Notice of Privacy Practices

Who This Notice Covers

This Notice applies to A Sacred Journey LLC ("A Sacred Journey," "we," "us," "our"), including our workforce members, clinical contractors, and anyone providing services on our behalf.

Our Responsibilities

We are required by law to:

• Protect the privacy and security of your protected health information;
• Give you this Notice describing our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect;
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.

Some of your information is protected by more than one law. Where the federal substance use disorder confidentiality rules (42 CFR Part 2) or Colorado law provide greater protection than HIPAA, we follow the stricter rule.

How We May Use and Share Your Information Without Your Written Permission

The law permits us to use and share your information for the purposes below. The examples are illustrations, not a complete list. Additional restrictions apply to substance use disorder records and to information protected by Colorado law, both described later in this Notice.

Treatment

To provide, coordinate, and manage your care. Example: coordinating your care with your primary care provider or a psychiatrist you are also seeing.

Payment

To bill and receive payment for services, verify coverage, and manage claims. Example: sending your diagnosis and dates of service to Colorado Medicaid so we can be paid.

Health Care Operations

For activities that support the running and quality of our practice, including quality review, training, licensing, and auditing. Example: reviewing records to evaluate the quality of care our clinicians provide.

Business Associates and Qualified Service Organizations

We use outside vendors for services such as billing, recordkeeping, and technology. They receive only the information they need, and each is bound by a written agreement requiring them to safeguard it under HIPAA and, where substance use disorder records are involved, under 42 CFR Part 2.

People Involved in Your Care

With your agreement, or when we can reasonably infer that you do not object, we may share information relevant to your care with a family member, friend, or caregiver involved in that care. Stricter rules apply to substance use disorder information and to minors receiving services on their own consent.

Appointment Reminders

We may contact you to remind you of appointments or to follow up on your care. We limit the content of reminders to the minimum necessary.

Other Uses Permitted or Required by Law

We may also use or share your information when required by law, including to the U.S. Department of Health and Human Services to verify our compliance; for public health activities; to report suspected abuse, neglect, or domestic violence; to avert a serious and imminent threat to health or safety; for health oversight activities such as audits and licensure investigations; in response to a court order or other lawful process; to coroners, medical examiners, and funeral directors; for workers' compensation claims; for specific law enforcement purposes; for approved research; and for certain specialized government functions. Where the information involved is a substance use disorder record, these disclosures are further limited by 42 CFR Part 2.

Uses and Sharing That Require Your Written Permission

We will obtain your written permission before we:

• Use or share your psychotherapy notes, except in the narrow circumstances the law allows;
• Use or share your information for marketing;
• Sell your information;
• Share substance use disorder records protected by 42 CFR Part 2, except as that rule allows;
• Use or share your information for any purpose not described in this Notice.

You may revoke a written permission at any time by notifying our Privacy Officer in writing. Revoking does not undo anything we already did in reliance on it.

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

A Sacred Journey provides substance use disorder services. Federal law gives records of those services protection that goes beyond HIPAA.

In general, we may not tell anyone that you have or have had a substance use disorder, or that you received substance use disorder services from us, unless one of the following applies:

• You give us specific written consent;
• The disclosure is to a qualified service organization under a written agreement;
• A court issues an order that meets the requirements of 42 CFR Part 2 (a subpoena alone is not enough);
• The disclosure is to medical personnel in a genuine medical emergency;
• The disclosure is for research, audit, or program evaluation as permitted by 42 CFR Part 2.

When we do disclose these records, we are required to include the following notice with the disclosure:

"This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose."

These records may not be used to bring criminal charges against you or to investigate you, without your consent or a court order meeting Part 2 requirements.

Part 2 does not protect information about a crime committed or threatened at our location or against our staff, and it does not prevent us from making legally required reports of suspected child abuse or neglect.

Colorado Law

Colorado law gives your mental health information protection beyond what HIPAA requires. Where Colorado law is stricter, we follow Colorado law.

Confidentiality of What You Say in Therapy

Under C.R.S. § 12-245-220, communications between you and a licensed, certified, or registered mental health professional are confidential and may not be disclosed without your consent, except in the specific circumstances that statute allows. Our staff and contractors, clinical and administrative alike, are bound by the same restriction. In court and administrative proceedings, these communications are also privileged under C.R.S. § 13-90-107.

When We Must Act Even Without Your Consent

There are narrow situations where Colorado law requires us to act:

• Threats of violence. If you communicate a serious threat of imminent physical violence against a specific person or persons, C.R.S. § 13-21-117 requires us to take steps to protect that person, which may include warning them and notifying law enforcement.
• Child abuse or neglect. We are mandatory reporters under C.R.S. § 19-3-304 and must report suspected child abuse or neglect.
• Abuse of at-risk adults and elders. We must report suspected mistreatment as required by Colorado law.

If You Are 12 or Older and Came to Us on Your Own

Under C.R.S. § 12-245-203.5, a minor who is twelve years of age or older may receive outpatient psychotherapy services without a parent or guardian's consent, if the clinician determines the minor is knowingly and voluntarily seeking services and that services are clinically indicated and necessary to the minor's well-being.

If you are a minor receiving services on your own consent:

• Information about your care is disclosed to you, not automatically to your parent or guardian.
• We must obtain your consent before telling your parent or guardian about your services, unless we believe you are unable to manage your own care or treatment.
• We will talk with you about why involving a parent or guardian may help, and we will encourage it.
• If you communicate an intent to commit suicide, we are required to notify your parent or legal guardian.
• If you communicate a serious threat of imminent physical violence against a specific person, we are subject to the duty to protect under C.R.S. § 13-21-117(2) and must notify your parent or legal guardian unless doing so would be inappropriate or detrimental to your care and treatment.

How Long We Keep Your Records

Under C.R.S. § 12-245-226(1)(a)(II)(A), client records may not be maintained after seven years. This is separate from, and shorter than, the six-year retention that HIPAA applies to our policies and compliance documentation.

Your Mandatory Disclosure Statement

Colorado also requires each mental health professional to give you a written Mandatory Disclosure Statement under C.R.S. § 12-245-216, covering their credentials, the regulation of their profession, your right to seek a second opinion, and the confidentiality of what you share. You will receive that separately from your clinician. It is a different document from this Notice.

Substance Use Disorder Records

Where Colorado law and 42 CFR Part 2 both apply to the same information, we follow whichever gives your information more protection.

Your Rights

To exercise any of these rights, contact our Privacy Officer using the information at the end of this Notice.

Get a copy of your record. You can inspect and receive a copy of the health information we maintain about you, in most cases within 30 days of your request. We may charge a reasonable, cost-based fee. Certain information, such as psychotherapy notes, may be withheld.

Ask us to correct your record. If you believe information in your record is wrong or incomplete, you may ask us to amend it. If we deny your request, we will tell you why in writing within 60 days.

Request confidential communications. You can ask us to contact you in a specific way or at a specific address or phone number. We will accommodate reasonable requests.

Ask us to limit what we use or share. You may request restrictions on how we use or disclose your information. We are not required to agree, with one exception: if you pay in full out of pocket for a service, you may direct us not to share information about that service with your health plan, and we must honor that request unless the law requires disclosure.

Get a list of who we shared it with. You may request an accounting of certain disclosures we made in the six years before your request, including disclosures of substance use disorder records. Disclosures for treatment, payment, and health care operations are excluded from the HIPAA accounting. The first request in any twelve-month period is free.

Get a paper copy of this Notice. You may request one at any time, even if you agreed to receive it electronically.

Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise these rights on your behalf. We will verify their authority before acting. If you are a minor receiving services on your own consent under Colorado law, these rights are yours.

File a complaint. If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or directly with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online: Office for Civil Rights Complaint Portal
• Mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201
• Phone: 1-800-368-1019

You may also file a complaint with the Colorado Behavioral Health Administration at bha.colorado.gov/help/submit-a-complaint .

We will not retaliate against you for filing a complaint.

Changes to This Notice

We may change this Notice at any time, and the changes will apply to all information we maintain, including information created before the change. The current version will always be posted on our website and available at our office on request. The Effective Date at the top shows when this Notice last changed.

Contact Us

Privacy Officer: Jennifer Abbie
A Sacred Journey LLC
3595 E Fountain Blvd, Suite 140
Colorado Springs, CO 80910

Phone: 303-981-7868
Email: jen@asacredjourney.org

If you are experiencing a crisis, call or text 988 for the Suicide and Crisis Lifeline. If you are in immediate danger, call 911.