Notice of Privacy Practices

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are

Aura Integra Behavioral Health, PLLC is a "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA) as defined at 45 CFR § 164.104. For substance use disorder (SUD) treatment records, Aura Integra Behavioral Health, PLLC is also a "program" subject to the heightened confidentiality requirements of 42 CFR Part 2. This Notice applies to all medical and behavioral health records we create and maintain about you.

How We May Use and Disclose Your Health Information

We may use and disclose your protected health information (PHI) for the following purposes:

Treatment

We may share your health information with other physicians, therapists, pharmacies, laboratories, or other healthcare providers involved in your care so that they can provide appropriate treatment.

Payment

We may use and disclose your health information to bill and collect payment for services, including verifying insurance eligibility (where applicable) and processing self-pay transactions.

Healthcare Operations

We may use your health information for quality improvement activities, staff training, licensing, and other operations necessary to run our practice.

As Required by Law

We will disclose your health information when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your health information for public health purposes, such as reporting disease outbreaks, vital events, or adverse events, as authorized by law.

Health Oversight Activities

We may disclose health information to health oversight agencies for activities authorized by law, such as audits, investigations, and licensure actions.

Judicial and Administrative Proceedings

We may disclose health information in response to a court order or, in limited circumstances, in response to a subpoena.

Law Enforcement

We may disclose limited health information to law enforcement officials for purposes such as identifying a suspect, fugitive, witness, or missing person, or in response to a valid court order or legal process, subject to applicable restrictions.

Serious Threats to Health or Safety

Consistent with applicable law and ethical standards, we may disclose health information if we believe in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, or the public (the "duty to warn" / Tarasoff-type disclosure). Massachusetts law recognizes specific exceptions to the psychotherapist-patient privilege for such disclosures. M.G.L. c. 233 § 20B.

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

• Your SUD treatment records generally cannot be disclosed without your specific written consent, except in the following limited circumstances: (a) a bona fide medical emergency; (b) for audit or program evaluation purposes; (c) pursuant to a qualifying court order; or (d) for research, subject to appropriate privacy protections.
• Your SUD records cannot be used to investigate or criminally prosecute you without your written consent or a qualifying court order, even if you consented to disclosure for treatment purposes.
• Under the 2024 Part 2 Final Rule (effective with a compliance date of February 16, 2026), we may obtain a single, broad-based patient consent covering all future uses and disclosures for treatment, payment, and healthcare operations (TPO) purposes. However, a separate, specific written consent is still required for SUD counseling notes, which receive additional protection.
• Any consent you provide for use of your SUD records in civil, criminal, administrative, or legislative proceedings against you cannot be combined with a consent for any other type of disclosure — it must be a distinct, standalone authorization.

Massachusetts-Specific Patient Rights

• Right to Access and Copy Records: You have the right to access and obtain copies of your medical records. M.G.L. c. 111 § 70; M.G.L. c. 112 § 12CC.
• Mental Health Client Confidentiality: Records of mental health treatment are subject to specific confidentiality protections for clients of licensed mental health professionals. M.G.L. c. 112 § 172A.
• Mental Health Records Retention: Mental health treatment records are retained for a minimum of twenty (20) years. M.G.L. c. 123 § 36.
• Psychotherapist-Patient Privilege: Communications between you and your psychotherapist are generally privileged and protected from disclosure in legal proceedings, subject to statutory exceptions. M.G.L. c. 233 § 20B.
• Patients' Rights: You have specific statutory rights as a patient receiving care in Massachusetts. M.G.L. c. 111 § 70E.
• Prescription Monitoring Program (MassPAT) Confidentiality: Information reported to or obtained from the Massachusetts Prescription Awareness Tool is confidential and protected from unauthorized disclosure. M.G.L. c. 94C § 24A.
• PATCH Act – Confidential Explanation of Benefits: You have the right to request that Explanation of Benefits (EOB) communications related to sensitive health services be sent directly to you rather than to a policyholder. M.G.L. c. 176O § 27.

Your Rights Under HIPAA

• Right to Request Restrictions on certain uses and disclosures of your PHI.
• Right to Request Confidential Communications by an alternative means or at an alternative location.
• Right to Inspect and Copy your PHI maintained in your medical record.
• Right to Request Amendment of your PHI if you believe it is incorrect or incomplete.
• Right to an Accounting of Disclosures of your PHI made by us, with certain exceptions.
• Right to a Paper Copy of This Notice at any time, even if you agreed to receive it electronically.
• Right to File a Complaint if you believe your privacy rights have been violated. You may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Ave., S.W., Washington, D.C. 20201, 1-800-368-1019, ocrmail@hhs.gov. You will not be retaliated against for filing a complaint.

Our Duties

• We are required by law to maintain the privacy and security of your protected health information.
• We will abide by the terms of the notice currently in effect.
• We will notify you if a breach occurs that may have compromised the privacy or security of your information, consistent with the breach notification requirements at 45 CFR §§ 164.400–414.

Website Tracking Disclosure

Consistent with the Massachusetts Consumer Protection Act (M.G.L. c. 93A) and recent case law addressing website tracking technologies in the healthcare context (A.J. v. LMND Med. Grp., Inc. (2024)), we disclose the following:

• Our website may use standard, privacy-respecting analytics tools to understand general traffic patterns (e.g., number of visitors, pages viewed).
• No personal health information is collected through website analytics.
• The self-screener tools available on our website collect no data whatsoever — all computation happens locally within your own web browser and is never transmitted to our servers or any third party.

Contact / Privacy Officer

If you have questions about this Notice or wish to exercise any of the rights described above, please contact our Privacy Officer: