HIPAA PRIVACY POLICY

Health Insurance Portability and Accountability Act (HIPAA) Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

ABA Solutions, Inc. is required by law to maintain the privacy of your Protected Health Information (PHI) and any Substance Use Disorder (SUD) records we maintain. We are required to provide you with this notice of our legal duties and privacy practices, and we must abide by the terms of the notice currently in effect.

Minimum Necessary Rule

We make every reasonable effort to limit the use, disclosure, or request of your PHI to the minimum level necessary to accomplish the intended medical, operational, or payment purpose.

  • Enhanced 2026 Protection: For any records governing substance use disorder diagnosis, treatment, or referral protected under federal law (42 CFR Part 2), the "minimum necessary" standard is superceded by a strict consent framework. We will not disclose these highly sensitive records to health plans, third parties, or outside providers for routine operations without obtaining your explicit, written consent beforehand, except in rare bona fide medical emergencies.

Release to Family/Friends

With your verbal agreement, or if you are given an opportunity to object and do not do so, we may share relevant PHI with a family member, close friend, babysitter, or any other person you identify who is directly involved in your or your child’s care during a therapy session.

  • SUD Record Exception: If the information to be shared contains or references substance use disorder treatment or history, federal law prohibits us from relying on a verbal agreement. A formal, written consent form designating the specific family member or friend must be signed prior to disclosure.

Required Disclosures

We are legally permitted or required to disclose your standard PHI without your authorization in specific situations, such as public health oversight, reporting suspected child abuse or neglect, domestic violence, or preventing a serious and imminent threat to health or safety.

  • Legal Proceedings & Subpoenas: While standard PHI may be disclosed in response to a lawful court order or subpoena, your SUD records face heightened legal barriers. They cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide explicit written consent or a specialized qualifying court order is issued under 42 CFR Part 2. A standard attorney-issued subpoena is legally insufficient to compel the release of these records.
  • Redisclosure Warning: When we disclose standard PHI to an outside entity, it may no longer be protected by federal privacy rules. However, any shared SUD/Part 2 records retain their strict federal protections and the recipient is legally prohibited from redisclosing that data without your continued, explicit permission.

Client Rights

Under federal law, you hold specific, actionable rights regarding your health information:

  • Right to Inspect and Copy: You have the right to look at or receive an electronic or paper copy of your medical and billing records. We will fulfill this request within 30 days.
  • Right to Request Restrictions: You may ask us not to use or share certain PHI for treatment, payment, or healthcare operations. While we are not required to agree to every restriction, we are mandated to honor your request if you pay for a service entirely out-of-pocket and ask us not to disclose that PHI to your health insurance plan.
  • Right to Request Confidential Communications: You can request that we communicate with you via alternative means (e.g., cell phone only) or at an alternative address. We will accommodate all reasonable requests.
  • Right to Amend Records: If you feel information in your record is incorrect or incomplete, you can request an amendment in writing. We will respond within 60 days.
  • Right to an Accounting of Disclosures: You can request a list of the times we have shared your standard PHI over the past six years (excluding disclosures made for treatment, payment, healthcare operations, or those you authorized). For any records protected under 42 CFR Part 2, you have an expanded right to request a specific accounting of all operational disclosures.
  • Right to Opt Out of Fundraising: If ABA Solutions, Inc. contacts you for fundraising efforts, you have an absolute right to opt out of receiving any future fundraising communications through a clear and simple mechanism.

Policy Updates & Breach Notification

We reserve the right to change our privacy practices and the terms of this notice at any time, provided the changes align with current state and federal laws. If our policy changes significantly, an updated notice will be made available on our website and provided to you upon request.

  • Breach Notification Mandate: In the event of an unauthorized acquisition, access, use, or disclosure that compromises the security or privacy of your unsecured PHI or SUD records, we will notify you directly in writing (via first-class mail or verified email) without unreasonable delay, and in no case later than 60 days following the discovery of the breach.

Questions and Complaints

If you believe your privacy rights have been violated, you can file a formal complaint with ABA Solutions, Inc. or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not penalize or retaliate against you in any way for filing a complaint.

To exercise any of your rights or file a privacy complaint with our organization, please contact our designated HIPAA Compliance Officer:

  • Attn: Executive Office Administrator / HIPAA Compliance Officer
  • Address: 7441 114th Avenue - Suite 604, Largo, FL 33773
  • Phone: (727) 492-5369 | Fax: (727) 544-5900
  • Website: www.abasolutionsinc.com