PRIVACY

Tammy Tender Touch Rehab
Privacy Policy

Last Updated: June 1, 2025

1. Introduction
Tammy Tender Touch Rehab (“Facility,” “we,” “us,” or “our”) is committed to protecting the privacy and confidentiality of personal information collected from Clients, prospective Clients, website visitors, and other individuals who interact with our services. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information in compliance with applicable federal and state laws, including HIPAA and 42 CFR Part 2 where applicable. By accessing or using our services—whether in person, by telephone, or via our website—you acknowledge that you have read and agree to this Privacy Policy.

2. Scope and Applicability
2.1 This Privacy Policy applies to:
• Clients enrolled in our halfway house program;
• Prospective Clients who inquire about admission;
• Website visitors who submit forms, request information, or browse our content;
• Family members or legal guardians providing information on behalf of a Client; and
• Any individual who interacts with Tammy Tender Touch Rehab in the course of our operations.

2.2 This Privacy Policy does not apply to personal information collected by third-party websites, social media platforms, or other entities not controlled by Tammy Tender Touch Rehab. We encourage you to review the privacy policies of any external sites you visit.

3. Definitions
“Client”
An individual admitted to Tammy Tender Touch Rehab’s residential program who has executed an intake agreement.

“Personal Information”
Information that identifies or can reasonably be used to identify an individual, either alone or in combination with other data. This includes Protected Health Information (“PHI”) subject to HIPAA and 42 CFR Part 2.

“Protected Health Information (PHI)”
Individually identifiable health information related to past, present, or future physical or mental health, the provision of health care, or payment for health care services, which is created, received, or maintained by us.

“You” or “Your”
Refers to any individual whose personal information is collected or processed by Tammy Tender Touch Rehab, including Clients, prospective Clients, and website visitors.

4. Categories of Information We Collect
4.1 Information Collected at Intake (Clients and Prospective Clients)
• Identifying Information: full name, date of birth, Social Security number (if required by law), gender, marital status, and emergency contact details.
• Contact Information: address, phone number, email address.
• Health and Clinical Information: medical history, mental health diagnoses, current medications, treatment progress notes, and any substance use assessments.
• Insurance and Billing Data: insurance provider, policy number, coverage details, payment history, and payment method.
• Legal and Background Information: criminal background (if required by licensing or regulatory agencies), court orders (if applicable), and consent forms.

4.2 Information Collected During Stay
• Treatment Records: progress notes from counseling sessions, group therapy attendance, medication logs, and discharge summaries.
• Behavioral and Compliance Data: incident reports, disciplinary actions, achievement of program milestones, and discharge planning details.

4.3 Information Collected via Our Website
• Voluntarily Submitted Information: name, email address, phone number, and message content when you submit a contact form or subscribe to newsletters.
• Technical Data: IP address, browser type, device type, operating system, and referral URL.
• Cookies and Similar Technologies: small data files (cookies or local storage) used to enhance user experience, remember login status (if applicable), and collect anonymous usage statistics.

4.4 Other Sources
• Third-Party Providers: information obtained from insurance companies, laboratories, pharmacies, or other healthcare providers with whom you have granted consent to share records.
• Regulatory and Licensing Bodies: required disclosures to state licensing agencies or accrediting organizations, such as program compliance reports.

5. How We Use Your Information
5.1 To Provide Treatment and Services
• Assess eligibility, develop and implement individualized treatment plans, and coordinate care with other healthcare professionals.
• Monitor progress, maintain medication logs, conduct drug screenings, and adjust clinical interventions as needed.
• Communicate with Clients and their authorized representatives regarding treatment scheduling, follow-up care, and discharge planning.

5.2 For Billing and Insurance Purposes
• Submit claims to insurance carriers, process copayments or deductibles, and address any billing inquiries.
• Verify insurance eligibility and coverage levels prior to and during treatment.

5.3 To Comply with Legal and Regulatory Obligations
• Fulfill mandatory reporting requirements (e.g., suspected child or elder abuse, court-ordered disclosures, subpoena compliance).
• Respond to lawful requests by public authorities, law enforcement, or oversight agencies.

5.4 To Administer Operations and Improve Services
• Maintain accreditation, renew licenses, and prepare for audits or inspections.
• Conduct internal quality assurance, program evaluation, and staff training.

5.5 To Communicate and Engage
• Provide appointment reminders, facility announcements, and safety alerts.
• Send newsletters, educational materials, and updates about our services (only if you opt in).

5.6 For Website Functionality and Analytics
• Enhance user experience by remembering preferences and login status.
• Analyze website traffic patterns, measure marketing campaign effectiveness, and generate aggregate usage statistics.

6. Disclosure of Your Information
6.1 Within Tammy Tender Touch Rehab
• Authorized Staff members and clinicians may access Client records strictly on a “need-to-know” basis to perform their duties.
• Administrative staff may access billing or scheduling data as necessary for operational support.

6.2 Third-Party Service Providers
We may share your information with third-party service providers who perform functions on our behalf, such as:
• Medical laboratories or pharmacies (for lab tests, medication fulfillment).
• Insurance companies or managed care organizations (for claims processing and verification).
• Billing and collections agencies (for unpaid balances or claims adjudication).
• IT and data hosting providers (for secure data storage, backup, and website hosting).
• Accrediting or licensing bodies (for compliance reporting, accreditation reviews).

pgsql
Copy
Edit
We require all third parties to implement appropriate safeguards to protect your information and to use it only for the purposes we authorize.
6.3 Legal and Regulatory Disclosures
• We may disclose PHI without your authorization if required by law, including:
– Reporting known or suspected abuse of children, elders, or dependent adults.
– Complying with a valid court order, subpoena, or other lawful process.
– Responding to investigations by government agencies (e.g., state licensing board).
• We may share limited PHI with law enforcement if we believe in good faith that it is necessary to:
– Prevent or respond to serious threats to health or safety;
– Aid in the investigation of a crime that occurred on our premises; or
– Identify or locate a suspect, fugitive, material witness, or missing person.

6.4 Business Transfers
If Tammy Tender Touch Rehab is involved in a merger, acquisition, sale of assets, or similar transaction, your PHI and other Personal Information may be transferred as part of that transaction. In such cases, we will require the new entity to honor the terms of this Privacy Policy.

6.5 With Your Consent or Authorization
• Except as described in Sections 6.1 – 6.4, we will not share your PHI or other Personal Information without your explicit written consent.
• You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance on that authorization.

7. Your Rights Regarding Personal Information
7.1 Right to Access and Obtain Copies
• You have the right to request access to and obtain a copy of your medical records or any other PHI maintained by Tammy Tender Touch Rehab, subject to certain exceptions (e.g., psychotherapy notes, information compiled for legal proceedings).
• Requests for records must be submitted in writing to our Privacy Officer (contact details in Section 15). A nominal fee may be charged for copying, postage, or administrative costs.

7.2 Right to Amend or Correct
• If you believe that any information in your record is inaccurate or incomplete, you may request a correction or amendment in writing.
• We will review your request and, if we agree, will amend the records accordingly. If we deny your request, you may submit a written statement of disagreement, which will be included in your record.

7.3 Right to an Accounting of Disclosures
• You may request a list of certain disclosures of your PHI made by us during the preceding six years (or shorter as required by state law), except disclosures for treatment, payment, or healthcare operations, or those made pursuant to your authorization.
• Requests for an accounting must be made in writing to the Privacy Officer. We will provide the first accounting free of charge; subsequent requests within a 12-month period may incur a reasonable fee.

7.4 Right to Request Restrictions
• You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to such restrictions, except for certain disclosures to a health plan if you have paid out-of-pocket in full for the services.
• If we do agree to a restriction, we will honor it except in emergencies.

7.5 Right to Confidential Communications
• You may request that we communicate with you regarding your PHI by alternative means or at an alternative location (e.g., sending billing statements to a different address). We will accommodate reasonable requests whenever possible.

7.6 Right to Withdraw Consent
• You may withdraw any written consent or authorization for use or disclosure of your PHI at any time, except to the extent that we have already relied upon it. Withdrawal requests must be submitted in writing.

7.7 Right to Opt Out of Marketing Communications
• We will not send you promotional or marketing materials without your explicit opt-in. If you have opted in, you may opt out at any time by following the unsubscribe instructions included in each communication or contacting our Privacy Officer.

8. Data Retention and Security
8.1 Data Retention
• We retain Client records, including PHI, for a minimum of seven (7) years from the date of discharge or as required by state law—whichever period is longer.
• After the retention period, records are securely destroyed in accordance with our record-retention policy and industry best practices.

8.2 Physical and Technical Safeguards
• Paper records are stored in locked, access-controlled areas; access is restricted to authorized personnel only.
• Electronic records (EHR, billing software, email, file servers) are protected by encryption, password controls, firewall protection, and intrusion-detection systems.
• Workstations and mobile devices that access PHI are password-protected and configured to lock after periods of inactivity.

8.3 Administrative Safeguards
• We conduct regular staff training on privacy and security protocols, HIPAA compliance, and incident reporting.
• We perform periodic risk assessments and security audits to identify and remediate vulnerabilities.
• Access to PHI is granted on a “need-to-know” basis; each Staff member is assigned role-based permissions.

8.4 Data Breach Response
• In the event of a suspected data breach involving PHI or other sensitive personal data, we will promptly investigate and, if confirmed, notify affected individuals, the U.S. Department of Health and Human Services (in accordance with HIPAA rules), and state authorities as required by law, within the mandated notification timelines.
• Our Breach Response Team will take immediate steps to contain the breach, mitigate harm, and implement corrective actions to prevent recurrence.

9. Use of Cookies, Tracking, and Analytics
9.1 Cookies and Similar Technologies
• We use cookies and web beacons on our website to remember user preferences (e.g., language, form entries), provide secure login sessions, and compile anonymous analytics.
• You can disable cookies via your browser settings; however, disabling cookies may limit certain functionalities of our site.

9.2 Third-Party Analytics
• We may employ third-party analytics services (e.g., Google Analytics) to measure website performance, track user behavior, and generate aggregate reports. These services collect and process anonymous usage data, which we use to improve our online presence.
• These third parties are prohibited from using the data for any purpose other than providing the analytics services.

10. Children’s Privacy
Our services are intended for adult Clients (18 years or older). We do not knowingly collect personal information from children under 13. If you become aware that a child under 13 has provided us with personal information without verifiable parental consent, please contact our Privacy Officer immediately. We will take steps to delete such information as required by law.

11. Third-Party Links and Services
Our website may contain links to external websites or applications operated by third parties (e.g., online support resources, referral services). This Privacy Policy does not apply to those third-party sites. We encourage you to read the privacy policies of any site you visit. Tammy Tender Touch Rehab is not responsible for the content, privacy practices, or security of third-party websites.

12. International Transfers
Tammy Tender Touch Rehab is based in the United States and stores all data on servers located within the U.S. If we must transfer PHI or Personal Information outside the U.S. (e.g., to a third-party service provider), we will take appropriate steps to ensure that such transfers comply with applicable legal requirements and maintain safeguards comparable to those described in this Privacy Policy.

13. Updates to This Privacy Policy
13.1 We reserve the right to modify this Privacy Policy at any time. Changes will be effective upon posting the revised Privacy Policy on our website or displaying a notice in our Facility.

13.2 We will provide at least thirty (30) calendar days’ notice to active Clients before material changes take effect. Non-material changes (e.g., clarifications, formatting) may take effect immediately without prior notice.

13.3 Your continued use of our services or sharing of information after changes take effect constitutes acceptance of the updated Privacy Policy.

14. Contact Information and Privacy Inquiries
If you have any questions, concerns, or requests related to this Privacy Policy or our privacy practices, please contact our Privacy Officer:

less
Copy
Edit
Tammy Tender Touch Rehab
Attn: Privacy Officer
[Facility Street Address]
[City, State, ZIP Code]
Phone: [Facility Phone Number]
Email: privacy@tammytendertouch.com
You may also submit written requests for access, amendment, or accounting of disclosures to the address above. Please allow up to thirty (30) days for a response. We may contact you to verify your identity before fulfilling any request.

15. Complaints and Enforcement
15.1 If you believe your privacy rights have been violated or you are dissatisfied with our privacy practices, you may file a complaint with:
• The Tammy Tender Touch Rehab Privacy Officer (using the contact information in Section 14), or
• The U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”)—for HIPAA or 42 CFR Part 2 related concerns.

15.2 We will not retaliate against any individual for filing a complaint.

16. Acknowledgment
By receiving services from Tammy Tender Touch Rehab, enrolling in our program, or providing information via our website, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree with our practices, you should not provide personal or health information to Tammy Tender Touch Rehab.