Privacy Policy and Notice of Privacy Practices

Steps to Recovery Homes
Effective Date: 1/1/2025
Last Updated: 11/9/2025

THIS NOTICE DESCRIBES HOW MEDICAL AND PERSONAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Introduction

Steps to Recovery Homes (“we,” “our,” or “us”) is committed to protecting your privacy and maintaining the confidentiality of your personal and health information. This document serves as both our Privacy Policy for website visitors and our Notice of Privacy Practices for residents and program participants, as required by the Health Insurance Portability and Accountability Act (HIPAA) and other federal and state laws.

Important: We are required by law to:

Maintain the privacy of your protected health information (PHI)
Provide you with this notice of our legal duties and privacy practices
Follow the terms of the notice currently in effect
Notify you if we are unable to agree to a requested restriction on disclosure

Our Commitment: We understand that your personal and health information is sensitive and private. We are committed to protecting this information and using it only as necessary to provide quality services and comply with legal requirements.

2. Who Must Follow This Notice

This notice applies to:

All Steps to Recovery Homes staff, employees, and volunteers
All contractors and service providers who have access to your information
All sites and locations where we provide services

3. Information We Collect and Maintain

3.1 Protected Health Information (PHI)

For residents and program participants, we collect and maintain health information that may include:

Contact and Demographic Information: Name, address, phone number, email, date of birth, Social Security number, emergency contacts
Health and Treatment Information: Medical history, substance use history, mental health information, medications, treatment plans, progress notes
Financial Information: Insurance information, payment records, billing information
Legal Information: Court orders, probation requirements, legal representative information
Program Information: Admission records, attendance records, drug test results, incident reports, discharge summaries
Communication Records: Records of our communications with you, your family (with authorization), and providers

3.2 Website Visitor Information

When you visit our website, we may automatically collect:

Device Information: IP address, browser type, operating system
Usage Information: Pages visited, time spent on site, referring websites
Location Information: General geographic location based on IP address
Cookies and Tracking: Small files stored on your device for site functionality and analytics

4. How We May Use and Disclose Your Information

4.1 Uses and Disclosures WITHOUT Your Written Authorization

We may use and disclose your information for the following purposes without obtaining your specific written authorization:

Treatment

We may use and disclose your health information to provide, coordinate, or manage your housing and recovery services. This includes:

Sharing information among our staff members involved in your care
Coordinating with healthcare providers, therapists, or counselors
Consulting with other recovery professionals about your treatment
Making referrals to other service providers

Example: We may share your treatment plan with your counselor to ensure coordinated care.

Payment

We may use and disclose your health information to obtain payment for services. This includes:

Billing you, your insurance company, or other payers
Determining eligibility and coverage
Processing claims and collecting payments
Conducting utilization review

Example: We may submit information to your insurance company to receive payment for services.

Health Care Operations

We may use and disclose your health information for our operational activities. This includes:

Quality assessment and improvement activities
Staff training and education
Licensing and accreditation requirements
Business planning and administration
Customer service and complaint resolution

Example: We may review your records as part of quality improvement activities.

As Required by Law

We will disclose your health information when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your health information for public health activities such as:

Reporting communicable diseases
Reporting abuse, neglect, or domestic violence (as required by law)
Reporting adverse reactions to medications
Product recalls or safety alerts

Health Oversight Activities

We may disclose your information to health oversight agencies for activities authorized by law, such as:

Audits and investigations
Inspections and licensure
Disciplinary proceedings

Judicial and Administrative Proceedings

We may disclose your health information in response to:

A court order
A subpoena or discovery request (only as permitted by law and 42 CFR Part 2)

Law Enforcement

We may disclose limited health information to law enforcement officials for specific law enforcement purposes, such as:

In response to a court order or warrant
To report certain types of injuries
To report suspected criminal activity on our premises

Coroners and Medical Examiners

We may disclose information to coroners or medical examiners as necessary for them to carry out their duties.

Serious Threats to Health or Safety

We may disclose your information if we believe it is necessary to prevent a serious threat to your health and safety or the health and safety of others.

Specialized Government Functions

We may disclose information for specialized government functions such as:

Military and veterans activities
National security and intelligence activities
Protective services for the President

Workers’ Compensation

We may disclose your information for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

4.2 Uses and Disclosures REQUIRING Your Written Authorization

Certain uses and disclosures of your information require your specific written authorization:

Substance Abuse Treatment Records (42 CFR Part 2)

Information related to substance abuse treatment is specially protected under federal law (42 CFR Part 2). We cannot disclose this information without your specific written consent except in limited circumstances defined by federal regulations, such as:

Medical emergencies
Court orders meeting specific requirements
Research under specific conditions
Audits and evaluations by authorized agencies

Marketing

We will not use or disclose your information for marketing purposes without your written authorization.

Sale of Information

We will not sell your information to third parties.

Psychotherapy Notes

Any disclosure of psychotherapy notes (if maintained separately) requires your authorization except in limited circumstances.

Other Uses

Any other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke your authorization at any time by providing written notice, except to the extent that we have already acted in reliance on your authorization.

5. Your Privacy Rights

You have the following rights regarding your health information. To exercise any of these rights, contact our Privacy Officer using the contact information at the end of this notice.

5.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of your health information that may be used to make decisions about your care or payment for services. This typically includes medical and billing records, but does not include psychotherapy notes.

We will respond to your request within 30 days
We may charge a reasonable fee for copying and mailing costs
We may deny your request in certain limited circumstances
If denied, you may request a review of the denial

5.2 Right to Amend

If you believe information in your record is incorrect or incomplete, you may request that we amend it.

Your request must be in writing and include a reason for the amendment
We will respond within 60 days
We may deny your request if the information is accurate and complete, or was not created by us
If we deny your request, you have the right to submit a statement of disagreement

5.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your health information.

The accounting will cover up to six years prior to your request
It will not include disclosures made for treatment, payment, or health care operations
It will not include disclosures made directly to you or with your authorization
The first accounting in any 12-month period is free; subsequent requests may incur a reasonable fee

5.4 Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your information for treatment, payment, or operations.

We are not required to agree to your request
If we do agree, we will comply with your request unless the information is needed for emergency treatment
You must make your request in writing

5.5 Right to Request Confidential Communications

You have the right to request that we communicate with you in a certain way or at a certain location.

You must make your request in writing
You must specify how or where you wish to be contacted
We will accommodate reasonable requests
You do not need to provide a reason for your request

5.6 Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this notice at any time, even if you have agreed to receive it electronically.

5.7 Right to Be Notified of a Breach

You have the right to be notified if there is a breach of your unsecured protected health information.

5.8 State-Specific Privacy Rights

Depending on your state of residence, you may have additional privacy rights under state law, including:

California Consumer Privacy Act (CCPA)
Virginia Consumer Data Protection Act (CDPA)
Other state privacy laws

6. Website Privacy Practices

6.1 Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies:

Essential Cookies: Necessary for website functionality
Analytics Cookies: To understand how visitors use our site (e.g., Google Analytics)
Functional Cookies: To remember your preferences
Marketing Cookies: For advertising and marketing purposes (with consent)

You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

6.2 Third-Party Services

Our website may use third-party services such as:

Google Analytics (for website analytics)
Social media plugins
Marketing and advertising tools

Each third-party service has its own privacy policy governing their use of your information.

6.3 Do Not Sell Personal Information

We do not sell, rent, or lease your personal information to third parties.

7. Data Security

We implement appropriate technical and organizational security measures to protect your information:

Encryption of sensitive data in transit and at rest
Secure data storage systems with access controls
Multi-factor authentication for system access
Regular security assessments and vulnerability testing
Staff training on privacy, security, and HIPAA compliance
Business associate agreements with service providers
Incident response and breach notification procedures

Limitation: While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you of any breach as required by law.

8. Data Retention

8.1 Treatment and Program Records

Treatment and program records are retained in accordance with:

Arizona state law requirements
Federal regulations (42 CFR Part 2 and HIPAA)
Our organizational policies

Typically, records are retained for a minimum of 7 years after discharge or last service date, or longer if required by law.

8.2 Website Information

Website visitor information is retained only as long as necessary for the purposes outlined in this notice.

9. Children’s Privacy

Our services and website are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18 without parental consent. If we become aware that we have collected information from a child under 18, we will take steps to delete such information promptly.

10. Changes to This Notice

We reserve the right to change this notice at any time. Any revised notice will apply to all information we already have about you and any information we receive in the future.

When We Make Changes:

The revised notice will be posted on our website
We will provide you with a copy of the revised notice at your next visit or by mail
Material changes will be communicated to current residents within 60 days
The effective date will be updated at the top of this notice

Notice Availability:

This notice is posted on our website at stepstorecoveryhomes.org
Paper copies are available at our facility entrance
You may request a copy at any time

11. Acknowledgment of Receipt

For Residents and Program Participants:

We will ask you to sign an acknowledgment that you have received this notice. This acknowledgment will become part of your record. If you decline to sign the acknowledgment, we will document our good faith effort to obtain it and the reason for your refusal. Your refusal to sign will not affect your ability to receive services.

12. Complaints

If you believe your privacy rights have been violated or you are concerned about our privacy practices, you have the right to file a complaint.

12.1 Internal Complaints

File a complaint with us:

Privacy Officer
Steps to Recovery Homes
Phone: (928) 649-0077
Email: damien@stepstorecoveryhomes.org

12.2 Federal Complaints

File a complaint with the federal government:

U.S. Department of Health and Human Services
Office for Civil Rights
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/
Phone: 1-877-696-6775

No Retaliation: You will not be retaliated against or penalized for filing a complaint.

13. Contact Information

13.1 Privacy Questions and Requests

For questions about this notice or to exercise your privacy rights:

Privacy Officer
Steps to Recovery Homes
Phone: (928) 649-0077
Email: damien@stepstorecoveryhomes.org
Website: stepstorecoveryhomes.org

13.2 Office Location

Steps to Recovery Homes
[Physical Address]
[City, State, ZIP]

14. Emergency Situations

IMPORTANT: If you are experiencing a medical emergency or mental health crisis:

Call 911 immediately
National Suicide Prevention Lifeline: 988
Crisis Text Line: Text HOME to 741741

This notice and our privacy practices do not apply to emergency situations where immediate disclosure may be necessary to protect health and safety.

15. Effective Date

This Notice of Privacy Practices is effective as of January 1, 2025 and was last updated on November 9, 2025.