Privacy Policy
Legal
Privacy Policy
1. Scope of this policy
This Privacy Policy applies to information collected through websites operated by Indiana Behavioral Health, our phone lines, our online forms, our marketing communications, and our advertising activities (collectively, the "Services").
This policy does not govern protected health information ("PHI") we maintain about individuals who become our patients. Patient PHI is governed by the Health Insurance Portability and Accountability Act ("HIPAA"), the federal substance use disorder confidentiality rule at 42 CFR Part 2 where applicable, and our separate Notice of Privacy Practices.
2. Information we collect
Information you give us directly
- Contact details — name, phone number, email address, ZIP code or city, and the person you are inquiring on behalf of (self, loved one, referral partner).
- Insurance information — when you request a verification of benefits, we collect insurance carrier name, member ID, group number, subscriber date of birth, and similar data needed to check coverage.
- Reason for reaching out — a short description of what you are looking for help with, which may include limited health information.
- Communications — the content of emails, form submissions, text messages, and voicemails you send us.
Information collected automatically
- Device and log data — IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, timestamps, and approximate location derived from IP.
- Cookies and similar technologies — small data files stored on your device to enable site functionality and measure marketing performance. See Section 6.
- Call metadata — when you call us, we automatically collect the phone number displayed by your carrier, the date and time of the call, its duration, the marketing source that generated the call (through a call-tracking provider), and, where lawful and disclosed, an audio recording of the call.
Information from third parties
- Referral sources — clinicians, hospitals, employers, unions, EAPs, family members, or other parties who refer you to us and share basic contact information.
- Advertising and analytics platforms — aggregated or pseudonymous data about how our ads perform.
- Insurance verification vendors — eligibility responses returned by clearinghouses or payers when we verify benefits on your behalf.
3. How we use information
We use the information described above for the following purposes:
- To respond to your inquiry and connect you with our admissions team.
- To verify your insurance benefits and provide a good-faith estimate of expected costs.
- To schedule and coordinate a clinical assessment and, if you enroll, your treatment.
- To operate, secure, troubleshoot, and improve our Services.
- To measure the performance of our marketing (which ads, keywords, or referral channels lead to genuine treatment inquiries).
- To comply with applicable laws, respond to lawful requests, and enforce our Terms of Use.
- To prevent, detect, and investigate fraud, abuse, harmful activity, or safety concerns.
We do not sell information collected through this website. We do not use information collected through this website to make automated decisions that produce legal or similarly significant effects about you.
4. When we share information
We share information only in the limited circumstances described below.
- Service providers. Vendors that host our website, route phone calls, send email, verify insurance, run analytics, and provide similar functions. These vendors are contractually restricted to using information only to perform services for us, and, when they handle PHI, are engaged under HIPAA Business Associate Agreements.
- With your authorization. When you ask us to share information with a third party (for example, a family member, employer EAP, or referring clinician), we share only what your authorization permits.
- Legal and safety. To comply with a subpoena, court order, or other legal process; to defend our legal rights; or to prevent imminent harm to any person, in each case consistent with HIPAA and 42 CFR Part 2 where those laws apply.
- Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to the same protections described here.
We do not pay for patient referrals, and we do not accept payment in exchange for sending you to a treatment provider. We do not permit our marketing partners to share your health-related information with data brokers.
5. Phone calls, text messages & call recording
Consent to be contacted. When you provide your phone number through our website, a form, or a call, you consent to be contacted by Indiana Behavioral Health at that number about your inquiry and, where applicable, your treatment. This may include calls or text messages placed using automated technology.
Message and data rates. Standard message and data rates may apply to any text messages. Message frequency varies. You may reply STOP at any time to opt out of text messages, and HELP for help. Opting out of marketing text messages will not affect operational messages related to your care (such as appointment reminders).
Call recording. For quality assurance, training, clinical documentation, and compliance monitoring, some calls to and from our admissions and clinical lines are recorded. Where required by law, you will be notified at the beginning of the call. If you do not consent to being recorded, please tell the person you are speaking with, and we will discontinue the recording or continue by another means.
Call tracking. We use call-tracking technology that assigns dynamically inserted phone numbers on our website so that we can attribute inbound calls to the marketing source that generated them. This technology captures your inbound phone number, call time, and the pages you viewed prior to calling. Attribution data is not used for advertising to individuals whose calls indicate protected health information.
6. Cookies, analytics & advertising
We use cookies, pixels, tags, SDKs, and similar technologies (collectively, "tracking technologies") to operate our website, measure how visitors use it, and understand which marketing channels generate treatment inquiries.
Categories of tracking technologies we use
- Strictly necessary — required for the site to function (for example, load balancing and security).
- Performance and analytics — help us understand aggregate traffic patterns, page performance, and where visitors have trouble.
- Advertising and attribution — help us measure the performance of our search, social, and display advertising, and provide non-identifying conversion signals back to advertising platforms.
Health-related advertising restrictions
Because our Services relate to sensitive health topics, we take additional care with advertising technology. We configure advertising and analytics tools to avoid transmitting protected health information, we do not upload identifiable patient lists to advertising platforms, and we restrict remarketing audiences to non-clinical page interactions. Where required, we rely on server-side or aggregated conversion signals rather than pixel-based tracking of clinical events.
Do Not Track & Global Privacy Control
Our website honors Global Privacy Control ("GPC") signals for visitors in jurisdictions where GPC is recognized as an opt-out of the "sale" or "sharing" of personal information. Because browser "Do Not Track" is not consistently implemented, our site does not respond to DNT headers separately from GPC.
7. HIPAA & 42 CFR Part 2
Once you become our patient, the information we collect about your health and treatment is protected health information under HIPAA. Where your care involves treatment for a substance use disorder at a federally assisted program, additional protections apply under 42 CFR Part 2.
These protections are described in detail in our Notice of Privacy Practices, which you will receive at admission. In the event of any conflict between this Privacy Policy and the Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.
8. Data retention & security
We retain information for as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations (including medical record retention requirements under Indiana and federal law), resolve disputes, and enforce our agreements. Marketing and website analytics data is generally retained for no longer than is necessary for the measurement purpose for which it was collected.
We use reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, workforce training, vendor security reviews, and logging and monitoring. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Your privacy rights
Depending on where you live, you may have some or all of the following rights with respect to personal information we hold about you (subject to legal exceptions):
| Right | What it means |
|---|---|
| Access | Request a copy of the personal information we hold about you. |
| Correction | Ask us to correct inaccurate or incomplete personal information. |
| Deletion | Ask us to delete personal information we hold about you. |
| Opt-out of sale/sharing | We do not sell personal information collected through this website. You may still opt out of cross-context behavioral advertising through GPC or by contacting us. |
| Non-discrimination | We will not deny you services or provide a different level of service because you exercised a privacy right. |
| Authorized agent | You may designate an authorized agent to submit requests on your behalf, subject to verification. |
Requests concerning protected health information should be submitted using the process described in our Notice of Privacy Practices. To exercise website privacy rights, contact us using the information in Section 12. We will verify your identity before acting on your request.
10. Children's privacy
Our Services are directed to adults age 18 and older. We do not knowingly collect personal information from children under 13 through our website. If you believe we have collected information from a child under 13, please contact us so we can delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, if the changes are material, provide additional notice (such as a banner on our homepage). Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.
12. How to contact us
Questions or requests concerning this Privacy Policy can be directed to our Privacy Officer:
Privacy Officer — Indiana Behavioral Health5534 Saint Joe Road
Fort Wayne, IN 46835
Phone: (866) 924-5638
Email: privacy@indianabehavioralhealth.com
HIPAA & 42 CFR Part 2
Notice of Privacy Practices
1. Who this Notice applies to
This Notice of Privacy Practices ("Notice") describes how Indiana Behavioral Health ("IBH," "we," "us," or "our") may use and disclose your protected health information ("PHI") to carry out treatment, payment, and health care operations, and for other purposes permitted or required by law. It also describes your rights regarding your PHI.
PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition, related health care services, or payment for those services.
We are required by the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices with respect to PHI, to notify you following a breach of your unsecured PHI, and to abide by the terms of the Notice currently in effect.
2. Special protections: 42 CFR Part 2
The confidentiality of records relating to substance use disorder ("SUD") diagnosis, treatment, or referral for treatment provided by a federally assisted program is also protected by federal law and regulations under 42 U.S.C. § 290dd-2 and 42 CFR Part 2 ("Part 2"). Generally, IBH may not disclose to a person outside IBH that a patient attends the program, or disclose any information identifying a patient as having or having had a substance use disorder, unless:
- The patient consents in writing on a form that meets Part 2 requirements;
- The disclosure is allowed by a court order that complies with Part 2;
- The disclosure is made to medical personnel in a bona fide medical emergency, or to qualified personnel for research, audit, or program evaluation; or
- The disclosure is a report of suspected child abuse or neglect made under state law to appropriate authorities, or a report of a crime committed on IBH premises or against IBH personnel.
Violation of Part 2 by a person is a crime. Suspected violations may be reported to the United States Attorney in the district in which the violation occurs. Part 2 restrictions do not apply to information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.
Where Part 2 provides greater protection than HIPAA, we follow Part 2.
3. Uses & disclosures for treatment, payment & operations
We may use and disclose your PHI for the following purposes, generally without a specific written authorization from you (subject, for SUD records, to Part 2, which may require your written consent for many of these disclosures):
Treatment
We may use and disclose your PHI to provide, coordinate, or manage your health care and any related services. For example, we may share information among your treatment team — therapists, psychiatric providers, care coordinators — and, with your written consent where required, with an outside provider, referring clinician, or facility involved in your care.
Payment
We may use and disclose your PHI to obtain payment for the services we provide. For example, we may share information with your health plan to verify coverage, obtain prior authorization, or submit claims for reimbursement. Where Part 2 applies, we obtain your written consent before sharing SUD-related information for these purposes.
Health care operations
We may use and disclose your PHI for internal operations necessary to run our practice, including quality assessment and improvement, care coordination, staff training and evaluation, licensing, accreditation, medical review, legal services, auditing, and general administration.
Business associates
We contract with third parties to perform certain services for us, such as billing, insurance verification, telehealth technology, electronic health records, secure communications, and legal or accounting services. When these functions require access to PHI, we enter into a written Business Associate Agreement (and, where applicable, a Qualified Service Organization Agreement under Part 2) that requires them to protect your PHI in accordance with law.
4. Uses & disclosures that require your authorization
The following uses and disclosures require your written authorization, which you may revoke at any time in writing (except to the extent we have already taken action in reliance on it):
- Psychotherapy notes — separate notes kept by a mental health provider documenting the contents of a counseling session. Most uses and disclosures require your written authorization.
- Marketing — most uses and disclosures of your PHI for marketing purposes require your written authorization. We will disclose if we receive any financial remuneration for a communication.
- Sale of PHI — we will not sell your PHI without your written authorization.
- Any other use or disclosure not described in this Notice will be made only with your written authorization.
Under 42 CFR Part 2, disclosure of SUD records generally requires your written consent even for treatment, payment, and health care operations. That consent must include specific elements (including the name of the recipient, the purpose of the disclosure, and an expiration date or event) and may be revoked orally or in writing.
5. Uses & disclosures that require the opportunity to object
For non-SUD PHI, we may disclose limited information to a family member, friend, or other person involved in your care or payment for care, unless you object. In the case of SUD records under Part 2, we will not make such disclosures without your written consent, except in an emergency as described below. You may tell us at any time who, if anyone, we may share information with about your care.
6. Uses & disclosures that do not require your authorization
Federal law permits, and in some cases requires, the following uses and disclosures without your authorization (subject, for SUD records, to Part 2, which may require additional safeguards such as a court order):
- As required by law. When required by federal, state, or local law.
- Public health activities. To public health authorities for the prevention or control of disease, injury, or disability, and to the FDA regarding regulated products.
- Victims of abuse, neglect, or domestic violence. Reports of suspected child abuse or neglect to appropriate authorities as required by state law. Other abuse reports as permitted under HIPAA and, when Part 2 applies, subject to Part 2 procedures.
- Health oversight activities. To a health oversight agency for audits, investigations, inspections, and licensure activities.
- Judicial and administrative proceedings. In response to a court order or, in some circumstances, a subpoena or discovery request. Disclosure of Part 2 records in litigation requires a court order that meets Part 2 requirements.
- Law enforcement. For limited law-enforcement purposes as permitted by HIPAA. Part 2 records may only be disclosed to law enforcement to report a crime committed on IBH premises or against IBH personnel, or as authorized by a Part 2 court order.
- Coroners, medical examiners & funeral directors. As necessary for identification, cause of death, or funeral arrangements.
- Organ, eye & tissue donation. To organizations that handle procurement or transplantation.
- Research. Where an Institutional Review Board or Privacy Board has approved a waiver of authorization, or where information is de-identified. Research using Part 2 records requires additional protections.
- To avert a serious threat. To prevent or lessen a serious and imminent threat to health or safety, consistent with law and applicable ethical standards. For Part 2 records, disclosure to medical personnel is permitted in a bona fide medical emergency.
- Specialized government functions. Including for national security, protective services for the President, and certain functions involving military and veterans.
- Workers' compensation. As authorized by, and to the extent necessary to comply with, workers' compensation laws.
7. Your rights
You have the following rights regarding PHI we maintain about you. To exercise any of these rights, contact our Privacy Officer using the information in Section 12.
| Right | What it means |
|---|---|
| Right to inspect & copy | You have the right to inspect and obtain a copy of your PHI in a designated record set. We may charge a reasonable cost-based fee. We may deny access in limited circumstances; if we do, you may request a review of the denial. |
| Right to electronic copy | If we maintain your PHI electronically, you have the right to receive an electronic copy in the form and format you request, if readily producible. |
| Right to amend | You have the right to request that we amend PHI in a designated record set for as long as we maintain the information. We may deny your request in certain circumstances; if we do, you may submit a statement of disagreement. |
| Right to an accounting of disclosures | You have the right to an accounting of certain disclosures of your PHI made in the six years prior to your request (or the applicable Part 2 lookback for SUD records). The first accounting in any 12-month period is free; additional accountings may involve a reasonable, cost-based fee. |
| Right to request restrictions | You have the right to request restrictions on our use or disclosure of your PHI for treatment, payment, or operations. We are not required to agree, except that we must agree to restrict disclosure to a health plan of PHI relating to a health care item or service you paid for in full out of pocket. |
| Right to confidential communications | You have the right to request that we communicate with you about your PHI in a certain way or at a certain location (for example, by mail only, or at a specific phone number). We will accommodate reasonable requests. |
| Right to a paper copy of this Notice | You have the right to a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. |
| Right to be notified of a breach | You have the right to be notified in the event of a breach of your unsecured PHI, as required by law. |
| Right to revoke consent (Part 2) | For SUD records under Part 2, you have the right to revoke your consent to disclosure at any time, orally or in writing, except to the extent we have already acted in reliance on it. |
8. Our duties
We are required by law to:
- Maintain the privacy and security of your PHI;
- Provide you with this Notice describing our legal duties and privacy practices with respect to PHI;
- Follow the terms of the Notice currently in effect;
- Notify affected individuals following a breach of unsecured PHI; and
- Comply with all applicable federal and Indiana state privacy and confidentiality laws, and to follow the more protective law where they differ.
9. Breach notification
If a breach of your unsecured PHI occurs, we will notify you consistent with the HIPAA Breach Notification Rule. Notice will describe the information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate, and how to contact us for more information.
10. Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
To file a complaint with us, contact our Privacy Officer using the information in Section 12.
To file a complaint with the federal government, write to:
Office for Civil Rights — U.S. Department of Health and Human Services200 Independence Avenue, S.W., Room 509F HHH Building
Washington, D.C. 20201
Phone: 1-877-696-6775
Web: hhs.gov/ocr/privacy/hipaa/complaints
Complaints regarding Part 2 violations may also be reported to the United States Attorney for the district in which the violation occurred, or to the Substance Abuse and Mental Health Services Administration ("SAMHSA").
11. Changes to this Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. We will post the revised Notice on our website and make paper copies available upon request. The effective date of the Notice is noted at the top of this page.
12. How to contact our Privacy Officer
To exercise your rights, request a copy of this Notice, or ask questions about our privacy practices, contact:
HIPAA Privacy Officer — Indiana Behavioral Health5534 Saint Joe Road
Fort Wayne, IN 46835
Phone: (866) 924-5638
Email: privacy@indianabehavioralhealth.com
Federal Consumer Protection
No Surprises Act & Good Faith Estimates
1. Overview
The federal No Surprises Act ("NSA"), effective January 1, 2022, created new protections for patients against surprise medical bills. Two of the protections most relevant to Indiana Behavioral Health are:
- The right of uninsured and self-pay patients to receive a written Good Faith Estimate of expected charges before scheduled care; and
- The ability to dispute a final bill that is substantially higher than the Good Faith Estimate through a federal Patient-Provider Dispute Resolution process.
These federal protections are in addition to any rights you may have under Indiana state law.
2. Your Right to a Good Faith Estimate
The following disclosure is provided as required by 45 CFR § 149.610 and related CMS guidance:
You have the right to receive a "Good Faith Estimate" explaining how much your medical care will cost
Under the law, health care providers need to give patients who don't have insurance or who are not using insurance an estimate of the bill for medical items and services.
- You have the right to receive a Good Faith Estimate for the total expected cost of any non-emergency items or services. This includes related costs like medical tests, prescription drugs, equipment, and hospital fees.
- Make sure your health care provider gives you a Good Faith Estimate in writing at least 1 business day before your medical service or item. You can also ask your health care provider, and any other provider you choose, for a Good Faith Estimate before you schedule an item or service.
- If you receive a bill that is at least $400 more than your Good Faith Estimate, you can dispute the bill.
- Make sure to save a copy or picture of your Good Faith Estimate.
For questions or more information about your right to a Good Faith Estimate, visit www.cms.gov/nosurprises or call 1-800-985-3059.
3. How we provide your Good Faith Estimate
If you are uninsured or you do not intend to have a claim submitted to your health plan for our services, we will provide you with a written Good Faith Estimate of the expected charges for a course of treatment in our virtual Intensive Outpatient Program:
- When you schedule. If services are scheduled at least 3 business days in advance, we will provide your Good Faith Estimate within 1 business day of scheduling. If services are scheduled at least 10 business days in advance, we will provide it within 3 business days of scheduling.
- On request. If you ask for a Good Faith Estimate before scheduling, we will provide it within 3 business days of your request.
- Format. You will receive your Good Faith Estimate in writing (paper or electronic, based on your preference) in a form you can easily understand and keep.
What your Good Faith Estimate will include
- Your name and date of birth.
- A description of the primary items and services expected to be furnished (for example, IOP group therapy sessions, individual therapy, psychiatric evaluation, medication management), including the diagnosis codes, service codes, and expected dates of service.
- The expected charges for each item or service, and the total estimated cost of the course of care.
- The name, National Provider Identifier ("NPI"), and Tax Identification Number ("TIN") of Indiana Behavioral Health, and the office or facility location where the services are expected to be furnished.
- A list of items and services that we anticipate would require separate scheduling and that are expected to occur before or following the primary item or service.
- A disclaimer that the Good Faith Estimate is only an estimate of items or services reasonably expected to be furnished at the time it is issued, and that actual items, services, or charges may differ.
- A disclaimer informing you of your right to initiate the patient-provider dispute resolution process if the actual billed charges are substantially in excess of the expected charges, along with instructions for where to find information about how to start the dispute process.
- A disclaimer that the Good Faith Estimate is not a contract and does not require you to obtain the items or services from Indiana Behavioral Health.
4. Patient-Provider Dispute Resolution
If you receive a final bill from Indiana Behavioral Health that is at least $400 more than your Good Faith Estimate for the same items and services, you may be eligible to dispute the charges through the federal Patient-Provider Dispute Resolution ("PPDR") process.
To start the process:
- You must start the dispute process within 120 calendar days of the date you receive the original bill.
- There is a $25 administrative fee to use the PPDR process (waived in certain circumstances).
- You must submit your initiation request to the U.S. Department of Health and Human Services. Instructions are available at www.cms.gov/nosurprises or by calling 1-800-985-3059.
- While your dispute is being reviewed, the provider cannot move the bill for the disputed item or service into collections or threaten to do so, and any collection efforts already in progress must be paused. Any late fees on unpaid amounts must also be suspended, and no adverse action can be taken against you for using the dispute process.
An independent dispute-resolution entity selected by HHS will review the Good Faith Estimate, the bill, and any information submitted by you and by Indiana Behavioral Health, and will determine the amount to be paid.
5. Surprise billing protections
The No Surprises Act also protects insured patients from certain "surprise" out-of-network bills, principally in emergency settings and when out-of-network providers deliver services at an in-network facility without the patient's informed consent.
Indiana Behavioral Health provides scheduled, non-emergency outpatient services. We do not operate a hospital or emergency department. Where NSA balance-billing protections apply, we honor them and will not balance-bill or seek cost-sharing from you in excess of what is permitted by federal law. You will never waive your NSA rights as a condition of receiving care from us.
6. If you have insurance
If you plan to submit a claim to your health plan for our services, we will:
- Verify your benefits before you begin treatment and provide a written summary of expected coverage, cost-sharing, and any authorization requirements identified during verification;
- Clearly explain whether we are considered in-network or out-of-network under your plan, and what that means for your out-of-pocket costs;
- Notify you if a required prior authorization is denied, and discuss options with you before continuing care.
Verification of benefits is not a guarantee of payment by your health plan. Your final out-of-pocket responsibility is determined by your plan when the claim is processed. Beginning January 1, 2022, group health plans and health insurance issuers are required to provide an Advanced Explanation of Benefits upon receiving a Good Faith Estimate from a provider; where required, we will transmit your Good Faith Estimate to your plan so it can prepare that document for you.
7. Financial assistance & self-pay
We offer self-pay pricing for patients who choose not to use insurance or who are uninsured. Financial hardship discounts and payment plans may be available on request. Ask our admissions team for details before you begin treatment.
Indiana Behavioral Health does not pay for patient referrals and does not accept payment for directing you to any specific treatment provider. There is no charge for a benefits check, a Good Faith Estimate, or an admissions conversation.
8. Contact & more information
For more information about your rights under the No Surprises Act, visit www.cms.gov/nosurprises or call the No Surprises Help Desk at 1-800-985-3059 (TTY: 711), 8 a.m. – 8 p.m. Eastern Time, seven days a week.
To request a Good Faith Estimate from Indiana Behavioral Health, or to ask questions about a bill you have received, contact:
Billing & Patient Accounts — Indiana Behavioral Health5534 Saint Joe Road
Fort Wayne, IN 46835
Phone: (866) 924-5638
Email: billing@indianabehavioralhealth.com
HIPAA & 42 CFR Part 2
Notice of Privacy Practices
1. Who this Notice applies to
This Notice of Privacy Practices ("Notice") describes how Indiana Behavioral Health ("IBH," "we," "us," or "our") may use and disclose your protected health information ("PHI") to carry out treatment, payment, and health care operations, and for other purposes permitted or required by law. It also describes your rights regarding your PHI.
PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition, related health care services, or payment for those services.
We are required by the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices with respect to PHI, to notify you following a breach of your unsecured PHI, and to abide by the terms of the Notice currently in effect.
2. Special protections: 42 CFR Part 2
The confidentiality of records relating to substance use disorder ("SUD") diagnosis, treatment, or referral for treatment provided by a federally assisted program is also protected by federal law and regulations under 42 U.S.C. § 290dd-2 and 42 CFR Part 2 ("Part 2"). Generally, IBH may not disclose to a person outside IBH that a patient attends the program, or disclose any information identifying a patient as having or having had a substance use disorder, unless:
- The patient consents in writing on a form that meets Part 2 requirements;
- The disclosure is allowed by a court order that complies with Part 2;
- The disclosure is made to medical personnel in a bona fide medical emergency, or to qualified personnel for research, audit, or program evaluation; or
- The disclosure is a report of suspected child abuse or neglect made under state law to appropriate authorities, or a report of a crime committed on IBH premises or against IBH personnel.
Violation of Part 2 by a person is a crime. Suspected violations may be reported to the United States Attorney in the district in which the violation occurs. Part 2 restrictions do not apply to information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.
Where Part 2 provides greater protection than HIPAA, we follow Part 2.
3. Uses & disclosures for treatment, payment & operations
We may use and disclose your PHI for the following purposes, generally without a specific written authorization from you (subject, for SUD records, to Part 2, which may require your written consent for many of these disclosures):
Treatment
We may use and disclose your PHI to provide, coordinate, or manage your health care and any related services. For example, we may share information among your treatment team — therapists, psychiatric providers, care coordinators — and, with your written consent where required, with an outside provider, referring clinician, or facility involved in your care.
Payment
We may use and disclose your PHI to obtain payment for the services we provide. For example, we may share information with your health plan to verify coverage, obtain prior authorization, or submit claims for reimbursement. Where Part 2 applies, we obtain your written consent before sharing SUD-related information for these purposes.
Health care operations
We may use and disclose your PHI for internal operations necessary to run our practice, including quality assessment and improvement, care coordination, staff training and evaluation, licensing, accreditation, medical review, legal services, auditing, and general administration.
Business associates
We contract with third parties to perform certain services for us, such as billing, insurance verification, telehealth technology, electronic health records, secure communications, and legal or accounting services. When these functions require access to PHI, we enter into a written Business Associate Agreement (and, where applicable, a Qualified Service Organization Agreement under Part 2) that requires them to protect your PHI in accordance with law.
4. Uses & disclosures that require your authorization
The following uses and disclosures require your written authorization, which you may revoke at any time in writing (except to the extent we have already taken action in reliance on it):
- Psychotherapy notes — separate notes kept by a mental health provider documenting the contents of a counseling session. Most uses and disclosures require your written authorization.
- Marketing — most uses and disclosures of your PHI for marketing purposes require your written authorization. We will disclose if we receive any financial remuneration for a communication.
- Sale of PHI — we will not sell your PHI without your written authorization.
- Any other use or disclosure not described in this Notice will be made only with your written authorization.
Under 42 CFR Part 2, disclosure of SUD records generally requires your written consent even for treatment, payment, and health care operations. That consent must include specific elements (including the name of the recipient, the purpose of the disclosure, and an expiration date or event) and may be revoked orally or in writing.
5. Uses & disclosures that require the opportunity to object
For non-SUD PHI, we may disclose limited information to a family member, friend, or other person involved in your care or payment for care, unless you object. In the case of SUD records under Part 2, we will not make such disclosures without your written consent, except in an emergency as described below. You may tell us at any time who, if anyone, we may share information with about your care.
6. Uses & disclosures that do not require your authorization
Federal law permits, and in some cases requires, the following uses and disclosures without your authorization (subject, for SUD records, to Part 2, which may require additional safeguards such as a court order):
- As required by law. When required by federal, state, or local law.
- Public health activities. To public health authorities for the prevention or control of disease, injury, or disability, and to the FDA regarding regulated products.
- Victims of abuse, neglect, or domestic violence. Reports of suspected child abuse or neglect to appropriate authorities as required by state law. Other abuse reports as permitted under HIPAA and, when Part 2 applies, subject to Part 2 procedures.
- Health oversight activities. To a health oversight agency for audits, investigations, inspections, and licensure activities.
- Judicial and administrative proceedings. In response to a court order or, in some circumstances, a subpoena or discovery request. Disclosure of Part 2 records in litigation requires a court order that meets Part 2 requirements.
- Law enforcement. For limited law-enforcement purposes as permitted by HIPAA. Part 2 records may only be disclosed to law enforcement to report a crime committed on IBH premises or against IBH personnel, or as authorized by a Part 2 court order.
- Coroners, medical examiners & funeral directors. As necessary for identification, cause of death, or funeral arrangements.
- Organ, eye & tissue donation. To organizations that handle procurement or transplantation.
- Research. Where an Institutional Review Board or Privacy Board has approved a waiver of authorization, or where information is de-identified. Research using Part 2 records requires additional protections.
- To avert a serious threat. To prevent or lessen a serious and imminent threat to health or safety, consistent with law and applicable ethical standards. For Part 2 records, disclosure to medical personnel is permitted in a bona fide medical emergency.
- Specialized government functions. Including for national security, protective services for the President, and certain functions involving military and veterans.
- Workers' compensation. As authorized by, and to the extent necessary to comply with, workers' compensation laws.
7. Your rights
You have the following rights regarding PHI we maintain about you. To exercise any of these rights, contact our Privacy Officer using the information in Section 12.
| Right | What it means |
|---|---|
| Right to inspect & copy | You have the right to inspect and obtain a copy of your PHI in a designated record set. We may charge a reasonable cost-based fee. We may deny access in limited circumstances; if we do, you may request a review of the denial. |
| Right to electronic copy | If we maintain your PHI electronically, you have the right to receive an electronic copy in the form and format you request, if readily producible. |
| Right to amend | You have the right to request that we amend PHI in a designated record set for as long as we maintain the information. We may deny your request in certain circumstances; if we do, you may submit a statement of disagreement. |
| Right to an accounting of disclosures | You have the right to an accounting of certain disclosures of your PHI made in the six years prior to your request (or the applicable Part 2 lookback for SUD records). The first accounting in any 12-month period is free; additional accountings may involve a reasonable, cost-based fee. |
| Right to request restrictions | You have the right to request restrictions on our use or disclosure of your PHI for treatment, payment, or operations. We are not required to agree, except that we must agree to restrict disclosure to a health plan of PHI relating to a health care item or service you paid for in full out of pocket. |
| Right to confidential communications | You have the right to request that we communicate with you about your PHI in a certain way or at a certain location (for example, by mail only, or at a specific phone number). We will accommodate reasonable requests. |
| Right to a paper copy of this Notice | You have the right to a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. |
| Right to be notified of a breach | You have the right to be notified in the event of a breach of your unsecured PHI, as required by law. |
| Right to revoke consent (Part 2) | For SUD records under Part 2, you have the right to revoke your consent to disclosure at any time, orally or in writing, except to the extent we have already acted in reliance on it. |
8. Our duties
We are required by law to:
- Maintain the privacy and security of your PHI;
- Provide you with this Notice describing our legal duties and privacy practices with respect to PHI;
- Follow the terms of the Notice currently in effect;
- Notify affected individuals following a breach of unsecured PHI; and
- Comply with all applicable federal and Indiana state privacy and confidentiality laws, and to follow the more protective law where they differ.
9. Breach notification
If a breach of your unsecured PHI occurs, we will notify you consistent with the HIPAA Breach Notification Rule. Notice will describe the information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate, and how to contact us for more information.
10. Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
To file a complaint with us, contact our Privacy Officer using the information in Section 12.
To file a complaint with the federal government, write to:
Office for Civil Rights — U.S. Department of Health and Human Services200 Independence Avenue, S.W., Room 509F HHH Building
Washington, D.C. 20201
Phone: 1-877-696-6775
Web: hhs.gov/ocr/privacy/hipaa/complaints
Complaints regarding Part 2 violations may also be reported to the United States Attorney for the district in which the violation occurred, or to the Substance Abuse and Mental Health Services Administration ("SAMHSA").
11. Changes to this Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. We will post the revised Notice on our website and make paper copies available upon request. The effective date of the Notice is noted at the top of this page.
12. How to contact our Privacy Officer
To exercise your rights, request a copy of this Notice, or ask questions about our privacy practices, contact:
HIPAA Privacy Officer — Indiana Behavioral Health5534 Saint Joe Road
Fort Wayne, IN 46835
Phone: (866) 924-5638
Email: privacy@indianabehavioralhealth.com