Notice of Privacy Practices

Effective date: TBD (upon counsel approval and operational rollout) · Last updated draft: 2026-05-15

1. Our pledge regarding your information

We are required by law to:

• Maintain the privacy and security of your protected health information ("PHI")
• Provide you with this Notice describing our legal duties and your rights
• Notify you in the event of a breach of unsecured PHI
• Follow the terms of the Notice currently in effect
• For substance use disorder records: obtain your written consent before disclosing your information to anyone outside Paramount, with limited exceptions described below

2. How we may use and disclose your information

2a. For treatment

We use and disclose your information to provide, coordinate, and manage your treatment. For example, our clinical team shares your information internally to plan and deliver your care. Because we are a 42 CFR Part 2 covered program, we will not share your treatment information with providers outside Paramount without your written consent, except in the limited circumstances listed in Section 4 below.

2b. For payment

We use and disclose your information to obtain payment for the treatment and services we provide. This includes billing your insurance carrier and obtaining prior authorization for treatment. For 42 CFR Part 2 records, billing communications with your insurance carrier require your written consent — we will obtain that consent at admission.

2c. For healthcare operations

We may use your information to support our operations, including quality assessment, staff training, accreditation, licensing, and compliance audits. We use the minimum information necessary for these purposes, and audits or reviews by external parties (such as state regulators) involve only the information required for that specific purpose.

3. Your written consent required for most other disclosures

Because Paramount is a federally protected substance use disorder treatment program under 42 CFR Part 2, we will not disclose your information for purposes other than the above without your written consent. This means we will not, without your written permission:

• Confirm to anyone — including your family, employer, or anyone else — that you are or have been a patient at Paramount
• Share treatment details with any provider outside Paramount
• Share information with your spouse, partner, parent, child, or anyone else not directly involved in your care
• Provide records in response to most subpoenas or court orders (federal law requires a special court order beyond an ordinary subpoena for SUD records)

You may give written consent for any of these disclosures. You may revoke your consent at any time in writing.

4. Limited exceptions where consent is not required

Federal and state law permit a small number of disclosures without your consent:

• Medical emergencies — to medical personnel for treatment of a condition that poses an immediate threat to your or another's health
• Internal communications — within Paramount and with our business associates who have signed a HIPAA Business Associate Agreement
• Reports of suspected child or elder abuse or neglect — required by Colorado law
• Court-ordered disclosures — only in response to a court order specifically meeting the requirements of 42 CFR Part 2 (a regular subpoena is not sufficient)
• Crime on premises or against personnel — limited disclosure to law enforcement for crimes committed on our property or against our staff
• Audits and evaluations — to government regulators, accreditors, and auditors, in their official capacity, under confidentiality obligations
• Research — only with Institutional Review Board approval and specific protocols protecting your identity

Even within these exceptions, we disclose only the minimum information necessary.

5. Your rights regarding your information

You have the following rights with respect to your information:

• Access — to inspect and obtain a copy of your records, generally within 30 days of a written request
• Amendment — to request correction of information you believe is inaccurate
• Accounting of disclosures — a list of certain disclosures we made, covering up to six years prior to your request
• Restriction — to request limits on how we use or disclose your information (we will accommodate reasonable requests; some restrictions are required by law)
• Confidential communications — to request that we communicate with you in a specific way or at a specific location (for example, by mail to a P.O. box rather than to your home address)
• Copy of this Notice — to receive a paper copy of this Notice on request, even if you have agreed to receive it electronically
• Complaint — to file a complaint with us or with the federal government if you believe your rights have been violated, without retaliation of any kind
• Restriction on disclosures to a health plan you self-pay for — if you pay for a service out of pocket in full, we must accommodate your request not to disclose information about that service to your health plan, except as required by law

To exercise any of these rights, contact our Privacy Officer using the information at the end of this Notice.

6. Breach notification

In the unlikely event of a breach of your unsecured information, we will notify you in writing without unreasonable delay and no later than 60 days following discovery of the breach, in accordance with the HIPAA Breach Notification Rule and applicable state law.

7. Re-disclosure prohibition (42 CFR Part 2)

Information received by another party from Paramount about a patient receiving substance use disorder treatment is subject to a federal re-disclosure prohibition. The federal rules prohibit the recipient from making further disclosure of the information without the patient's written authorization or as otherwise specifically permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose.

8. Non-discrimination notice (Section 1557)

Paramount Rehabilitation Center complies with applicable federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, sex (including sexual orientation and gender identity), or any other class protected by law. We provide free aids and services to people with disabilities and to people whose primary language is not English, including qualified interpreters and written information in other formats, to communicate effectively.

If you believe Paramount has failed to provide these services or discriminated in another way, you may file a grievance with our Compliance Officer (contact information below) or with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr, by mail at 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201, or by phone at 1-800-368-1019 (TDD 1-800-537-7697).

9. Changes to this Notice

We reserve the right to change this Notice and to make the new Notice applicable to all information we maintain about you. When we make a material change, we will post the new Notice in our facility, on our website, and (for active patients) provide it to you directly.

10. Contact us

Questions, requests to exercise your rights, or complaints under this Notice can be directed to our Privacy Officer:

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr. Paramount will not retaliate against you for filing a complaint.