I. Protected Health Information We Maintain

Protected Health Information (“PHI”) is any information that identifies you and relates to your physical or mental health condition, the healthcare we provide, or the payment for that healthcare. In a detox and residential treatment context, PHI commonly includes:

• Your name, date of birth, address, phone, email, and emergency contacts;
• Insurance information and benefit verification records;
• Substance use history, drug screen results, and intake assessments;
• Withdrawal severity scores (CIWA-Ar, CIWA-B, COWS) and vital-sign logs;
• Medication administration records, including Medication-Assisted Treatment (MAT) prescriptions such as buprenorphine/naloxone (Suboxone) and naltrexone;
• Physician notes, nursing notes, individualized treatment plans, and discharge summaries;
• Mental health, trauma, and dual-diagnosis evaluations;
• Laboratory work, EKGs, and other diagnostic test results;
• Billing, payment, and benefit-determination records.

PHI exists in paper, electronic, and verbal forms. All forms are protected under this Notice.

II. How We Use and Disclose Your PHI

We may use and disclose your PHI for the following purposes without your written authorization, subject to the additional restrictions of 42 CFR Part 2 described in Section VI:

For Treatment. Members of your clinical team — physicians, nurses, therapists, case managers — share PHI with one another to coordinate your inpatient detox and residential treatment at Titan Recovery Center.

For Payment. We use and disclose your PHI to verify your insurance benefits, obtain prior authorization, and submit claims to your health plan.

For Healthcare Operations. We use your PHI for internal quality improvement, clinical training, accreditation surveys conducted by the Joint Commission, and other administrative functions required to operate a licensed facility.

As Required by Law. We disclose PHI when required by federal, state, or local law — including mandatory reporting of suspected child or elder abuse, certain communicable diseases, and court orders that comply with 42 CFR §2.61–2.67.

In Limited Emergency Circumstances. Where permitted by 42 CFR §2.51, we may disclose information to medical personnel in a bona fide medical emergency.

All other uses and disclosures require your specific written authorization, which you may revoke at any time.

III. Your Rights Regarding Your PHI

Under HIPAA and 42 CFR Part 2, you have the following rights with respect to your PHI:

Right to Inspect and Copy (45 CFR §164.524). You may inspect and obtain a copy of your record in paper or electronic form, subject to limited exceptions. We will respond within 30 days. A reasonable, cost-based fee may apply for copies.

Right to Amend (45 CFR §164.526). If you believe information in your record is inaccurate or incomplete, you may request that we amend it. We will respond within 60 days. If we deny your request, you may submit a written statement of disagreement that becomes part of your record.

Right to an Accounting of Disclosures (45 CFR §164.528). You may request a list of disclosures we have made of your PHI for purposes other than treatment, payment, or healthcare operations, going back six years.

Right to Request Restrictions (45 CFR §164.522). You may ask us to restrict certain uses or disclosures of your PHI. We are not generally required to agree, except where you pay for a service in full out of pocket and ask us not to disclose that service to your health plan.

Right to Confidential Communications. You may ask that we contact you only at a specific phone number, email address, or mailing location — including a location other than your home — and we will accommodate reasonable requests.

Right to Breach Notification. Pursuant to Section 13402 of the HITECH Act, we will notify you within 60 days of discovering any breach of your unsecured PHI.

Right to Revoke Authorization. When you sign a written authorization for any use or disclosure of your PHI, you may revoke it in writing at any time, except to the extent we have already acted in reliance on it.

Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

California Rights. California residents have additional rights under the Confidentiality of Medical Information Act (Civil Code §56) and the Patient Access to Health Records Act (Health & Safety Code §123100 et seq.), including expedited access timelines and additional restrictions on disclosure to employers, insurers, and marketing partners.

IV. Our Responsibilities

Titan Recovery Center is required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this Notice describing our legal duties and your privacy rights;
• Notify you if a breach of your unsecured PHI occurs;
• Train our workforce on HIPAA and 42 CFR Part 2 requirements at hire and annually;
• Conduct security risk assessments and implement administrative, physical, and technical safeguards under the HIPAA Security Rule (45 CFR Part 164 Subpart C);
• Execute Business Associate Agreements with any third party that handles your PHI on our behalf;
• Abide by the terms of the Notice currently in effect.

We will not use or disclose your PHI for marketing purposes, sell your PHI, or use psychotherapy notes for purposes other than treatment without your specific written authorization, except where the law permits or requires us to do so.

V. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or directly with the federal government. We will not retaliate against you for filing a complaint.

With Titan Recovery Center. Submit a written complaint to the Privacy Officer at the address in Section VIII. We will respond within 30 days.

With the U.S. Department of Health and Human Services.

Office for Civil Rights — Region IX
90 7th Street, Suite 4-100, San Francisco, CA 94103
Telephone: (800) 368-1019 (toll-free) · TDD: (800) 537-7697
Online complaint portal: ocrportal.hhs.gov

A complaint to OCR must be filed within 180 days of the date you knew or should have known of the violation.

VI. Substance Use Disorder Records — 42 CFR Part 2

Because Titan Recovery Center is a federally assisted substance use disorder treatment program, your records receive an additional layer of protection beyond HIPAA. Under 42 CFR Part 2:

• The fact that you are or were a patient at Titan Recovery Center is itself protected. We will not acknowledge your status to family members, employers, or other third parties without your written consent — not even to confirm that you are here.
• A written consent that complies with 42 CFR §2.31 is generally required before we may share your records with anyone outside the facility, including primary care providers, family members, or other treatment programs.
• Disclosures made with your consent are limited to the specific purpose and recipient identified on the consent form.
• Re-disclosure of Part 2 records by anyone who receives them is prohibited unless permitted by a new consent or another Part 2 exception.

Limited exceptions to the consent requirement include bona fide medical emergencies, audits and program evaluations conducted under §2.53, qualified research, court orders that comply with §2.64–2.67, and mandatory reports of suspected child abuse or neglect to the extent permitted under §2.12(c)(6).

If you have questions about how 42 CFR Part 2 applies to your records, our Privacy Officer will walk you through the consent forms in plain language before you sign anything.

VII. Changes to This Notice

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. Any revised Notice will be posted in our facility and on our website, and provided on request.