Associates)
    discover a breach of your unsecured protected health information. Notice of any such breach will be made in
    writing and in accordance with federal requirements.
    Right to Request Restriction of Use and Disclosure – You have the right to request privacy protection of your
    PHI. The Recovery Team will accommodate reasonable requests under a specific circumstance which can be
    found under the section “Restricting Uses and Disclosures of Protected Health Information” in this Notice of
    Privacy Practices. The Recovery Team is not required to agree to your request, and you cannot place limits on
    uses and disclosures that we are legally required or allowed to make.
    Right to a Copy of Privacy Practices and Paper Copy – You have a right to receive an electronic copy of this
    Notice of Privacy Practices and any revised notices at any time.
    Responsibilities and Obligations of Facility
    The Recovery Team is required by law to maintain the privacy and security of Protected Health Information
    that we collect, create, and receive about your past, present, or future health condition including health care
    we provide to you and payment for services. The Recovery Team is also required to provide clients with notice
    of the facility’s legal duties and privacy practices, including any changes to our policies. We are only allowed to
    use and disclose protected health information in the manner described in this Notice. To comply with these
    state and federal laws, The Recovery Team has adopted policies and procedures that require its employees,
    contractors, and business associates to obtain, maintain, use and disclose PHI in a manner that protects client
    privacy. In the case of a breach of unsecured protected health information, all affected individuals will be
    notified in writing via mail. Clients are encouraged to keep their address up to date by contacting the Quality
    Assurance Department. The contact information can be found below.
    Changes to This Notice and Distribution
    The Recovery Team is required by law to provide you with this notice which includes our legal duties, privacy
    practices, and process for changing our policies. The Recovery Team must abide by the terms of the Notice
    currently in effect. The Recovery Team reserves the right to amend this Notice of Privacy Practices at any time
    in the future and to make the new Notice provisions effective for all health information that it maintains. If we
    have more than one Notice of Privacy Practices, the individual will be provided with the Notice that pertains to
    them. The most recent Notice of Privacy Practices will always be posted in a common area of each facility and
    facility building and entered into the EMR to ensure the recent version is reviewed and signed by clients upon
    admission. The Client Handbook will be updated as needed. You may submit a written request at any time using
    the contact information at the end of this form and the most recent notice will be provided to you.
    Complaints
    Complaints about this Notice of Privacy practices or about how we handle your health information should be
    directed to the Haven Health Management Quality Assurance Department at 2925 10th Ave. N. Palm Springs, FL
11. You may also contact the Director of Quality Assurance via email at
    [email protected] or by phone at (561) 516-0734. The Recovery Team will not retaliate
    against you in any way for filing a complaint. All complaints to The Recovery Team must be submitted in
    writing.
    If you believe your privacy rights have been violated, you may also file a complaint with the Secretary of the
    Department of Health and Human Services online at www.hhs.gov/ocr/privacy/hipaa/complaints/ or call
    (800) 368-1019. You may also submit your complaint in writing to:
    The U.S. Department of Health and Human Services
    200 Independence Avenue, S.W.
    Washington, D.C. 20201
    Toll Free: 1-877-696-6775
    Contact
    If you would like to have a more detailed explanation of these rights, or if you would like to exercise one or
    more of these rights, or if you have a complaint, please contact the Quality Assurance Department at:
    Haven Health Management
    Attn: Quality Assurance Dept.
    2925 10th Ave. N.
    Palm Springs, FL 33461
    Phone: (561) 516-0734
    Email: [email protected]