Notice of Privacy Practices
Effective Date:
2/16/2026
Review Date:
02/06/2026
PURPOSE
This policy specifies the procedures to be followed in providing Blue Ridge Chiropractic Clinic, P.A. patients with Blue Ridge Chiropractic Clinic, P.A. Notice of Privacy Practices, as required by the federal Health Insurance Portability and Accountability Act of 1996 (the “Privacy Rule”).
POLICY
The Privacy Rule requires that Blue Ridge Chiropractic Clinic, P.A. give patients detailed information about Blue Ridge Chiropractic Clinic, P.A. privacy practices. A copy of Blue Ridge Chiropractic Clinic, P.A. current, “Notice of Privacy Practices,” shall be given to all Blue Ridge Chiropractic Clinic, P.A. patients upon admission. Or, in the case of outpatients, at the time of service. In addition, a separate notice addressing the uses and disclosures of mental health information will be provided to inpatient and outpatient psychiatric patients.
DEFINITIONS
Health Care Operations: Covers a broad range of activities such as quality assessment, patient education and training, student training, contracting for health care services, medical review, legal services, auditing functions, compliance, business planning and development, licensing and accreditation, business management, and general administrative activities.
Payment: Can be defined as activities related to being paid for services rendered. These include eligibility determinations, billing, claims management, utilization review, etc. It also includes using debt collection and location agencies.
Protected health information or PHI: Defined as any individually identifiable health information collected or created as a consequence of the provision of health care by a covered entity, in any form (including verbal communications).
Treatment: Means providing, coordinating, or managing a patient’s care, and includes consultations between providers and referrals.
PROCEDURE
Notice of Privacy Practices
Blue Ridge Chiropractic Clinic, P.A. must describe, in plain language, its privacy practices, including an individual’s rights related to his or her PHI. This Notice of Privacy Practices (“Notice”) must be made available to patients and be posted throughout Blue Ridge Chiropractic Clinic, P.A. facilities and on Blue Ridge Chiropractic Clinic, P.A. website. Blue Ridge Chiropractic Clinic, P.A. must also make a good faith effort to obtain a written acknowledgement from the individual that he or she has received the Notice.
The Notice must include the following elements:
Header. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
The uses and disclosures the provider will make of the PHI. The Privacy Rule requires that the notice contain:
A description, including at least one example, of the types of uses and disclosures of information that Blue Ridge Chiropractic Clinic, P.A. is permitted to make for each of the following purposes: treatment, payment, and health care operations. The description must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by state and federal law;
A description of each of the other purposes (other than Treatment, Payment, or Health Care Operations) for which Blue Ridge Chiropractic Clinic, P.A. is permitted or required to use or disclose PHI without the individual’s written authorization;
A statement that other uses and disclosures will be made only with the individual’s written authorization, and that the individual may revoke this authorization at any time in writing; and
Blue Ridge Chiropractic Clinic, P.A. must include a separate statement if they contact individuals for: (i) Appointment reminders or to provide information regarding treatment alternatives or other health-related benefits, including services that may be of interest to the individual; or (ii) fundraising.
Blue Ridge Chiropractic Clinic, P.A. must include specific information about the protection of substance use disorder (SUD) treatment records in accordance with 42 CFR Part 2. The Notice must explain that certain uses and disclosures otherwise permitted by HIPAA are materially limited by Part 2, including:
Stricter limitations on the use and disclosure of SUD records beyond what HIPAA requires;
A requirement that an individual’s written consent or a court order is required to use SUD records in civil, criminal, administrative, or legislative proceedings against the individual;
That an individual may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes, and that this consent may be revoked;
An explanation of individual rights with respect to SUD records, including the right to request restrictions on re-disclosure;
Contact information for questions or concerns about SUD record privacy; and
Information about how to file complaints regarding SUD record privacy protections.
Individual Rights. The Notice must contain a statement of the individual’s rights with respect to PHI and how he or she may exercise the right to:
Inspect and copy PHI;
Amend PHI;
Receive an accounting of disclosures of PHI;
Request restrictions on certain uses and disclosures of information including a statement that Blue Ridge Chiropractic Clinic, P.A. is not required to agree to a requested restriction;
Receive confidential communications of PHI; and
Obtain a paper copy of the notice upon request.
Provider Duties. The Notice needs to explain that Blue Ridge Chiropractic Clinic, P.A., under the law, must:
Maintain the privacy of PHI and provide individuals with notice of its legal duties and privacy practices;
Abide by the terms of the Notice currently in effect; and
State in the Notice that Blue Ridge Chiropractic Clinic, P.A. reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI it maintains. The statement must also explain how Blue Ridge Chiropractic Clinic, P.A. will provide individuals with a revised Notice.
Complaints. The Notice must explain that individuals may file a complaint with Blue Ridge Chiropractic Clinic, P.A. and/or the Secretary of HHS if they believe their privacy rights have been violated. A brief description of how to file a complaint with Blue Ridge Chiropractic Clinic, P.A. must be included. The Notice must also include a statement that the individual will not be retaliated against for filing a complaint.
Contact Information. The Notice must contain the name, or title, and telephone number of a person or office to contact for further information.
Effective Date. The Notice must contain its effective date.
Font Size. California law requires that information produced by a hospital regarding patients’ rights be printed in 12-point font or larger.
Dissemination and Publication of the Notice of Privacy Practices
Blue Ridge Chiropractic Clinic, P.A. must provide the Notice to its patients no later than the date of the first service delivery by a direct care provider. The Notice may also be given to an individual by e-mail, if the individual agrees to such electronic notice. If Blue Ridge Chiropractic Clinic, P.A. knows that the e-mail transmission has failed, it must provide a hard paper copy. If the first service is delivered electronically, Blue Ridge Chiropractic Clinic, P.A. must send the notice electronically, automatically, and contemporaneously.
Blue Ridge Chiropractic Clinic, P.A. must make the Notice available for individuals to take with them. (When the patient is not physically present, the Notice may be sent by first class mail.)
The Notice must be posted in a clear and prominent location where it is reasonable to expect patients to be able to read the Notice.
The Notice shall be posted prominently on the Blue Ridge Chiropractic Clinic, P.A. website and shall be available electronically through the website.
Patients will be informed of their right to restrict directory information. Requests for restrictions to the Facility Directory will be referred to the Director of Patient Access Services. Other requests for further restrictions, such as the use and disclosure of information, will be referred to the Health Information Management Services Department for consideration.
If revised, Blue Ridge Chiropractic Clinic, P.A. must make the revised Notice available upon request and post the revised Notice.
No Notice is required to be given to inmates who may receive treatment at a Blue Ridge Chiropractic Clinic, P.A. facility.
In the case of patients who are minors, the Notice should be given to the minor’s parent or guardian.
Acknowledgement of Notice of Privacy Practices
Except in the case of an emergency treatment situation, Blue Ridge Chiropractic Clinic, P.A. must make a good faith effort to obtain a written Acknowledgement that the individual received Blue Ridge Chiropractic Clinic, P.A. Notice. If some individual refuses to sign the Acknowledgement, then Blue Ridge Chiropractic Clinic, P.A. must document the good faith efforts taken and the reason why the Acknowledgement was not obtained.
A “good faith effort” to obtain written acknowledgment is not required: (1) where emergency treatment/stabilization is required; or (2) when the Notice is mailed, and the patient does not return the acknowledgement form, no further effort need be made.
Acknowledgement of the Notice will be completed during the intake process. The electronic ADT system flag will be updated to reflect the Acknowledgement has been signed or refused. The Acknowledgement form will be sent to the Health Information Management Services Department for scanning into the Electronic Medical Record. If the form is not scanned within 30 calendar days from the date of signing, the electronic ADT system flag will revert back to its original state to reflect that the Acknowledgment Notice has not been obtained. Upon the patient’s next encounter the process will repeat until the signed or refused Acknowledgement is scanned.
A separate ADT flag will be set when the Notice of Privacy Practices for Mental Health has been obtained, but the flag will only be visible to staff with access to the psychiatric registration and encountering system.
Revisions to the Notice of Privacy Practices
Blue Ridge Chiropractic Clinic, P.A. must promptly revise and distribute its Notice whenever there is a material change to the uses and disclosures, individual’s rights, Blue Ridge Chiropractic Clinic, P.A. legal duties, or other privacy practices stated in the Notice. The revised Notice will be posted in the service delivery areas and will be provided to patients upon request. The revised Notice will also be posted on the Blue Ridge Chiropractic Clinic, P.A. website as indicated above.
CRITICAL COMPLIANCE DEADLINE: February 16, 2026. All HIPAA covered entities, including Blue Ridge Chiropractic Clinic, P.A., must update their Notice of Privacy Practices by this date to comply with the final rule aligning 42 CFR Part 2 (substance use disorder records) with HIPAA. This update is mandatory even if the practice does not primarily treat substance use disorders, as the practice may receive such records through care coordination, health information exchanges, or from other providers.
REMOVAL OF REPRODUCTIVE HEALTH PRIVACY LANGUAGE. In June 2025, the U.S. District Court for the Northern District of Texas vacated the HIPAA Privacy Rule changes related to reproductive health care privacy protections in Purl v. Department of Health and Human Services. The Fifth Circuit dismissed the appeal in September 2025, confirming the end of these provisions. If Blue Ridge Chiropractic Clinic, P.A. previously added reproductive health privacy language to its Notice of Privacy Practices in 2024, that language must be removed as it is no longer enforceable under federal HIPAA regulations. Only the substance use disorder notice requirements remain in effect for the February 16, 2026 deadline.
Record Retention
All versions of Blue Ridge Chiropractic Clinic, P.A. approved, “Notice of Privacy Practices,” will be archived and maintained by the Compliance Office for a period no less than six (6) years.
REFERENCES
Health Insurance Portability and Accountability Act, 45 CFR 160
42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records (Final Rule, February 16, 2024)
45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information (Updated 2024)
Purl v. Department of Health and Human Services, No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025)