SECTION 1: Introduction and Applicability
“This Notice of Privacy Practices satisfies both the requirements of the HIPAA Privacy Rule at 45 CFR §164.520 and the Part 2 Patient Notice requirements at 42 CFR §2.22 for covered entities that create or maintain substance use disorder treatment records. The Department of Health and Human Services has confirmed that these notices may be combined into a single document (89 FR 33047).”
Who Will Follow This Notice: This Notice describes the privacy practices of Santa Rosa Behavioral Healthcare Hospital and applies to all workforce members authorized to create health information, including: • All departments and units of Santa Rosa Behavioral Healthcare Hospital • All employees, staff, and personnel • Medical staff and credentialed providers • Students, trainees, and volunteers • Business associates performing services on our behalf These individuals and entities will follow the terms of this Notice and share your health information with each other as necessary for treatment, payment, and healthcare operations described below.
SECTION 2: Our Commitment to Your Privacy
We understand that your health information is personal and sensitive. We are committed to protecting it. This Notice explains how we may use and disclose your health information, your rights regarding your information, and our legal obligations to you.
SECTION 3: How We May Use and Disclose Your Health Information
Uses for Treatment, Payment, and Healthcare Operations
The following describes the ways we may use and disclose your health information for treatment, payment, and healthcare operations without your written authorization:
• Treatment: We may use and disclose your health information to provide, coordinate, or manage your healthcare and related services. For example, we may share your information with doctors, nurses, technicians, medical students, or other personnel involved in your care. We may also disclose information to people outside our organization who may be involved in your care, such as family members, other healthcare providers, or social service agencies.
• Payment: We may use and disclose your health information to bill and collect payment for the services we provide. For example, we may share information with your health insurance company to obtain payment for your healthcare. We may also tell your health plan about a treatment you are going to receive to determine whether it will be covered.
• Healthcare Operations: We may use and disclose your health information for our business operations. For example, we may use your information to evaluate the quality of care you received, to train our staff, or to conduct business planning and management activities. We may also combine health information about many patients to make decisions about what services to offer and whether new treatments are effective. Effective February 26th, 2026
Other Uses and Disclosures We May Make Without Your Authorization
We may also use or disclose your health information for the following purposes without your authorization:
• Public Health Activities: To prevent or control disease, injury, or disability; to report births and deaths; to report suspected abuse or neglect; to report reactions to medications or problems with medical devices; and to notify people about recalls of products they may be using.
• Health Oversight Activities: To federal or state agencies that oversee our activities, such as for audits, inspections, investigations, or licensure.
• Lawsuits and Legal Proceedings: In response to a court order, subpoena, discovery request, or other lawful process.
• Law Enforcement: To law enforcement officials for purposes such as identifying or locating a suspect or missing person, reporting crimes, or complying with a court order or subpoena.
• Coroners and Medical Examiners: To coroners or medical examiners to identify a deceased person or determine cause of death, and to funeral directors as necessary. • Organ and Tissue Donation: To organizations that handle organ, eye, or tissue procurement or transplantation.
• Research: For research purposes when the research has been approved by an institutional review board or privacy board that has reviewed the research proposal. • To Avert a Serious Threat: When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Specialized Government Functions: For military and veterans’ activities, national security and intelligence activities, protective services for the President, or for correctional institutions and law enforcement custody.
• Workers’ Compensation: For workers’ compensation or similar programs that provide benefits for work-related injuries or illnesses.
Uses and Disclosures That Require Your Authorization
We will obtain your written authorization before using or disclosing your health information for purposes other than those described in this Notice. Specifically, we must obtain your authorization for:
Psychotherapy Notes (if we maintain them) – Psychotherapy notes are process notes recorded by a mental health professional during a counseling session and kept separate from your medical record. We generally need your authorization to use or disclose psychotherapy notes.
Substance Use Disorder (SUD) Counseling Notes (if we maintain them) – SUD counseling notes are process notes recorded by an SUD counselor during individual or group counseling sessions and kept separate from your medical record. Under federal law (42 CFR Part 2), we need your specific written consent to use or disclose SUD counseling notes, even for your treatment. You have the right to access your SUD counseling notes (42 CFR §2.23), unlike psychotherapy notes which we can withhold from you under HIPAA.
Uses and disclosures for marketing purposes. We need your authorization before we can use or disclose your health information to market products or services to you, with limited exceptions.
Disclosures that constitute a sale of protected health information. We need your authorization if we receive payment in exchange for disclosing your health information, with certain exceptions.
Your Right to Revoke Authorization: Effective February 26th, 2026 If you provide us with written authorization, you may revoke that authorization at any time by submitting a written revocation to the Health Information Management Department at asr.him@aurorabehavioral.com or by fax (707) 800-7798. The revocation will not affect any actions we took before we received your revocation.
Important Information About Redisclosure
Potential for Redisclosure: Once we disclose your health information to someone outside our organization, that information may be redisclosed by the recipient and may no longer be protected by federal privacy law. We cannot control how others use information after we disclose it to them.
SECTION 4: Additional Information About Use and Disclosure
Fundraising
We may contact you to raise funds for our organization and its operations. We would only use basic contact information such as your name, address, phone number, and the dates you received treatment or services. You have the right to opt out of receiving fundraising communications. Each fundraising communication will include instructions on how to opt out.
Protection for SUD Records in Legal Proceedings
Substance use disorder treatment records received from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.
Enhanced Fundraising Protection for SUD Records
If we create or maintain substance use disorder treatment records protected by 42 CFR Part 2 and intend to use such records for fundraising, we will provide you with a clear and conspicuous opportunity to opt out of receiving fundraising communications BEFORE we use your SUD records for fundraising purposes.
SECTION 5: Special Rules for Substance Use Disorder Records
If you are receiving substance use disorder (SUD) treatment from us, federal law (42 CFR Part 2) provides your SUD treatment records with additional privacy protections beyond what HIPAA requires. These protections apply to records created or received in connection with your SUD diagnosis, treatment, or referral for treatment.
WHAT MAKES SUD RECORDS DIFFERENT:
• Written Consent Generally Required: Unlike other health information that we can use for treatment, payment, and operations without your authorization, we generally need your specific written consent to use or disclose SUD treatment records for these same purposes. You may provide a single consent that allows us to use and disclose your SUD treatment information for all future treatment, payment, and healthcare operations purposes. You may also limit your consent to specific uses or recipients.
Limited Exceptions
We may use or disclose your SUD treatment records without your consent for very limited purposes, including:
• Medical emergencies
• Research (with additional protection)
• Audits and evaluations required by law
• Reporting certain crimes committed at our facility or against our personnel
• How to Provide Consent: Effective February 26th, 2026 If you would like us to use or disclose your SUD treatment records, you will need to sign a written consent form. The consent form will specify what information can be disclosed, to whom, for what purpose, and for how long the consent is valid. You may revoke your consent at any time.
• For More Information: If you have questions about your rights regarding SUD treatment records, please contact the Health Information Management department (707) 800-7761 or email your questions at asr.him@aurorabehavioral.com.
SECTION 6: Your Rights Regarding Your Health Information You have the following rights regarding your health information:
Right to Request Restrictions
You have the right to request restrictions on certain uses and disclosures of your health information. For example, you could ask that we do not use or disclose information about a certain type of therapy you received from us to a family member or friend. We are not required to agree to your request except in one situation: if you pay out-of-pocket in full for a healthcare item or service. You can ask us not to share information about that item or service with your health plan for payment or healthcare operations purposes. We will agree to this request unless we are required by law to share the information. We will need a written request that includes:
• What information do you want to limit • Whether you want to limit our use, disclosure, or both
• To whom you want the limits to apply
Right to Confidential Communications
You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We will accommodate reasonable requests. We will not ask you the reason for your request.
Right to Access, Inspect, and Copy Your Health Information
You have the right to access, inspect, and obtain a copy of your health information that may be used to make decisions about your care. This usually includes medical and billing records but does not include psychotherapy notes or certain other information.
Special Access Rights for Substance Use Disorder Records: If you are receiving substance use disorder treatment, you have the right to access your SUD treatment records, INCLUDING your SUD counseling notes (42 CFR §2.23). This right is broader than HIPAA’s treatment of psychotherapy notes, which we can withhold from you. We may only restrict your access to SUD counseling notes if a qualified professional determines, based on professional judgment.
• We may deny your request to access, inspect, and copy in certain limited circumstances. If you are denied access, you may request that the denial be reviewed.
• If we maintain your health information electronically, you may request an electronic copy. We may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.
Right to Request Amendment
If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You must provide a reason that supports your request. Effective February 26th, 2026
• We may deny your request for an amendment if it is not in writing or does not include a reason to support the request.
• We may also deny your request if the information was not created by us, is not part of the information kept by us, is not part of the information you would be permitted to inspect and copy or is accurate and complete.
Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures.” This is a list of certain disclosures we have made of your health information. This does not include disclosures for treatment, payment, or healthcare operations, disclosures made to you, or disclosures you authorized.
• Your request must state a time period, which may not be longer than six years. The first list you request within a 12-month period will be free. For additional lists, we may charge you for providing these lists.
To request a restriction, or confidential communications, or to request an amendment, or an accounting of disclosure, to your medical record, or if you would like a copy of this notice, email the Health Information Management department at asr.him@aurorabehavioral.com.
SECTION 7:
Our Legal Duties Covered Entity Duties
We are required by law to: Maintain the privacy of your health information Provide you with this Notice of our legal duties and privacy practices Notify you if we experience a breach of your unsecured health information Follow the terms of the Notice currently in effect
Changes to This Notice: We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all health information that we maintain, including information created or received before we made the change. If we make a material change to this Notice, we will: Post the revised Notice in our facility Make the revised Notice available on our website Provide you with a copy of the revised Notice upon request
SECTION 8: How to File a Complaint
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services.
To file a complaint with us: Contact: Melissa Wyckoff, RHIA, CHPS / Director of Health Information Management / Privacy & Security Officer Address: 1287 Fulton Road Santa Rosa, CA 95401 Phone: (707) 800-7762 Email: asr.him@aurorabehavioral.com
To file a complaint with the U.S. Department of Health and Human Services: Office for Civil Rights, U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Washignton, DC 20201 Phone: 1-877-696-6775 Website: https://www.hhs.gov/hipaa/filing-acomplaint/index.html
No Retaliation: You will not be penalized or retaliated against for filing a complaint.