Marula Rehab Telehealth - HIPAA Compliance Notice

(Utah & Federal Requirements)

Marula Rehab Telehealth is committed to protecting the privacy, security, and lawful use of your health information. This notice explains how we comply with the Health Insurance Portability and Accountability Act (HIPAA), the HITECH Act, 42 C.F.R. Part 2 (for substance‑use disorder information), and Utah state privacy laws under Utah Code Title 26B.

1. Our Legal Duty to Protect Your Information

• We are required by federal and Utah law to:

• Maintain the privacy of your Protected Health Information (“PHI”)

• Maintain the security of electronic PHI (“ePHI”)

• Provide you with a Notice of Privacy Practices

• Notify you if a breach compromises the privacy or security of your information

• Follow all confidentiality rules for substance‑use disorder treatment records under 42 C.F.R. Part 2, when applicable

• Comply with Utah’s Health and Human Services Code and Data Breach Notification Act

• We may not disclose your information unless permitted or required by law, or unless you provide valid written authorization.

2. How We Use and Disclose Your Information

• We may use or disclose your PHI for:

• Treatment – providing, coordinating, or managing your care

• Payment – billing, claims, and insurance coordination

• Healthcare Operations – quality improvement, training, compliance, audits

• For substance‑use disorder treatment, disclosures are strictly limited by 42 C.F.R. Part 2 and generally require your written consent, except in medical emergencies or when required by court order.

• We do not sell your information, share it for marketing, or disclose it to third parties without legal authority.

3. Your Rights Under HIPAA and Utah Law

• You have the right to:

• Access your medical records

• Request corrections to inaccurate information

• Request restrictions on certain uses or disclosures

• Receive confidential communications

• Obtain an accounting of disclosures

• Receive a copy of this notice at any time

• File a complaint without fear of retaliation

• Utah law also grants you rights to:

• Access your records within 30 days

• Receive records in electronic format when available

• Request amendments under Utah Code § 26B‑8‑302

4. Telehealth Privacy & Security

• For telehealth services, we use:

• Encrypted, HIPAA‑compliant platforms

• Secure authentication and access controls

• Encrypted storage and transmission of PHI

• Audit logs and monitoring

• Utah‑compliant telehealth procedures under Utah Code § 26B‑4‑704

• We do not record telehealth sessions unless required by law and only with your written consent.

5. Breach Notification

• If your information is compromised, we will notify you:

• Without unreasonable delay, and

• No later than 60 days after discovery, as required by HIPAA and HITECH

• If the breach affects 500 or more individuals, we will also notify:

• The U.S. Department of Health & Human Services (HHS)

• Prominent media outlets, as required

• Utah authorities when applicable under Utah Code § 13‑44‑202

6. Confidentiality of Substance‑Use Disorder Records (42 C.F.R. Part 2)

• If you receive substance‑use disorder or alcohol‑dependency treatment:

• Your records are protected by federal law

• We cannot disclose them without your written consent

• Violations may result in criminal penalties

• A general medical release does not authorize disclosure of Part 2 records

7. Contact Information

• For questions, concerns, or to exercise your rights, contact:

• Marula Rehab Telehealth – Privacy & Compliance Office Phone: [Insert Clinic Number] Email: [Insert HIPAA‑secure email] Address: [Insert Mailing Address]

• You may also file a complaint with:

• U.S. Department of Health & Human Services – Office for Civil Rights (OCR)

• Utah Department of Health & Human Services

• You will not be penalized for filing a complaint.