Notice of Privacy Practices – Ark National Holdings LLC dba Ark Behavioral Health

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

This notice is effective as of April 12, 2024, and will remain in effect until revised. We must amend this Notice if there are significant changes to your rights, our duties or other practices mentioned here.

Contact

If you have any questions about this Notice of Privacy Practices, please refer to the contacts listed below.

Purpose

Ark Behavioral Health, its facilities, subsidiaries, and all associates are dedicated to offering you top-notch behavioral healthcare services. A crucial part of this commitment is safeguarding your health information as mandated by law. This “Notice of Privacy Practices” (the “Notice”), details your rights and our obligations under the Health Insurance Portability and Accountability Act (HIPAA), and other applicable law.

Protected Health Information (PHI) is health information about you, which (i) someone may use to identify you, and (ii) we keep or transmit in electronic, oral, or written form. PHI includes information such as your: (i) name; (ii) contact information, (iii) past, present, or future physical or mental health, or medical conditions; (iv) payment for health care products or services; or (v) prescriptions.

As part of our commitment and legal compliance, we are providing you with this Notice, which describes:

• Our legal duties and privacy practices regarding your PHI, including our duty to notify you following a data breach of your unsecured PHI;
• Our permitted uses and disclosures of your PHI;
• Your rights regarding your PHI.

Our Duties

We are legally bound to:

1. Maintain the privacy of your PHI;
2. Provide you with a notice of our legal duties and privacy practices concerning your PHI;
3. Notify you in the event of a breach of unsecured PHI related to you;
4. Abide by the terms of this Notice.

We reserve the right to modify our privacy policy, practices, and this Notice, consistent with applicable law and our current business processes. Any new Notice will apply to all PHI we maintain at that time. We will notify you of revisions:

• Upon request;
• Electronically via our website or other electronic means;
• As posted in our place of business.

Additionally, we have an obligation to address your requests (e.g., those related to your rights) promptly and appropriately. We are committed to upholding your privacy rights and ensuring your PHI is protected.

Confidentiality of Alcohol and Drug Abuse Records

The confidentiality of alcohol and drug abuse patient records maintained by us is safeguarded by Federal law and regulation. Generally, we may not disclose any information identifying you as an alcohol or drug abuser or say to a person outside of Ark Behavioral Health, or its subsidiaries, that you are a patient in any of our facilities, except where (i) the patient consents in writing; (ii) the disclosure is allowed by a court order or subpoena; or (iii) the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluations.

Uses and Disclosures

The law permits or requires us to use and disclose PHI in various ways, which are explained in this Notice. We have included some examples, but we have not listed every permissible use or disclosure. When using or disclosing PHI or requesting your PHI from another source, we will make reasonable efforts to limit our use, disclosure, or request about your PHI to the minimum extent necessary to accomplish our intended purpose. The following categories detail the different ways in which we might use and disclose your PHI:

1. Among Ark Behavioral Health Personnel: We may use or disclose information among our personnel who require the information in connection with their duty related to the diagnosis, treatment, or referral for treatment of alcohol and drug abuse. This includes communication:
   • Within Ark Behavioral Health and its subsidiaries;
   • Between Ark Behavioral Health and its associates. For instance, our staff, including doctors, nurses, and clinicians, will utilize your PHI to provide your treatment care. Your PHI may also be used for billing purposes, tracking changes and credits to your account, checking eligibility for insurance coverage, and preparing claims for your insurance company. We may use and disclose your PHI to conduct our healthcare business/operations and perform functions associated with our business activities, including accreditation and licensing.
2. Secretary of Health and Human Services: We are mandated to disclose PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy and Security Rules.
3. Business Associates: We may share your PHI with Business Associates contracted by us to perform services on our behalf which may involve the receipt, use, or disclosure of your PHI. All our Business Associates must commit to:
   • Protecting the privacy of our PHI;
   • Using and disclosing the information only for the purposes for which they were engaged;
   • Adhering to 42 CFR Part 2;
   • Resisting any efforts to obtain access to patient records, except as permitted by law.
4. Health Information Exchanges: We participate in health information exchanges, such as eRx, and Top Lab Direct, which supports electronic information sharing with OmniCare to provide prescription services to patients.
5. Crimes on Premises: We may disclose to law enforcement officers information directly related to the commission of a crime on our premises or against our personnel, or any threats to commit such a crime.
6. Reports of Suspected Child Abuse and Neglect: We may disclose information required by state law about suspected child abuse and neglect to the appropriate state or local authorities. However, the original patient records may not be disclosed without consent, even for civil or criminal proceedings arising from such reports.
7. Court Order: We may disclose information when required by a court order, discovery request, or other lawful process, provided certain regulatory requirements are met.
8. Emergencies: In situations where there is a threat to your health and immediate medical intervention is required, we may disclose your records to medical personnel to ensure you receive the necessary care.
9. Research: Qualified personnel may access the information for the purpose of conducting scientific research, management audits, financial audits, or program evaluation. However, such personnel may not identify you in any reports or disclose your identity in any manner.
10. Audit and Evaluation Activities: We may disclose your information to individuals conducting audit and evaluation activities, provided they agree to certain restrictions on the disclosure of information.
11. Reporting of Death: We may disclose information related to the cause of death to a public health authority authorized to receive such information. For example, we may share PHI with coroners, medical examiners, or funeral directors when an individual dies.
12. Helping with Public Health and Safety Issues: For example, we may share PHI to:
    • Report injuries and births;
    • Prevent disease;
    • Report adverse reactions to medications or medical device product defects;
    • Report suspected domestic violence; or
    • Avert a serious threat to public health or safety.
13. Responding to Organ and Tissue Donation Requests: For example, we may share your PHI to arrange an authorized organ or tissue donation from you or a transplant for you.
14. Other Uses and Disclosures: We may share your information in other ways, usually for public health or research purposes or to contribute to the public good. For more information on permitted uses and disclosures, see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html
15. Addressing Workers’ Compensation, Law Enforcement, or Other Government Requests: for example, we may use and disclose your PHI for:
    • Workers’ compensation claims;
    • Health oversight activities by federal or state agencies;
    • Law enforcement purposes or with a law enforcement official; or
    • Specialized government functions, such as military and veterans’ activities, national security and intelligence, presidential protective services, or medical suitability.
16. Authorization to Use or Disclose PHI: Apart from the above, we will not use or disclose your PHI without your written authorization. If you or your representative authorizes us to use or disclose your PHI, you can revoke that authorization in writing at any time to prevent future uses or disclosures. We will honor oral revocations upon verifying your identity until a written revocation is obtained. Your revocation will not impact any uses or disclosures permitted by your authorization while it was in effect.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact us, and we will make reasonable efforts to follow your instructions.

In these cases, you have both the right and the choice to tell us whether to:

• Share information, such as your PHI, general condition, or location, with your family, close friends, or others involved in your care;
• Share information in a disaster relief situation, such as to a relief organization to assist with locating or notifying your family, close friends, or others involved in your care;
• Exclude your information, such as your name, room number, or general condition, from a hospital directory.

If you cannot tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, according to our best judgment. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we will not share your information unless you give us written permission:

• Most sharing of a mental health care professional’s notes (psychotherapy notes);
• Marketing purposes;
• Selling or otherwise receiving compensation for disclosing your PHI;
• Other uses and disclosures not described in this Notice.

You may revoke your authorization at any time, but it will not affect information that we already used and disclosed.

Patient Rights

You have several rights concerning your PHI. This section explains your rights and some of our responsibilities to help you.

Right to Notice: You have the right to be informed about how your PHI is used and shared. This right ensures that you are kept abreast of our practices and any potential changes to them. Specifically:

• Information: You are entitled to a notice that explains the ways in which we may use or disclose your PHI. This Notice also outlines your rights and our obligations concerning your PHI.
• Accessibility: You can request both a paper and electronic copy of this Notice at any time, ensuring that you can access the information in a format that is convenient for you.
• Updates and Changes: If we make any material changes to our policies, governing our handling of your PHI, you will have the right to receive an updated notice. The new notice will be available upon request, electronically via our website or other electronic means, or as posted in our place of business. This ensures you are always informed about how your information is being protected.
• Website Access: For easy accessibility, this Notice is available on our website. You can view or download it whenever you wish.
• Physical Copies: If you visit one of our facilities, you can ask for a printed copy of this Notice.
• Language and Understanding: We strive to ensure that this Notice is written in clear, concise language to ensure that you fully understand your rights and our practices.

By providing you with comprehensive and accessible information, we aim to empower you to make informed decisions about your healthcare and the privacy of your information.

Right to Access: You have the right to access and review your PHI that is held by us. This right ensures that you can stay informed about your health information and be an active participant in your care. Specifically:

• Requesting Access: You can request to see or get an electronic or paper copy of your medical records and other health information we have about you. This request must be made in writing to ensure proper documentation and processing.
• Response Time: We will respond to your request in a timely manner, ensuring you have access to your information when you need it.
• Denials: In certain situations, we might deny your request to see or get a copy of your PHI. If we do, we will provide the reason for the denial in writing. Reasons might include concerns about patient safety or the privacy of others.
• Review of Denial: If you are denied access, you can ask for a review of that decision. An independent medical professional, who wasn’t involved in the original decision to deny, will be appointed to review your request and the denial. We will comply with the outcome of this review.
• Fees: While you have the right to access your PHI, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.
• Electronic Records: If your PHI is maintained electronically, you have the right to request an electronic copy be provided to you. If you don’t want an electronic format or if it’s not feasible, we will coordinate with you to provide the record in a format that meets your needs.
• Third-Party Directives: You can also request that your PHI be sent to another entity or person, as long as you clearly state that in writing.
• Duration of Maintenance: You have the right to access your PHI for as long as we maintain it. This duration is typically for seven years after your last date of service, or longer if mandated by state or federal laws.

By ensuring you have comprehensive access to your health information, we aim to promote transparency, trust, and patient empowerment in healthcare decisions.

Right to Amend: You have the right to request amendments or corrections to your PHI if you believe there are inaccuracies or if the information is incomplete. This right ensures that your health records are accurate and up-to-date. Specifically:

• Submitting a Request: If you believe there is an error in your PHI or that important information has been omitted, you can request that we amend the existing information or add the missing information. Your request must be made in writing and provide a reason that supports your request for the amendment.
• Response Time: We will respond to your request within 60 days, ensuring timely consideration of your concerns.
• Acceptance or Denial: We may accept or deny your request based on certain criteria. For instance, we might deny the request if:
  • The PHI was not created by us, unless the person or entity that created the information is no longer available to make the amendment.
  • The information is not part of the medical record kept by or for Ark Behavioral Health or any of its subsidiaries.
  • The information is not part of the information which you would be permitted to inspect or copy.
  • The information is accurate and complete.
• Notification of Decision: If we accept your request, we will inform you of our decision, and we’ll undertake efforts to inform others, including specific people you indicate, of the amendment and include the changes in any future disclosures of that information. If we deny your request, we will provide you with a written explanation of why we denied it.
• Statement of Disagreement: If we deny your request, you have the right to write a statement of disagreement. We may then prepare a rebuttal to your statement, and we will provide you with a copy of any such rebuttal.
• Future Disclosures: If you don’t file a statement of disagreement, you still have the right to request that your original amendment request and our denial be attached to all future disclosures of your PHI.
• Record Keeping: All written requests, denials, and statements of disagreement will be kept as part of your medical record, ensuring a transparent history of the amendment process.

By providing you with the right to amend, we aim to ensure that your health records are accurate, complete, and truly reflective of your health history.

Right to an Accounting of Disclosures: You have the right to receive an accounting, which is essentially a list, of certain disclosures we have made of your PHI. This right ensures transparency in how your health information is shared. Specifically:

• Requesting an Accounting: You can request an accounting of disclosures made by us for a specific time period, up to six years before the date of your request. This request must be made in writing to ensure proper documentation and processing.
• Inclusions: The accounting will include each disclosure we made, the reason for the disclosure, and the date of the disclosure. It will also provide details about the recipient of the PHI, including their name, address, and role.
• Exclusions: Not all disclosures will be listed. For instance, disclosures made for treatment, payment, or healthcare operations; disclosures made to you; disclosures made with your authorization; and certain other exceptions will not be included in the accounting.
• Response Time: We will respond to your request within 60 days, ensuring you receive the information in a timely manner.
  Frequency of Requests: You can request an accounting of disclosures once every 12 months for free. If you request this accounting more frequently, we may charge a reasonable, cost-based fee for the additional requests.
• Notification of Fee: If there’s a fee for providing the accounting, we will notify you in advance, allowing you to decide if you want to proceed or withdraw your request.
• Electronic Format: If our records are maintained electronically, you can request an electronic copy of the accounting. If you don’t want an electronic format or if it’s not feasible, we will coordinate with you to provide the record in a format that meets your needs.

By offering you the right to an accounting of disclosures, we aim to maintain transparency and trust, ensuring you are informed about who has accessed your health information and for what purpose.

Right to Request Restrictions: You have the right to request restrictions or limitations on how we use and disclose your PHI for treatment, payment, healthcare operations, or with certain persons involved in your care. As such, this right allows you to have more control over who sees your health information and under what circumstances. Specifically:

• Submitting a Request: If you want certain parts of your PHI to be restricted from being disclosed to specific individuals, entities, or agencies, you can make such a request. This request must be made in writing and should clearly specify the information you want to restrict, to whom you want the restriction applied, and the nature of the restriction.
• Response to Requests: We will carefully review your request. While we are not required to agree to all restrictions, if we believe the restriction is in your best interest and does not interfere with your care or our ability to operate effectively, we may honor it.
• Emergencies: In certain emergencies, we may disclose restricted PHI if it’s deemed necessary for your care. However, we will request that the recipient not further use or disclose the information.
• Termination of Restrictions: You can terminate a restriction at any time upon written request. Additionally, we may also terminate a restriction if we believe it’s in your best interest or if it’s hindering our ability to provide care. However, any written termination of a restriction will only apply to future disclosures.
• Out-of-Pocket Payments: If you pay for a service or health care item out-of-pocket in full, you can ask us in writing not to share that information for the purpose of payment or our operations with your health insurer. We will agree unless a law requires us to share that information.
• Notification of Changes: If we have agreed to a restriction, and there are changes in the agreed-upon circumstances, we will notify you of such changes.
• Impact on Care: It’s important to understand that restricting certain information may affect our ability to provide comprehensive care, especially if other healthcare providers do not have access to a complete medical record.

By providing you with the right to request restrictions, we aim to give you more control over your health information while balancing the need for comprehensive care.

Right to Confidential Communications: You have the right to request that we communicate with you about your PHI and health matters in a specific way or at a specific location to ensure your privacy. This right is designed to provide you with added control over the confidentiality of your health information. Specifically:

• Preferred Methods: You can ask us to contact you in a certain way, for example, at home or at work, or through a specific means like email, phone, or mail. This ensures that we communicate with you in a manner that you feel best protects your privacy.
• Alternate Locations: If you believe that receiving information at your primary address could compromise your safety or privacy, you can request that we send information to an alternative address.
• Making a Request: All requests for confidential communications must be made in writing. In your request, you should describe with specificity how or where you wish to be contacted.
• Reasonable Requests: We will accommodate all reasonable requests. You do not need to provide a reason for your request, but it can be helpful for us to understand and process your request more efficiently.
• Emergencies: In the case of emergencies, we may use our judgment to communicate with you through the most immediate means available, but we will revert to your specified means of communication once the emergency has passed.
• Electronic Communications: If you request email communication, it’s important to understand that email is not always a secure method of communication. We will ensure that any electronic communication adheres to privacy regulations, but you should also ensure your email is secure and accessed only by you.
• Changes to Preferences: If you wish to change your communication preferences, you can do so at any time by submitting a new written request.

By offering you the right to confidential communications, we aim to ensure that you feel safe and secure in how your health information is communicated to you.

Right to Breach Notification: You have the right to be notified promptly if a breach occurs that may have compromised the privacy or security of your PHI. This right ensures transparency and accountability on our part in the event of any unauthorized access or disclosure of your health information. Specifically:

• Definition of a Breach: A breach is generally considered to be an unauthorized use or disclosure HIPAA that compromises the privacy or security of PHI.
• Assessment: Upon discovering a potential breach, we will conduct a thorough assessment to determine the risk level and the potential harm that might come from the unauthorized use or disclosure.
• Timely Notification: If we determine that a breach has occurred, we will notify you without unreasonable delay, but no later than 60 days after the discovery of the breach.
• Contents of Notification: The notification will provide a description of what happened, including the date of the breach and the date of discovery, if known. It will also describe the types of PHI involved, steps you should take to protect yourself from potential harm, what we are doing to investigate the breach, mitigate harm, and prevent further breaches, as well as contact information for further inquiries.
• Methods of Notification: Notification will typically be provided in writing, sent to your last known address. In certain circumstances, if contact information is out of date, alternative methods of notification may be used, such as email or public postings.
• Notification to Media and Authorities: In cases where the breach affects more than 500 residents of a state or jurisdiction, we will also provide notice to prominent media outlets. Additionally, we will notify the Secretary of the U.S. Department of Health and Human Services.
• Substitute Notice: If we have insufficient or out-of-date contact information for 10 or more individuals, we will provide substitute notice, either by posting the notice on our website, public media, or written notice.
• Protection and Redress: We are committed to mitigating any potential harm caused by the breach. This may include offering credit monitoring services, setting up a dedicated call center for questions, or other appropriate measures.

By ensuring you have the right to breach notification, we aim to maintain trust and transparency, ensuring you are informed and empowered in the event of any unauthorized access or disclosure of your health information.

Right to Voice Concerns: You have the right to voice concerns or file a complaint if you believe your privacy rights have been violated or if you are dissatisfied with our privacy practices. This right ensures that you have a platform to express any concerns and that those concerns are taken seriously and addressed promptly. Specifically:

• Internal Complaints: If you have concerns about the way we handle your PHI or our privacy practices, you can file a complaint directly with us. We encourage open communication and would like the opportunity to address any issues directly and promptly.
• External Complaints: If you believe that we have not adequately addressed your concerns or if you believe your rights have been violated, you may file a complaint with the Office of Civil Rights at the US Department of Health and Human Services. Send a letter to: US Department of Health and Human Services, 200 Independence Ave., SW, Room 509F, HHH Building, Washington, DC 20201; call (800) 368-1019; or visit https://www.hhs.gov/ocr/privacy/hipaa/complaints/
• No Retaliation: We are committed to ensuring that you can exercise your rights without fear of retaliation. You will not be penalized, discriminated against, or treated differently for filing a complaint or voicing concerns.
• Response to Complaints: We take all complaints seriously and will investigate each one thoroughly. We are committed to resolving any issues and will provide you with feedback or a resolution as soon as possible.
• Continuous Improvements: We use feedback from complaints as an opportunity for continuous improvement. Addressing your concerns helps us enhance our services and ensure that we uphold the highest standards of privacy and care.
• Support and Guidance: If you need assistance in filing a complaint or are unsure about any aspect of the process, our team is available to guide and support you.

By providing you with the right to voice concerns, we aim to foster an environment of trust, transparency, and open communication, ensuring that your rights and privacy are always upheld.

Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.

Questions, Requests for Information, and Complaints

For questions, requests for information, more information on our privacy policy, complaints, and concerns, please contact us. Our organization’s Chief Compliance Officer can be contacted at:

Ark Behavioral Health’s Chief Compliance Officer:

Doug Schotters
500 Victory Rd. 3rd Floor
Quincy, MA 02171
[email protected]

If you believe your rights have been violated, you can also file a complaint with:

U.S. Department of Health & Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, DC 20201
(877) 696-6775
[email protected]
www.hhs.gov