Privacy Policy

Notice of Privacy Practices of Promises Dallas-Fort Worth

THIS NOTICE DESCRIBES: HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED.
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION.
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION.
• PLEASE REVIEW THIS NOTICE CAREFULLY. YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH Promises Dallas-Fort Worth AT PRIVACYOFFICER@PROMISES.COM IF YOU HAVE ANY QUESTIONS.

This Notice of Privacy Practices (“Notice”) applies to Promises Dallas-Fort Worth, Promises Behavioral Health, LLC, its employees and workforce members (“we,” “our,” and “us”). In providing services to you, we will create and receive records about you and the treatment and services we provide you. Your health information is protected by federal law and regulations, including your protected health information (“PHI”) under the Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”). If you receive or seek substance use disorder treatment and diagnosis services from us, your substance use disorder patient records (“Substance Use Disorder Records”) are also protected by the federal regulations governing the confidentiality of substance use disorder patient records, known as the “Part 2” regulations. We may refer to PHI and Substance Use Disorder Records collectively as your “Health Records.” Your Health Records may be stored in paper, electronic or other form and may be disclosed electronically and by other methods.

This Notice describes how we may use and disclose your Health Records and how you can obtain access to your Health Records. This Notice also describes your rights with respect to your Health Records. We are required by law to maintain the privacy and security of your Health Records; to provide you with notice of our legal duties and privacy practices with respect to your Health Records; and to notify you following a breach of unsecured Health Records. This Notice does not apply to any care you may separately receive from health care professionals at their offices. Your health care professional may have their own policies and procedures regarding your Health Records and you should review your health care professional’s notice of privacy practices for information on how your Health Records will be handled outside of our facilities.

I. HOW WE MAY USE AND DISCLOSE YOUR HEALTH RECORDS

We will obtain your written authorization to use and disclose your Health Records unless we are permitted to use or disclose your information without your authorization under applicable law. Part 2 has stringent requirements on how we use and disclose Substance Use Disorder Records. If we maintain Substance Use Disorder Records about you that are protected under Part 2, we will only use and disclose that information as permitted by Part 2. Information about how we may use and disclose Substance Use Disorder Records governed by Part 2 is provided in Section II below.

If you do not receive substance use disorder services from the Facility, Section II does not apply to your information, but we are required to comply with HIPAA. Section III describes how we may use and disclose your PHI under HIPAA. In addition, please be aware that certain state laws may have stricter requirements for certain categories of health information, such as mental health records and HIV/AIDS information. If there are state-specific requirements that are more restrictive, we will adhere to those.

II. USES AND DISCLOSURES OF SUBSTANCE USE DISORDER RECORDS UNDER PART 2

    a. Uses and Disclosures of Your Substance Use Disorder Records that Do Not Require Your Written Consent

The following categories describe the ways that we may use and disclose your Substance Use Disorder Records without your written authorization. Not every use or disclosure in a category will be listed.

• To you or your personal representative. We may disclose your health information to you or your personal representative, including if you or they request access, as described below.
• Within Our Facilities or Programs. We may use and disclose your health information between and among our staff and any entities with direct administrative control over our programs that need the information to perform their job duties related to providing diagnosis, treatment, or referral for treatment of substance use disorders.
• Medical Emergencies. We may use and disclose your health information in the event of a bona fide medical emergency in which your prior informed consent cannot be obtained, including disclosures to the Food and Drug Administration.
• Business Associates. We may disclose your health information to business associates (sometimes called Qualified Service Organizations) with whom we contract to provide services to us. Examples of business associates include administrative and management services, medical records, IT vendors, consultants, accountants, attorneys, medical transcriptionists, and third-party billing companies. We will only make these disclosures if we have received assurance that the business associate will properly safeguard your health information.
• Research. In certain limited circumstances permitted by applicable law, we may use and disclose your health information for research purposes. For example, we may use or disclose health information for research as authorized by a privacy waiver.
• Audit and Evaluation Activities. We may use and disclose your health information for certain audit and evaluation activities, such as if we are audited by a government agency.
• Public Health. We may disclose your health information to public health authorities, provided your health information is first de-identified in accordance with the HIPAA standards for de-identification.
• Crimes on the Premises. We may disclose your health information to law enforcement agencies or officials that is directly related to the commission of a crime on our premises or against a staff member or a threat to commit such a crime. The disclosure must be limited to information related to the circumstances of the incident, including your status as a patient at the Facility, name and address and last known whereabouts.
• Child Abuse and Neglect. We may use and disclose your health information as required by state law to report to appropriate state or local authorities incidents of suspected child abuse and neglect. We may not, however, disclose the original Substance Use Disorder Records we maintain unless otherwise permitted or required by law, including disclosures for civil or criminal proceedings that arise out of a report of suspected child abuse and neglect.
• Court Orders and Lawsuits. We may use and disclose your health information if required by a valid court order. A court order must be accompanied by a subpoena or similar legal mandate compelling disclosure before health information is used or disclosed. Your health information, or testimony relaying the contents of those records, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written consent or based on a court order. If required by law, your records will only be used or disclosed based on a court order after you receive notice and an opportunity to be heard.
• Deceased Patients. We may use and disclose health information related to the cause of death of a patient under applicable laws requiring the collection of death or other vital statistics or permitting inquiry in the cause of death.

    b. Uses and Disclosures of Your Substance Use Disorder Records that Require Your Written Consent

For any purpose other than those described in Section II(a) of this Notice, we will obtain your written consent before using or disclosing your Substance Use Disorder Records. You may revoke any consent you give at any time by contacting us using the contact information provided at the end of this Notice. For example, we can use and disclose your Substance Use Disorder Records with your consent for the following purposes:

• Treatment, Payment and Health Care Operations. We may use or disclose your health information with your consent for treatment, payment and health care operations purposes. Please refer to Section III(a) for a description and examples of disclosures for treatment, payment, and health care operations purposes. Health information that is disclosed to a federally-assisted substance use disorder program or a covered entity or business associate under HIPAA for treatment, payment, and health care operations may be further disclosed by that entity without your consent if permitted by HIPAA. When health information is disclosed pursuant to HIPAA, it is possible that the information could be re-disclosed by the recipient and no longer be protected by HIPAA. See Section III for a description of uses and disclosures permitted by HIPAA, including disclosures permitted without your authorization.
• Multiple Enrollments. We may disclose your health information to a central registry or to any withdrawal management or maintenance treatment program within 200 miles of the Facility to ensure that you are not enrolled in multiple substance use disorder treatment programs.
• To Persons Within the Criminal Justice System Who Referred You. We may disclose your health information to those persons within the criminal justice system who have made participation in our program a condition of the disposition of any criminal proceedings against you or a condition of your parole or other release from custody.
• Disclosures to Prescription Drug Monitoring Programs. If required by law, we may report substance use disorder medication the Facility prescribes or dispenses to applicable state prescription drug monitoring programs.
• Counseling Notes. We may use or disclose your substance use disorder counseling notes, which are notes recorded by a substance use disorder or mental health professional documenting or analyzing the contents of conversations during a counseling session and that are maintained separately from your medical record.

III. USES AND DISCLOSURES OF PHI UNDER HIPAA

    a. Uses and Disclosures that Do Not Require Written Authorization

The following categories describe the ways that we may use and disclose your health information under HIPAA without your written authorization under HIPAA. Not every use or disclosure in a category will be listed.

• For Treatment. We may use health information about you to provide you treatment or services. We may disclose health information about you to doctors, nurses, technicians, or other Facility personnel who are involved in taking care of you at the Facility. For example, we may share information with another health care provider to coordinate your plan of care.
• For Payment. We may use and disclose health information about your treatment and services to bill and collect payment from you, your insurance company or a third-party payer. For example, we may disclose PHI to determine your eligibility for health plan coverage or need to give your insurance company information about your treatment so they will pay us or reimburse you for the treatment. We may also tell your health plan about treatment you are going to receive to determine whether your plan will cover it.
• For Health Care Operations. We may use and disclose your health information for health care operations purposes. For example, health care operations include quality assessment and improvement activities, arranging for legal services, conducting training programs, reviewing the competence and qualifications of health care professionals, and licensing activities. We may also use your health information to notify you about our health-related products and services, to recommend possible treatment options or alternatives that may interest you, to send you patient satisfaction surveys, and to send you appointment reminders.
• Business Associates. We may disclose your health information to business associates (sometimes called Qualified Service Organizations) with whom we contract to provide services to us. Examples of business associates include administrative and management services, medical records, IT vendors, consultants, accountants, attorneys, medical transcriptionists, and third-party billing companies. We will only make these disclosures if we have received assurance that the business associate will properly safeguard your health information.
• Directory. We may include certain limited information about you in the Facility directory while you are a patient at the Facility unless you opt out of the directory. The information may include your name, location in the Facility, your general condition (e.g., good, fair) and your religious affiliation. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name.
• Individuals Involved in Your Care or Payment for Your Care and/or Notification Purposes. We may release health information about you to a friend or family member who is involved in your health care or who helps pay for your care or to notify, or assist in the notification of (including identifying or locating), a family member, your personal representative, or another person responsible for your care of your location and general condition. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort in order to assist with the provision of this notice.
• Research. We may use or disclose health information for research as permitted by HIPAA (such as using de-identified data or by obtaining a privacy waiver). You may also be contacted to participate in a research study.
• Health Information Exchange/Regional Health Information Organization. We may participate in one or more Health Information Exchanges (“HIEs”) and may electronically share your PHI for treatment, payment, health care operations and other permitted purposes with other participants in the HIE unless you opt out. HIEs allow your health care providers to efficiently access and use your PHI as necessary for treatment and other lawful purposes.
• As Required by Law. We may disclose information when required to do so by law.
• For Public Health. We may use and disclose health information for public health activities, such as to prevent or control disease, injury or disability; reporting adverse reactions to medications to the Food and Drug Administration; preventing the spread of disease; helping with product recalls; or reporting suspected child abuse, domestic violence or neglect.
• Serious Threats to Health or Safety. We may use and disclose your PHI when necessary to reduce or prevent a serious threat to the health and safety of an individual or the public. Under these circumstances, we will only make disclosures to a person or organization reasonably able to help prevent or lessen the threat.
• For Worker’s Compensation Purposes. We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs established by law.
• For Specialized Government Functions. To the extent applicable, we may release your health information for specialized government functions, including military and veterans’ activities, national security and intelligence activities, and correctional institutions.
• For Health Oversight Activities. We may disclose your health information to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure actions.
• To a Medical Examiner, Coroner, or Funeral Director. We may disclose health information to a coroner, medical examiner, or funeral director when an individual dies.
• For Organ and Tissue Donation. We may disclose health information about you to organ procurement organizations, which are entities involved in procuring, banking and transplanting organs, eyes, and tissues.
• Law Enforcement. We may disclose health information to a law enforcement official for purposes such as responding to a subpoena or providing limited information to locate a missing person or report a crime.
• For Judicial or Administrative Proceedings. We may disclose health information as permitted by law in connection with judicial or administrative proceedings, such as in response to a court order or subpoena, but in the case of subpoenas, only if we receive assurances you have been notified of the request or the parties have sought an order protecting the information.
• Limited Data and De-Identified Data. We may remove most information that identifies you from a set of data and use and disclose this data set for research, public health and health care operations, provided the recipients of the data set agree to keep it confidential. We may also de-identify your information consistent with the law and use and disclose the de-identified information for purposes permitted by law, including selling the de-identified information.

    b. Other Uses of Health Records

Other uses and disclosures of your Health Records not listed above will be made only with your written permission, including but not limited to (i) most uses and disclosures of psychotherapy notes, (ii) most uses and disclosures of substance use disorder counseling notes, or (iii) most uses and disclosures of your Health Records for marketing purposes. If you provide us with permission to use or disclose your Health Records, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your Health Records for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

V. YOUR HEALTH INFORMATION RIGHTS

If you wish to exercise any of your health information rights described below, you must submit a request in writing to 400 Highland Dr, Lewisville, TX 75067 or by email to PrivacyOfficer@promises.com. All requests will be reviewed and considered within the timeframes required under state law, HIPAA and, if applicable, Part 2. If you have given another individual a medical power of attorney, if another individual is appointed as your legal guardian or if another individual is authorized by law to make health care decisions for you (known as a “personal representative”), that individual may exercise any of the following rights listed below.

• Right to Inspect and Copy. You have the right to inspect and copy the PHI that we maintain about you, with limited exceptions. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. If we maintain this information electronically, you have the right to receive a copy of such information in an electronic format. Additionally, you have the right to ask us to send a copy of your PHI to other individuals that you designate. To do so, you must provide us with your signed written request that clearly identifies the designated person and where to send the copy of your PHI. In most cases, we will provide this access to you or the person you designate within 30 days of your request. This right applies to PHI used to make decisions about you or payment for your care, subject to limited exceptions.
• Right to Request an Amendment. You may ask us to amend your PHI if you believe it is incorrect or incomplete. You must make your request in writing. We may deny your request if you ask us to amend information that is: (i) accurate and complete; (ii) not part of the identifiable health information kept by or for the Facility; (iii) not part of the PHI which you would be permitted to inspect and copy; or (iv) not created by us, unless the individual or entity that created the information is not available to amend the information.
• Right to Accounting of Disclosures. You have the right to request a list (an accounting) of certain disclosures that we have made of your Health Records. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make) that we are not required by law to include. To request this list, you must submit your request in writing. Your request must state a time period, within the 6 years immediately preceding the request. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12-month period will be free of charge. For additional requests in the same 12-month period, we may charge you a reasonable cost-based fee for providing you with the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
• Right to List of Disclosures by an Intermediary. If you consent under a general designation to the disclosure of your Substance Use Disorder Records to another person (other than us or an entity covered by HIPAA) who has a treating provider relationship with you, that other person is required to provide you with a list of disclosures they make for the past 3 years.
• Right to Request Restrictions. You have the right to request a restriction or limitation on our use or disclosure of your Health Records for treatment, payment or health care operations, including when you have previously signed a written consent for such disclosures. You also have the right to request a limitation on the Health Records we disclose about you to someone who is involved in your care or the payment for your care. If we agree, we will comply with your request unless the information is needed to provide emergency treatment. We are not required to agree to the restrictions, unless your request is that we not disclose information to a health plan for payment or health care operations activities, if the disclosure is not otherwise required by law, and the Health Records pertain solely to a health care item or service for which you, or a person on your behalf, has paid in full.
• Right to Request Confidential Communications. You have the right to request that we communicate with you about your health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Please note if you choose to receive communications from us via e-mail or other electronic means, those may not be a secure means of communication and your PHI that may be contained in our e-mails to you will not be encrypted. This means that there is risk that your PHI in the e-mails may be intercepted and read by, or disclosed to, unauthorized third parties.
• Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice even if you have agreed to receive the Notice electronically. You may ask us to give you a copy of this Notice at any time. You may also obtain a copy of this Notice on our website.
• Right to Notification of a Breach. You have the right to be notified following a breach of your unsecured Health Records, and we will notify you in accordance with applicable law.
• Right to Discuss This Notice. You have the right to discuss this Notice with us. You can do so by contacting us using the contact information provided at the end of this Notice.
• Right to Not Receive Fundraising Communications. You have the right to elect not to receive communications about our fundraising activities by using the contact information listed at the end of this Notice.

V. CHANGES TO THIS NOTICE

We are required to follow the terms of this Notice or any change to it that is in effect. We reserve the right to change our practices and this Notice at any time and to make the new Notice effective for all Health Records we create or maintain and that we obtain in the future. If we make a material change to this Notice, we will post the revised notice at the Facility where you receive services and on our website and make the revised notice available upon request.

VI. COMPLAINTS OR INFORMATION REQUESTS

If you believe that we have violated your privacy rights you may file a complaint with the Privacy Officer at the contact information listed in Section VII below. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

We will promptly investigate any complaints in an effort to resolve the matter. We will not penalize or retaliate against you for filing a complaint.

VII. OUR CONTACT INFORMATION

If you have questions or would like additional information about our privacy practices, please contact our Privacy Officer:
Promises Behavioral Health
Attn: Privacy Officer
103 Powell Court, Suite 100
Brentwood, TN 37027
Email: PrivacyOfficer@promises.com
Phone: 888.465.6223
Website: www.promisesbehavioralhealth.com

Effective Date: This Notice is effective as of July 29, 2025

47334858.3