HIPAA Privacy Rights Form

If you have any questions about this Notice or want additional information, please contact
Chesapeake Behavioral Health Center, LLC (Privacy Contact – Lucy Cashdollar, R.N.) at
410-833-0581.

1. Purpose

We are required by law to maintain the privacy of your protected health information (“PHI”), to
provide individuals with notice of our legal duties and privacy practices with respect to PHI, and
to notify affected individuals following a breach of unsecured protected health information.
“Protected health information” is information about you that may identify you and that relates to
your past, present, or future physical or mental health or condition and related health care
services.

This Notice describes how we may use and disclose your protected health information to carry
out treatment, payment, or health care operations and for other purposes that are permitted or
required by law. It also describes your rights to access and control your protected health
information. We are required to abide by the terms of this Notice currently in effect. We reserve
the right to change the terms of our Notice at any time as permitted by law. The new Notice will
be effective for all protected health information we maintain at that time and for information we
receive in the future. We will post a current copy of the Notice and will have copies of our
current Notice available each time you are here for health care services. We will also provide
you with any revised Notice of Privacy Practices upon request made by you via phone or in
person.

2. Uses and Disclosures of Protected Health Information for Treatment,
Payment, and Health Care Operations

The following categories describe ways we may use and disclose health information for
treatment, payment, and health care operations. At least one example is given for each
category. Not every possible use or disclosure is listed.

A. Treatment: We may use and disclose your protected health information to provide you
with treatment and services and to coordinate your care. For example, we may disclose
your protected health information to other agency clinical staff involved in your care as
well as different departments of the agency to coordinate the various services you might
need, such as prescriptions.

B. Payment: Your protected health information may be used to obtain approval for and
payment for services you receive. For example, we may confirm your eligibility with
insurance plans, governmental agencies, or Medicaid to obtain approval and/or payment
for services.

C. Health Care Operations: We may use or disclose your protected health information as
necessary for our regular business activities such as health oversight, accreditation,
licensing, and quality assurance. For example, members of the quality assurance team
may use information in your health record to assess the care in your case to continually
improve the quality and effectiveness of the health care services we provide. As part of
operations, we may contact you to provide appointment reminders.

We may share your protected health information with third-party “business associates” that
perform various activities for us involving protected health information (e.g., auditors, attorneys),
but only when we have a written contract with the business associate that fully protects the
privacy of your protected health information.

3. Other Permitted and/or Required Uses and Disclosures

According to Federal Privacy Regulations, we may make the following uses and disclosures
without obtaining consent or written authorization from you:

A. Unless you object, under federal law, we may disclose health information about you to a
member of your family, a relative, a close friend, or any other person you identify as
involved in your care.

B. We may use or disclose your protected health information in an emergency when the
use and disclosure of the protected health information are necessary to prevent a
serious risk of bodily harm or death.

C. We may use or disclose your protected health information if and to the extent we are
required by federal or state law. If required by law, you will be notified of any such uses
or disclosures.

D. We may disclose to a court when ordered by the court.

E. We must disclose to a public health authority that is authorized by law to receive reports
of child abuse or neglect. In addition, if we believe that you have been a victim of abuse,
neglect, or domestic violence, we must disclose your protected health information to the
governmental entity or agency authorized to receive such information. Any disclosure of
suspected abuse will be made consistent with the requirements of any applicable state
law.

F. We may disclose to governmental agencies or private entities responsible for overseeing
health care activities through audits, investigations, inspections, and licensure. Oversight
agencies include government and/or private agencies that oversee the health care
system, government benefit programs, government regulatory programs, and civil rights
laws.

G. Required Uses and Disclosures: Under federal law, we must make disclosures when
required by the Secretary of the United States Department of Health and Human
Services to investigate or determine our compliance with the requirements of the HIPAA
Privacy Rule (45 C.F.R. Part 164, Subpart E, §§ 164.500 et seq.). We may disclose for
public health purposes such as notifying public health authorities regarding specific
communicable diseases but only to the extent allowed by state law. We may disclose to
federal, state, or local agencies engaged in disaster relief to the extent that such
information is required to enable them to carry out their responsibilities in specific
disaster situations.

4. Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization

Other uses and disclosures of your protected health information not covered by this Notice or by
laws that apply to us will be made only with your written authorization. You may revoke this
authorization at any time, in writing. If you revoke this authorization, we will no longer use or
disclose your protected health information for the reasons covered by the authorization.
However, we cannot undo any disclosures we have already made with the authorization and are
required to retain our records of the care that we provided to you.

Special Authorization Requirements: Most uses and disclosures of psychotherapy notes
require your written authorization. Most uses and disclosures of protected health information for
marketing purposes require your written authorization. The sale of protected health information
requires your written authorization. We will not use or disclose your information for these
purposes without your specific written authorization.

If we create or maintain substance use disorder (SUD) records protected under 42 CFR Part 2,
those records receive additional protections. Part 2 records generally require your written
consent before being used or disclosed for treatment, payment, or health care operations
(subject to limited exceptions), and they may not be used or disclosed in civil, criminal,
administrative, or legislative proceedings against you without your consent or a court order that
meets specific requirements.

5. Your Rights Regarding Your Protected Health Information

You have the following rights with respect to your protected health information:

● Right to Request Restrictions: You have the right to request a limitation or a restriction
on the protected health information we use or disclose about you for treatment, payment,
or health care operations. We are not required to agree to a restriction that you may
request, except in the following case: If you (or someone on your behalf) pay for a health
care item or service in full out-of-pocket, you may request that we not disclose
information about that item or service to your health plan for payment or health care
operations purposes. In that case, we must agree to the requested restriction (unless the
disclosure is required by law). If we agree to a requested restriction, we may not use or
disclose your protected health information in violation of the restriction unless it is
needed to provide emergency treatment. You must make this request in writing to our
Privacy Contact at the address listed below.
● Right to Request Confidential Communication: You have the right to request to
receive confidential communications from us in a certain way or at an alternative
location. For example, you can ask that we only contact you at home or by mail. We will
accommodate reasonable requests. We may also condition this accommodation by
asking you for a specification of an alternative address or another method of contact.
The request must be made in writing to our Privacy Contact at the address listed below
specifying how or where you wish to be contacted.
● Right to Inspect and Copy: You have the right to inspect and obtain a copy of
protected health information about you that we maintain (including an electronic copy if
we maintain the information electronically and it is readily producible). To inspect and/or
obtain a copy of protected health information, you must submit your request in writing to
our Privacy Contact. If you request a copy of the information, we may charge a
reasonable fee for the costs of copying, mailing, or other related costs. We may deny
your request to inspect and copy in certain limited circumstances. Under federal law, for
example, you may not inspect or copy the following records: psychotherapy notes;
information compiled in reasonable anticipation of, or use in, a civil, criminal, or
administrative action or proceeding. We are also permitted to deny your request to
inspect and copy if the protected health information was obtained from someone under a
promise of confidentiality. Please contact our Privacy Contact if you have questions
about access to your records.
● Right to Amend: If you believe that the health information we have about you is
incorrect or incomplete, you may request that we amend it. Your request must be in
writing, submitted to the address listed below, and must state the reason you are seeking
an amendment. If we deny your request for amendment, you have the right to file a
statement of disagreement with us which will be made a part of your record. We may
prepare a rebuttal to your statement and will provide you with a copy of such a rebuttal.
Please contact our Privacy Contact if you have questions about amending your record.
● Right to Receive an Accounting of Disclosures: You have the right to an accounting
of disclosures for purposes other than treatment, payment, or health care operations as
described in this Notice. You have the right to receive specific information regarding
these disclosures that occurred after April 14, 2003. You must submit your request in
writing to the address listed at the end of this Notice. The right to receive this information
is subject to certain exceptions, restrictions, and limitations.
● Right to Receive a Copy: You have a right to receive a paper copy of this Notice of
Privacy Practices upon request, even if you have agreed to receive it electronically.
● Right to File a Complaint: If you believe we have violated your privacy rights, you may
complain to us or to the Secretary of Health and Human Services. You may file a
complaint with us by notifying our Privacy Contact. We will not retaliate against you for
filing a complaint.

6. Contacting the Privacy Officer

Lucy Cashdollar, R.N. (Privacy Contact)
Chesapeake Behavioral Health Center, LLC
217 Main Street, Suite B
Reisterstown, Maryland 21136
Phone: 410-833-0581

This Notice of Privacy Practices is effective October 16, 2026, and supersedes prior versions.