This notice describes:  

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED 

• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION 

• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION 

PLEASE REVIEW THIS NOTICE CAREFULLY. YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH CEMPA’S PRIVACY OFFICER, MELISSA WHITE, AT 423-417-9432 OR PRIVACY@CEMPA.ORG IF YOU HAVE ANY QUESTIONS. 

This notice applies to Cempa Community Care (referred to in this notice as “Health Center,” “we” and “us”) and our workforce members (employees, contractors, volunteers, etc.) and to the health information we create and maintain about you. 

Laws that Protect Your Health Information1 

Federal and Tennessee state laws protect the health information that we create and maintain about you. For example: 

• Health Center Record: Your Health Center Record includes records we maintain about your health care and related services, such as treatment and billing information, that we use to make decisions about your care. Your Health Center Record is protected by HIPAA.  

• Part 2 Record: If you receive services from our Part 2 Program(s), including substance use disorder assessment, counseling, or treatment services, substance use disorder records that we create and maintain related to the Part 2 Program(s) are provided extra privacy protections under 42 CFR Part 2 (Part 2).  

• State Laws: State laws allow minors to consent to certain health care services without the consent of a parent or legal guardian. These services include testing and treatment for sexually transmitted infections and other services permitted by law. Health Center Records related to these services are confidential and may only be disclosed with the minor’s written authorization or as otherwise permitted or required by law. 

Your Rights 

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities. 

Get an electronic or paper copy of your medical record  

• The fastest way to get an electronic copy of the information in your Health Center Record is by logging into the patient portal through our website at www.cempa.org or by using theMyChart (Epic) application on your smartphone or tablet. The following information from your Health Center Record is available through the portal. The portal generally includes visit summaries, upcoming appointments, test results, medication lists, and secure messages. Certain information may not be available through the portal, and you may request a full copy of your Health Center Record as permitted by law.  

• You can also ask to see or get an electronic or paper copy of your Health Center Record. Submit your requests online through HealthMark’s Request Manager at https://requestmanager.healthmark-group.com anytime, or contacting 800-659-4035 or status@healthmark-group.com Mon – Fri 8am-5pm CST (9am-6pm Eastern time). We will provide a copy or a summary of your health information, usually within 30 days of your request. Status updates are sent via email, and you will be notified once your records are ready for download. We may charge a reasonable, cost-based fee. 

• State law limits the circumstances under which we may provide a parent or legal guardian with access to certain health information of minors. Access to a minor’s information through the patient portal may be limited for services the minor can consent to under state law. When such restrictions apply, parents or legal guardians may request access to the minor’s other records by following the steps outlined above with HealthMark or contacting our Medical Records Department at 423-265-2273. Parents or guardians may also request proxy access to the portal, subject to applicable confidentiality restrictions. 

Ask us to correct your Health Center Record 

• You can ask us to correct information about you in your Health Center Record that you think is incorrect or incomplete. Ask us how to do this. 

• We may say “no” to your request, but we’ll tell you why in writing within 60 days. 

Request confidential communications 

• You can ask us to contact you in a specific way (for example, home or cell phone) or to send mail to a different address.  

• We will say “yes” to all reasonable requests. 

Ask us to limit what we use or share 

• You can ask us not to use or share certain health information for treatment, payment, or our operations, including Part 2 Records shared with your written consent for purposes of treatment, payment and health care operations. We are not required to agree to your request, and we may say “no” if it would affect your care. 

• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information, including health information in Part 2 Records, for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information. 

Get a list of those with whom we’ve shared information 

• You can ask for a list (accounting) of the times we’ve shared your health information, who we shared it with and why. For Health Center Records, you may request 7 years of disclosures.  For Part 2 Records, you may request 3 years of disclosures. 

• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. 

• If you consented to the disclosure of your Part 2 Records to an intermediary, you can ask the intermediary for 3 years of disclosures. Please contact our Privacy Officer for questions or assistance.  

Get a copy of this privacy notice 

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly. 

Discuss this privacy notice 

You have the right to discuss this notice with Melissa White, Privacy Officer, at 423-417-9432 or privacy@cempa.org.   

Opt out of fundraising 

You can decide not to receive fundraising information from us, including from our Part 2 program. To opt out of fundraising, contact our Marketing and Communications office at info@cempa.org or 423-265-2273. 

Choose someone to act for you 

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your Health Center Record, including your Part 2 Record. 

• We will make sure the person has this authority and can act for you before we take any action. 

File a complaint if you feel your rights are violated 

• If you feel we have violated your rights or if you have questions, please contact Melissa White, Compliance and Risk Officer, at 423-417-9432 or privacy@cempa.org. We take the privacy of your health information seriously and will respond to your concerns and questions as quickly as possible.  

• You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints. 

• We will not retaliate against you for filing a complaint. 

Your Choices 

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, tell us what you want us to do, and we will follow your instructions. 

In these cases, you have both the right and choice to tell us to: 

• Share information with your family, close friends, or others involved in your care 

• Share information in a disaster relief situation 

In these cases we never share your information unless you give us written permission: 

• Marketing purposes 

• Sale of your information 

• Most sharing of psychotherapy notes 

In the case of fundraising: 

• We may use information in your Health Center Record to contact you for fundraising efforts, but you can tell us not to contact you again.  

• We may use or disclose your Part 2 Records to fundraise for the benefit of our Part 2 Program(s) only if we first provide you with a clear and conspicuous opportunity to elect not to receive fundraising communications. To opt out of fundraising communications, please contact our Marketing and Communications office at info@cempa.org or 423-265-2273.  

Our Uses and Disclosures 

How do we typically use or share your health information? 

We can use or share information in your Health Center Record without your consent or authorization as described in this section. In general, using or sharing Part 2 Records requires written consent as described in this section, unless one of the exceptions described in this section applies.  

Treatment: We can use information in your Health Center Record to provide you with care and we can share it with other professionals who are treating you. For example, a Health Center provider may share your prescription history with the hospital where you are having surgery. A Health Center provider may also disclose information about prescribing or dispensing controlled substances to a prescription drug monitoring program as part of your treatment.  

For any Part 2 Records: 

• You must sign a consent form allowing us to share Part 2 Records, unless an exception applies. For example, if your prescription history includes medication prescribed or dispensed by our Part 2 Programs, you must sign a consent form for us to share your prescription history with the hospital where you are having surgery or with a prescription drug monitoring program, if required by state law. 

• You may sign a single consent form for all future uses and disclosures of your Part 2 Records for treatment, payment and health care operations purpose.  

• In a bona fide medical emergency, we may share Part 2 Records if: (1) we cannot obtain your consent or (2) if a state or federal authority declares a temporary state of emergency because of a natural or major disaster and our Part 2 Programs are closed and unable to provide services or obtain your consent.

Payment: We can use and share information in your Health Center Record to bill and get payment from health plans or other entities. For example, we can send a bill to your health insurance company that includes your diagnosis, procedures performed, and supplies used 

For any Part 2 Records, you must sign a consent form allowing us to share your Part 2 Records for payment purposes, unless an exception applies. You may sign a single consent form for all future uses and disclosures of your Part 2 Records for payment purposes. 

Health Care Operations: We can use and share information from your Health Center record to run our practice, improve your care, and contact you when necessary. For example, we may send you appointment reminders and our clinical team may review the care you received and compare outcomes in your case with similar cases. 

For any Part 2 Records, you must sign a consent form allowing us to share your Part 2 Records for operations purposes, unless an exception applies. You may sign a single consent form for all future uses and disclosures of your Part 2 Records for health care operations purposes. 

Single Consent to Use and Disclose Part 2 Records 

• If you sign a single consent form allowing us to use and share your Part 2 Records for all future treatment, payment and health care operations purposes, the recipient may further disclose your Part 2 Records consistent with the consent. 

• If you sign a consent form allowing us to disclose your Part 2 Records for treatment, payment, and health care operations to a covered entity (such as another health care provider) or their business associate (such as a vendor), the recipient may share your Part 2 Records as permitted by HIPAA, except for uses or sharing for civil, criminal, administrative, and legislative proceedings against you. 

Substance Use Disorder Records We Receive from Other Organizations: If we receive substance use disorder treatment records from a program subject to 42 CFR Part 2 and are notified the records are protected by Part 2, we shall not use or disclose such records in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before we will use or disclose the requested record. 

How else can we use or share your health information?  

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes.  

Public health and safety issues: We can share information from your Health Center Record in certain situations such as:  

• Preventing disease 

• Helping with product recalls.  

• Reporting adverse reactions to medications 

• Reporting suspected abuse, neglect, or domestic violence 

• Preventing or reducing a serious threat to anyone’s health or safety. 

For any Part 2 Records: Using or sharing Part 2 Records for the purposes listed above requires written consent, except: 

• For public health purposes, we can disclose Part 2 Records without your consent if: (1) the disclosure is made to a public health authority and (2) information from the Part 2 Record has been de-identified. 

• If medical personnel of the Food and Drug Administration (FDA) assert a reason to believe that the health of an individual maybe be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, we may disclose Part 2 Records for the exclusive purpose of notifying patients or their physicians. 

• We can report suspected child abuse and neglect to appropriate state or local authorities, as required by law.  

• We can share certain information from your Part 2 Records with law enforcement if a crime is committed or threatened on the premise of our Part 2 Program(s) or against Part 2 Program staff members.   

Research: We can use or share information from your Health Center Record, including any Part 2 Records, for health research. 

Comply with the Law: We will share information from your Health Center Record if state or federal laws require it. We will share information from your Health Center Record, including your Part 2 Record, with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law. 

Organ Procurement Organizations: We can share health information from your Health Center Record with organ procurement organizations. For any Part 2 Records, written consent is required. 

Medical examiners or funeral directors: We can share information from your Health Center Record with a coroner, medical examiner, or funeral director when an individual dies.  

For any Part 2 Records, we can share information from Part 2 Records relating to cause of death if the law requires reporting on cause of death or vital statistics or permits inquiry into cause of death. Other uses or disclosures of any Part 2 Records require written consent.  

Workers’ compensation, law enforcement, and other government requests: We can use or share information from your Health Center record: 

• For workers’ compensation claims 

• For law enforcement purposes or with a law enforcement official 

• With health oversight agencies for activities authorized by law 

• For special government functions such as military, national security, and presidential protective services 

For any Part 2 Records: Using or sharing Part 2 Records for the above purposes requires written consent, except: 

• We can share certain information from your Part 2 Records with law enforcement if a crime is committed or threatened on the premise of our Part 2 Programs or against Part 2 Program staff members.   

• We can share Part 2 Records for audits or evaluations on behalf of certain government agencies, third-party payors or health plans, or quality improvement organizations. We may also share Part 2 Records with such auditors if you sign a consent allowing us to share Part 2 Records for health care operations. 

Respond to lawsuits and legal actions 

We can share information from your Health Center Record about you in response to a court or administrative order, or in response to a subpoena. 

For any Part 2 Records: 

• Part 2 Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on specific written consent or a court order; 

• Part 2 Records shall only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or to the holder of the record, where required by 42 U.S.C. 290dd-2 and 42 CFR Part 2; and 

• A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Record is used or disclosed. 

Our Responsibilities 

• We are required by law to maintain the privacy and security of your protected health information.  

• We will let you know promptly if a breach compromises the privacy or security of your information. 

• We must follow the duties and privacy practices described in this notice and give you a copy of it.  

• We will not use or share information from your Health Center Record, including any Part 2 Records, other than as described in this notice unless you consent in writing. You may change your mind at any time. To revoke (take back) your consent, submit a request in writing to Melissa White, Privacy Officer, at privacy@cempa.org or 423-265-2273 or 423-417-9432. If you revoke your consent, it will not affect any information we shared based on your earlier permission. 

Changes to the Terms of this Notice 

We can change this notice and make the new provisions effective for all the information we have about you. We will post the updated notice in our reception area and on our website www.cempa.org. You may also request a paper copy of the current notice.  

This notice is effective as of February 13, 2026. 

 Notes:  

This Notice is based on the Model Notice of Privacy Practices for Health Care Providers issued by the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), in 2013 (available at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html). This Notice also reflects the header requirements for Part 2 Programs at 42 CFR § 2.22(b)(1)(i) (including the right to a copy of the notice and to discuss the notice with a designated contact person as described at 42 CFR § 2.22(b)(1)(iv)E)-(F)). The Part 2 requirements, while more detailed than the current HIPAA requirements at 45 CFR § 164.520(b)(1)(i), align with the proposed updates to the header section in OCR’s “Proposed Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement” (86 Fed. Reg. 6446, 6534).