Part 1 — Notice of Privacy Practices
THIS NOTICE EXPLAINS HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND SHARED, AND HOW YOU CAN ACCESS IT. PLEASE READ IT CAREFULLY.
Arista Recovery ( “Arista,” “we,” “us”) provides substance use disorder and mental health treatment at our facilities in Paola, Kansas; Overland Park, Kansas; and Hilliard, Ohio. We take the privacy of your health information seriously. This notice explains how we use and share it and what rights you have. It is provided under the Health Insurance Portability and Accountability Act (HIPAA) and the federal confidentiality rules for substance use disorder records at 42 CFR Part 2 (“Part 2”).
Our duties to you
By law, we must:
- Keep your health information private and secure.
- Give you this notice of our legal duties and privacy practices, and follow it.
- Tell you if a breach occurs that may have compromised the privacy or security of your information.
We may change this notice. Changes will apply to all information we hold. The current version is posted at each facility and on aristarecovery.com, and you may request a copy at any time.
Extra protection for substance use disorder records
Records of your substance use disorder (SUD) diagnosis, treatment or referral from Arista are protected by Part 2 in addition to HIPAA. In general, we cannot confirm to anyone outside Arista that you are a patient, or share SUD records that identify you, unless you give written consent or the law allows it.
- Legal proceedings. Your SUD records, or testimony about them, cannot be used or shared in any civil, criminal, administrative or legislative investigation or proceeding against you unless you give specific written consent, or a court issues an order that meets Part 2 requirements together with a subpoena or similar legal mandate.
- One consent for treatment, payment and operations. You may sign a single written consent allowing us to share your SUD records for treatment, payment and health care operations. Once shared under that consent with another HIPAA-covered provider, health plan or business associate, the recipient may further use and share the records as HIPAA allows, except in proceedings against you as described above.
- SUD counseling notes. Notes a clinician keeps separately from your record about counseling sessions require your separate written consent to share.
- Revoking consent. You may revoke a consent in writing at any time, except for action we have already taken in reliance on it.
How we may use and share your information without your authorization
For information not covered by Part 2 (and for Part 2 information where Part 2 also permits it), we may use and share your information as follows. These are examples, not a complete list.
- To provide and coordinate your care, for example among the clinicians on your treatment team or with a provider you are being referred to.
- To bill and get paid, for example confirming benefits or obtaining authorization from your health plan.
- Health care operations. To run our programs, such as quality review, staff training, licensing, accreditation and audits.
- Business associates. With vendors who perform services for us (such as electronic health record, billing or transcription vendors). They must sign an agreement to protect your information.
- Family and others involved in your care. With people you identify as involved in your care or payment, if you agree or do not object. SUD information requires your written consent.
- Medical emergencies. With medical personnel to the extent needed to treat a bona fide medical emergency.
- Required by law. When federal, state or local law requires it, limited to what the law requires.
- Abuse or neglect reporting. To report suspected child abuse or neglect, and other abuse as required by Kansas or Ohio law.
- Public health and safety. To prevent or lessen a serious and imminent threat to someone’s health or safety, or for public health activities such as reporting disease or problems with medications.
- Health oversight. To agencies conducting audits, inspections, licensing and investigations authorized by law.
- Crimes on our premises. To law enforcement about a crime committed on our premises or against our staff, or a threat to commit one.
- Court orders. In response to a court order that meets the legal requirements described above.
- For approved research, under the safeguards the law requires.
- Other legally permitted purposes. Including workers’ compensation, coroners and medical examiners, organ donation, military and national security, and correctional settings, only as allowed by law and, for SUD records, only as Part 2 permits.
Uses that require your written authorization
We will ask for your written authorization before we:
- Use or share your information for most marketing purposes.
- Sell your information.
- Share psychotherapy notes or SUD counseling notes, with limited exceptions.
- Use or share your information for any purpose not described in this notice.
Your rights
To use any of these rights, send a written request to our Privacy Officer (contact details below).
- Get a copy of your records. You may see or get a paper or electronic copy of your health record, or have it sent to someone you choose. We may charge a reasonable, cost-based fee.
- Ask us to correct your record. If you think information is wrong or incomplete, you may ask us to amend it. We may say no, but will tell you why in writing.
- Request confidential communications. You may ask us to contact you a certain way (for example, only by mobile phone) or at a certain address. You do not need to give a reason, and we will agree to reasonable requests.
- Ask us to limit what we use or share. We will consider every request. We must agree if you ask us not to share information with your health plan about a service you paid for in full out of pocket, unless the law requires us to share it.
- Get a list of disclosures. You may ask for an accounting of certain disclosures we made. The first list in any 12-month period is free; we may charge a reasonable fee for more.
- Get a paper copy of this notice, even if you agreed to receive it electronically.
- Choose someone to act for you. A personal representative or legal guardian may exercise your rights.
State law
Where Kansas or Ohio law gives your information greater protection than federal law, such as for certain mental health or HIV-related information, we follow the stricter law.
Nondiscrimination and language assistance
Arista does not discriminate on the basis of race, color, national origin, age, disability or sex (including sexual orientation, gender identity, sex stereotypes and pregnancy-related conditions). Free language assistance and auxiliary aids are available. Call [Language line] or ask any staff member.
Si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame al [Language line] o pregunte a cualquier miembro del personal.
If you believe you have been discriminated against, you may file a grievance with [Grievance contact / Privacy Officer] at [Phone].
Questions and complaints
Contact our Privacy Officer: @Alyssa, Privacy Officer, Arista Recovery, [Mailing address], [Phone], [Email].
If you believe your privacy rights have been violated, including your Part 2 rights, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, or at www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.
Effective date: [Effective date]
Part 2 — Website & Online Privacy Notice
Last updated: [Effective date]
This notice explains how Arista Recovery ([Legal entity name], “Arista,” “we,” “us”) collects, uses and shares personal information through aristarecovery.com, ohio.aristarecovery.com, our phone lines, forms, text messages and other online channels (together, our “Sites and Services”). Health information we hold as your treatment provider is covered by our Notice of Privacy Practices, which controls if the two notices conflict.
Information we collect
- Contact details — name, phone, email, mailing address, and contact details for a loved one or referring professional if you provide them.
- Inquiry and admissions details — information you share when you call, chat, request an insurance check or complete a form, such as the type of help you are looking for, insurance carrier and member information, and preferred location.
- Referral information — details a professional submits through our referral form on behalf of a client, with that client’s permission.
- Call information — calls to our tracked phone numbers may be recorded and transcribed for quality, training and follow-up, along with the number you called from, call time and how you found us.
- Usage information — IP address, approximate location, device and browser type, pages visited, referring site, and ad or campaign details, collected through cookies and similar technologies.
- Job applicant information — your resume, work history, contact details and other information you choose to provide when you apply to work with us.
How we collect it
- Directly from you when you call, text, chat, submit a form or apply for a job.
- From people acting for you, such as a family member, case manager, clinician or other referral source.
- Automatically through cookies, pixels and call-tracking technology on our Sites.
- From service providers, such as insurance verification, advertising and analytics partners.
How we use it
- To respond to your inquiry, verify insurance benefits, and help you or your loved one access care.
- To follow up by phone, email or text about the services you asked about.
- To understand how people find and use our Sites, measure our advertising, and improve our services.
- To train staff and review call quality.
- To review job applications and hire.
- To protect our Sites, prevent fraud and comply with the law.
How we share it
We do not sell your personal information. [Counsel to confirm wording based on the tracking tools in use.] We share it only as follows:
- Within Arista, with staff at our Kansas and Ohio locations who need it to respond to you.
- Service providers that support our operations, such as website hosting, call tracking and recording, customer relationship management, email and analytics providers. They may use the information only to provide services to us.
- Advertising and analytics partners that receive limited technical information, such as device identifiers and pages visited, through cookies or pixels. [List vendors in use, e.g., Google Analytics, Google Ads, Microsoft Advertising, Meta.]
- Referral partners, when you ask us to connect you with another provider better suited to your needs.
- Legal and safety reasons, when required by law or needed to protect the rights, property or safety of Arista, our patients, staff or the public.
- Business transfers, in connection with a merger, acquisition or sale of assets.
Text messages and calls
If you give consent on our forms, we may contact you by call, text or email about your inquiry. Message and data rates may apply. Reply STOP to opt out of texts at any time. Consent is not a condition of receiving services.
Cookies and your choices
- You can set your browser to block or delete cookies; some site features may not work as expected.
- You can limit interest-based ads through the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org), and through Google’s Ad Settings.
- You can opt out of Google Analytics with Google’s browser add-on.
- You can unsubscribe from emails using the link in any message.
Data security and retention
We use reasonable administrative, technical and physical safeguards to protect personal information. No method of transmission over the internet is completely secure. We keep information as long as needed to serve you, run our business, resolve disputes and meet legal obligations.
Your requests
You may ask to access, correct or delete personal information we hold about you, or to stop receiving marketing. Contact us using the details below. We will verify your identity before acting, and some requests may be limited by law, including medical record retention requirements.
Third-party sites
Our Sites may link to other websites and social media platforms. Their privacy practices are governed by their own policies.
Children
Our Sites are not directed to children under 13, and we do not knowingly collect their information online. [Confirm the age range Arista treats and adjust if needed.]
Changes to this notice
We may update this notice. The date at the top shows when it last changed.
Contact us
@Alyssa, Privacy Officer, Arista Recovery, [Mailing address] · [Phone] · [Email]
