Your Information. Your Rights. Our Responsibilities.

This notice is not a consent to treatment and is not an authorization to release records. Signing an acknowledgment only confirms that SEKYBH provided or offered the notice; it does not waive any privacy right.

At a Glance

Your rights

• Get an electronic or paper copy of much of your health record.
• Ask us to correct information you believe is wrong or incomplete.
• Request confidential communications and ask us to limit certain uses or disclosures.
• Get a list of certain disclosures we made.
• Get a paper copy of this notice, choose someone to act for you, and file a complaint without retaliation.
• Your choices
• You have choices about sharing information with family, friends, caregivers, disaster-relief organizations, and others involved in your care or payment. Most uses of psychotherapy notes, marketing, sale of information, and uses not described in this notice require your written authorization.
• Our typical uses and disclosures
• We may use and share information to treat you, coordinate services, operate SEKBH, obtain payment, comply with law, protect health and safety, and perform other activities described below. More protective federal or Kentucky law controls when it applies.

1. Who Must Follow This Notice

This notice applies to SEKYBH and its workforce members, clinicians, psychiatric nurse practitioners, case managers, SCL personnel, trainees, supervised practitioners, administrative and billing staff, volunteers, and other persons who perform services for SEKYBH under SEKYBH’s privacy policies. It also describes how SEKYBH works with business associates—such as electronic-health-record, billing, secure communications, transcription, technology, legal, accounting, quality, and storage vendors—that receive protected health information to perform services for SEKYBH under written privacy and security obligations.

Independent providers or organizations involved in your care may have their own privacy notices. This notice does not automatically cover a hospital, pharmacy, laboratory, school, payer, crisis center, other practice, or outside waiver provider merely because SEKYBH communicates with it.

2. Information Covered by This Notice

Protected health information (“PHI”) is individually identifiable health information created, received, maintained, or transmitted by SEKYBH in any form. It may include demographic and contact information; intake and assessment data; diagnoses; treatment, service, safety, and person-centered plans; progress and psychotherapy documentation; medications and laboratory information; developmental and functional information; TCM and SCL service records; telehealth information; communications; recordings or transcripts when separately authorized; claims and payment information; and records received from others.

Psychotherapy notes have a special HIPAA definition and receive additional protection. They are a mental-health professional’s private notes documenting or analyzing the contents of a counseling conversation, kept separate from the rest of the medical record. Ordinary progress notes, diagnoses, symptoms, treatment plans, medication information, session times, test results, and summaries are not psychotherapy notes merely because they concern therapy.

3. Your Privacy Rights

Inspect and obtain a copy

You may ask to inspect or receive an electronic or paper copy of health and billing information in SEKYBH’s designated record set. We generally will act within 30 days and may take one lawful extension after written notice. We may charge only a reasonable, cost-based fee permitted by law. As a Kentucky behavioral health services organization, SEKYBH will provide one free copy of the client record as required by 902 KAR 20:430. Ask the Privacy Officer how SEKYBH applies this right.

The access right generally does not include separately maintained psychotherapy notes, information prepared for a civil, criminal, or administrative action, or certain information subject to other lawful limitations. Some test instruments, raw items, copyrighted materials, or information obtained under a promise of confidentiality may require special handling. If access is denied, we will explain the reason and any available review right.

Request an amendment

You may ask us in writing to amend information in the designated record set that you believe is incorrect or incomplete and explain why. We generally will respond within 60 days and may take one lawful extension after written notice. We may deny the request in circumstances permitted by law—for example, if SEKYBH did not create the information, the information is not part of the designated record set, it is not available for access, or we believe it is accurate and complete. If denied, you may submit a statement of disagreement as permitted by law.

Request confidential communications

You may ask us to contact you in a particular way or at a different address—for example, by portal rather than voicemail. We will accommodate reasonable requests and will not require you to explain why. Tell us which methods are safe. We cannot guarantee the security of ordinary email, SMS, or voicemail after transmission or delivery.

3. Your Privacy Rights (Continued)

Request restrictions

You may ask us not to use or disclose certain PHI for treatment, payment, or health-care operations or not to disclose information to a person involved in your care. We generally do not have to agree. If we agree, we will follow the restriction except when information is needed for emergency treatment or another exception applies. You may ask us how to document or end a restriction.

If you pay SEKYBH in full out of pocket for a specific service or item, you may ask us not to disclose information about that service to your health plan for payment or health-care operations. We will agree unless disclosure is required by law. This right may be limited by Medicaid, Medicare, managed-care, provider-contract, or other rules that prohibit private payment or require claims or coordination of benefits; we will explain if the requested arrangement is not legally available.

Receive an accounting of disclosures

You may request a list of certain disclosures made during the six years before your request. The accounting generally excludes disclosures for treatment, payment, or health-care operations; disclosures to you; disclosures you authorized; and certain other disclosures excluded by law. One accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for an additional accounting after telling you the cost and giving you a chance to withdraw or modify the request.

Receive this notice and choose a representative

You may receive a paper copy at any time, even if you agreed to electronic delivery. A verified personal representative—such as a legal guardian or person holding applicable health-care authority—may exercise rights for you within the scope of that authority. SEKYBH will verify identity and authority and may decline to treat someone as a personal representative where law permits, including certain abuse, neglect, exploitation, or safety circumstances.

Revoke an authorization

You may revoke a HIPAA or Part 2 authorization in writing at any time, except to the extent SEKYBH or another person has already acted in reliance on it, or as otherwise permitted by law. Revocation does not erase lawful records or reverse disclosures already made.

Complain without retaliation

If you believe your privacy rights were violated, you may contact the SEKYBH Privacy Officer using the information on the first page. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by visiting https://www.hhs.gov/ocr/complaints/, calling 1-877-696-6775, or writing to 200 Independence Avenue, S.W., Washington, D.C. 20201. SEKYBH will not retaliate against you for filing a complaint or exercising a privacy right.

4. Your Choices

When you can express a preference, tell us what you want us to do. We will follow your instructions when required by law and otherwise consider your best interests and professional judgment.

Family, friends, caregivers, and others involved in care or payment

With your agreement or when you do not object, we may share information directly relevant to a family member, friend, caregiver, or other person involved in your care or payment. If you cannot express a preference—for example, because you are unconscious or incapacitated—we may share relevant information when professional judgment indicates it is in your best interest. We may also disclose information to lessen a serious and imminent threat as permitted by law. A general emergency contact designation does not automatically authorize unrestricted access to your records.

Disaster relief

We may share limited information with an authorized disaster-relief organization to help notify or locate family or others responsible for your care, consistent with your preferences when practicable and applicable law.

Situations requiring written permission

Unless an exception specifically permits the activity, we will obtain your written authorization before:

• Using or disclosing most psychotherapy notes.
• Using PHI for marketing when HIPAA requires authorization.
• Selling PHI.
• Making a use or disclosure not described in this notice and not otherwise permitted or required by law.
• Recording a session or using session audio for AI-assisted documentation, except where a different lawful basis clearly applies and SEKYBH policy permits it.

SEKYBH does not currently use PHI to contact clients for fundraising. If that practice changes, the notice will be revised as required and any communication will explain how to opt out.

5. How We Typically Use and Share PHI

Treatment and coordination of care

We may use PHI and share it with professionals and entities involved in your treatment or services. Examples include consulting within SEKBH; coordinating psychotherapy, psychiatric medication, primary or specialty medical care, TCM, crisis services, assessments, laboratories, pharmacies, SCL waiver services, person-centered planning, discharge, and referrals; and communicating with a guardian or authorized representative. We disclose only as permitted by HIPAA, Part 2 when applicable, Kentucky law, signed authorization, or another lawful basis.

Health-care operations

We may use and share PHI to operate SEKBH, improve quality and safety, supervise and train staff, credential providers, conduct compliance and risk-management activities, resolve grievances, audit documentation and claims, evaluate performance, perform legal and accounting functions, maintain systems, prevent fraud or abuse, and contact you when necessary. Business associates may perform some functions under written contracts requiring safeguards.

Payment

We may use and share PHI to verify eligibility and benefits; obtain authorization; submit and correct claims; coordinate benefits; support medical necessity; respond to payer review or audit; collect lawful patient responsibility; and appeal payment decisions. Payers may require diagnoses, dates, service codes, plans, progress information, assessments, or portions of the record. Part 2-protected records require a Part 2-compliant consent or another Part 2 permission when applicable.

5. How We Typically Use and Share PHI (Continued)

Appointments, alternatives, and benefits

We may contact you about appointments, missed visits, refills, test or assessment results, care coordination, treatment alternatives, case-management or waiver needs, health-related benefits, services, or operational updates. We will use your recorded communication preferences when reasonably possible.

6. Other Uses and Disclosures Permitted or Required by Law

The following categories are not unconditional permissions. Each has legal prerequisites, and more protective federal or Kentucky law controls.

Public health and safety

We may disclose PHI to authorized persons for activities such as preventing or controlling disease, reporting adverse medication or product events, product recalls, public-health surveillance, or notifying a person who may have been exposed to a communicable disease when law permits. We may use or disclose PHI to prevent or lessen a serious and imminent threat to health or safety, consistent with law and professional standards.

Abuse, neglect, exploitation, and domestic violence

We will make reports required by law, including reports of suspected child abuse or neglect and applicable reports concerning abuse, neglect, or exploitation of vulnerable adults. We may make other disclosures about abuse, neglect, exploitation, or domestic violence when authorized by law and will limit information to what the law permits or requires.

Health oversight, licensing, and government programs

We may disclose PHI to authorized oversight agencies for audits, investigations, inspections, licensure, credentialing, disciplinary proceedings, civil-rights compliance, Medicaid or Medicare program integrity, waiver quality review, and other activities authorized by law. Special government functions may permit disclosures related to military missions, national security, protective services, correctional institutions, or lawful custody.

Judicial, administrative, and legal proceedings

We may disclose PHI in response to a valid court or administrative order or, when legal requirements are satisfied, a subpoena, discovery request, or other lawful process. Behavioral-health, psychotherapy, assessment, minor, and Part 2 information may receive additional protection. A subpoena alone does not necessarily permit every disclosure. SEKYBH may object, seek a protective order, notify you, or disclose only the minimum information authorized or required.

Law enforcement

We may disclose limited PHI for law-enforcement purposes when HIPAA and applicable law permit—for example, under qualifying legal process; to identify or locate certain persons; concerning a suspected crime on SEKYBH premises or against SEKYBH personnel; or in response to certain emergencies. Part 2 information cannot be used against a patient in covered legal proceedings without the patient’s specific written consent or the required Part 2 court order and legal mandate.

6. Other Uses and Disclosures Permitted or Required by Law (Continued)

Workers’ compensation and other benefit programs

We may disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation or similar programs. Disability, employment, school, court, or benefit forms may require a written authorization when another permission does not apply.

Research

We may use or disclose PHI for research only when legal safeguards are satisfied—for example, with your authorization, approval of an Institutional Review Board or Privacy Board waiver, for limited preparatory activities, or as a limited or de-identified data set under applicable agreements. SEKYBH does not promise that it conducts research.

Coroners, medical examiners, funeral directors, and organ donation

We may disclose relevant PHI to a coroner or medical examiner and to funeral directors as needed to perform lawful duties. We may disclose information to organ-procurement organizations as permitted by law.

Required disclosures

We will disclose PHI when federal or Kentucky law requires it, including to the U.S. Department of Health and Human Services when it investigates SEKYBH’s compliance. We will limit a required disclosure to what the law requires.

7. Special Protection for Behavioral Health Information

Psychotherapy notes

Most uses and disclosures of separately maintained psychotherapy notes require your written authorization. Authorization is generally not required for the originator’s use in treatment, certain training uses, SEKYBH’s legal defense, health-oversight of the originator, uses or disclosures required by law, and other narrow HIPAA exceptions. You generally do not have a HIPAA right of access to psychotherapy notes, although the provider may choose to share them when lawful and clinically appropriate.

Substance use disorder records under 42 C.F.R. Part 2

PART 2 APPLIES ONLY WHEN THE RECORD AND PROGRAM MEET FEDERAL REQUIREMENTS To the extent SEKYBH is a Part 2 program or creates or maintains records received from a Part 2 program, those records receive additional federal protection. This section does not by itself mean that every reference to substance use in a general mental-health record is a Part 2 record.

Part 2 generally requires written consent for uses and disclosures for treatment, payment, and health-care operations, unless a specific exception permits disclosure. A consent may authorize future treatment, payment, and health-care-operations disclosures until revoked. A HIPAA covered entity or business associate that receives Part 2 records under such consent may redisclose them as HIPAA permits, but the records still may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against the patient without the patient’s written consent or a Part 2 court order accompanied by a subpoena or similar legal mandate.

7. Special Protection for Behavioral Health Information (Continued)

Substance use disorder records under 42 C.F.R. Part 2 (Continued)

Part 2 permits certain disclosures without consent under defined conditions, including within the program and to qualified service organizations/contractors, bona fide medical emergencies, research, audits and evaluations, FDA-related safety notification, reports of suspected child abuse or neglect limited as required by law, certain crimes on program premises or against program personnel, and certain cause-of-death activities. The precise rule depends on the record, recipient, and purpose.

State and other laws that are more protective

Kentucky law and professional rules may provide additional protection for behavioral-health, developmental, medication, minor, guardianship, abuse/neglect, HIV or communicable-disease, genetic, assessment, and other information. SEKYBH will follow the more protective rule when it applies. Because the legal basis varies by situation, this notice summarizes rather than lists every Kentucky statute or privilege. Ask the Privacy Officer about a specific proposed disclosure.

8. Minors, Guardians, and Personal Representatives

A parent, guardian, custodian, or other authorized person generally may act as a minor’s or represented adult’s personal representative within the scope of legal authority. Exceptions may apply when a minor lawfully consents to care, a court or other person consents, the parent agrees to a confidential relationship, or treating the person as representative could endanger the client in circumstances recognized by law. Custody and guardianship orders may limit authority. SEKYBH will verify documentation and apply federal and Kentucky law to access and disclosure requests.

SEKYBH supports developmentally appropriate privacy and may share general treatment participation or safety information while limiting unnecessary detail, but this clinical practice does not override a representative’s lawful rights or SEKYBH’s mandatory-reporting and safety duties. Education records held by a school may be governed by FERPA rather than HIPAA; records held by SEKYBH generally remain governed by HIPAA and applicable behavioral-health law.

9. Electronic Records, Telehealth, Portals, and Technology

SEKYBH may create, store, transmit, and receive PHI through electronic health records, secure portals, telehealth systems, e-prescribing and pharmacy systems, electronic visit verification, payer portals, health-information exchange or care-coordination systems, secure fax, approved messaging, and other technology. We use administrative, physical, and technical safeguards and require appropriate business-associate agreements, but no system can eliminate all risk.

Ordinary email, text messaging, voicemail, personal devices, and communications outside SEKYBH’s controlled systems may be intercepted, misdirected, displayed to others, retained by carriers, or backed up without SEKYBH’s control. Clients should use approved secure methods and promptly update safe contact preferences.

SEKYBH will not record sessions or process session audio through an AI documentation tool solely on the basis of this notice. Any such use must follow SEKYBH policy and applicable consent/authorization requirements. If AI or transcription technology is used, the clinician remains responsible for reviewing the clinical record, and SEKYBH will apply vendor, access, security, and retention safeguards appropriate to the actual system.

10. Our Responsibilities

• Maintain the privacy and security of PHI as required by law.
• Follow the duties and privacy practices in the notice currently in effect.
• Provide a copy of this notice and make it available upon request, at the office, and on SEKYBH’s website if SEKYBH maintains a website describing services.
• Notify affected individuals promptly following a breach of unsecured PHI when notification is required.
• Use or disclose only the minimum necessary information when that standard applies.
• Not use or disclose PHI beyond this notice unless you authorize it in writing or law otherwise permits or requires it.
• Honor a valid revocation prospectively, subject to prior reliance and other legal exceptions.
• Not retaliate against anyone for exercising privacy rights or filing a complaint.

11. Changes to This Notice

SEKYBH may change this notice and may make the revised terms effective for all PHI it maintains, including information created or received before the revision. When a material change occurs, SEKYBH will promptly revise the notice and make the current version available upon request, at its service location, and on its website if applicable. The notice will display its effective date. Ask the Privacy Officer for the current version.

12. Contact SEKYBH About Privacy

Privacy Officer	John S. Collier, MSW, LCSW-S, Executive Director
Mailing address	Southeast Kentucky Behavioral Health, LLC, Attn: Privacy Officer, 202 West 7th Street, Suite 200, London, KY 40741
Telephone	606-657-0532, Ext 101
Secure email / fax	john@sekybh.com
Website / current NPP	www.sekybh.com
Office hours	By Appointment Only

Acknowledgment of Receipt

I acknowledge that Southeast Kentucky Behavioral Health, LLC provided or offered me its Notice of Privacy Practices. I understand that this acknowledgment is not consent to treatment, does not authorize a special use or disclosure, and does not waive any privacy right. I may receive a paper copy upon request.

Client name: ______________________________________    Client date of birth:______________________

Client/authorized representative signature: ____________________________________________________

Printed name and relationship / legal authority: __________________________________________________

Date and time: ______________________________________________________________

If signed by a representative, SEKYBH may request documentation of authority.

 

For SEKYBH Use When Acknowledgment Is Not Obtained

The client is not required to sign this acknowledgment as a condition of treatment. If SEKYBH cannot obtain a signature, staff must document the good-faith effort and reason.

☐  Client declined to sign.

☐  Client unable to sign.

☐  Emergency treatment situation.

☐  Notice delivered electronically; return acknowledgment not received.

☐  Other: ______________________________________________________________

Good-faith effort / delivery method: __________________________________________________________

Staff name and signature: ___________________________________Date and time: ____________________

as an operational te