Notice of privacy practices

Effective Date: August 17, 2026 — Last Revised: August 17, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Section 1: Who we are

Jasper Grove Recovery is a residential substance use disorder treatment program providing detoxification and residential rehabilitation services. We are a HIPAA-covered entity and a federally assisted SUD treatment program subject to 42 CFR Part 2. This Notice applies to all services at this facility and to all staff, contractors, and volunteers acting on our behalf.

Section 2: Our legal duties

We are required by law to:

• Maintain the privacy and security of your protected health information (PHI) and SUD treatment records;
• Provide you with this Notice and abide by its terms;
• Notify you of any breach of your unsecured PHI; and
• Obtain your written consent before disclosing SUD treatment records in most circumstances, consistent with 42 CFR Part 2.

Section 3: How we use and disclose your information

A. Treatment, Payment, and Health Care Operations (No Authorization Required)

For general health information not specifically identifying you as receiving SUD treatment, we may use and disclose your PHI without authorization for:

• Treatment: Coordinating care with physicians, nurses, therapists, and other providers involved in your treatment.
• Payment: Submitting claims to Medicaid, Medicare, or other insurers; verifying eligibility; responding to utilization review.
• Operations: Quality improvement, peer review, accreditation (including Joint Commission), staff training, and compliance functions.

B. Substance Use Disorder Records — 42 CFR Part 2 (Stricter Rules Apply)

Records identifying you as receiving SUD assessment or treatment are subject to stricter protection under 42 CFR Part 2. Generally, we will NOT disclose these records without your written consent on a Part 2-compliant form. A general HIPAA authorization is NOT sufficient. Exceptions where consent is not required:

• Medical emergencies posing an immediate threat to your health or life;
• Research, audit, or evaluation activities meeting federal requirements;
• Court orders meeting specific 42 CFR Part 2 requirements (not just any subpoena);
• Crimes on program premises or against staff, reported to law enforcement; and
• Mandatory reports of child abuse or neglect required by state law.

C. Other Permitted Uses (No Authorization Required)

Subject to Part 2 restrictions, we may also use or disclose PHI without authorization for: required legal reporting; government health oversight and inspections; judicial proceedings; serious threats to health or safety; decedents (coroner/medical examiner); organ donation; workers' compensation; and disaster relief notification to family members.

D. Uses Requiring Your Written Authorization

All other uses and disclosures—including marketing, sale of PHI, psychotherapy notes, and SUD records not covered by a Part 2 exception—require your written authorization. You may revoke any authorization in writing at any time; revocation does not apply to actions already taken in reliance on it.

Section 4: Group therapy confidentiality

Information shared in group therapy sessions is confidential. Participants may not disclose other members' identities or disclosures outside the group. Clinical staff may share relevant clinical information with your treatment team as part of integrated care. Breaching group confidentiality may result in consequences up to and including discharge.

Section 5: Your rights

To exercise any right below, submit a written request to our Privacy Officer (contact in Section 7).

• Access and Inspect: You may obtain copies of your health records (electronic copies available). We respond within 30 days.
• Amendment: You may request correction of inaccurate or incomplete information. We may deny requests where information was not created by us or is accurate and complete.
• Accounting of Disclosures: You may request a list of certain disclosures made in the prior six years, excluding treatment, payment, and operations disclosures.
• Request Restrictions: You may request we restrict certain uses or disclosures. If you pay out-of-pocket in full, we must restrict disclosure to your health plan for that service.
• Confidential Communications: You may request we contact you in a specific way or location.
• Paper Copy: You may request a paper copy of this Notice at any time.
• Breach Notification: We will notify you if your unsecured PHI is breached.
• File a Complaint: You may file a complaint with us or with HHS Office for Civil Rights. We will not retaliate.

Section 6: Changes to this notice

We reserve the right to change this Notice and apply the revised version to all PHI we hold. Material changes will be posted at our facility and on our website. You may request a current copy at any time.

Section 7: Contact information and complaints

Privacy Officer:

Stacie Hurley | Jasper Grove Recovery | 6330 Digital Way, Indianapolis, IN 46278 | 203.668.0103 | stacie.hurley@alsosmgmt.com

HHS Office for Civil Rights:

200 Independence Avenue S.W., Washington D.C. 20201 | 1-800-368-1019 | www.hhs.gov/ocr

SAMHSA (42 CFR Part 2 Questions):

1-877-SAMHSA-7 (1-877-726-4727) | www.samhsa.gov

This notice satisfies 45 CFR §164.520 (HIPAA) and 42 CFR Part 2. Not legal advice.