top of page

Privacy Policy & HIPAA Notice

1. Our Commitment to Your Privacy

The Community Recovery Center of Roane County is committed to protecting your health information. Because we provide Substance Use Disorder (SUD) treatment, your records are protected by two federal laws: the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and 42 CFR Part 2.

2. How We May Use and Disclose Your Information

Under the 2026 Alignment Rules, we may use and disclose your information for the following purposes:

  • Treatment, Payment, and Healthcare Operations (TPO): With your Single Consent, we may disclose your SUD records to other healthcare providers, your insurance company, or for our own internal quality checks. You may provide a one-time consent for all future TPO disclosures, which you may revoke at any time.

  • SUD Counseling Notes: Notes taken by our LADAC II counselors during private sessions are kept separate from your medical record. We will not disclose these notes without a specific, separate written authorization from you, except in very limited circumstances (such as a threat of serious bodily harm).

  • Legal Proceedings (Strict Protection): Your SUD records cannot be used against you in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, unless you provide specific written consent or a court order is issued that meets the strict requirements of 42 CFR Part 2.

  • Public Health: We may disclose de-identified information to public health authorities to help track health trends (e.g., opioid statistics in Roane County) without your consent, provided you cannot be personally identified.

3. Your Rights Regarding Your Records

  • Right to an Accounting of Disclosures: You have the right to receive a list of every time we shared your information for the past 3 years, including disclosures made for treatment, payment, and healthcare operations.

  • Right to Request Restrictions: You may ask us not to share certain information. If you pay for a service out-of-pocket in full, we must honor your request not to share that info with your health plan.

  • Right to Breach Notification: We will notify you promptly if there is a "breach" (unauthorized access) of your unsecured health information.

4. Fundraising

  • If we intend to use any part of your record for fundraising for our 501(c)(3), we must provide you with a clear "opt-out" opportunity before contacting you.

5. Complaints

  • If you believe your privacy rights have been violated, you may file a complaint with:

  • The Privacy Officer at the Community Recovery Center of Roane County.

  • The Secretary of the U.S. Department of Health and Human Services (HHS) through the Office for Civil Rights (OCR).

  • You will not be retaliated against for filing a complaint.

5. Complaints

Primary Federal Regulatory References

  • 42 CFR Part 2 (Confidentiality of SUD Patient Records): The core regulation. The 2024 Final Rule (implemented Feb 16, 2026)

    • Reference: 42 CFR Part 2 - Electronic Code of Federal Regulations

  • The CARES Act (Section 3221): The Congressional mandate that forced HHS to align Part 2 with HIPAA.

    • Reference: Public Law 116-136, Section 3221

  • HIPAA Privacy Rule (45 CFR § 164.520): The section governing the Notice of Privacy Practices. The 2026 update specifically requires the integration of Part 2 protections into this notice.

    • Reference: 45 CFR § 164.520 - Notice of Privacy Practices

bottom of page