Legal Document · HIPAA Covered Entity

Privacy Policy

Combined HIPAA Notice & 42 CFR Part 2 Patient Notice

This Notice of Privacy Practices describes how Comprehensive Recovery Solutions (“CRS Recovery”) may use and disclose your protected health information (PHI) and your substance use disorder (SUD) treatment records, and how you can exercise your rights regarding that information.

Section 01

Information We Collect

Information you provide directly

When you contact us, complete our pre-screening form, or use our telehealth services, we may collect the following information:

Full name, email address, and phone number submitted via our contact or pre-screening forms
Pre-screening responses including your location (Florida confirmation) and treatment interest
Communications you send to us via email, phone, or our contact form
Payment information processed through our third-party billing processor
Health and clinical information collected during the course of treatment, which is governed separately by our Notice of Privacy Practices

Information collected automatically

When you visit our website, we automatically collect certain technical information:

IP address, browser type, device type, and operating system
Pages visited, time spent on pages, and referring website
Cookies and similar tracking technologies (see Section 06)

Information we do not collect on this website

Our website contact and pre-screening forms do not collect detailed medical history, substance use history, diagnosis information, or treatment records. That clinical information is collected separately through our HIPAA-compliant patient portal (Counsol) at the start of treatment.

Section 02

How We Use Your Information

We use the information we collect for the following purposes:

To respond to your questions and inquiries in a timely manner
To assess your eligibility for our telehealth Suboxone treatment program
To schedule and conduct telehealth appointments via our secure patient portal
To provide clinical assessment, Suboxone treatment, and ongoing care management
To process payments and maintain billing records
To send appointment reminders, follow-up communications, and treatment-related information
To improve our website, services, and patient experience
To comply with applicable federal and state laws, including HIPAA and 42 CFR Part 2
To respond to lawful requests from government authorities as required by law

We do not use your information for marketing to third parties

CRS Recovery does not sell, rent, or share your personal information with advertisers or marketing companies. We do not use your health information for any purpose other than your direct care and legally required disclosures.

Section 03

How We Share Your Information

CRS Recovery does not sell your personal information. We share your information only in the following limited circumstance

Service providers and business associates

We work with certain third-party vendors who assist us in delivering our services. Any vendor that handles your protected health information (PHI) is required to sign a HIPAA Business Associate Agreement (BAA) before accessing your data. These vendors include:

Counsol — our HIPAA-compliant practice management and patient portal platform
Payment processors — for billing and payment collection
SiteGround — our HIPAA-aware web hosting provider

Legal requirements

We may disclose your information when required to do so by law, such as in response to a court order, subpoena, or other legal process. However, substance use disorder treatment records receive additional legal protections under 42 CFR Part 2 (see Section 05) and cannot be disclosed in most legal proceedings without your explicit written consent or a court order meeting specific legal standards.

Safety emergencies

We may disclose information to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person, to the extent permitted by HIPAA and 42 CFR Part 2.

We never share your information without authorization

Your employer, family members, insurance companies, and law enforcement cannot obtain your substance use disorder treatment records from CRS Recovery without your written consent, except in the narrow circumstances permitted by federal law.

Section 04

HIPAA & Protected Health Information

CRS Recovery is a HIPAA-covered entity

As a licensed healthcare provider delivering telehealth services, Comprehensive Recovery Solutions is subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. Your protected health information (PHI) is governed by our separate Notice of Privacy Practices (NPP), which you will receive at the beginning of treatment and which is available upon request.

HIPAA defines protected health information (PHI) as any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity. This includes your name combined with any health information, your date of birth, your contact information in connection with health services, and any information relating to your physical or mental health condition or treatment.

Your HIPAA rights include

The right to access and receive a copy of your health records
The right to request corrections to your health records
The right to request restrictions on how we use or disclose your PHI
The right to receive confidential communications about your health information
The right to an accounting of certain disclosures of your PHI
The right to file a complaint with us or with the U.S. Department of Health & Human Services Office for Civil Rights (OCR) if you believe your privacy rights have been violated

For a complete description of your HIPAA rights and our privacy practices, please refer to our Notice of Privacy Practices.

Section 05

42 CFR Part 2 — Substance Use Disorder Confidentiality

⚠ Enhanced Federal Protection — 42 CFR Part 2

Your substance use disorder (SUD) treatment records are protected by a separate and stricter federal law: 42 USC § 290dd-2 and 42 CFR Part 2. These regulations provide significantly stronger confidentiality protections than standard HIPAA. The 2024 Final Rule (effective February 16, 2026) updated Part 2 requirements. CRS Recovery fully complies with these regulations.

As a federally assisted substance use disorder treatment provider, CRS Recovery is required to comply with 42 CFR Part 2. This law was designed to protect people seeking treatment for substance use disorders from the fear that their treatment records could be used against them — in employment, housing, custody proceedings, or criminal prosecution.

What 42 CFR Part 2 means for you

CRS Recovery may not disclose any information identifying you as a person with a substance use disorder, or as a patient seeking or receiving SUD treatment, without your prior written consent — except in very limited circumstances defined by law
CRS Recovery may not confirm or deny that you are a current or former patient without your written authorization
Your SUD treatment records cannot be used to initiate or support criminal charges against you, or to conduct a criminal investigation, without a court order meeting the strict requirements of 42 CFR §§ 2.64 and 2.65
A general medical release or authorization is NOT sufficient to authorize disclosure of your SUD treatment records — a specific consent meeting the requirements of 42 CFR § 2.31 is required
You have the right to revoke your consent for disclosure at any time
Any records disclosed with your consent must be accompanied by the statement:“42 CFR Part 2 prohibits unauthorized use or disclosure of these records”

Limited exceptions where disclosure may occur without consent

Under 42 CFR Part 2 and the 2024 Final Rule, disclosure without your consent is permitted only in the following narrow circumstances:

A medical emergency in which your life is in immediate danger
For audit or evaluation purposes by federal, state, or local government agencies, under strict confidentiality requirements
To report a crime committed on CRS Recovery premises or against CRS Recovery staff
To public health authorities, provided information is de-identified in accordance with HIPAA standards
Pursuant to a court order that meets the specific requirements of 42 CFR Part 2

How to file a Part 2 complaint.

If you believe your Part 2 rights have been violated, you may file a complaint with the U.S. Department of Health & Human Services Office for Civil Rights at hhs.gov/ocr or call 1-800-368-1019. You will not be retaliated against for filing a complaint.

Section 06

Cookies & Website Tracking

Our website uses cookies and similar technologies to improve your experience and understand how visitors use our site. A cookie is a small text file stored on your device when you visit a website.

Types of cookies we use

Essential cookies— required for the website to function. These cannot be disabled.
Analytics cookies— help us understand how visitors interact with our site so we can improve it. We use Google Analytics for this purpose.
Functionality cookies— remember your preferences to improve your experience.

Managing cookies

You can disable non-essential cookies through your browser settings at any time. However, disabling cookies may affect the functionality of some parts of our website. Most browsers allow you to manage cookie preferences through their settings menus.

We do not use cookies to identify you as a patient or to track your health information. Website analytics data is not linked to your clinical records in any way.

Section 07

Data Security

CRS Recovery takes the security of your personal and health information seriously. We implement administrative, technical, and physical safeguards to protect your information in accordance with HIPAA Security Rule requirements and 42 CFR Part 2.

Our security measures include

SSL/TLS encryption for all data transmitted between your device and our website
All telehealth appointments are conducted via Counsol — a HIPAA-compliant, encrypted platform
Access to patient records is restricted to authorized clinical personnel only
Signed Business Associate Agreements (BAAs) with all vendors who handle PHI
Regular security reviews of all systems that process or store patient information
Written security policies maintained in accordance with 42 CFR Part 2 and HIPAA Security Rule

Data breach notification

In the event of a breach of your unsecured protected health information, CRS Recovery will notify you as required by the HIPAA Breach Notification Rule and 42 CFR Part 2. We will provide notification without unreasonable delay and no later than 60 days following the discovery of a breach. If the breach affects 500 or more individuals, we will also notify the HHS Office for Civil Rights and, if applicable, prominent media outlets in Florida.

Section 08

Your Rights

As a patient and website visitor, you have rights regarding your personal and health information. Many of these rights are guaranteed by HIPAA and 42 CFR Part 2.

Rights regarding your health information (HIPAA)

Right to access— you may request a copy of your health records in the format of your choosing
Right to amend— you may request corrections to inaccurate or incomplete information in your records
Right to an accounting of disclosures— you may request a list of certain disclosures of your PHI we have made
Right to request restrictions— you may request that we restrict how we use or share your PHI, though we are not always required to agree
Right to confidential communications— you may request that we communicate with you in a specific way or at a specific location
Right to file a complaint— you may file a complaint with us or with HHS OCR if you believe your rights have been violated

Rights regarding your SUD records (42 CFR Part 2)

You may revoke your consent for disclosure of SUD records at any time in writing
You may request an accounting of disclosures of your Part 2-protected records
You will never be penalized or have your treatment affected for exercising any of these rights

To exercise any of these rights, please contact us using the information in Section 11. We will respond to all requests within 30 days.

Section 09

Children's Privacy

CRS Recovery’s telehealth Suboxone treatment services are exclusively for adults 18 years of age and older. We do not knowingly collect, use, or disclose personal information from individuals under the age of 18.

Our pre-screening form includes an age verification question that disqualifies anyone under 18 from proceeding. If we become aware that we have inadvertently received personal information from a minor, we will delete that information immediately.

If you are a parent or guardian and believe your child has submitted personal information to us, please contact us immediately at cristina@crsrecovery.com and we will promptly delete the information.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law — including updates to HIPAA regulations or 42 CFR Part 2. When we make material changes, we will update the “Last Updated” date at the top of this page.

If changes are significant — particularly any changes affecting how we handle your protected health information or SUD treatment records — we will provide more prominent notice, which may include a notice in our patient portal or direct communication to patients.

Your continued use of our website or services after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

Section 11

Contact Us

If you have questions or concerns about this Privacy Policy, wish to exercise any of your rights described above, or wish to file a privacy complaint, please contact us here