HIPAA & 42 CFR Part 2 Notice of Privacy Practices

Effective date: pending program launch. This notice will be finalized with Virginia counsel before clinical admissions begin and will be presented to every client at intake along with a written acknowledgment.

Two Federal Frameworks

Roanoke Refuge protects your health information under two overlapping federal regulations:

• HIPAA (Health Insurance Portability and Accountability Act): establishes baseline privacy and security standards for all protected health information held by healthcare providers.
• 42 CFR Part 2: provides additional, stricter protections specifically for substance use disorder treatment records. Part 2 generally requires written consent before treatment information can be shared, with limited exceptions.

Where the two frameworks differ, the stricter protection applies. In most cases, that means 42 CFR Part 2 governs.

What Is Protected

Protected information includes anything that could identify you as a person who has received or is receiving substance use treatment from Roanoke Refuge, including your name, your enrollment in the program, your clinical records, lab results, billing information, and any communication between you and our clinical team.

How We Use and Disclose Your Information

We use your information for treatment, payment, and healthcare operations. Specifically:

• Treatment: Your clinical team uses your information to coordinate care, prescribe medication when appropriate, and consult with other clinicians involved in your treatment.
• Payment: We share necessary information with your insurance carrier to verify benefits, obtain authorizations, and submit claims.
• Healthcare operations: We use aggregated information for quality improvement, training, and program evaluation.

When We Share Your Information Outside the Program

Under 42 CFR Part 2, we generally need your written consent to share substance use treatment information with anyone outside Roanoke Refuge, including family members, employers, primary care providers, and even other healthcare providers treating you for separate conditions. Limited exceptions exist:

• Medical emergency: When immediate medical intervention is needed and you cannot consent.
• Court order: When a court of competent jurisdiction issues an order meeting Part 2 requirements.
• Mandated reporting: Suspected child abuse or neglect, as required by Virginia law.
• Crimes on premises or against staff: Limited disclosure to law enforcement.
• Audit and program evaluation: With required confidentiality safeguards in place.

Your Rights

You have the right to:

• Receive a copy of this notice at intake and at any later time on request.
• Inspect and copy your treatment records.
• Request amendments to your records when you believe information is incorrect.
• Request an accounting of certain disclosures of your information.
• Request restrictions on how we use or share your information.
• Revoke prior consent for release of your information at any time, in writing, for any disclosures not already made.
• File a complaint with our privacy officer, with the U.S. Department of Health and Human Services Office for Civil Rights, or with the Substance Abuse and Mental Health Services Administration without retaliation.

Contact

Once the program is operational, a designated privacy officer will be available to answer questions about this notice, accept written authorizations, and process complaints. Contact information will be published here and provided at intake.