Holdfast Recovery LLC is required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. This notice applies to the records of your care at Holdfast Recovery.

This is a different document from our website privacy policy, which covers information collected through this website before you become a patient.

Extra protection for substance use records

Records of substance use disorder treatment carry protection beyond HIPAA, under federal regulations at 42 CFR Part 2. In practice this means something stronger than most people expect:

We generally may not tell anyone that you are a patient here, or that you ever have been, without your written consent. That includes family, employers and people who call asking for you by name.
Your written consent has to say who may receive information, what may be released, and for how long. You can revoke it at any time, except where it has already been acted on.
Violating these regulations is a federal offense and can be reported to the United States Attorney.

There are limited exceptions where we may share without your consent:

A medical emergency, to the medical personnel treating it
Scientific research, audit or program evaluation, under conditions that protect your identity
A court order that specifically authorizes disclosure after a hearing

Two things Part 2 does not protect: a report of suspected child abuse or neglect, which we are required by Arizona law to make; and information about a crime committed at the program or against anyone who works here.

How we may use and share your information

Without additional authorization, and subject to the Part 2 rules above, we may use your health information for:

Treatment. So the people caring for you can coordinate. Your therapist, the prescriber and the clinical team work from one record, and where residential care is involved that includes AnchorPoint, the organization that delivers it.
Payment. To verify your benefits, obtain authorization and bill your insurer for care you received.
Health care operations. Quality review, staff training, accreditation surveys and the business administration of the program.

Other permitted or required disclosures

The law permits or requires us to share information in specific circumstances, including:

Where required by law, including reporting suspected abuse or neglect of a child or a vulnerable adult
Public health activities, including reporting communicable disease
Health oversight: audits, investigations and licensure inspections by agencies that regulate us
Judicial and administrative proceedings, subject to the Part 2 court-order requirement above
To avert a serious and imminent threat to the health or safety of you or another person
Workers’ compensation, as authorized by law
Military, national security and correctional institution circumstances that may apply to you
Organ and tissue donation, and to coroners and medical examiners

Uses that need your written permission

We will not do any of the following without a separate written authorization from you, which you may revoke at any time:

Use or share psychotherapy notes, except in the narrow cases the law allows
Use your information for marketing
Sell your information. We do not sell patient information under any circumstances.
Use your name, image, story or testimonial in anything we publish. Alumni who appear on this website chose to and can withdraw at any time.

Your rights

To see and get a copy of your record. Electronic where we hold it electronically. We may charge a reasonable, cost-based fee for copies.
To ask us to correct it if you believe something is wrong or incomplete. If we deny the request we will tell you why in writing and you may file a statement of disagreement.
To get a list of disclosures we have made, other than for treatment, payment and operations, for the six years before your request.
To ask us to limit what we use or share. We are not required to agree, with one exception: if you pay for a service in full yourself, you can require us not to share that information with your insurer.
To ask us to contact you a particular way, at a particular number or address. We will accommodate reasonable requests and will not ask you why.
To get a paper copy of this notice, even if you agreed to receive it electronically.
To choose someone to act for you. A person with medical power of attorney or a legal guardian can exercise these rights on your behalf.
To be told if your information is breached. We will notify you if a breach affects your unsecured health information.

Our duties

We are required by law to maintain the privacy and security of your health information, to notify you promptly if a breach occurs that may have compromised it, and to follow the terms of this notice.

We may change this notice, and any change applies to information we already hold as well as information we receive afterwards. The current notice is always available on this page with its effective date, and a copy is available at our office.

How to complain

If you believe your privacy rights have been violated, tell us using the contact details below. You may also complain directly to the United States Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint, and a violation of the substance use confidentiality regulations may be reported to the United States Attorney for this district.

We will not retaliate against you for making a complaint, and it will not affect your treatment.

Who to contact

For anything in this notice, to exercise any of the rights above, or to request a paper copy:

Privacy Officer
Holdfast Recovery LLC
1385 W Iron Springs Rd
Prescott, AZ 86305
(928) 378-3599

Notice of Privacy Practices