Patient Privacy Policy

EFFECTIVE DATE: April 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

MedMark Treatment Centers (“MedMark”) is committed to protecting your privacy and understands the importance of safeguarding your medical information. We are required by federal law to protect the confidentiality and maintain the privacy of health information that identifies you or that could be used to identify you, including information related to your alcohol, drug, or mental health treatment (known as “Protected Health Information” or “PHI”). We also are required to provide you with this Notice of Privacy Practices, which explains our legal duties and privacy practices, as well as your rights, with respect to PHI that we collect and maintain. We are required by federal law to abide by the terms of this Notice currently in effect. However, we reserve the right to change the privacy practices described in this Notice and make the new practices effective for all PHI that we maintain. Should we make such a change, you may obtain a revised Notice by contacting the MedMark Privacy Officer at (214) 379-3300 and requesting a copy be mailed to you, or accessing our website at medmark.com/patient-privacy-policy.

You may also contact the MedMark Privacy Officer with questions or for further information about matters covered by this Notice of Privacy Practices.

BAYMARK AFFILIATED COVERED ENTITY

MedMark is part of the BayMark Affiliated Covered Entity (“BayMark ACE”) comprised of certain BayMark Health Services, Inc.’s affiliated outpatient and residential addiction treatment providers. As members of the BayMark ACE, the entities within the ACE may share your PHI with each other for treatment, payment, and health care operations purposes as permitted by law. This means that providers and staff within the BayMark ACE may access your PHI as necessary to coordinate your care, process payment for services rendered, and conduct health care operations activities.

HOW MEDMARK MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The following list describes the ways we may use and disclose your PHI. The examples provided serve only as guidance and do not include every possible use or disclosure.

Routine Uses and Disclosures

For Treatment. We may use and disclose your PHI to provide, coordinate, or manage your health care For example, we use your PHI to communicate with you about your treatment, including in reminders of a scheduled treatment appointment or procedure. Your PHI may be disclosed to MedMark qualified staff members as needed to provide you with the best possible care. Your PHI will only be disclosed outside of MedMark when your express written consent or authorization has been obtained except as required by law.
For Payment. We may use and disclose your PHI so that we may receive payment for the treatment and services you receive. Your PHI will only be disclosed for payment purposes with your express written consent or authorization . For example, with your consent we may disclose PHI to your health plan in order to obtain prior approval, determine coverage, or seek payment for your treatment and services. It is important to know, however, that your refusal to give such permission may lead to non-payment by that third party as without your written consent or authorization, we will be unable to discuss payment for your treatment services with any third party.
For Health Care Operations. We may use and disclose medical information about you for our operations. Your PHI will only be disclosed for health care operations purposes with your express written consent or authorization. For example, we may use your PHI to assess our treatment and services. These uses and disclosures are necessary for us to operate in an efficient manner and to ensure that all individuals receive quality care.
Business Associates. We may disclose your PHI to persons who perform functions, activities or services to us or on our behalf that require the use or disclosure of PHI. To protect your health information, we require the business associate to appropriately safeguard your information.

Uses and Disclosures that May be Made Without Your Authorization or Opportunity to Object

Required by Law. We will disclose your PHI when required to do so by federal or state laws.
To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI to medical or law enforcement personnel when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Organ and Tissue Donation. If you are an organ donor, we may disclose your PHI to organizations that handle procurement of organ, eye, or tissue transplantations.
Military and Veterans. If you are a member of the armed forces, we may disclose your PHI as required by military command authorities.
Workers’ Compensation. We may disclose your PHI for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Research. We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
Public Health Risks. We may disclose your PHI for public health These activities generally include the following:
- To prevent or control disease, injury, or disability;
- To report births and deaths;
- To report child abuse or neglect;
- To report reactions to medications or problems with products;
- To notify people of recalls of products they may be using;
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
- To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence.

All such disclosures will be made in accordance with the requirements of federal and state laws and regulations.

Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law. Health oversight agencies include public and private agencies authorized by law to oversee health care providers and the health care industry in general.
Law Enforcement. We may disclose your PHI, so long as applicable legal requirements are met, for law enforcement purposes, such as providing information to the police about the victim of a crime.
Judicial and Administrative Proceedings. We may disclose your PHI in response to a valid court order or subpoena.
Coroners, Medical Examiners, and Funeral Directors. We may disclose your PHI to a coroner or medical examiner when authorized by law (g., identify a deceased person or determine cause of death) or to funeral directors.
Inmates. We may use or disclose your PHI if you are an inmate of a correctional facility and we created or received your PHI in the course of providing care to you.
Special Government Functions. We may use or disclose your PHI for special government functions such as military, national security, and presidential protective services when authorized by law.

Uses and Disclosures Based on Your Authorization or Consent

Disclosure to Family and Friends. Only the PHI that you have specified will be disclosed and only to those for which you have provided written consent or authorization. We will not confirm or deny your presence at a MedMark facility to any individual that you have not signed a consent or authorization for except in the case of an emergency or as required by law. In the event of your incapacity or under emergency circumstances, we will disclose your PHI to the person you had previously designated as your Emergency Contact Person(s).
Marketing. We must obtain your written authorization to use and disclose your PHI for most marketing purposes.
Sale of PHI. We must obtain your written authorization for any disclosure of your PHI which constitutes a sale of PHI.
Psychotherapy Notes or Counseling Notes. We must obtain your written authorization for most uses and disclosures of psychotherapy notes.
Other Uses and Disclosures. We will not use or disclose your PHI for any other purposes, unless you give us your written authorization to do so. If you give us such written authorization for a purpose not described in this Notice, then you may revoke such authorization in writing at any time. Your revocation will be effective for all your PHI that we maintain, unless we have already taken action in reliance on your prior authorization.

Notice of Redisclosure

Once your information is shared with your consent or as otherwise permitted by applicable law, it may be subject to redisclosure by the recipient and no longer protected by any such law(s).

ADDITIONAL PROVISIONS: SUBSTANCE USE DISORDER RECORDS

These additional provisions apply when we create, receive, or maintain records relating to diagnosis, treatment, or referral for treatment of a substance use disorder that are protected by federal regulations (“SUD Records”). Unless specifically indicated below, your SUD Records will generally have the same protections and you will have the same rights related to your SUD Records as described in this Notice.

Uses and Disclosures of SUD Records Without Consent

We may use or disclose your SUD Records without your consent, and only when all conditions required by applicable law are met, for medical emergencies, scientific research, management audits, financial audits, and program evaluations conducted by federal, state, or local governmental agencies, and to public health authorities when the SUD Records are de-identified.

Uses and Disclosures of SUD Records for Certain Treatment, Payment, and Health Care Operations

For SUD Records protected by federal regulations, we may obtain your written consent for future uses of such records for certain treatment, payment, or health care operations, as required by law. Once we obtain your consent, we may use and disclose SUD Records for these purposes as permitted by law.

Disclosure of SUD Records in Civil, Administrative, Criminal, or Legislative Proceedings

We will not use or disclose your SUD Records (or provide testimony based on such information) in any civil, criminal, administrative, or legislative proceedings against you unless such use or disclosure is permitted with your written consent or a special court order required by federal regulations is obtained.

YOUR HEALTH INFORMATION RIGHTS

You have certain rights regarding your PHI, which are explained below. You may exercise these rights by submitting a request in writing to our Privacy Officer.

Right to Inspect and Copy. You have the right to inspect and obtain a paper or electronic copy of your PHI that is contained in a designated record set (e.g. medical and billing records). If you request a copy of the information, we may charge a fee as established by its licensing authority, if applicable, for the costs of copying, mailing, or summarizing your medical We may deny your request to inspect and copy your PHI in certain limited circumstances. Depending on the circumstances of the denial, you may have a right to have this decision reviewed.
Right to Amend. If you feel that your PHI maintained in a designated record set (e.g. medical and billing records) is incorrect or incomplete, you may ask us to correct or amend the information. You have the right to request an amendment for as long as the information is kept by us. You must provide a reason that supports your request. We may deny your request for an amendment, for example, if we determine that your PHI is accurate and complete, or if your request does not include a reason to support the request. If we deny your request, we will send you a written explanation and allow you to submit a written statement of disagreement.
Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of the disclosures made of your PHI for purposes other than treatment, payment, or health care operations. Your request must state a time period, which may not be longer than six (6) years from the date of the request. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be provided to you for free. For additional lists within the same 12-month period, you may be charged for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI that we use or disclose for treatment, payment, or health care operations. You may also request that any part of you PHI not be disclosed to someone who is involved in your care or the payment for your care. Your request must state the specific restriction requested and to whom you want the restriction to apply we are not required to agree to such a request, except we must agree not to disclose your PHI to your health plan if the disclosure (1) is for payment or health care operations and is not otherwise required by law, and (2) relates to a health care item or service which you paid for in full out of pocket. Should we agree to your request, we will comply with your request unless the information is needed to provide you emergency treatment.
Right to Request Confidential Communications. You have the right to request that we communicate with you in a certain way or at a certain location. Your request must specify how or where you wish to be contacted. You do not have to state a reason for your request. We will accommodate all reasonable requests.
Right to Paper Copy. You have the right to obtain a paper copy of this Notice from us.
Right to Breach Notification. You have the right to be notified if you are affected by a breach of unsecured PHI.
Right to Opt Out of Fundraising Communications. We may contact you for fundraising purposes. You have the right to opt out of receiving these You may elect not to receive fundraising communications at any time and you will be provided a clear and conspicuous opportunity to do so, even if you initially permitted us to send such communications.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the MedMark Privacy Officer. To file a complaint with us, contact the MedMark Patient Advocate Hotline at (800) 949-7840, and your complaint will be forwarded to the Privacy Officer for processing. You may also file a complaint with the Office for Civil Rights, U.S. Department of Health and Human Services by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting http://www.hhs.gov/ocr/privacy/hipaa/complaints/.

All complaints should be submitted in writing. We will NOT retaliate against you in any way for filing a complaint