Notice of Privacy Practices

1. Who we are

Painted Grove Recovery is a substance use disorder treatment program at 8311 Preston Hwy, Louisville, KY 40219. We are accredited by The Joint Commission. Our ASAM Levels of Care 3.5 and 3.1 are certified by CARF International. We are licensed in Kentucky.

We are a covered entity under HIPAA and a Part 2 program under 42 CFR Part 2. Both sets of rules apply to your records, and where they differ, we follow the stricter one.

2. Our duties

We are required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. We are also required to notify you if a breach affects your unsecured health information.

3. How we may use and disclose your information

A. What we use your information for

We use and disclose your health information for treatment, for payment, and for our own health care operations. Treatment means using it to care for you — for example, your counsellor and the nurse managing your withdrawal both read your chart so your medication and your therapy fit together. Payment means using it to get paid for that care — for example, sending your diagnosis and the level of care you received to your Medicaid plan so the stay is covered. Health care operations means running the program — for example, reviewing charts internally to check the quality of care, or providing records to an accrediting body during a survey.

B. With your written consent

Because we are a Part 2 program, most disclosures of your records require your written consent — including many that HIPAA alone would permit without it. Under the 2024 Part 2 rule, you may give a single consent covering all future uses and disclosures for treatment, payment, and health care operations, and you may revoke that consent in writing at any time except to the extent we have already acted on it.

When we disclose Part 2 records with your consent, limits on what the recipient may do next depend on who they are. Under the 2024 Part 2 rule, if the recipient is a health care provider, health plan, or health care clearinghouse covered by HIPAA and received the records under a consent for treatment, payment, or health care operations, they may then use and disclose them as HIPAA permits — they are not held to Part 2's narrower rules. Any other recipient is generally prohibited from redisclosing them except as Part 2 permits or with your further consent. Separately, and regardless of who holds them, these records may not be used against you in a criminal or civil proceeding without a court order that meets Part 2's requirements.

C. Without your consent

We may use or disclose your information without your consent only in the narrow situations the law allows, including: a medical emergency where information is needed to treat a condition that poses an immediate threat to health; reports of suspected child abuse or neglect, and other reports Kentucky law requires; scientific research, audits, and program evaluation under Part 2 safeguards; a valid court order that meets the specific requirements of 42 CFR Part 2 subpart E; and to a coroner or medical examiner regarding a deceased patient.

A subpoena, a search warrant, or a law-enforcement request alone is not enough to require us to disclose Part 2 records.

D. Uses that always require your written authorization

We will not use or disclose your information for marketing, or sell your information, without your written authorization. We will not use your records for fundraising without your written authorization, and you may opt out of any fundraising communication. Most uses of psychotherapy notes also require your authorization. You may revoke an authorization in writing at any time.

4. Group therapy

Our privacy obligations cover what we disclose. They cannot bind what another participant in a group session repeats outside it. We ask every participant to keep what is said in group confidential, and we take that expectation seriously — but you should know that it is an agreement among participants, not a legal protection we can enforce on your behalf.

5. Your rights

You have the right to:

Inspect and copy your records, and to receive an electronic copy where we hold them electronically.
Request an amendment if you believe your record is incorrect or incomplete. We may deny the request, and will tell you why in writing if we do.
Receive an accounting of disclosures we have made, including disclosures made for treatment, payment, and health care operations from electronic records, as provided under the 2024 Part 2 rule.
Request restrictions on uses and disclosures. We are not required to agree to a requested restriction, with one exception: if you pay for a service in full yourself, you may require that we not disclose the record of it to your health plan, and we must honour that.
Request confidential communications — for example, that we contact you only at a particular phone number or address.
Receive a paper copy of this notice on request, even if you agreed to receive it electronically.
Be notified if a breach affects your unsecured health information.
Complain without any retaliation, penalty, or effect on your care.

6. Changes to this notice

We may change this notice, and any change applies to information we already hold as well as to information we receive in the future. The current version is always posted on this page with its effective date, and a copy is available at our facility.

7. Federal confidentiality of substance use disorder records (42 CFR Part 2)

The confidentiality of your substance use disorder records is protected by federal law and regulations, 42 U.S.C. §290dd-2 and 42 CFR Part 2. Generally, we may not tell anyone outside this program that you attend it, or disclose any information identifying you as having a substance use disorder, unless you consent in writing, the disclosure is permitted by 42 CFR Part 2, or it is allowed by a court order that meets Part 2's requirements.

Federal law and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.

Federal law and regulations do not protect any information about a crime committed by a patient either at this program or against any person who works for this program, or about any threat to commit such a crime.

Violation of these federal laws and regulations by a program is a crime. Suspected violations may be reported to the United States Attorney for the district in which the violation occurs.

8. Complaints

If you believe your privacy rights have been violated, you may complain to us using the contact below, or directly to the federal government. We will not retaliate against you for filing a complaint, and filing one will not affect your care.

9. Contact