Notice of Privacy Policy - SUD Program

As described in Whitman-Walker Health’s (“WWH’s”) Notice of Privacy Practices, patient medical records are protected by federal, state, and/or District of Columbia laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Certain substance use disorder records are also protected by federal regulations under 42 CFR Part 2 (“Part 2”).  At WWH, the Part 2 regulations apply to treatment records from:

• Whitman-Walker Addiction Services Co-occurring Program (“WWAS Co-OP”);
• Substance Use Management for Harm Reduction; and
• Understanding Your Use Group

Together these services and staff are WWH’s Part 2 Programs. This notice for WWH’s Part 2 Programs (“this Notice”) describes the additional confidentiality protections that apply to Part 2-protected records.

This notice:

• Describes how Part 2-protected records may be used and disclosed;
• Describes your rights with respect to your Part 2-protected records;
• Describes how to file a complaint concerning a violation of the privacy of your Part 2-protected records, or of your rights concerning your Part 2-protected records;
• Supplements WWH’s Notice of Privacy Practices and describes the additional protections for Part 2-protected records; and
• Applies only to your Part 2-protected records. This Notice does not apply to health information related services your receive outside of WWH’s Part 2 Programs. For example, records of an appointment with your primary care provider at WWH, including if they screen you for a substance use disorder, are not covered by Part 2.

I. Uses and Disclosures of Part 2-Protected Records

WWH will use and disclose your Part 2-protected records only as described in this Notice or with your written consent.

1. Using and Sharing Part 2-Protected Records without Consent: We are allowed to share your Part 2-protected records without your consent in the following situations:
   
   • To communicate among staff members within WWH’s Part 2 programs who have a need for the information in connection with their duties to provide diagnosis, treatment, or referral for treatment;
   • To medical personnel in a medical emergency;
   • To qualified service organizations providing services on our behalf who agree in writing to protect the information in the same way that we are required to protect the information;
   • To law enforcement if you commit, or threaten to commit, a crime in our facilities or against our personnel;
   • To report suspected child abuse and neglect as required by applicable law;
   • To qualified personnel for research subject to approval and oversight laws;
   • To qualified personnel for audit or program evaluation who a) agree in writing to protect the information as required under our policies, b) represent federal, state, or local government agencies that are authorized by law to oversee our program, or c) provide financial assistance to the program or provide payment for health care; or
   • To a public health authority, if the information has been de-identified.
2. Consent Requirements for Using or Sharing Part 2-Protected Records:
   
   • When Consent is Required. We will ask for your consent to share your Part 2-protected records in situations not listed in above Section I(a), including:

     • Treatment, payment and operations purposes. To allow us to share your Part 2-protected records with the doctors treating you at the hospital or at another clinic, with your health insurance company so that we may be paid for the services you received form us, or for our quality improvement and other operations purposes, you must sign a Part 2 consent form.

     • Single consent: You may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes. If the recipient is a HIPAA covered entity (such as another health care provider or insurance company) or a business associate (such as a company that assists a health care provider with storing medical records), they may disclose your information as permitted by HIPAA, except in civil, criminal, administration and legislative proceedings against you. You will need to sign a separate consent in order for us to share your Part 2-protected records with the health information exchanges (HIEs) that we participate in (Care Everywhere; CRISP). HIEs provide a way for us to share your health information with your other care providers (doctors’ offices, hospitals, labs, radiology centers, and other providers) through secure, electronic means. Please speak with your Part 2 provider for additional information.

     • Mandated Treatment. If you were mandated to receive treatment from WWH’s Part 2 Programs through the criminal legal system (including drug court, probation, or parole), you must sign a separate consent form allowing us to share your Part 2-protected records with the criminal legal system such as the court, probation officers, parole officers, prosecutors, or other law enforcement. The duration of your consent (how long it is in effect) and your right to revoke your consent may be more limited than under a standard Part 2 consent form.

     • Prescription Drug Monitoring Programs. If we are required by District law to report SUD medications we prescribe or dispense to a state prescription drug monitoring program, we may disclose information protected by Part 2 with your written consent.

     • Civil, Criminal, Administrative or Legislative Proceedings. To share your Part 2-protected records or testify about information in the records in a civil, criminal, administrative, or legislative investigation or proceeding against you, you must sign a separate Part 2 consent form.

     • Other Uses and Disclosures. WWH will make uses and disclosures of Part 2-protected records not described in this Notice only with your consent.

   • Revoking (Canceling) Your Consent. You may revoke your consent at any time, except to the extent that WWH has acted in reliance upon it. You may revoke consent by submitting a request in writing to the WWH Privacy Officer, or you may request reasonable accommodation for an alternative revocation process by contacting your Part 2 provider.
3. Using or Sharing Part 2-Protected Records in Lawsuits and Legal Actions.
   • Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless you sign a specific consent form allowing the use or disclosure or a court orders the use or disclosure.
   • Records shall only be used or disclosed based on a court order after notice and an opportunity to hear is provided to you and/or the holder of the record (WWH), where required by 42 USC § 290dd-2 and 42 CFR Part 2.
   • A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

II. Your Rights Related to Your Part 2-Protected Records

As a patient in a WWH Part 2 Program, you have the following rights regarding your Part 2-protected records:

1. Right to request restrictions. You have a right to request a restriction or limitation on the Part 2-protected records we use or disclose about you for purposes of treatment, payment, and health care operations, including when you have signed a consent for such disclosures. To request a restriction, submit your request in writing to the WWH Privacy Officer (contact information provided below) and tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply. We will review your request. If we agree to your request, we may still share your information where needed for emergency care or where required by law.

2. Right to request and obtain restrictions on disclosures to your health insurer. You have the right to request and obtain restrictions of disclosures to your health plan for those services which you have paid (or which someone has paid on your behalf) in full. To request a restriction, follow the process in above Section II(a). We will agree to your request, unless a law requires us to share the information with your health plan.

3. Right to an accounting of disclosures. You have a right to ask for an accounting (list) of the times we have shared your Part 2-protected records, who we shared it with, and why. To request an accounting of disclosures, submit your request in writing to the WWH Privacy Officer (contact information provided below) and provide the time period for the accounting (not more than six years from the date of your request).

4. Right to a list of disclosures by an intermediary. If you consented to share your Part 2-protected records through an intermediary, you have a right to a list of disclosures by an intermediary for the past 3 years. To request a list of disclosures by an intermediary, submit your request to the intermediary.

5. Right to a copy of this notice and to discuss this Notice. To get a paper or electronic copy of this notice or to discuss this Notice with the WWH Privacy Officer, submit your request to HIPAA@Whitman-Walker.org and/or at (202) 745-7000. Copies of this Notice are available from your Part 2 program and providers, from the WWH Privacy Officer, and on the WWH website at https://www.whitman-walker.org/disclaimers.

6. Right to opt-out of fundraising communications. If you do not want to receive fundraising communication from WWH, please submit your request to HIPAA@Whitman-Walker.org and/or at 202.745.7000.

III. Our Duties.

1. Maintaining the privacy of Part 2-protected records. WWH’s Part 2 Programs are required by law to maintain the privacy of records, to provide patients with notice of its legal duties and privacy practices with respect to Part 2-protected records, and to notify affected patients following a breach of unsecured records.
2. Following this Notice. WWH’s Part 2 Programs are required to abide by the terms of the Notice currently in effect.
3. Changing this Notice. WWH’s Part 2 Programs reserves the right to change this Notice. We further reserve the right to make the revised or changed Notice effective for information that we already have about you, as well as any information that we receive in the future. We will post a copy of the current Notice on the WWH website at https://www.whitman-walker.org/disclaimers.

IV. Complaints. If you have questions or believe that your privacy rights have been violated, you may file a complaint with:

1. WWH. Write to Whitman-Walker Health, 1201 Sycamore Drive S.E., Suite 500, Washington, D.C. 20032, Attention: Compliance/Privacy Office, or email at HIPAA@Whitman-Walker.org or call 202.745.7000.
2. HHS. Secretary of the Department of Health and Human Services: Write to the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue, SW, Washington, DC 20201, or call 877.696.6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints.
   You will not be retaliated against for filing a complaint.

V. For Additional Information. If you have any questions about this Notice or its contents, please ask a Part 2 Program staff member. You may also contact WWH’s Privacy Officer at HIPAA@Whitman-Walker.org and/or at 202.745.7000.

VI. Effective Date: This Notice is effective November 3, 2025, and amends in its entirety all prior WWH Part 2 Notices.