Notice of Privacy Practices for INTEGRIS Health, Inc. Substance Use Disorder Part 2 Programs

This notice describes:

• How medical information about you may be used and disclosed.
• Your rights with respect to your medical information.
• How to file a complaint concerning a violation of the privacy or security of your medical information, or of your rights concerning your information.
• Your right to a copy of the notice (in paper or electronic form) and to discuss it with the Privacy Office at [email protected] if you have any questions.

Who We Are

This notice describes the privacy practices of INTEGRIS Health, Inc’s Substance Use Disorder Part 2 Programs and includes inpatient, outpatient, and virtual services offered at these facilities, individually and collectively.

I. Our Privacy and Confidentiality Obligations

We are legally required to protect the privacy and confidentiality of your health information, which includes details about your health, healthcare, and payment for services (referred to as “protected health information” or “information”). This notice outlines our legal duties and privacy practices regarding your protected health information. We will also notify you if there is a breach of unsecured protected health information. When we use or disclose your information, we must follow the terms of this notice (or any updated notice in effect at the time).

• Protected Health Information in connection with substance use disorder services: 42 CFR Part 2 protects your health information if you are applying for or receiving services (including diagnosis or treatment, or referral) for substance use disorder. Generally, if you are applying for or receiving services for substance use disorder, we may not acknowledge to a person outside the program that you attend the program except under certain circumstances that are listed in this notice.
• All Protected Health Information, including substance use disorder services: The Health Insurance Portability and Accountability Act ("HIPAA") Privacy Regulations (45 CFR Parts 160 and 164), also protect your health information whether you are applying for or receiving services for substance use disorder. Generally, if you are not applying for or receiving services for substance use disorder, the way we may use and disclose information differs slightly. These differences are listed in this notice.

II. Uses and Disclosures WITH Your Authorization: All Protected Health Information

We may use or disclose your protected health information when you give your authorization to do so in writing.

• Single Consent: You may provide a single consent for all future uses or disclosures for treatment, payment, and healthcare operations purposes. Recipients of your protected health information for these purposes are legally required to protect your protected health information. Those who are bound by HIPAA regulations may share your information only as permitted by HIPAA, but they are prohibited from redisclosing it for civil, criminal, administrative, or legislative proceedings against you.
• Revocation of Authorization: You may revoke your authorization at any time, except to the extent that we have already acted upon the authorization. If you are currently receiving care and wish to revoke your authorization, contact your counselor. After you are discharged, you will need to contact the Health Information Department.

III. Uses and Disclosures WITHOUT Your Authorization: All Protected Health Information

Even when you have not given your written authorization, we may use and disclose information under the circumstances listed below. This list applies to all protected health information, including the information we get when you are applying for or receiving services for substance use disorders.

• Treatment. We may use or disclose your protected health information for treatment purposes. Treatment includes diagnosis, treatment and other services, including discharge planning. For example, counselors may disclose your health information to each other to coordinate individual and group therapy sessions for your treatment or information about treatment alternatives or other health-related benefits and services that are necessary or may be of interest to you.
• Health Care Operations. We may use or disclose your protected health information for the purposes of health care operations that include internal administration and planning and various activities that improve the quality and effectiveness of care. For example, we may use information about your care to evaluate the quality and competence of our clinical staff. We may disclose information to qualified personnel for outcome evaluation, management audits, financial audits, or program evaluation; however, such personnel may not identify, directly or indirectly, any individual patient in any report of such audit or evaluation or otherwise disclose patient identities in any manner. We may disclose your information as needed within INTEGRIS Health to resolve any complaints or issues arising regarding your care. Health care operations may also include the use of your protected health information for programs offered by INTEGRIS Health, such as sending you invitations to alumni events and workshops sponsored by INTEGRIS Health. This list of examples is for illustration only and is not an exclusive list of all the potential uses and disclosures that may be made for health care operations.

Other allowable uses and disclosures without your authorization, aside from treatment and health care operations, include:

1. Appointment Reminders. We may contact you to send you reminder notices of future appointments for your treatment.
2. Medical Emergencies. We may disclose your protected health information to medical personnel to the extent necessary to meet a bona fide medical emergency (as defined by 42 CFR Part 2) this information might include HIV status, if applicable.
3. Minors. We may disclose to a parent or guardian or other person authorized under state law to act on behalf of a minor, those facts about a minor which are relevant to reducing a threat to the life or physical well-being of the minor or any other individual, if the program director determines that the minor applicant lacks capacity to make a rational decision and the minor’s situation poses a substantial threat to the life or physical well-being of the minor or any other individual which may be reduced by communicating relevant facts to such person.
4. Incompetent and Deceased Patients. In such cases, authorization of a personal representative, guardian or other person authorized by applicable state law may be given in accordance with 42 CFR Part 2.
5. Decedents. We may disclose protected health information to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.
6. Judicial and Administrative Proceedings. We may disclose your protected health information in response to a court order that meets federal regulations, specifically 42 CFR Part 2, which protects the confidentiality of substance use disorder patient records.
• Use in Legal Proceedings: Your records or testimony about protected health information cannot be used in any civil, administrative, criminal, or legislative proceedings against you unless you give specific written consent or there is a court order.
• Court Order Requirements: Your medical records can only be disclosed with a court order after you or the record holder have been given notice and an opportunity to be heard.
• Subpoena Requirement: A court order must be accompanied by a subpoena or similar legal mandate before your medical records can be disclosed

Note, if your records are not considered “patient records” under 42 CFR Part 2 (e.g., created as a result of your participation in the family program or non- treatment setting), they may not be protected by these regulations.

7. Commission of a Crime on Premises or against Program Personnel. We may disclose your protected health information to the police or other law enforcement officials if you commit a crime on the premises or against program personnel or threaten to commit such a crime.
8. Child Abuse. We may disclose your protected health information for the purpose of reporting child abuse and neglect and, in Minnesota, prenatal exposure to controlled substances, including alcohol, to public health authorities or other government authorities authorized by law to receive such reports.
9. Duty to Warn. Where the program learns that a patient has made a specific threat of serious physical harm to another specific person or the public, and disclosure is otherwise required under statute and/or common law, the program will carefully consider appropriate options that would permit disclosure.
10. Audit and Evaluation Activities. We may disclose protected health information to those who perform audit or evaluation activities for certain health oversight agencies, e.g., state licensure or certification agencies, the Joint Commission on Accreditation of Healthcare Organizations, which oversees the health care system and ensures compliance with regulations and standards, or those providing financial assistance to the program.
11. Fundraising Communications. We may use some health information to contact you about fundraising programs. If, in the past, you have been a donor to one of the INTEGRIS Health hospitals or programs, you may receive mailings related to specific areas or programs. We may disclose this information to a business associate or an institutionally related foundation to assist us in fundraising efforts. Each fundraising communication will include a clear and conspicuous statement allowing you the opportunity to elect not to receive any further fundraising communications. We will not send any further fundraising communications to you if you elect not to receive them. We will not condition treatment or payment on your choice with respect to the receipt of fundraising communications.
12. Research. We may use or disclose protected health information without your consent or authorization if our research privacy board approves a waiver of authorization for disclosure.
13. Marketing Communications. We must obtain your authorization for any use or disclosure of Health Information for marketing. The following are activities are not considered marketing, and we may conduct them without authorization: (i) a face-to-face communication made by INTEGRIS Health to a patient; ii) a promotional gift of nominal value; (iii) refill reminders so long as any payment received is limited to the cost of making the communication; (iv) case management; (v) care coordination; (vi) communications that merely promote health in general; and (vii) communications to you concerning health-related products, benefits or services related to your treatment or alternative treatments, therapies, providers or care settings.
    Note, we do not sell our patients’ protected health information.

IV. Uses and Disclosures WITHOUT Your Authorization—Protected Health Information NOT in Connection with Substance Use Disorder Diagnosis, Treatment, or Referral.

If you are not applying for or receiving services for substance use disorder, the rules governing the use and disclosure of protected health information are different from and less restrictive than the rules governing information involving substance use disorder diagnosis, treatment and referral. The next section lists the additional allowable disclosures that may be made without your authorization if you are not applying for or receiving services for substance use disorder. (This list does NOT apply to those individuals applying for or receiving services for substance use disorder):

1. Allowable disclosure when required by law. We may disclose your protected health information as required by state or federal law.
2. Allowable disclosure for health or safety. We may disclose your protected health information to avert or lessen a serious threat of harm to you, to others, or to the public.
3. Expanded allowable abuse reporting/investigation of abuse. We may disclose protected health information to a person legally authorized to investigate a report of abuse or neglect.
4. Expanded allowable public health and health oversight activities. We may disclose your protected health information for public health purposes and health oversight purposes including licensing, auditing or accrediting agencies authorized or allowed by law to collect such information, including, for example, when we are required to collect, report or disclose information about disease, injury, vital statistics for public health purposes or other information for investigation, audit or other health oversight purposes.
5. Expanded allowable disclosure for law enforcement activities. We may disclose protected health information to law enforcement officials in response to a valid court order or warrant or as otherwise required or permitted by law.
6. Expanded allowable disclosure to your legally authorized representative. We may disclose your health information to a person appointed by a court to represent or administer your interests.
7. Expanded allowable disclosure in judicial and administrative proceedings. We may disclose your health information pursuant to a valid court or administrative order, or in some cases, in response to a valid subpoena or discovery request.
8. Allowable disclosure to the Secretary of Health and Human Services. We must disclose your health information to the United States Department of Health and Human Services when requested to enforce the privacy laws.

V. Your Rights

When it comes to your protected health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

1. Right to Receive Confidential Communications. Normally we will communicate with you through the phone number and /or address you provide. You may request, and we will accommodate, any reasonable, written request for you to receive your protected health information by alternative means of communication or at alternative locations.
2. Right to Request Restrictions. At your request, we will not disclose health information to your health plan if the disclosure is for payment of a health care item or service for which you have paid out of pocket in full unless a law requires us to share that information. You may request additional restrictions on our use and disclosure of protected health information for treatment, payment and health care operations. While we will consider requests for additional restrictions carefully, we are not required to agree to the requested restriction if it affects your care. If you wish to request additional restrictions and you are currently receiving services, please contact your counselor.

Once you are no longer receiving services, contact the Health Information Department in writing. We will send you a written response.

3. Right to Inspect and Copy Your Health Information. You may request access to your medical record maintained by us to inspect and request copies of the records. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records and you are currently receiving services, please ask your counselor for the records. Once you are no longer receiving services, contact the Health Information Department.
4. Right to Amend Your Records. You have the right to request that we amend protected health information maintained in your clinical file or billing records. If you desire to amend your records and you are currently receiving services, please contact your counselor. Once you are no longer receiving services, contact the Health Information Department. Under certain circumstances, INTEGRIS has the right to deny your request to amend your records and will notify you of this denial in writing within 60 days. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend,” a record, we may append information to the original record, as opposed to physically removing or changing the original record. If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical record.
5. Right to Receive an Accounting of Disclosures (list of those with whom we shared information). You can request a list of the times we shared your medical information for six years prior to the date of request, who we shared it with, and why. If you request an accounting of disclosures more than once during a twelve (12) month period, there will be a reasonable, cost-based fee. You will be told the cost prior to the request being filled.
6. Right to Receive Notification of Breach. You will be notified in the event we discover a breach has occurred such that your protected health information may have been compromised. A risk analysis will be conducted to determine the probability that protected health information has been compromised. Notification will be made no more than 60 days after the discovery of the breach, unless it is determined by a law enforcement agency that the notification should be delayed.
7. Right to Receive a Paper Copy of This Notice. Upon request, you may obtain a paper copy of this notice.

Violation of federal law and regulations on Confidentiality of Substance Use Disorder Patient Records is a crime, and suspected violations of 42 CFR Part 2 may be reported to the United States Attorney in the district where the violation occurs. Upon request, we will provide you with the appropriate agency contact information.

VI. Effective Date and Duration of This Notice

1. Effective Date. This notice is effective on February 16, 2026.
2. Right to Change Terms of This Notice. We may change the terms of this notice at any time. If we change this notice, we may make the new notice terms effective to all protected health information that we maintain, including any information created or received prior to issuing the new notice. If we change this notice, we will post the new notice in public access areas at our service sites and on our Internet site at www.INTEGRISHealth.org. You may also obtain any new notice by contacting the INTEGRIS Health Privacy Office.

How to Contact Us

If you need to request medical records or exercise any of the rights laid out in this Notice, please contact our Health Information Management department:

If you would like to receive a paper copy of this Notice, have questions about this Notice and about our privacy practices, or need to lodge a complaint or report a breach of privacy, please contact the INTEGRIS Health Privacy Officer:

You may also file a complaint if you feel your privacy rights have been violated to the United States Secretary of the Department of Health and Human Services, within 180 days learning about the violation. We will not retaliate against you for filing a complaint.