Notice of Privacy Practices for Protected Health Information

This Notice of Privacy Practices (“Notice”) describes how we may use and disclose protected health information (“PHI”) and medical records about you, and explains your rights regarding that information. It applies to PHI we create or receive when we provide substance use disorder and related health care services at our licensed treatment facility.

This Notice is provided in accordance with the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), including 45 C.F.R. Part 164, Subpart E, and applicable California law, including the Confidentiality of Medical Information Act (CMIA), where applicable. It is not a general website data policy; information about non-clinical website use is described separately on our Website Disclosures page.

What is protected health information?

Protected health information (PHI) is information that identifies you and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for that care. PHI includes information in your medical record, clinical assessments, treatment plans, progress notes, laboratory and toxicology results, medication records, insurance and billing information related to treatment, and communications between you and our clinical or medical staff.

When you are a patient or resident in our program, information you provide for treatment, payment, or health care operations is generally PHI and is protected by this Notice and applicable law.

Our pledge regarding your medical information

We understand that your health information is personal. We are committed to protecting the privacy of PHI and medical records we maintain about you and to using and disclosing PHI only as permitted or required by law.

Our legal duties

We are required by law to:

• Maintain the privacy of PHI;
• Provide you with this Notice of our legal duties and privacy practices with respect to PHI;
• Follow the terms of this Notice as currently in effect;
• Notify you following a breach of unsecured PHI as required by HIPAA; and
• Abide by applicable state and federal rules for substance use disorder treatment records, including heightened protections under 42 C.F.R. Part 2 where they apply to records we maintain.

We reserve the right to change our privacy practices and the terms of this Notice as permitted by law. If we make material changes, we will post an updated Notice on our website and make it available at our facility.

How we may use and disclose your protected health information

We may use and disclose PHI for the following purposes without your written authorization, except as otherwise required by law:

For treatment

We may use and disclose PHI to provide, coordinate, or manage your health care and related services. For example, we may share PHI among physicians, nurses, therapists, case managers, and other staff involved in your care; with pharmacies or laboratories; with hospitals or other providers for continuity of care; and with family members or others involved in your care when appropriate and permitted by law.

For payment

We may use and disclose PHI to obtain payment for services we provide, including billing your health plan or insurer, determining eligibility or coverage, obtaining prior authorization, and collecting amounts owed (including use of collection agencies subject to HIPAA limits).

For health care operations

We may use and disclose PHI for health care operations, such as quality assessment and improvement, accreditation (e.g., The Joint Commission), staff training, compliance and audit activities, licensing surveys, business planning, and administrative functions related to operating our treatment program.

Appointment reminders and care communications

We may contact you by phone, mail, email, or text (as you authorize) regarding appointments, follow-up care, or other information related to your treatment.

Other uses and disclosures permitted or required by law

We may also use or disclose PHI when required or permitted by law, including but not limited to:

• Public health activities (e.g., disease reporting as required);
• Reporting abuse, neglect, or domestic violence as required by law;
• Health oversight activities (e.g., DHCS, licensing, accreditation surveys);
• Judicial and administrative proceedings in response to a court order or lawful process;
• Law enforcement purposes as authorized by law;
• Coroners, medical examiners, and funeral directors as authorized;
• Organ and tissue donation if you are an organ donor;
• Research in limited circumstances with appropriate approvals or authorizations;
• To avert a serious threat to health or safety;
• Workers’ compensation as authorized; and
• Military and national security purposes as required by law.

Uses that require your written authorization

We will obtain your written authorization before using or disclosing PHI for purposes not described in this Notice, including most uses and disclosures of psychotherapy notes (where applicable), marketing, or sale of PHI. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Your rights regarding your protected health information and medical records

You have the following rights with respect to PHI we maintain about you. To exercise a right, contact our privacy contact listed above. We may require requests in writing. We will respond within timeframes required by law.

Your right	What it means
Right to inspect and copy	You may inspect and obtain a copy of PHI in your medical record and other designated record sets, subject to limited exceptions. We may charge a reasonable, cost-based fee as permitted by law.
Right to amend	You may request that we amend PHI in your medical record if you believe it is incorrect or incomplete. We may deny your request in certain circumstances and will explain our decision in writing.
Right to an accounting of disclosures	You may request a list of certain disclosures of your PHI made for purposes other than treatment, payment, health care operations, and certain other exceptions during the six years prior to your request (or shorter period as specified by law).
Right to request restrictions	You may request restrictions on how we use or disclose your PHI for treatment, payment, or operations. We are not required to agree except in limited situations (e.g., when you pay out of pocket in full for a service and request that we not disclose PHI to your health plan for that service).
Right to confidential communications	You may request that we communicate with you about PHI by alternative means or at alternative locations (for example, a different mailing address or phone number).
Right to a paper copy of this Notice	You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
Right to choose someone to act for you	If you give someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights on your behalf, subject to law and our verification of their authority.
Right to file a complaint	You may file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us by contacting:

Experience Recovery Detox & Residential, LLC — Privacy Contact
3919 W. Hazard Ave., Santa Ana, CA 92703
Email: info@experiencerecovery.com
Phone: (866) 514-7282

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online: https://www.hhs.gov/ocr/complaints/index.html
• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201
• Phone: 1-877-696-6775 (toll-free)

We will not retaliate against you for filing a complaint.

Breach of unsecured protected health information

If a breach of your unsecured PHI occurs, we will notify you as required by HIPAA, including notice of what happened, what information was involved, steps you should take, what we are doing, and contact information for questions.

Medical records retention

We retain medical records and PHI for the period required by applicable federal and California law, licensing requirements, and professional standards. When records are no longer required to be retained, they are destroyed in a manner that protects your privacy.

Website inquiries and non-clinical information

Information you submit through general website contact forms before you become a patient may not be PHI. Once you begin treatment and we create a medical record, information related to your care is PHI and protected under this Notice. For information about cookies, analytics, and non-clinical website data, see Website Disclosures & Advertising.

Changes to this Notice

We reserve the right to change this Notice. We reserve the right to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. The current Notice will always be posted at https://experiencerecovery.com/privacy/ with the effective date shown above.

Acknowledgment of receipt

When you begin treatment at Experience Recovery, we will offer you the opportunity to acknowledge receipt of this Notice as required by HIPAA. A copy is available on request at our facility and on this website at any time.

This Notice describes our privacy practices for protected health information and medical records. It does not by itself create a provider–patient relationship. For facility licensure, practitioner credentials, and other transparency disclosures, see Facility Licensure & Accreditation and Health Care Practitioner Information.