Privacy Practices

Effective Date: 02/16/2026

As part of our program, we maintain personal information about you and your health. State and federal law, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) protects such information by limiting its uses and disclosures. Protected health information (“PHI”) is information about you, including demographic information, that may identify you or be used to identify you, and that relates to your past, present or future physical or mental health or condition, the provision of health care services, or the past, present or future payment for the provision of health care.

Substance use disorder (SUD) patient records are specifically subject to additional confidentiality restrictions under federal law (42 C.F.R. Part 2) (“Part 2”) and other applicable state and federal law. We are required to comply with these additional restrictions. If a use or disclosure described in this Notice is prohibited or materially limited by more stringent law (including 42 C.F.R. Part 2), we follow the more stringent law.

We are required by law to maintain the privacy of your PHI and the privacy of Part 2 records, to provide you with this Notice of our legal duties and privacy practices, and to notify affected you following a breach of your unsecured PHI or unsecured Part 2 records as required by law. We are required to abide by the terms of this Notice currently in effect.

Your Rights Regarding Your PHI and Part 2 Records

The following are your rights regarding PHI and, where applicable, Part 2-protected SUD records, that we maintain about you:

• Right of Access to Inspect and Copy. You have the right, which may be restricted only in certain limited circumstances, to inspect and copy your PHI that we maintain. We may charge a reasonable, cost-based fee for copies.
• Right to Amend. If you feel that PHI we have about you is incorrect or incomplete, you may ask us to amend the information although we are not required to agree to the amendment.
• Right to an Accounting of Disclosures. You have the right to request a copy of an accounting of disclosures that we make of your PHI, as required by law.

• Right to a List of Disclosures by an Intermediary. You have the right to request a list of disclosures by an intermediary for the past three (3) years, as provided by 42 C.F.R. Part 2.

• Right to Request Restrictions. You have the right to request a restriction or limitation on the use or disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except as required by law for certain disclosures to a health plan when you have paid in full for a service. For Part 2 records, you also have (i) the right to request restrictions of disclosures made with prior consent for treatment, payment, and health care operations as provided by Part 2, and (ii) the right to request and obtain restrictions of disclosures of Part 2 records to your health plan for those services for which you have paid in full, in the same manner as provided under HIPAA.
• Right to Request Confidential Communication. You have the right to request that we communicate with you in a certain way or at a certain location. We will accommodate reasonable requests and will not ask why you are making the request.
• Right to a Copy of this Notice. You have the right to a paper or electronic copy of this Notice.

• Right to Discuss this Notice. You have the right to discuss this Notice with the designated contact person or office identified below.
• Right to Elect Not to Receive Fundraising Communications. If we engage in fundraising communications, you have the right to elect not to receive such communications.

• Right of Complaint. You have the right to file a complaint in writing with us or with the Secretary of Health and Human Services if you believe we have violated your privacy rights. We will not retaliate against you for filing a complaint. To file a complaint with us, submit your complaint in writing to the Privacy Officer at the address or email listed below.

Our Uses and Disclosures of PHI for Treatment, Payment, and Healthcare Operations

Treatment: We may use your PHI for the purpose of providing you with health care treatment. To coordinate and manage your care, we may disclose your PHI to others of your current providers, and to the extent you have not raised an objection in writing, to your prior providers. We may also disclose your PHI to other health care providers who become involved in your care. For Part 2-protected SUD records, disclosures for treatment generally require your written consent unless an exception under 42 C.F.R. Part 2 applies, including certain medical emergencies.

Payment: We may use your PHI in connection with billing statements we send you and our system for tracking charges and credits to your account. We may also disclose your PHI to third party payers for payment purposes, such as to obtain information concerning benefit eligibility and coverage, to submit claims for payment, and for medical necessity and utilization reviews, as permitted by law. For Part 2-protected SUD records, disclosures for payment generally require your written consent unless an exception under 42 C.F.R. Part 2 applies.

Health Care Operations: We may use and disclose your PHI for the health care operations of our program in support of the functions of treatment and payment. Such disclosures may also be made to a Qualified Service Organization and/or to a Business Associate to provide services to the program and its patients for data processing, bill collecting, dosage preparation, laboratory analysis, or legal, medical, accounting, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy. For Part 2-protected SUD records, uses and disclosures for health care operations generally require your written consent unless permitted without consent under 42 C.F.R. Part 2 or other applicable law.

Uses and Disclosures That Do Not Require Your Authorization or Opportunity to Object

Required by Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. For example, we must make disclosures to the Secretary of the Department of Health and Human Services for the purpose of investigating or determining our compliance with the requirements of the Privacy Rule.

Audit and Evaluation: We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies, and organizations that provide financial assistance to the program (such as third-party payers) and peer review organizations performing utilization and quality control. If we disclose PHI to a health oversight agency, we will have an agreement in place that requires the agency to safeguard the privacy of your PHI. We may also disclose Part 2-protected SUD records for audit and evaluation activities as permitted by 42 C.F.R. Part 2 and subject to required safeguards.

Research: We may disclose your PHI for use in a research project that an institutional review board has determined to be of sufficient importance to outweigh the privacy intrusion, to be impracticable without PHI, to have specified safeguards against further disclosure in reports or otherwise, and, among other provisions, to require destruction or de-identification of your PHI.

Criminal Activity on Program Premises / Against Program Personnel: We may disclose your PHI to law enforcement officials if you have committed a crime on program premises or against program personnel or you have made a threat to commit such crimes. Such disclosure is limited to circumstances of the incident, including name, address, status as a patient, and last known whereabouts.

Qualified Service Organization: We may disclose your PHI to a Qualified Service Organization to provide certain services to the program and its patients, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, medical, accounting or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy.

Court Orders and Legal Proceedings

• Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against the patient unless based on specific written consent or a court order;

 

• Records shall only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to the patient or the holder of the record, where required by 42 U.S.C. 290dd-2 and Part 2; and

 

• A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

Uses and Disclosures of PHI (and Part 2 Records) With Your Written Authorization

Uses and Disclosures Not Described: We will make uses and disclosures not described in this Notice only with your written consent, as required by 42 C.F.R. Part 2. For example, disclosure of your Part 2-protected SUD records to a family member, employer, school, or other third party generally requires your written consent unless a Part 2 exception applies.

In addition, we must obtain your written authorization before we may:

• Use or disclose psychotherapy notes (if we maintain them), except as allowed by law.
• Use or disclose your information for marketing purposes, except as allowed by law.
• Sell your protected health information (if ever applicable), except as allowed by law.

You may revoke your authorization in writing at any time, except to the extent we have already relied on it, as permitted by law.

Single consent for future uses/disclosures for treatment, payment, and health care operations. You may provide a single consent for all future uses or disclosures of your Part 2 records for treatment, payment, and health care operations purposes.

Revocation. You may revoke written consent as provided by 42 C.F.R. §§ 2.31 and 2.35.

Redisclosure: Information disclosed under HIPAA may be subject to redisclosure by the recipient and may no longer be protected by HIPAA, depending on the recipient and applicable law. If you sign a written consent for treatment, payment, and health care operations, Part 2 records disclosed to a Part 2 program, covered entity, or business associate pursuant to that consent may be further disclosed by that recipient, without your written consent, to the extent the HIPAA regulations permit such disclosure.

Fundraising: We may use or disclose your Part 2 records to fundraise for the benefit of the part 2 program only if you are first provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.

This Notice: We reserve the right to change the terms of our Notice of Privacy Practices at any time. Any new Notice of Privacy Practices will be effective for all PHI (and Part 2 records) we maintain at that time. We will make available a revised Notice of Privacy Practices by posting in our facility, displaying it on our website at http://www.sundown.org, and providing you a copy upon your request.

Contact Information

If you have any questions about this Notice of Privacy Practices, please contact our Privacy Officer:

Mark Loes or Designee
Sundown M Ranch
P.O. Box 217
Selah WA 98942

or e-mail markloes@sundown.org.

Complaints                                                                                

If you believe we have violated your privacy rights you may file a complaint in writing to us, in care of our Privacy Officer at the address or email above. We will not retaliate against you for filing a complaint. You may also file a complaint with the Secretary of the Department of Health and Human Services.