Notice of Privacy Practices

Disclosures Permitted without Your Consent:

• Within the Program and for Program Administration: We may use or disclose information among personnel within a Part 2 program who have a need for the information in connection with their duties relating to the diagnosis, treatment, or referral for treatment of patients. Information may also be disclosed to an entity having direct administrative control over the program as permitted by law.
• Qualified Service Organizations and Business Associates: We may disclose information to individuals or organizations that provide services to Wholeness Health, such as billing, data processing, laboratory, legal, accounting, technology, population health management, or other professional services, when the applicable requirements for a Qualified Service Organization agreement, Business Associate agreement, or other legally required protections have been satisfied.
• Medical Emergencies: We may disclose Part 2 records to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient’s prior consent cannot be obtained. Other protected health information may also be used or disclosed for emergency treatment as permitted by HIPAA and applicable law.
• Research: We may use or disclose information for research when the requirements of HIPAA, Part 2, and other applicable law have been satisfied, including applicable privacy, approval, and oversight requirements.
• Audit and Evaluation Activities: We may disclose information for certain authorized audits, evaluations, examinations, or other oversight activities when the requirements of HIPAA, Part 2, and applicable law are satisfied. Persons receiving Part 2 records for these purposes are subject to restrictions on their use and redisclosure.
• Public Health Activities: We may disclose health information to public health authorities as permitted or required by law. When the information is protected by Part 2, disclosure without patient consent for public health purposes will be made only as permitted by Part 2, including applicable requirements concerning de-identification.
• Reports of Abuse, Neglect, or Exploitation: We may disclose information when necessary to make reports of suspected child abuse or neglect or other abuse, neglect, or exploitation when reporting is required or permitted by applicable law. The disclosure of Part 2 information in connection with such reports remains subject to applicable restrictions on the use of Part 2 records in proceedings against the patient.
• Crimes on Program Premises or Against Program Personnel: We may disclose limited information to law enforcement concerning a crime committed, or a threat to commit a crime, on Wholeness Health’s premises or against Wholeness Health personnel, to the extent permitted by applicable law.
• Serious Threats to Health or Safety: We may disclose information when permitted or required by applicable federal or Colorado law to prevent or address certain threats to health or safety or to fulfill an applicable legal duty to warn or protect. Any disclosure will be limited to information permitted or required by applicable law. Additional information regarding Colorado confidentiality requirements is provided in the Colorado Additional Privacy Protections section of this Notice.
• Court Orders and Legal Proceedings: We may disclose information pursuant to a valid court order, subpoena, or other legal mandate when the requirements of HIPAA, Part 2, and applicable Colorado law have been satisfied. Part 2 records generally may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you without your specific written consent or a court order that satisfies Part 2, together with a subpoena or other legal mandate requiring disclosure.
• Cause of Death: We may disclose Part 2 records relating to the cause of death of a patient to a medical examiner, coroner, or other person authorized under applicable law to inquire into or determine the cause of death, when the requirements of Part 2 and other applicable law are satisfied.
• Other Disclosures Required or Permitted by Law: We may use or disclose health information without your authorization or consent in other circumstances when the use or disclosure is specifically required or permitted by applicable federal or Colorado law. When more than one privacy law applies, Wholeness Health will comply with the applicable requirements governing the information.

Disclosures Permitted with Your Consent:

• Treatment, Payment, and Healthcare Operations (“TPO”). We may use and disclose your Part 2 records for TPO purposes. You may provide a single consent for all future TPO uses or disclosures. If your Part 2 records are shared under a consent for this purpose with another Part 2 program or a HIPAA regulated entity (including the components of Wholeness which are not SUD Programs) your records may be further disclosed by the recipient to the extent permitted by HIPAA, or if the Part 2 program is not subject to HIPAA, to the extent permitted by your consent.
• Proceedings Against You. Except where required by a court order, any use or disclosure of your Part 2 records, or testimony relaying the content of such records, in any civil, administrative, criminal, or legislative proceedings against you requires your written consent. Your consent for this purpose must be separate from your consent for any other use or disclosure.
• Prescription Drug Monitoring Programs. We may report any medication prescribed or dispensed by the program to the applicable state prescription drug monitoring program (“PDMP”) if required by applicable state law.

Additional Statements Regarding Part 2 Records.

• Revocation. You have the right to revoke your consent for Part 2 disclosures at any time, except to the extent that action has already been taken in reliance on your consent.
• SUD Counseling Notes. A separate consent is required and must specifically address the use and disclosure of SUD counseling notes (if maintained). This consent cannot be combined with any other legal permission.
• Fundraising Communications. Wholeness Health does not use or disclose your Part 2 records for fundraising communications. If Wholeness Health’s practices change in the future, we will provide you with clear and conspicuous notice in advance and a choice about whether to receive fundraising communications that use your Part 2 information, as required by law.
• Redisclosure. If your Part 2-protected information is disclosed with your consent, recipients of that information are generally prohibited from redisclosing it unless permitted by law. However, as described above, records that are disclosed to a part 2 program or HIPAA regulated entity pursuant to the patient’s written consent for TPO may be further disclosed by that part 2 program or HIPAA regulated entity, without the patient’s written consent, to the extent the HIPAA regulations permit such disclosure.

Colorado Additional Privacy Protections

Your Rights with Respect to Your Health Information:

• Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your health information for treatment, payment, and health care operations. Wholeness Health is generally not required to agree to a requested restriction. However, if we agree to a restriction, we will comply with that restriction except as otherwise permitted or required by law.If you request that we not disclose information to your health plan concerning a health care item or service for which you, or someone on your behalf other than the health plan, have paid Wholeness Health in full out of pocket, we will comply with your request when required by law.Additional restrictions may apply to substance use disorder records protected by 42 C.F.R. Part 2.
• Request Confidential Communications: You have the right to request that we communicate with you about your health information by alternative means or at an alternative location. For example, you may request that we contact you at a particular telephone number or address. We will accommodate reasonable requests as required by law and will not require you to explain the reason for your request.
• Request Access: You generally have the right to inspect and obtain a copy of health information about you maintained by Wholeness Health, in accordance with HIPAA and applicable Colorado law. Certain information may be excluded from this right, including psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, as well as other information that may be restricted from access by law.When applicable, you may request that records maintained electronically be provided to you in an electronic format. Reasonable fees may apply to requests for copies as permitted by federal and Colorado law.
• Request Amendment: You have the right to request an amendment to health information about you if you believe that the information is incorrect or incomplete. Wholeness Health may deny your request under certain circumstances permitted by law. If we deny your request, we will provide you with information regarding the denial and any rights you may have to submit a statement of disagreement or otherwise respond to the denial.If we accept your requested amendment, the amendment will become part of the applicable health record and will be handled in accordance with applicable law.
• Request an Accounting of Disclosures: You have the right under HIPAA to request an accounting of certain disclosures of your health information made by Wholeness Health during the six (6) years prior to the date of your request, or for a shorter period if requested by you. The accounting will not include every use or disclosure of your health information. For example, certain disclosures for treatment, payment, and health care operations; disclosures made directly to you; disclosures made pursuant to your authorization; and certain other disclosures permitted by law are not required to be included in a HIPAA accounting.Federal law also provides certain accounting rights with respect to records protected by 42 C.F.R. Part 2. The compliance date for the additional Part 2 accounting-of-disclosures requirements will be established by the U.S. Department of Health and Human Services. Wholeness Health will provide an accounting of disclosures of Part 2 records as required by applicable law and within the time periods required by law.The first accounting requested within a twelve (12)-month period will be provided without charge. We may charge a reasonable, cost-based fee for additional accountings requested within the same twelve-month period after notifying you of the anticipated cost and giving you an opportunity to withdraw or modify your request.
• Be Notified of a Breach: You have the right to be notified following a breach of your unsecured protected health information when notification is required by law. This requirement also applies to breaches involving records protected by 42 C.F.R. Part 2, when applicable.
• Receive a Copy of This Notice: You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to receive the Notice electronically. You may also obtain the current version of this Notice electronically when it is available on Wholeness Health’s website.
• Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is otherwise legally authorized to act on your behalf, that person may exercise your rights and make choices about your health information as permitted by applicable law. Wholeness Health will verify that the person has appropriate legal authority before taking action on their behalf.
• Exercise Your Rights Without Retaliation: You will not be denied services, discriminated against, intimidated, threatened, coerced, or retaliated against for exercising your privacy rights or filing a complaint regarding our privacy practices.
• Additional Rights Under Colorado Law: Colorado law provides additional protections for certain health information, including mental health information, substance use disorder information, and information concerning certain services to which a minor may independently consent. When Colorado law provides greater privacy protection than HIPAA or other applicable federal law, Wholeness Health will comply with the more protective requirement, as applicable.

Revisions to this Notice

Questions and Complaints