Marula Rehab Telehealth

NOTICE OF PRIVACY PRACTICES (NPP)

 

Effective Date: 06/14/2026

 

This Notice describes how your medical information may be used and disclosed, and how you can access this information. Please review it carefully.

Marula Rehab Telehealth is committed to protecting the privacy and security of your health information in accordance with:

• HIPAA (Health Insurance Portability and Accountability Act)

• HITECH Act (Health Information Technology for Economic and Clinical Health Act)

• 42 C.F.R. Part 2 (Confidentiality of Substance Use Disorder Patient Records)

• Utah Code Title 26B (Utah Health & Human Services Code)

• Utah Data Breach Notification Act

1. Our Legal Duties

• We are required by federal and Utah law to:

• Maintain the privacy of your Protected Health Information (PHI)

• Maintain the security of electronic PHI (ePHI)

• Provide you with this Notice of Privacy Practices

• Follow the terms of this Notice

• Notify you if a breach compromises your information

• Comply with strict confidentiality rules for substance‑use disorder treatment records

• We may not use or disclose your information unless permitted or required by law, or unless you authorize the disclosure in writing.

2. How We May Use and Disclose Your Information

• We may use or disclose your PHI for the following purposes:

• A. Treatment

• To provide, coordinate, or manage your care, including telehealth services, referrals, consultations, and clinical coordination.

• B. Payment

• To bill and collect payment for services, including insurance claims, eligibility verification, and prior authorizations.

• C. Healthcare Operations

• For quality improvement, training, licensing, audits, compliance, and administrative functions.

3. Uses and Disclosures Requiring Your Written Authorization

• We must obtain your written authorization before:

• Disclosing substance‑use disorder treatment information (42 CFR Part 2)

• Using PHI for marketing

• Selling your PHI

• Sharing psychotherapy notes

• Releasing information to attorneys, employers, or third parties not involved in your care

• You may revoke your authorization at any time in writing.

4. Uses and Disclosures Allowed Without Authorization

• We may disclose PHI without your written authorization when permitted or required by law, including:

• Medical emergencies

• Public health reporting

• Suspected abuse, neglect, or exploitation

• Health oversight activities

• Judicial or administrative orders

• Serious threats to health or safety

• Coroners, medical examiners, and funeral directors

• Workers’ compensation

• 42 CFR Part 2 allows limited disclosures only in medical emergencies, audits, or by court order.

5. Telehealth Privacy & Security

• Marula Rehab Telehealth uses:

• Encrypted, HIPAA‑compliant telehealth platforms

• Secure authentication and access controls

• Encrypted transmission and storage of PHI

• Utah‑compliant telehealth procedures under Utah Code § 26B‑4‑704

• No recording of sessions unless required by law and only with your written consent

6. Your Rights Under HIPAA and Utah Law

• You have the right to:

• A. Access Your Records

• You may inspect or obtain copies of your PHI. Utah law requires access within 30 days unless an extension is permitted.

• B. Request Amendments

• You may request corrections to inaccurate or incomplete information.

• C. Request Restrictions

• You may request limits on how we use or disclose your PHI. We must honor restrictions for services you pay for out‑of‑pocket (Utah Medicaid Rule R414).

• D. Confidential Communications

• You may request alternative communication methods (e.g., alternate address, phone‑only communication).

• E. Accounting of Disclosures

• You may request a list of disclosures made without your authorization.

• F. Receive a Copy of This Notice

• You may request a paper or electronic copy at any time.

7. Confidentiality of Substance‑Use Disorder Records (42 CFR Part 2)

• If you receive substance‑use disorder treatment:

• Your records are protected by federal law

• We cannot disclose them without your written consent

• Violations may result in criminal penalties

• A general medical release does not authorize disclosure of Part 2 records

• Disclosures for treatment, payment, or operations require specific consent language

8. Breach Notification

• If your information is compromised, we will notify you:

• Without unreasonable delay, and

• No later than 60 days after discovery

• If the breach affects 500 or more individuals, we will also notify:

• The U.S. Department of Health & Human Services (HHS)

• Prominent media outlets

• Utah authorities under Utah Code § 13‑44‑202

9. Changes to This Notice

• We reserve the right to revise this Notice at any time. Revised versions will be posted on our website and available upon request.

10. Questions, Complaints, or Requests

• If you have questions or wish to exercise your rights, contact:

• Marula Rehab Telehealth – Privacy & Compliance Office Phone: 801-427-5515 Email: corp@marularehabtelehealth.com

• Address: 2728 N. Canyon Rd. Pleasant Grove Utah 84062

• You may also file a complaint with:

• U.S. Department of Health & Human Services – Office for Civil Rights (OCR) Utah Department of Health & Human Services – Office of Civil Rights

• You will not be penalized for filing a complaint.