Notice of Privacy Practices

Notice of Privacy Practices of Heights Behavioral Health, LLC. This notice explains how we may use and disclose your health information, your rights with respect to that information, and how to file a complaint. You may request a paper or electronic copy of this notice at any time, and you may discuss it with our Privacy Officer using the contact details at the end of this page.

Who we are and our commitment to your privacy

Heights Behavioral Health, LLC (“Heights Behavioral Health,” “we,” “us,” or “our”) is an adult outpatient behavioral health practice located at 1009 Yale Street, Houston, Texas 77008. We provide treatment for mental health conditions, trauma, substance use, and process and behavioral addictions.

We are required by law to maintain the privacy and security of your protected health information (PHI), to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach of your unsecured PHI occurs. This notice applies to all records of your care that we create, receive, or maintain, including records in our electronic health record system.

Because we provide treatment for substance use disorders, records that identify you as having or having had a substance use disorder receive additional protection under federal law, 42 U.S.C. 290dd-2 and 42 C.F.R. Part 2 (“Part 2”). These Part 2 records are not treated like other health information: in most situations they cannot be used or disclosed without your written consent, even where HIPAA alone would allow it. Your information is also protected by Texas law, including the Texas Medical Records Privacy Act (Texas Health and Safety Code Chapter 181) and the Texas mental health records confidentiality statute (Chapter 611). Where state or federal law is stricter than HIPAA, we follow the stricter rule.

Extra protection for substance use disorder records

Federal law protects the confidentiality of substance use disorder patient records. Generally, we may not tell a person outside our practice that you attend our program, and we may not disclose any information that identifies you as having a substance use disorder, unless one of the following applies:

• You consent in writing;
• The disclosure is allowed by a court order that meets the requirements of Part 2 and is accompanied by a subpoena or similar legal mandate;
• The disclosure is made to medical personnel to the extent necessary to meet a bona fide medical emergency;
• The disclosure is made to qualified personnel for research, audit, evaluation, or public health purposes, as permitted by Part 2; or
• The disclosure is otherwise permitted under Part 2, for example reporting suspected child abuse or neglect under state law, or reporting a crime committed on our premises or against our personnel.

One consent for treatment, payment, and health care operations. You may give a single written consent that covers all future uses and disclosures of your Part 2 records for treatment, payment, and health care operations. Once you give that consent, we may use and disclose those records as described in it, and a recipient that is a HIPAA covered entity or business associate may redisclose them as permitted by the HIPAA Privacy Rule, unless you ask us to apply a restriction. You may revoke your consent at any time, in writing, except to the extent we have already acted in reliance on it. Any use or disclosure of Part 2 records not described in this notice, or not covered by a consent you have signed, requires your written consent.

Legal proceedings. Your Part 2 records, and testimony relaying their content, may not be used or disclosed against you in any civil, criminal, administrative, or legislative proceeding without your specific written consent or a court order issued under Part 2. Before such a court order can be issued, you must be given notice and an opportunity to be heard where the regulations require it, and the order must be accompanied by a subpoena or similar legal mandate.

Fundraising. We do not use or disclose your records for fundraising. If that ever changes, you will be given a clear and conspicuous opportunity to opt out of fundraising communications before any Part 2 record is used for that purpose.

Violation of these federal requirements is a crime, and suspected violations may be reported to the Secretary of the U.S. Department of Health and Human Services.

How we may use and disclose your health information

The following describes the ways we may use and disclose PHI. Where your records are protected by Part 2, these uses and disclosures occur only with your written consent or as Part 2 otherwise permits.

Treatment

We use your PHI to provide, coordinate, and manage your care. For example, your therapist may share information with other members of our clinical team during treatment planning, or, with your consent where required, coordinate with an outside psychiatrist, primary care physician, prior treatment program, or your mentor within our recovery support program.

Payment

We use and disclose PHI to bill and collect payment for services. Because we are a private-pay practice, this typically means processing your payments and, at your request, preparing superbills that you may submit to your health plan for possible out-of-network reimbursement. If you pay in full out of pocket for a service and ask us not to disclose information about that service to your health plan, we must honor that request.

Health care operations

We use PHI to run our practice: quality improvement, clinical supervision and training, licensing and accreditation, business planning, auditing, and administrative activities. We limit these uses to the minimum necessary information.

Appointment reminders and care communications

We may contact you to remind you of appointments, to follow up after a session, or to tell you about treatment options and services that may benefit you. Tell us if you prefer to be contacted a particular way, for example only by cell phone, by text, or without voicemail, and we will accommodate reasonable requests.

Family and others involved in your care

With your permission, or in limited circumstances when you are unable to agree or object and we determine it is in your best interest, we may share relevant information with a family member, close friend, or other person involved in your care or in paying for your care. For Part 2 records, we obtain your written consent before these disclosures except as Part 2 specifically permits.

Business associates

We share PHI with vendors that perform services for us, such as our electronic health record platform, billing and payment processors, secure communication and telehealth tools, and professional advisors. Each business associate signs a written agreement requiring it to safeguard your information, including Part 2 protections where they apply.

Uses and disclosures permitted or required by law without your authorization

Subject to the stricter Part 2 rules described above, we may use or disclose PHI without your authorization in the following situations:

• When required by law. Including mandatory reporting of suspected abuse, neglect, or exploitation of a child, an elderly person, or a person with a disability, as Texas law requires.
• Public health activities. To public health authorities for activities such as disease reporting, as required or permitted by law.
• Health oversight. To agencies that oversee health care providers, such as licensing boards, the Texas Health and Human Services Commission, and auditors.
• Judicial and administrative proceedings. In response to a court order, or in some cases a subpoena or discovery request with the protections the law requires. Part 2 records require a Part 2 court order and accompanying subpoena.
• Law enforcement. In limited circumstances defined by law, for example to report a crime committed on our premises or against our personnel, or as required by a court order.
• To avert a serious threat. To prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with Texas law and professional ethics.
• Coroners, medical examiners, and funeral directors. As permitted by law.
• Workers’ compensation. As authorized by workers’ compensation laws.
• Military, veterans, and national security. If you are a member of the armed forces, as required by military command authorities; and to authorized federal officials for lawful intelligence or protective activities, as permitted by law.
• Correctional institutions and custody. If you are in the custody of a correctional institution or law enforcement official, as necessary for your health or the safety of others.
• Research. Only under the protections required by law, such as approval by an institutional review board or privacy board, or using de-identified information.
• De-identified information. We may use information that no longer identifies you for quality improvement, planning, and reporting.

Uses and disclosures that require your written authorization

We will obtain your written authorization before:

• Most uses and disclosures of psychotherapy notes, which are the personal notes a therapist keeps separate from your medical record;
• Any use or disclosure of PHI for marketing purposes;
• Any sale of PHI;
• Any disclosure of Part 2 records that is not described in this notice or covered by a consent you have signed; and
• Any other use or disclosure not described in this notice.

You may revoke an authorization or consent at any time by notifying our Privacy Officer in writing. Revocation stops future uses and disclosures but does not affect actions we have already taken in reliance on your authorization.

Notice regarding electronic disclosure of your health information

Your protected health information may be subject to electronic disclosure. Under Texas law (Texas Health and Safety Code Section 181.154), we are required in certain circumstances to obtain a separate authorization from you before each electronic disclosure of your PHI. That authorization may be given in writing, electronically, or orally if we document it in writing. Authorization is not required for electronic disclosures made for treatment, payment, or health care operations, for certain insurance or health maintenance organization functions, or as otherwise permitted or required by law.

Your rights regarding your health information

You have the following rights. To exercise any of them, contact our Privacy Officer using the information at the end of this notice. We will respond within the timeframes the law requires and will not charge you for making a request, although a reasonable, cost-based fee may apply to copies.

• Right to access and copies. You may inspect and obtain a copy of your health records, in electronic form if you request it and we can readily produce it. Texas law generally requires us to provide electronic health records within 15 business days of your written request. You may also direct us to send a copy to a person or organization you designate. Limited exceptions apply, including psychotherapy notes and, under Texas Health and Safety Code Chapter 611, mental health records where a professional determines that release would be harmful to your physical, mental, or emotional health; in that case we will tell you in writing and you may ask us to send the record to another qualified professional.
• Right to amend. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing. We may deny the request in certain circumstances; if we do, we will explain why and you may submit a statement of disagreement that will be kept with your record.
• Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI in the six years before your request, other than disclosures for treatment, payment, and health care operations and certain other exceptions. For Part 2 records, you may also request an accounting of disclosures made from an electronic record in the three years before your request, including disclosures for treatment, payment, and health care operations made with your consent, and a list of disclosures made by any intermediary for the past three years.
• Right to request restrictions. You may ask us to limit how we use or disclose your PHI, including Part 2 records disclosed under a consent for treatment, payment, or health care operations. We are not required to agree to every request, but we must agree when you have paid for a service in full out of pocket and ask us not to disclose information about it to your health plan.
• Right to confidential communications. You may ask us to contact you in a specific way or at a specific location, for example only at a certain phone number or email address. We will accommodate reasonable requests.
• Right to a copy of this notice. You may request a paper or electronic copy of this notice at any time, even if you agreed to receive it electronically, and you may ask our Privacy Officer to discuss it with you.
• Right to breach notification. We will notify you without unreasonable delay if a breach occurs that compromises the privacy or security of your unsecured PHI.
• Right to opt out of fundraising. We do not conduct fundraising. If we ever did, you would have the right to opt out of fundraising communications.
• Right to choose someone to act for you. A person with a valid medical power of attorney, a legal guardian, or another personal representative recognized under Texas law may exercise your rights on your behalf. We will verify their authority before acting.

Our duties

We are required by law to maintain the privacy and security of your PHI, to provide you with this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you following a breach of unsecured PHI. We reserve the right to change this notice and to make the revised notice effective for all PHI we maintain, including information we already hold. The current notice is always posted on this page and available at our office. When we make a material change, we will post the revised notice promptly, make copies available at your next visit and on request, and update the effective and revision dates shown at the top of this page.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer by phone, email, or mail using the details below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, online at hhs.gov/ocr/complaints, by mail at 200 Independence Avenue SW, Washington, DC 20201, or by calling 1-800-368-1019 (TDD 1-800-537-7697). Complaints about the handling of substance use disorder records may also be reported to the Secretary of Health and Human Services. We will not retaliate against you or penalize you in any way for filing a complaint.

Your right to a Good Faith Estimate

Under the federal No Surprises Act, health care providers must give clients who do not have insurance, or who are not using insurance, an estimate of the expected charges for scheduled services. Because Heights Behavioral Health is a private-pay practice, this right applies to you.

• You have the right to receive a Good Faith Estimate for the total expected cost of any non-emergency services, including psychotherapy, psychiatric services, program fees, and related costs.
• You can ask for a Good Faith Estimate before you schedule a service. We will also provide one in writing at least one business day before a scheduled service, and within three business days of a request made without scheduling.
• If you receive a bill that is at least $400 more than your Good Faith Estimate, you can dispute the bill through the federal patient-provider dispute resolution process.
• Keep a copy or a picture of your Good Faith Estimate.

For questions or more information about your right to a Good Faith Estimate, visit cms.gov/nosurprises or call 1-800-985-3059. Our admissions team will walk you through expected costs before care begins and can provide the estimate in an accessible format or another language on request.

Privacy Officer contact

Questions about this notice, requests to exercise your rights, revocations of consent, or complaints:

Effective July 14, 2026. Revised October 25, 2026. This Notice of Privacy Practices governs protected health information related to your treatment at Heights Behavioral Health. Information collected through this website is governed by our Website Privacy Policy and Cookie Policy.