HIPAA & 42 CFR Part 2 · Combined Notice
This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. It also describes the additional federal protections that apply to your substance use disorder records. Please review it carefully.
Fortify Wellness (“Fortify,” “we,” “us,” or “our”) is a licensed behavioral health treatment provider offering Partial Hospitalization (PHP) and Intensive Outpatient (IOP) programming, with a focus on co-occurring substance use and mental health disorders, in the San Fernando Valley, California. We are required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
The health information we create and keep about you is called protected health information, or “PHI.” Because Fortify provides substance use disorder treatment, much of your record is also a “Part 2 record”, information that receives an extra layer of federal protection described in Section 02. Where any law that applies to us, including 42 CFR Part 2 or California law, is more protective of your information than HIPAA, we follow the stricter rule.
This is a single, combined notice issued under both the HIPAA Privacy Rule (45 CFR 164.520) and the federal Confidentiality of Substance Use Disorder Patient Records regulation (42 CFR Part 2, including 42 CFR 2.22). It applies to all care you receive at Fortify and to everyone who is part of our workforce.
Records of your substance use disorder diagnosis, treatment, or referral for treatment that we create or receive are protected under federal law 42 CFR Part 2, which is stricter than HIPAA. The purpose of these rules is to make sure that fear of disclosure, discrimination, or legal consequences does not keep people from seeking treatment.
In most cases, we may not tell anyone outside Fortify that you attend our program or share your SUD records without your written consent, except in the limited situations described in this notice. This protection is broader than HIPAA: it generally applies even to disclosures that HIPAA alone would permit. You decide who may receive your SUD information, and you may take that permission back at any time.
You may give us a single written consent that authorizes us to use and disclose your records for your future treatment, payment, and our health care operations. If you give that consent, a HIPAA-covered provider or plan that receives your records under it may then handle them under HIPAA’s rules. You may revoke this consent at any time, in writing, except to the extent we have already acted on it.
If one of our clinicians keeps separate notes analyzing what was discussed in an individual counseling session (“SUD counseling notes,” similar to psychotherapy notes), those notes receive special protection. We will not use or disclose them based on a general treatment, payment, or operations consent, they require your separate, specific written consent, except in narrow circumstances the law allows.
The following describes the ways we may use and disclose your information. For your SUD records, these uses generally require the consent described in Section 02.
We use your information to provide, coordinate, and manage your care, for example, so that your therapist, prescriber, case manager, and group facilitators can work together on your treatment plan, and so we can coordinate with other providers involved in your care when you have consented.
We use and disclose your information to obtain authorization for treatment, to bill and collect payment from your health plan, and to confirm benefits and medical necessity. For example, our utilization review staff may share clinical information with your insurer to obtain approval for a level of care.
We use your information to run our program safely and effectively, for example, quality and outcomes review, staff training and supervision, licensing and accreditation activities, compliance and audit functions, and care coordination.
With your agreement, we may share relevant information with a family member, friend, or other person you identify who is involved in your care or payment for your care. Because of Part 2, we will confirm your consent before sharing your SUD information with family or others.
We may contact you with appointment reminders and information about your treatment. We will use the contact method and level of detail you tell us is safe for you.
The law permits or requires us to use or disclose information without your authorization in certain limited situations. For your SUD records, Part 2 restricts most of these further, so where a situation below would normally apply under HIPAA, we make the disclosure only to the extent Part 2 also allows it.
California law may give you additional protections beyond those described here, including under the Confidentiality of Medical Information Act and California’s mental health confidentiality laws. Where California law is more protective, we follow it.
Your SUD records carry two protections that are stronger than HIPAA and that we want you to understand clearly.
When we share your SUD information with someone you have authorized, we attach a notice telling them they may not pass it on. In substance:
You have the following rights regarding the information we keep about you. To exercise any of them, contact our Privacy Officer (Section 11).
You may inspect and request a copy of the information used to make decisions about your care, in the form and format you request when readily producible. We may charge a reasonable, cost-based fee for copies.
If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain cases and will tell you why in writing.
You may request a list of certain disclosures we have made of your information, including your Part 2 records, other than those for treatment, payment, and operations or those you authorized. (The federal compliance date for the Part 2 accounting requirement follows the corresponding HIPAA Privacy Rule update; we will provide accountings as those requirements take effect.)
You may ask us to restrict how we use or disclose your information for treatment, payment, or operations, or to people involved in your care. We will consider every request, though we are not required to agree to all of them.
You may ask us to contact you in a specific way or at a specific location, for example, only by a certain phone number or address. We will accommodate reasonable requests.
You may revoke a consent or authorization in writing at any time, except to the extent we have already acted on it.
If we ever contact you for fundraising purposes, you have the right to opt out of receiving those communications.
You have the right to be notified if a breach occurs that may have compromised the privacy or security of your information, including your Part 2 records.
You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
We are required by law to maintain the privacy of your information, including the heightened confidentiality of your SUD records; to provide you this notice of our legal duties and privacy practices; to follow the terms of the notice currently in effect; and to notify you following a breach of unsecured protected health information. We may not retaliate against you for exercising any right described here or for filing a complaint.
We may change this notice and make the new terms apply to all information we maintain. If we make a material change, we will post the revised notice in our facility and on our website, and provide it to you on request. Each notice will show its effective date.
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer (Section 11). You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights, which enforces both HIPAA and 42 CFR Part 2. You will not be penalized or retaliated against in any way for filing a complaint.
U.S. Department of Health and Human Services
Office for Civil Rights · 200 Independence Avenue, S.W., Washington, D.C. 20201
Toll-free: 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints/
For questions about this notice, to exercise any of your rights, or to file a complaint with us, contact our Privacy Officer:
