Required Legal Notice · February 2026 Model
Notice of Privacy Practices
This Privacy Policy describes how Comprehensive Recovery Solutions (“CRS Recovery,” “we,” “us,” or “our”) collects, uses, and protects your personal and health information when you visit our website at comprehensiverecoverysolutions.com or use our telehealth Suboxone treatment services in Florida.
- Effective: July 15, 2026
- Revised: February 2026 model
- HIPAA covered entity
- 42 CFR Part 2 compliant
⚠ THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Section 01
Who We Are
Comprehensive Recovery Solutions (“CRS Recovery”) is a Florida-licensed telehealth practice providing Suboxone treatment — the most effective form of Medication-Assisted Treatment (MAT) — for opioid use disorder. CRS Recovery is operated by Cristina Cavallo, MS, MCAP, ICADC, BC-TMH, a licensed healthcare provider and DEA-registered prescriber.
CRS Recovery is a HIPAA-covered entity and a federally assisted substance use disorder treatment program subject to 42 CFR Part 2. This combined notice satisfies both the HIPAA Notice of Privacy Practices requirement under 45 CFR § 164.520 and the Part 2 Patient Notice requirement under 42 CFR § 2.22, as permitted by 42 CFR § 2.22(d).
Required header — federal law
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. Federal law protects the confidentiality of your substance use disorder patient records.
Section 02
How We Use & Disclose Your Protected Health Information
We use and disclose your protected health information (PHI) for the following purposes. For SUD treatment records, additional restrictions apply under 42 CFR Part 2 — see Section 03.
Treatment
We use your PHI to provide, coordinate, and manage your healthcare and related services. For example, we may share information with your pharmacy when sending a Suboxone prescription, or with a specialist if we refer you for additional care. Your consent to treatment constitutes your consent to use your PHI for treatment purposes under HIPAA. For SUD records, we may use a single consent to share information for all treatment, payment, and healthcare operations purposes.
Payment
We use your PHI to process payments for services rendered. As a self-pay practice, CRS Recovery does not submit claims to insurance companies for clinical services. However, we may share limited PHI with payment processors to collect fees for services.
Healthcare operations
We use your PHI for internal practice operations, including quality improvement, training, compliance activities, and business management. This includes reviewing the care we provide to patients to improve our services.
Required by law
We may use or disclose your PHI when required to do so by federal or Florida state law, including mandatory reporting requirements. For SUD records, disclosure without consent is strictly limited to the circumstances defined in 42 CFR Part 2 — see Section 03.
Public health and safety
We may disclose your PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, to the extent permitted by HIPAA and 42 CFR Part 2. For SUD records, this exception is narrow and applies only to medical emergencies where your life is in danger.
Business associates
We work with certain third-party vendors (business associates) who help us deliver our services. All business associates are required to sign a Business Associate Agreement (BAA) and comply with HIPAA. Business associates who receive SUD records are also required to comply with 42 CFR Part 2.
Section 03
Special Protections for Substance Use Disorder Records
⚠ Enhanced federal protection — 42 CFR Part 2
Your substance use disorder (SUD) treatment records are protected by federal law under 42 USC § 290dd-2 and 42 CFR Part 2. These protections are stronger than standard HIPAA. Federal law prohibits us from making any disclosure of your SUD records that identifies you as having a substance use disorder without your written consent, except in the limited circumstances described below. Any disclosure of your SUD records must be accompanied by the statement: “42 CFR Part 2 prohibits unauthorized use or disclosure of these records.”
What your SUD records include
Your SUD records include any information that identifies you as a person who has applied for, been diagnosed with, or is receiving treatment for a substance use disorder at CRS Recovery. This includes your name combined with any information about your opioid use disorder diagnosis or Suboxone treatment.
Permitted disclosures without your consent
We may disclose your SUD records without your consent only in the following very limited circumstances:
- A medical emergency in which your life is in immediate danger (we will seek your consent as soon as possible after the emergency)
- For audit or evaluation by authorized federal, state, or local government agencies, subject to strict confidentiality requirements
- To report a crime committed on CRS Recovery premises or against CRS Recovery staff — but only the circumstances of the crime and not your treatment records
- To public health authorities, only when your identifying information has been removed in accordance with HIPAA de-identification standards
- Pursuant to a court order that meets the strict requirements of 42 CFR §§ 2.64 and 2.65
Your SUD records cannot be used against you
Federal law prohibits the use of your SUD records to initiate or support criminal charges against you, or to conduct any criminal investigation of you, without your written consent or a court order meeting the requirements of 42 CFR Part 2. Your employer, law enforcement, family members, and insurers cannot obtain your SUD treatment records from CRS Recovery without your written authorization.
Single consent for treatment, payment, and operations
Under the 2024 Part 2 Final Rule, you may provide a single written consent that authorizes CRS Recovery to use and share your SUD records for all treatment, payment, and healthcare operations purposes. This consent may be revoked at any time in writing. Revoking your consent will not affect disclosures already made in reliance on your prior consent.
Section 04
Uses & Disclosures Requiring Your Written Authorization
Beyond the permitted uses described above, we will only use or disclose your PHI with your written authorization. You have the right to revoke any authorization at any time in writing, except to the extent that we have already acted in reliance on it. The following uses and disclosures require your specific written authorization:
- Disclosure of your PHI or SUD records to anyone not involved in your direct care, payment, or healthcare operations
- Use of your PHI for marketing purposes (CRS Recovery does not use your health information for marketing)
- Sale of your PHI to any third party (CRS Recovery does not sell your health information)
- Any disclosure of your SUD records for purposes other than treatment, payment, or healthcare operations — including any disclosure to your employer, family members, or law enforcement without a court order
- Use of your SUD records in any civil, criminal, or administrative proceeding — which requires either your separate written consent or a court order per 42 CFR § 2.64
We will never sell your information
CRS Recovery does not sell, rent, or share your personal health information or SUD records with advertisers, data brokers, or any third party for commercial purposes. Your health information is used only for your direct care and legally required disclosures.
Section 05
Your Rights
You have the following rights regarding your protected health information and SUD records. To exercise any of these rights, contact us using the information in Section 09.
Right to access your records
You have the right to inspect and obtain a copy of your health records, including your SUD treatment records. We will provide access within 30 days of your request. We may charge a reasonable fee for copies.
Right to amend your records
You have the right to request that we correct information in your records that you believe is inaccurate or incomplete. We may deny your request if we determine the information is accurate and complete, but we will document your disagreement.
Right to an accounting of disclosures
You have the right to receive a list of certain disclosures of your PHI and SUD records that we have made in the past six years, other than disclosures for treatment, payment, and healthcare operations made with your consent.
Right to request restrictions
You have the right to request that we restrict how we use or disclose your PHI. We are not always required to agree to your request, but we will consider it carefully. If we agree to a restriction, we will honor it except in an emergency.
Right to confidential communications
You have the right to request that we communicate with you about your health information in a specific way or at a specific location — for example, by calling you on a specific phone number or sending mail to a specific address.
Right to a paper copy of this notice
You have the right to receive a paper copy of this Notice of Privacy Practices at any time, even if you have agreed to receive it electronically. Contact us and we will provide one promptly.
Right to revoke consent for SUD records
You have the right to revoke any consent you have given for the use or disclosure of your SUD records at any time in writing. Revocation will not affect disclosures already made in reliance on your prior consent.
Right to file a complaint
You have the right to file a complaint if you believe your privacy rights have been violated. You may file a complaint directly with CRS Recovery or with the HHS Office for Civil Rights. You will not be retaliated against for filing a complaint — your care will never be affected by whether you exercise your privacy rights.
Section 06
Our Duties
CRS Recovery is required by law to:
- Maintain the privacy and security of your protected health information
- Provide you with this notice of our legal duties and privacy practices
- Follow the terms of this notice currently in effect
- Comply with HIPAA and 42 CFR Part 2 in all uses and disclosures of your health information
- Notify you if we discover a breach of your unsecured protected health information
- Review the Florida Prescription Drug Monitoring Program (PDMP/E-FORCSE®) before prescribing controlled substances, as required by law
We reserve the right to change this notice and our privacy practices at any time, as permitted by law. Any revised notice will apply to all information we have about you, including information created or received before the revision. We will post the updated notice on our website and make it available to you upon request.
Section 07
Breach Notification
If CRS Recovery discovers that your unsecured protected health information or SUD records have been breached, we will notify you as required by the HIPAA Breach Notification Rule and 42 CFR Part 2.
We will provide notification:
- Without unreasonable delay and no later than 60 days after discovery of the breach
- By first-class mail or email (if you have provided an email address and agreed to electronic communication)
- The notification will describe the breach, the information involved, steps you can take to protect yourself, and what we are doing to investigate and prevent future breaches
If the breach affects 500 or more individuals in Florida, we will also notify the HHS Office for Civil Rights and prominent Florida media outlets as required by law. We will maintain a log of all breaches for a minimum of six years.
Section 08
How to File a Complaint
If you believe your privacy rights under HIPAA or 42 CFR Part 2 have been violated, you have the right to file a complaint. You will not be penalized, and your care will not be affected, for filing a complaint.
File a complaint with CRS Recovery
Contact us. We take all privacy complaints seriously and will respond within 30 days, please contact us here
File a complaint with HHS Office for Civil Rights
You may also file a complaint with the federal agency that enforces HIPAA and 42 CFR Part 2:
HHS Office for Civil Rights
Website: hhs.gov/ocr/complaints
Phone: 1-800-368-1019 (free)
TDD: 1-800-537-7697
Mail: U.S. Department of Health & Human Services, 200 Independence Avenue SW, Washington DC 20201
Deadline: Complaints must be filed within 180 days of the alleged violation
File a complaint with Florida Department of Health
For complaints related to clinical care or Florida licensing:
Florida Department of Health
Website: flhealthsource.gov
Phone: 1-800-342-0429
Section 09
Contact Us
For questions about this Notice of Privacy Practices, to exercise your privacy rights, or to request a paper copy of this notice: Please contact us here