Notice of Privacy Practices
Effective date: January 1, 2026
This notice combines the requirements of the Health Insurance Portability and Accountability Act (HIPAA) and the privacy protections under 42 CFR Part 2. Please review it carefully. It also describes:
- How health information about you may be used and shared
- Your rights with respect to your health information
- How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information
**YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH HIPAA PRIVACY OFFICER IF YOU HAVE ANY QUESTIONS**
Understanding Your Health Record/Information
Each time you visit a clinician, doctor, or other healthcare provider, a record of your visit is made. This record contains your symptoms, diagnoses, care, and plan of care. This information, often referred to as your medical or electronic health record (EHR), serves as a basis for planning your care, communicating among professionals, documenting services, billing, and improving the quality of care provided.
Federal law under 42 CFR Part 2 provides extra privacy protection for substance use disorder (SUD) treatment records, with the 2024 update aligning these protections more closely with HIPAA rules. This law requires healthcare organizations to keep your SUD records private, provide you with this notice, notify you if records are accidentally exposed, and only share your information with your written consent or when specifically allowed by law.
I. Uses and Disclosures
a. Uses and Disclosures Without Your Written Consent
For substance use treatment, we cannot share information without your written permission, except:
- Medical emergency: Medical staff need information to help you, and we can’t get your permission first
- FDA safety alerts: To warn you or your doctor about dangerous products
- Research: For scientific studies (only with your permission or special approval that protects
your privacy) - Court order: A judge orders us to share information
For HIPAA, medical providers can share your health information without getting your permission first in these situations:
- For Your Care and Billing – Your providers can share information with other providers who are treating you. They can also send information to your insurance company to get paid and use your records to make sure they’re giving good care and training their staff.
- When the Law Says They Have To – Providers must share information when a judge orders it, when police have a warrant, or when other laws require it.
- To Keep People Safe and Healthy – Your information can be shared to stop diseases from spreading, to report if someone is being abused or neglected, to tell health departments about serious illnesses, or to prevent someone from getting badly hurt or killed. Someone has been threatened with physical harm.
- For Police and Court Cases – Information can be given upon receiving a judges order, if a crime happens at the facility, in emergencies, to help find missing people or crime victims, or when someone dies and needs to be identified.
- Research or audits: For research studies or program reviews (by qualified people)
- Partner organization – To organizations we work with through official agreements
- For Other Special Reasons – Astra Mental Health and Recovery can use your information to ask for donations (but you can say no), do medical research that’s been approved, or let your family know how you’re doing in an emergency. If you get hurt at work, your records can be sent to worker’s compensation so you can get help paying your medical bills. If you are in jail or prison, the jail or prison can get your health information to take care of you while you are there. If you are in the military, your commanders may need to see your health records. A coroner or medical examiners request, national security or intelligence activities, protective services for the president, if you’re an inmate in custody, when required for interpreters services, for medication assistance programs.
- When sharing your information, healthcare providers only share what’s necessary for that specific reason. You also have the right to ask for a list of who they shared your information with.
b. Uses and Disclosures That Require Your Written Consent
Examples of uses and disclosures that require written consent under 42 CFR Part 2:
i. For Treatment, Payment, and Health Care Operations: Records that are disclosed to a Part 2 program, covered entity, or business associate pursuant to the patient’s written consent for treatment, payment, and health care operations may be further disclosed by that Part 2 program, covered entity, or business associate, without the patient’s written consent, to the extent the HIPAA regulations permit such disclosure.
Examples include:
- Sharing information among providers involved in your care
- Submitting claims for billing purposes
- Quality improvement activities
- Training staff
- Following regulatory requirements
ii. For Fundraising: Astra Mental Health and Recovery may use or disclose records to fundraise for the benefit of the Part 2 program only if the patient is first provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.
iii. For Research: When approved by a review board
iv. For Appointment Reminders: To remind you of appointments or treatment options
v. To Family Members or Personal Representatives: To notify a family member or personal representative about your general condition
vi. SUD Counseling Notes: Your SUD records can be shared with your written consent for purposes like treatment and care coordination, billing and insurance claims, and healthcare operations. However, SUD counseling notes require separate consent even beyond your general authorization.
c. Single Consent for Future Disclosures
A patient may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes.
d. Limitation on Uses and Disclosures
Astra Mental Health and Recovery will only use and disclose your protected information as described in this notice, or with your written consent. We cannot directly or indirectly take money in exchange for your protected health information (PHI) unless specifically authorized by you.
e. Revocation of Consent
You may revoke your consent at any time, except to the extent that Astra Mental Health and Recovery has acted in reliance upon it. You may revoke consent by submitting a request in writing to HIPAA Privacy Officer at the contact information listed below or you may request reasonable accommodation for an alternative revocation process.
f. Criminal Legal System Mandates
If you were mandated to treatment through the criminal legal system (including drug court, probation, or parole) and you sign a consent authorizing disclosures to elements of the criminal legal system such as the court, probation officers, parole officers, prosecutors, or other law enforcement, your right to revoke consent may be more limited and should be clearly explained on the consent you sign.
g. Legal Protections
Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written consent or a court order. Records shall only be used or disclosed based on a court order after notice and an opportunity to hear is provided to you (the patient) and/or the holder of the record, where required by 42 USC § 290dd-2 and 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.
All disclosures made with your consent must include a notice stating that further re-disclosure is not
allowed unless permitted by law.
II. Your Rights
a. Right to Request Restrictions
You have the right to request restrictions of disclosures, for purposes of treatment, payment, and healthcare operations, including when you have previously provided written consent. Contact the HIPAA Privacy Officer for further information.
b. Right to Restrict Disclosures to Health Plans
You have the right to request and obtain restrictions of disclosures to your health plan for those
services for which you have paid in full. Contact the HIPAA Privacy Officer for further information.
c. Right to an Accounting of Disclosures
You have the right to an accounting of disclosures of electronic records under this part for the past three years.
You have the right to an accounting of disclosures by Astra Mental Health and Recovery for the preceding three years, including information about who received your protected records, the date of the disclosure, and a brief description of the information that was disclosed. You may submit your request to the HIPAA Privacy Officer.
d. Right to Obtain a Copy of This Notice
You have the right to obtain a copy of this notice from Astra Mental Health and Recovery upon
request.
e. Right to Discuss This Notice
You have the right to discuss this notice with the contact person or office designated at the end of this
notice.
f. Right to Elect Not to Receive Fundraising Communications
You have the right to elect not to receive communications from Astra Mental Health and Recovery to fundraise on its own behalf.
g. Right to Inspect and Copy Your Records
You have the right to inspect and copy your health records. Contact the HIPAA Privacy Officer for
additional information.
h. Right to Request Amendments
You have the right to request amendments if you believe information is inaccurate or incomplete. Contact the HIPAA Privacy Officer for additional information.
i. Right to Request Alternative Communications
You have the right to request alternative communications. Contact the HIPAA Privacy Officer for
additional information.
j. Electronic Health Information Technology (HIT) Systems
Astra Mental Health and Recovery participates in secure electronic health information technology (HIT) systems. You may choose to allow or limit access to your information through these systems. Visit http://www.KanHIT.org if you want to restrict access and submit the required information. For more information, contact our Privacy Officer.
III. Astra Mental Health and Recovery’s Duties
a. Privacy and Security Obligations
Astra Mental Health and Recovery is required by law to maintain the privacy of records, to provide patients with notice of its legal duties and privacy practices with respect to records, and to notify affected patients following a breach of unsecured records.
b. Compliance with Notice Terms
Astra Mental Health and Recovery is required to abide by the terms of the notice currently in effect.
c. Right to Change Terms
Astra Mental Health and Recovery reserves the right to change the terms of its notice and to make the new notice provisions effective for records that it maintains.
d. Staff Training and Enforcement
We must train our staff about privacy, discipline those who violate privacy rules, and follow all
applicable privacy regulations.
IV. Breach Notice
If there is a breach (unauthorized use or disclosure) of your unsecured SUD records, we will provide
notice and comply with HIPAA’s Breach Notice Rule as applied to Part 2 records.
V. Complaints
a. Right to File a Complaint
If you believe your privacy rights have been violated, you have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services and Astra Mental Health and Recovery. You may do so by contacting:
HHS Office for Civil Rights: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
A patient is not required to report an alleged violation either to the Secretary or part 2 program but
may report to either or both.
b. Filing a Complaint with Astra Mental Health and Recovery
In order to file a complaint with Astra Mental Health and Recovery, contact the below:
Mary Rudy, HIPAA Privacy Officer
Address: 330 SW Oakley, Topeka, KS 66606
Phone: 785-233-1730 ext 3104
Email: rudy.mary@astraks.org
c. No Retaliation
Astra Mental Health and Recovery will not retaliate against you for filing a complaint.