AND NOTICE OF FEDERAL CONFIDENTIALITY REQUIREMENTS FOR SUBSTANCE USE DISORDER PATIENT RECORDS

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

FEDERAL LAW PROTECTS THE CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS. ADDITIONAL PROTECTIONS UNDER 42 CFR PART 2 APPLY TO THESE RECORDS AS DESCRIBED BELOW.

NOTICE OF PRIVACY PRACTICES OF PATHWAY HEALTHCARE SERVICES, LLC

This notice describes:

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE PRIVACY OFFICER AT 205-208-9312 OR privacy@pathwayhealthcare.com IF YOU HAVE ANY QUESTIONS.

Pathway Healthcare Services, LLC and its affiliates and subsidiaries are required by law to maintain the privacy of your medical information, to give you this Notice of Privacy Practices (“Notice”) describing its legal duties and privacy practices with respect to your medical information, to notify you of any breaches of your unsecured medical information, and to abide by the terms in this Notice.  This Notice applies to records of your care created and maintained by Pathway Healthcare Services, LLC and its affiliates and subsidiaries, including subsidiary physician practices and offices (the “Practices”). A list of the affiliated entities covered by this Notice, including those that operate as substance use disorder treatment programs subject to 42 CFR Part 2 (“Part 2 Programs”), is available upon request and at [www.pathwayhealthcare.com]. The Practices are required to abide by the terms of the privacy notice currently in effect. The Practices reserve the right to change the terms of this Notice for all records, including information they already have, and will inform you by posting the revised notice on its website or by providing it to you in the same manner this Notice was provided to you.

Some of the Practices’ affiliates create or maintain records that are protected by both HIPAA and 42 CFR Part 2 (“Part 2”), the federal regulation governing the confidentiality of substance use disorder (“SUD”) treatment records. Where Part 2 is more restrictive than HIPAA, the Practices will follow Part 2. The descriptions of permitted uses and disclosures in this Notice are accordingly limited by Part 2 with respect to SUD records.

Scope of This Notice. This Notice serves as a combined Notice of Privacy Practices that satisfies the requirements of both 45 CFR § 164.520 (HIPAA) and 42 CFR § 2.22 (Part 2). It applies to all medical information held by the Practices. However, the heightened protections described in this Notice for “SUD records,” “Part 2 records,” or records of patients of a “Part 2 Program” apply only to records that meet the definition of a Part 2 record — generally, records that would identify a patient as having or having had a substance use disorder and that are created or received by a federally assisted program providing SUD diagnosis, treatment, or referral for treatment. Records held by Practices’ affiliates that are not Part 2 Programs, and that do not contain Part 2-protected information, are subject only to the standard HIPAA protections described in this Notice.

Key Terms Used in This Notice. To make this Notice easier to understand, here is what some terms mean:

• “Medical Information” (also called “Protected Health Information” or “PHI”) means information about your health, health care, or payment for your health care that identifies you or could be used to identify you. This includes paper and electronic records, billing information, and verbal communications about your care.
• “SUD Records” or “Part 2 Records” means medical information about substance use disorder diagnosis, treatment, or referral for treatment that is protected by 42 CFR Part 2.
• “Part 2 Program” means a federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment and is therefore subject to the heightened confidentiality rules at 42 CFR Part 2.
• “Use” means sharing or using your medical information within the Practices.
• “Disclose” or “Share” means sharing your medical information with someone outside the Practices.
• “Treatment, Payment, and Health Care Operations” (“TPO”) are HIPAA terms describing the routine activities of providing care, billing for care, and running a health care organization (such as quality improvement, training, accreditation, and audits).
• “We,” “us,” “our” means one or more of the Practices, their providers, or their staff. “You” means the patient whose medical information is being described.

This Notice is effective March 3, 2017. Last revised: May 1, 2026.

HOW THE PRACTICES MAY USE AND DISCLOSE YOUR MEDICAL INFORMATION

The Practices may use your medical information only as permitted by HIPAA and other applicable federal laws, including those related to the confidentiality of substance use disorder records under 42 CFR Part 2. Where federal or state law is more protective of your medical information than HIPAA, the Practices will follow the more protective law.

DISCLOSURES MADE WITHOUT YOUR AUTHORIZATION

The following is a list of ways that the Practices are allowed to use your medical information without your authorization.

Note: For Substance Use Disorder (“SUD”) records that are protected under 42 CFR Part 2 (records created or maintained by a Part 2 Program), most uses and disclosures including those for treatment, payment, and health care operations generally require your written consent, except as specifically permitted by Part 2 (for example, in a medical emergency or to report suspected child abuse). Each subsection below notes how Part 2 affects these activities.

For Treatment.  The Practices are permitted to use and disclose your medical information for treatment purposes.  For example, the nurse at the Practice might discuss your medical information with a lab technician or physician at the same Practice.  The Practices will not disclose your medical information to practitioners who are not working at the Practices without your consent. For SUD records protected by Part 2, the Practices generally must obtain your written consent before using or disclosing those records for treatment, except in limited circumstances permitted by Part 2 (such as a bona fide medical emergency). Under the 2024 amendments to Part 2, you may provide a single written consent that authorizes future uses and disclosures of your SUD records for treatment, payment, and health care operations.

Health Information Exchanges (HIEs). The Practices may participate in one or more Health Information Exchanges (“HIEs”) — secure electronic networks that allow participating health care providers, health plans, and other authorized organizations to share medical information for treatment, payment, and health care operations. If the Practices participate in an HIE, your medical information may be made available to non-Practice providers and entities who participate in the same HIE and are involved in your care or its administration. You have the right to ask whether the Practices participate in any HIE, and to ask whether and how you may opt out of HIE participation, by contacting the Privacy Officer at [INSERT PHONE NUMBER] or privacy@pathwayhealthcare.com. Important: SUD records protected by 42 CFR Part 2 will not be disclosed through an HIE except in compliance with Part 2 — generally, only with your written consent or as otherwise permitted by Part 2 (for example, in a bona fide medical emergency). If an HIE acts as an “intermediary” within the meaning of 42 CFR § 2.24, additional requirements apply, and you have the right to obtain a list of entities to which your SUD records have been disclosed by that intermediary in the past three years.

For Payment. The Practices may use and disclose your medical information for payment activities, such as billing for treatment, determining your eligibility or coverage, and obtaining payment from your health plan. For SUD records protected by Part 2, written patient consent is generally required before the Practices may use or disclose those records for payment, except as otherwise permitted by Part 2. As described above, you may provide a single written consent that authorizes future uses and disclosures of your SUD records for treatment, payment, and health care operations together.

For Health Care Operations. The Practices are permitted to use and disclose your medical information for health care operations of the Practices.  For example, the Practice may disclose your medical information to review treatment and services to evaluate performance of its staff and for other management and administrative purposes. For SUD records protected by Part 2, written patient consent is generally required for health care operations disclosures, except as otherwise permitted by Part 2.

Appointment Reminders and Health-Related Communications.  The Practice may also use and disclose your medical information incident to a permitted use or disclosure. For example, it may use your medical information to remind you of services scheduled to be received, to inform you about possible treatment alternatives, or health-related benefits and services that may be of interest to you. Communications that constitute “marketing” under HIPAA — generally, communications that encourage you to purchase or use a product or service where the Practices receive financial remuneration from the third party whose product or service is being marketed — require your written authorization before they are made. For example, if a pharmaceutical manufacturer paid the Practices to send you information promoting one of the manufacturer’s medications, the Practices would obtain your written authorization before doing so. SUD records protected by Part 2 may be used or disclosed for appointment reminders, treatment alternatives, or other health-related communications only as permitted by Part 2 (generally, with your written consent or as part of a single TPO consent that you have signed).

Business Associates and Qualified Service Organizations.  The Practices may disclose your medical information to third party “Business Associates” that perform various activities on behalf of the Practices (for example, billing, legal, and network and software services) and agree to maintain the confidentiality of your medical information. For SUD records subject to Part 2, the Practices use “Qualified Service Organizations” (QSOs), which are entities that perform services for a Part 2 Program under a written QSO agreement that requires them to comply with Part 2’s confidentiality requirements.

In Medical Emergencies.  The Practices may use and disclose your medical information to medical personnel who have a need for such information for purposes of treating a condition that poses an immediate threat to any individual’s health and safety and which requires immediate medical intervention. The Practices must limit the disclosures to only that medical information which is necessary to treat the emergency condition.

To Report Suspected Child Abuse or Neglect.  As required by law, the Practices will use and disclose your medical information when the law requires it to report suspected child abuse or neglect, but it will limit its use or disclosure to the relevant requirements of the law and only for initial reporting purposes.

To Report a Crime on the Premises.  The Practices may disclose your medical information to law enforcement officers as necessary to report crimes on the Practices’ premises or against Practices’ personnel.  However, any such disclosures must be limited to the circumstances of the incident and your patient status, name, address and last known whereabouts.

Judicial and Administrative Proceedings.  The Practices may, and in some circumstances are required by law, to disclose your medical information in response to a court order, subpoena, or other lawful process, to the extent permitted by HIPAA and other applicable law. With respect to substance use disorder treatment records, federal regulations are far more protective: Substance use disorder treatment records received from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.

Research.  The Practices may use and disclose your medical information to researchers when an Institutional Review Board or Privacy Board has reviewed the research project and approved a waiver of authorization, or when the disclosure otherwise complies with HIPAA. SUD records protected by Part 2 may be used or disclosed for research only as permitted by 42 CFR Part 2, including with appropriate Institutional Review Board approval and required safeguards.

To Auditors and Evaluators.  The Practices may disclose your medical information to qualified persons who are conducting an audit or evaluation of the Practices, provided certain safeguards are met.  Additionally, the Practices will only disclose the amount of your medical information that is necessary for the purpose of the audit or evaluation. SUD records protected by Part 2 may be used or disclosed for audit or evaluation only as permitted by Part 2 (see 42 CFR § 2.53), which imposes additional requirements — including written agreement to the audit or evaluation requirements and a prohibition on using the records to investigate or prosecute a patient.

Vital Statistics.  The Practices may disclose medical information relating to causes of death to vital statistics registries or other authorities as required by law. For SUD records protected by Part 2, this disclosure is limited to cause-of-death information as permitted by 42 CFR § 2.15(b)(1); any broader disclosure of Part 2 records to vital statistics or related authorities will be made only as otherwise permitted by Part 2.

Public Health Activities. The Practices may disclose your medical information to public health authorities for purposes such as preventing or controlling disease, reporting births and deaths, reporting reactions to medications or product defects, notifying recipients of product recalls, and notifying persons who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease, as permitted by HIPAA. Under the 2024 amendments to Part 2, SUD records may be disclosed to public health authorities only after they have been de-identified in accordance with HIPAA standards, unless the patient has provided written consent.

Victims of Abuse, Neglect, or Domestic Violence. In addition to suspected child abuse, the Practices may disclose your medical information to a government authority authorized by law to receive reports of abuse, neglect, or domestic violence, in accordance with HIPAA. SUD records protected by Part 2 may be used or disclosed for these purposes only as permitted by Part 2 (which permits reports of suspected child abuse and neglect under 42 CFR § 2.12(c)(6) but otherwise generally requires your written consent or a qualifying court order).

Health Oversight, Workers’ Compensation, and Other Required Disclosures. The Practices may disclose your medical information for health oversight activities authorized by law (including audits, investigations, inspections, and licensing of health care providers and programs), for workers’ compensation purposes, to a correctional institution if you are an inmate, and as otherwise required by law, in each case to the extent permitted by HIPAA. SUD records protected by Part 2 may be used or disclosed in these circumstances only as permitted by Part 2.

Coroners, Medical Examiners, and Funeral Directors. The Practices may disclose your medical information to coroners and medical examiners for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. The Practices may also disclose medical information to funeral directors as necessary to carry out their duties. SUD records protected by Part 2 may be used or disclosed to coroners, medical examiners, and funeral directors only as permitted by Part 2 (which permits cause-of-death information under 42 CFR § 2.15(b)(1) but otherwise generally requires written consent of the patient’s personal representative under 42 CFR § 2.15(b)(2)).

Family Members, Friends, and Others Involved in Your Care. Unless you object, the Practices may disclose to a family member, close personal friend, or other person you identify, medical information directly relevant to that person’s involvement in your care or payment for your care. The Practices may also notify a family member, personal representative, or another person responsible for your care of your location, general condition, or death. If you are not present or are incapacitated, or in an emergency, the Practices will use professional judgment to determine whether the disclosure is in your best interest. SUD records protected by Part 2 may be disclosed to family members, friends, or other informal caregivers only as permitted by Part 2 (generally, with your written consent or in limited circumstances such as a medical emergency).

Disaster Relief. The Practices may disclose your medical information to a public or private organization authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with that organization to notify family members, personal representatives, or others responsible for your care of your location, general condition, or death. SUD records protected by Part 2 may be used or disclosed for disaster relief purposes only as permitted by Part 2 (generally, with your written consent or in limited circumstances such as a medical emergency under 42 CFR § 2.51).

Research Invitations. In addition to using your medical information for approved research, the Practices may use your medical information to identify and contact you about research opportunities that may be of interest to you. Your participation in any research study is voluntary. SUD records protected by Part 2 may be used to identify and contact you about research opportunities only as permitted by Part 2 (which generally requires your written consent, or compliance with the research provisions at 42 CFR § 2.52, before Part 2 records may be used or disclosed for research purposes).

Lawsuits and Legal Disputes. The Practices may disclose your medical information in connection with a lawsuit or other legal proceeding in response to a court order, subpoena, discovery request, warrant, summons, or similar lawful process, as permitted by HIPAA. SUD records protected by Part 2 are subject to the additional restrictions described below under “Judicial and Administrative Proceedings.”

Law Enforcement. The Practices may disclose your medical information to law enforcement officials as permitted by HIPAA, including: in response to a court order, subpoena, warrant, summons, or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; in response to a request about a victim of a crime; about a death the Practices believe may have resulted from criminal conduct; about criminal conduct on the Practices’ premises; and in emergencies to report a crime, the location of a crime or victims, or the identity, description, or location of a person who committed a crime. SUD records protected by Part 2 may be used or disclosed to law enforcement only as permitted by Part 2. In particular, Part 2 records (including testimony relaying their content) may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you absent your specific written consent or a qualifying court order accompanied by a subpoena (see “Judicial and Administrative Proceedings” above), and Part 2 records may be disclosed to law enforcement to report a crime on the Practices’ premises or against Practices’ personnel only as permitted by 42 CFR § 2.12(c)(5) (limited to the circumstances of the incident and the patient’s status, name, address, and last known whereabouts).

Breach Notification. The Practices are required by law to notify you in the event of a breach of your unsecured medical information, including unsecured records protected by Part 2.

Segmentation of Records. Under the 2024 amendments to Part 2, the Practices are not required to segregate or segment SUD records from other medical records. The Practices apply Part 2’s heightened protections to records that meet the Part 2 definition regardless of where those records are stored.

Redisclosure of Records. Information disclosed pursuant to your authorization or consent may be subject to redisclosure by the recipient and may no longer be protected by HIPAA or by Part 2. When the Practices disclose SUD records pursuant to your written consent, the disclosure will be accompanied by a written statement that 42 CFR Part 2 prohibits unauthorized use or disclosure of those records, as required by Part 2. Important: If you provide a single written consent for use and disclosure of your SUD records for treatment, payment, and health care operations, then a Part 2 Program, a HIPAA covered entity, or a HIPAA business associate that receives your records under that consent may further use and disclose them for treatment, payment, and health care operations as permitted by HIPAA, until you revoke your consent in writing. However, even after disclosure under such a consent, your SUD records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you absent a separate written consent or a qualifying court order, as described above under “Judicial and Administrative Proceedings.”

DISCLOSURES MADE ONLY WITH YOUR WRITTEN AUTHORIZATION

Other uses and disclosures of your medical information will be made only with your written authorization, unless otherwise permitted or required by law as described in this Notice. These uses and disclosures include (i) most uses and disclosures of psychotherapy notes (where applicable), (ii) most uses and disclosures of SUD counseling notes (notes by a clinician documenting or analyzing a counseling session that are kept separate from the rest of your record), uses and disclosures for marketing purposes, and disclosures that constitute a sale of your medical information. Sale of your medical information is generally prohibited absent your written authorization. For SUD records protected by Part 2, written patient consent is also required for most uses and disclosures, including for treatment, payment, and health care operations, except as specifically permitted by Part 2. For example, the Practices would not sell a list identifying their patients to a pharmaceutical company or to a data broker in exchange for payment without first obtaining your written authorization. Limited exceptions exist (such as for certain public health activities, research with cost recovery only, and treatment-related transfers), as described in HIPAA at 45 CFR 164.502(a)(5)(ii). You may revoke the authorization or consent at any time, except to the extent that (i) the Practice has taken action in reliance thereon, or (ii) the authorization was obtained as a condition of obtaining treatment.

Fundraising. If the Practices use your medical information to contact you for the Practices’ own fundraising activities, the communication will provide you with a clear and conspicuous opportunity to opt out of receiving further fundraising communications, and your decision to opt out will not affect your treatment or payment for treatment. If the Practices use or disclose any record subject to 42 CFR Part 2 for fundraising for the benefit of the Practices, you will first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications.

YOUR INDIVIDUAL RIGHTS

The following are statements of your rights about medical information, including SUD records protected by 42 CFR Part 2:

Request Restrictions.  You have the right to request restrictions on certain uses and disclosures of your medical information, by sending a written request specifying what information you want to limit and what limitations on the Practices’ use or disclosure of that information you wish to have imposed. The Practices reserve the right to accept or reject your request, and will notify you of its decision. However, the Practices will honor your request if your request restricts disclosure to your health plan for payment or health care operations provided that you agree to fully pay out of pocket and be solely responsible for such payment for the service or treatment that is the basis for your request for restriction. This right to request restrictions also applies to SUD records protected by Part 2.

Right to Inspect, Copy, and Receive an Electronic Copy. You have the right to inspect and obtain a copy of your records, with limited exceptions. If your records are maintained electronically, you have the right to obtain a copy in an electronic form and format you request, if readily producible, and to direct the Practices to transmit an electronic copy directly to a person or entity you designate, provided your request is in writing, signed, and clearly identifies the recipient. In certain circumstances, the Practices may deny your request.  The Practices will respond, in most cases, within thirty (30) days of your request, with the option of a single 30-day extension upon written notice to you. It may charge a reasonable cost-based fee to accommodate your request.

Request Amendment.  If you believe the Practices’ records are incomplete or inaccurate, you may request that the Practices change your medical information by submitting a written request and explaining the reason in support of the requested revision. The Practices will respond to your written request within sixty (60) days, with the option of a single 30-day extension upon written notice to you. The Practices reserve the right to deny your request in certain circumstances, including if the information you asked to amend was not created by the Practices. If your request is denied, the Practices will provide you with a written denial that explains the reason and your rights, including: (i) the right to submit a written statement of disagreement (the Practices may limit this statement to a reasonable length, such as 250 words); (ii) the right to request that your amendment request, the denial, and any statement of disagreement be included in any future disclosures of the affected information; and (iii) the right to file a complaint with the Practices or the Secretary of HHS.

Request an Accounting of Disclosures.  You have the right to receive an accounting of certain disclosures of your medical information that the Practices have made, including, where applicable, an accounting of disclosures of SUD records protected by Part 2 in accordance with 42 CFR § 2.25. Exclusions from the HIPAA accounting. The HIPAA accounting will not include disclosures: (i) for treatment, payment, or health care operations; (ii) made to you or to a person you authorized; (iii) to family members, friends, or others involved in your care or payment for your care; (iv) for national security or intelligence purposes; (v) to correctional institutions or law enforcement officials with custody; (vi) made before April 14, 2003; (vii) as part of a limited data set; or (viii) in other instances where the law does not require listing the disclosure. You may request an accounting covering up to six (6) years prior to the date of your request. The first accounting you request in any 12-month period will be free; the Practices may charge a reasonable, cost-based fee for additional accountings within the same 12-month period, after notifying you of the fee and giving you the opportunity to withdraw or modify your request. Special rules for SUD records protected by Part 2 (42 CFR § 2.25). The exclusions listed in (i) through (viii) above describe the HIPAA accounting only and do not control the accounting of disclosures of Part 2 records, which is governed separately by 42 CFR § 2.25 and must comply with that section. For records protected by 42 CFR Part 2, the accounting period is three (3) years (rather than six). You have the right to request: (a) an accounting of disclosures of your Part 2 records that the Practices made with your written consent during the three (3) years prior to your request; and (b) once the implementing rules under HIPAA take effect, an accounting of disclosures of your Part 2 records made for treatment, payment, or health care operations during the three (3) years prior to your request, where those disclosures were made through an electronic health record. The format of these Part 2 accountings will follow the requirements at 45 CFR 164.528(a)(2) and (b) through (d). In addition, as described above under “Health Information Exchanges,” if any of your Part 2 records are disclosed through an “intermediary” within the meaning of 42 CFR § 2.24, you have the right to obtain a list of the entities to which the intermediary disclosed your Part 2 records during the three (3) years prior to your request. If you would like to have an accounting of disclosures that the Practices have made regarding your medical information, please contact the office listed at the bottom of this Notice.

Request a Paper Copy of This Notice.  You have the right to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically.  You may request a copy of this Notice at any time.  In addition, you may obtain a copy of this Notice at the Practices’ website at: www.pathwayhealthcare.com.

Request Confidential Communications.  You have the right to request that you receive your medical information in a specific way or at a specific location. For example, you may ask that the Practices send information to a particular e-mail or to your work address. The Practices will comply with all reasonable requests submitted in writing which specify how or where you wish to receive these notifications, but the Practices will verify the authenticity of such request. You do not need to provide an explanation as to the basis for your request.

Right to Be Notified of a Breach. You have the right to be notified, without unreasonable delay, in the event of a breach of your unsecured medical information, including unsecured SUD records protected by Part 2.

Special Rights Concerning SUD Records. If you are a patient of a Part 2 Program, you have additional rights with respect to your SUD records, including: (i) the right to give, withhold, and revoke your written consent for uses and disclosures of your SUD records; (ii) the right to choose, at your option, to provide a single written consent authorizing future uses and disclosures of your SUD records for treatment, payment, and health care operations together, or instead to provide more limited consent for specific purposes or specific recipients; (iii) the right to revoke any consent in writing at any time, except to the extent the Practices or another recipient has already acted in reliance on it; (iv) the right to a separate, specific written consent before the Practices may use or disclose any “SUD counseling notes” about you (notes by a clinician documenting or analyzing a counseling session that the clinician keeps separate from the rest of your record); and (v) the right to discuss this Notice with the Privacy Officer (or other designated contact identified in the header of this Notice) at the contact information listed at the end of this Notice. The Practices may not condition your treatment, payment, enrollment, or eligibility for benefits on whether you sign a consent for the use or disclosure of SUD counseling notes.

Mobile Information and SMS Privacy

We do not share or sell mobile phone numbers or other mobile data with third parties or affiliates for marketing or promotional purposes. Mobile information collected through our forms, services, or SMS platforms will only be used for healthcare-related communication such as appointment reminders, follow-ups, or service-related updates.

No mobile information will be disclosed to third parties or affiliates for promotional or marketing use. This clause applies to all data collected via SMS, mobile forms, and telecommunication platforms. SUD records protected by Part 2 will not be disclosed via SMS or other mobile channels except as permitted by Part 2 and consistent with your written consent.

Risks of Unsecured Electronic Communications. If you choose to contact the Practices, or any of the Practices’ health care providers, by unsecured electronic means — such as standard email or text message — the Practices will respond to you in the same way you contacted them. If you provide your email address or cell phone number to the Practices, the Practices may use those channels to send you appointment reminders, surveys, treatment information, billing information, or other information related to your care. These messages may not be encrypted.

There are risks associated with using unsecured electronic communications, including: (i) messages may be intercepted by unauthorized parties; (ii) messages may be misaddressed or misdirected; (iii) the email account or phone number you use may be shared with others; (iv) messages may be forwarded to or seen by other people; and (v) messages may be stored on unsecured or portable devices that could be lost or stolen.

If you choose to contact the Practices using unsecured electronic communications, or to receive communications from the Practices in this manner, you acknowledge and accept these risks. Standard message and data rates from your wireless carrier may apply. Email and text messages do not replace professional medical advice, diagnosis, or treatment, and you should never use email or text messaging to communicate a medical emergency. In an emergency, call 911 or go to the nearest emergency room. To stop receiving SMS communications from the Practices, reply STOP to any text message or contact the Privacy Officer.

AFFILIATED ENTITIES COVERED BY THIS NOTICE

This Notice applies to the following Pathway Healthcare affiliates and subsidiaries (collectively, the “Practices”). The Practices have designated themselves as a single affiliated covered entity under 45 CFR § 164.504(d) and/or operate under organized health care arrangements as permitted by HIPAA, and have agreed to follow the privacy practices described in this Notice.

Pathway Healthcare Affiliates and Subsidiaries:

• Pathway Healthcare Services, LLC
• Impact Behavioral Counseling, LLC
• Pathway Healthcare – Alabama, LLC
• Pathway Healthcare – Tennessee, LLC
• Pathway Healthcare – Jackson TN, LLC
• Boyett Healthcare of Tennessee, PLLC (dba Impact Healthcare)
• Pathway Healthcare – Texas, LLC
• Pathway Healthcare – Mississippi, LLC
• Pathway Healthcare – Jackson MS, LLC
• Pathway Healthcare – Columbus MS, LLC
• Pathway Healthcare – California, LLC
• Pathway Clinical – California, PC
• Pathway Clinical – Iowa, PC
• Life Connection, LC
• Beyond Behavior ABA Services, LLC

This list may be updated from time to time. For the most current list of affiliated entities covered by this Notice, please contact the Privacy Officer at 205-208-9312 or privacy@pathwayhealthcare.com, or visit www.pathwayhealthcare.com.

LANGUAGE ASSISTANCE AND ACCESSIBILITY SERVICES

The Practices comply with applicable federal civil rights laws and do not discriminate on the basis of race, color, national origin, age, disability, or sex. Free language assistance services are available to people whose primary language is not English, and free auxiliary aids and services are available to people with disabilities to communicate effectively with us. To request these services, please contact the Privacy Officer at 205-208-9312 or privacy@pathwayhealthcare.com. The Practices’ full notice of nondiscrimination and language assistance services is available at www.pathwayhealthcare.com and upon request.

COMPLAINTS AND CONTACT INFORMATION

If you believe your privacy rights have been violated, you may file a complaint with the Practices or directly with the Secretary of the U.S. Department of Health and Human Services. You may file complaints concurrently with the Practices and the Secretary of HHS. You also have the right to file a complaint directly with the Secretary of HHS for any alleged violation of 42 CFR Part 2.

To file a complaint with the Practices, please submit your complaint in writing to the Privacy Officer at the address below, by email to privacy@pathwayhealthcare.com, or by phone at 205-208-9312.

To file a complaint with the U.S. Department of Health and Human Services, you may contact the Office for Civil Rights (OCR):

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue, SW

Washington, D.C. 20201

Toll-Free: 1-800-368-1019  |  TDD: 1-800-537-7697

Online: https://www.hhs.gov/ocr/

You will not be retaliated against if you file a complaint.

You may also request additional information regarding how the Practices use your medical information by written request to:

Pathway Healthcare Services, LLC

ATTN: Privacy Officer

48 Medical Park Drive East, Suite 453

Birmingham, AL 35235

Phone: 205-208-9312

Email: privacy@pathwayhealthcare.com

Health Information Management (Records Requests) by Location. To request a copy of your records or to submit other written requests related to your medical information, you may contact the office where you received care or the Medical Records Department:

205-208-9312, option 3 for “Medical Records”

205-517-7730 extension 1159

If you do not know which location to contact, or if you received care at more than one location, you may direct any request to the Medical Records Department of the Privacy Officer at the address above.