Notice of Privacy Practices for ARC Wellness
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Explanation of Form
ARC Wellness, LLC (the “Practice”) handles personal health information (“PHI”) about you, and how that information is handled is regulated by law, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and, for substance use disorder (“SUD”) treatment records, 42 CFR Part 2 (“Part 2”). In the course of treatment, the Practice may receive records from healthcare providers that are Part 2 programs. When the Practice receives those records, only those records remain subject to the additional protections of 42 CFR Part 2. To comply with the law, the Practice asks you to acknowledge receiving this notice in writing.
Types of Uses and Disclosures
PHI about you may be used or disclosed by the Practice for the reasons described in this Notice, including, but not limited to treatment, payment, and health care operations without your authorization (See discussion further below regarding special treatment for SUD treatment records). Treatment includes consultation, diagnosis, provision of care, and referrals. Payment includes all those things necessary for billing and collection, such as claims processing. Health care operations include things the Practice does to assess the quality of care, train staff, and manage the Practice’s business. Some examples of these disclosures are below.
Examples of Treatment Disclosure
The Practice may disclose PHI about you to a medical specialist, a hospital or other providers to help them diagnose and treat an injury or illness. The Practice may use your PHI to send you (via telephone, email, text or other electronic communication means) information and/or reminders about upcoming appointments, refills, and other aspects related to your care and treatment, including to describe health-related products or services that are provided by the Practice. The Practice may also use or disclose your PHI to direct or recommend alternative treatments, therapies, health care providers, or settings of care. Treatment Disclosure may involve communicating with healthcare providers and others not affiliated with us. We may also share your health information with individuals or entities outside of the Practice who are involved in your care, such as treating physicians, home health providers, pharmacies, medical or pharmaceutical consultants, and family members.
Example of Payment Disclosure
The Practice may disclose your PHI when your insurance company requires the information before paying for your health care services.
Examples of Health Care Operations Use
We may use and disclose your health information, including PHI, outside of the Practice for purposes related to our health care operations, including in healthcare operations processes assisted by artificial intelligence (AI), such as medical transcription. These activities support the efficient management of the Practice and help us enhance the quality of patient care. For instance, we may use your health information to assess the care provided to you and evaluate the performance of our staff. Additionally, we may analyze health information from multiple patients to identify opportunities for new services, determine the necessity of existing services, or assess the effectiveness of certain treatments. We may also share information with doctors, nurses, technicians, medical students, and others within the Practice for training and quality improvement purposes. When sharing data with external parties for research or analysis, we may remove any information that identifies you to ensure your privacy is protected, or we may require external parties to do so. The Practice may use your PHI when it hires new staff whose training requires information about the medical needs of our patients.
Other Uses and Disclosures
The Practice may also use or disclose your PHI in the following situations without your authorization. These situations include:
As Required By Law
The Practice may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law.
Public Health and Health Oversight
The Practice may disclose PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the PHI. The disclosure will be made for the purpose of controlling disease, injury or disability. The Practice may also disclose PHI, if directed by the public health authority, to another government agency that is collaborating with the public health authority. The Practice may also disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
Communicable Diseases
The Practice may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Abuse or Neglect
The Practice may disclose your PHI to a public health authority that is authorized by law to receive reports of child and other types of abuse or neglect. In addition, the Practice may disclose PHI if the Practice believes that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such PHI. In this case, the disclosure will be made consistent with applicable law.
Food and Drug Administration
The Practice may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.
Legal Proceedings
The Practice may disclose PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.
Law Enforcement
The Practice may also disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the Practice, and (6) medical emergency not on the premises and it is likely that a crime has occurred.
Coroners, Funeral Directors, and Organ Donation
The Practice may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. The Practice may also disclose PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out his duties. The Practice may disclose such PHI in reasonable anticipation of death. PHI may be used and disclosed for cadaveric organ, eye or tissue donation purposes.
Research
The Practice may use or disclose your PHI for research purposes in compliance with applicable laws and regulations. Research helps improve public health and advance medical knowledge. Before we use or disclose your health information for research, the research project must go through a special approval process. This process ensures that researchers will use or disclose only the minimum necessary information and take measures to protect your privacy. In certain cases, your authorization may not be required for research purposes, such as when:
- The research has been reviewed and approved by an Institutional Review Board (IRB) or Privacy Board that determines the research poses minimal risk to your privacy.
- The health information is necessary for the research but identifying details (e.g., name, address) are removed to safeguard your identity.
- The use or disclosure is required by law or for public health purposes, such as evaluating the effectiveness of a treatment.
If the research involves your personal participation, you may be asked to sign a specific authorization form before your health information is used or disclosed.
Criminal Activity
Consistent with applicable federal and state laws, the Practice may disclose your PHI if the Practice believes that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The Practice may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security
When the appropriate conditions apply, the Practice may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military services. The Practice may also disclose PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Workers’ Compensation
PHI may be disclosed by the Practice as authorized to comply with workers’ compensation laws and other similar legally-established programs.
Inmates
The Practice may use or disclose PHI if you are an inmate of a correctional facility and your physician created or received your PHI in the course of providing care to you.
Required Uses and Disclosures
Under the law, the Practice must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine compliance with the law. Also, the Practice may make any other disclosures required by law.
Substance Use Disorder Records Received from Other Providers
The Practice may receive SUD treatment records that are protected under Part 2 from other healthcare providers in connection with your treatment. These records are subject to special confidentiality protections under federal law (42 CFR Part 2). When the Practice receives Part 2 records from another provider, the Practice may use and disclose those records for treatment, payment, and health care operations only after you have provided written consent. Once you provide consent, it covers all future uses and disclosures for treatment, payment, and health care operations unless and until you revoke it in writing. You have the right to revoke your consent at any time by providing written notice to the Practice, except to the extent the Practice has already acted in reliance on your consent. Upon request, you have the right to receive a copy of any consent you have signed regarding your Part 2 records. Part 2 records received by the Practice may not be used to discriminate against you in connection with admissions, treatment, employment, housing, insurance, or child custody. Additionally, Part 2 records may not be used as evidence against you in any criminal, civil, administrative, or legislative proceeding conducted by any federal, state, or local authority without your specific written consent or a qualifying court order under 42 CFR Part 2. When the Practice discloses Part 2 records to other providers or entities, federal law requires those records be accompanied by a notice prohibiting further redisclosure except as permitted by 42 CFR Part 2.
Others Involved in Your Healthcare
Unless you object, the Practice may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, the Practice may disclose such PHI as necessary if the Practice determines that it is in your best interest based on its professional judgment. The Practice may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, the Practice may use or disclose your PHI to an authorized entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
Other Uses and Disclosures
Disclosure of your PHI or its use for any purposes other than those listed above requires your specific written authorization. If you change your mind after authorizing a use or disclosure of your PHI, you may submit a written revocation of the authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of PHI that occurred before you notified the Practice of your decision to revoke your authorization. Without your authorization, the Practice may not use or disclose your PHI for marketing purposes. The Practice may not sell your PHI without your authorization. The Practice may not disclose psychotherapy notes without your authorization, except in limited circumstances permitted by law. The Practice maintains a video surveillance system throughout the common areas and hallways of its locations. The Practice may use video and other images captured by the surveillance system for the purposes of general premises security and safety. Signage will be posted where video surveillance is in use. You have the right to opt out of receiving fundraising communications from the Practice at any time.
Restrictions
You have the right to request restrictions on the use and disclosure of your PHI; however, in most cases, we are not required to agree to your requests. You may also request limitations on the health information we share with individuals involved in your care or payment for your care, such as family members or friends. Similarly, while we will consider your request, we are not required to agree. The Practice will only be bound by the restrictions if the Practice notifies you in writing that it agrees with them. The Practice will agree to a request to restrict a release of PHI to an insurance provider related to an item or service if you pay the bill for that item or service out of pocket and in full, and to the extent that the disclosure to the health plan is for the purpose of carrying out payment or health care operations and the disclosure is not required by law.
Confidentiality
You have the right to request that the Practice use only confidential means of communicating with you about PHI. This means you may request to have PHI delivered to you at a certain place, or in a manner that keeps your PHI confidential. Such a request must be in writing, signed and dated. We will accommodate reasonable requests.
Access, Amendment and Accounting
You may generally inspect or copy your PHI that the Practice maintains. If the Practice maintains your PHI electronically, you have the right to request an electronic copy of your records in a readily producible electronic format. Your request will be reviewed and will generally be approved unless there are legal or medical reasons to deny the request. As permitted by federal regulation, the Practice requires that all requests regarding your PHI be submitted in writing. Any requested copies will be made at a reasonable cost to you (as permitted by the law), which is payable prior to the pickup or delivery. You may also direct the Practice to transmit a copy of your PHI to another person or entity you designate in writing. You have the right to have the Practice amend your PHI it maintains. The Practice may refuse to amend PHI that is accurate, that was created by someone else or is not disclosable to you. You have the right to see a list of disclosures of PHI about you by the Practice, made within a period of time up to 6 years prior to the date of your request, excluding certain disclosures, such as those made for treatment, payment, or health care operations. With respect to SUD treatment records received from Part 2 programs, you have the right to an accounting of disclosures of such records, including disclosures made for treatment, payment, and health care operations.
Complaints
If you would like to submit a complaint about the privacy practices related to your PHI/medical records maintained at a facility where services were provided to you by the Practice, please contact that facility’s Privacy Officer directly. If you would like to submit a complaint about the Practice’s privacy practices, or if you believe that your privacy rights have been violated by the Practice, you should call the matter to our attention by sending a written letter outlining your concerns to ARC Wellness, LLC’s Privacy Officer, or to the Secretary of the U.S. Department of Health and Human Services. For complaints concerning the handling of SUD treatment records protected by Part 2, you may also file a complaint with the Substance Abuse and Mental Health Services Administration (SAMHSA).
To contact our Privacy Officer, please submit your complaint in writing to: Privacy Officer, ARC Wellness, LLC, 25700 Science Park Drive, STE 210, Beachwood, OH 44122.
To file a complaint with HHS, you may contact the Office for Civil Rights online at www.hhs.gov/ocr/privacy/hipaa/complaints/ or by mail at U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775.
The Practice will not retaliate against you for filing a complaint.
Right to Privacy Breach Notification
In the event of a breach of unsecured protected health information, if your information has been compromised it is our duty to notify you.
Privacy Notice
The Practice is required by law to keep your PHI private and to give you this notice. The Practice is required to abide by the privacy policies and practices outlined in this notice. As permitted by law, the Practice may amend or modify its privacy policies and practices at any time, including this notice. You have the right to receive the most recently revised copy of this notice. You have the right to receive a paper copy of the most recently revised notice. If you receive(d) Practice’s services at a facility/site (such as a skilled nursing facility, etc.), you may request a copy of this notice from the administrator of that facility.
Effective Date
This notice is effective from August 20, 2026, until revised by the Practice.