Notice of Privacy Practices

1. Who this notice applies to

This notice applies to Eternity Recovery Center, an outpatient substance use disorder and mental health treatment program located at 16946 Sherman Way, Suite 400, Van Nuys, CA 91406. It covers all of the health information we create or receive about you, in paper or electronic form, including information created by our clinicians, counselors, case managers, and administrative staff.

It applies to everyone who works for us — employees, contracted clinicians, students in training, and volunteers — and to our business associates, meaning outside companies that handle your information on our behalf (for example, an electronic health record vendor or a billing service). Business associates are required by written contract to protect your information the same way we do.

2. Two laws protect your records

Two federal privacy laws apply to us, and where they differ, we follow the stricter one.

HIPAA — the Health Insurance Portability and Accountability Act — protects your protected health information, which is health information that identifies you or could reasonably be used to identify you.

42 CFR Part 2 — the federal rule on the confidentiality of substance use disorder patient records — gives records from programs like ours additional protection beyond HIPAA. It exists because of a specific concern: that fear of exposure keeps people from seeking treatment for a substance use disorder. Under Part 2, the fact that you are or were a patient here is itself confidential. We will not confirm to anyone that you have contacted us or been treated here without your written consent, unless the law specifically allows or requires it.

We also follow the California Confidentiality of Medical Information Act, Civil Code section 56 and following, which places its own limits on disclosing medical information in California.

Because Part 2 is stricter than HIPAA in most situations, some of the disclosures that HIPAA would permit are not available to us, or require your written consent or a court order first. Where that is the case, this notice says so.

3. Uses and disclosures for treatment, payment, and health care operations

Under Part 2, we generally need your written consent before we use or share your records for treatment, payment, or health care operations. As of the 2024 changes to Part 2, you may give us a single consent that covers all future uses and disclosures for all three of those purposes, rather than signing a separate consent each time. You may also give a narrower consent if you prefer, and you may revoke a consent at any time, except to the extent we have already acted on it.

Here is what each purpose means, with an example.

Treatment. Using your information to provide, coordinate, or manage your care. For example, your therapist and the prescribing physician on your medication-assisted treatment may review your record together so your counseling plan and your medication are aligned.

Payment. Using your information to bill and collect for the care we provide. For example, with your consent we may send your diagnosis and the dates and level of care you received to your health plan so that it will authorize and pay for your treatment.

Health care operations. Using your information to run the program and keep quality high. For example, we may review a sample of records internally to evaluate the quality of our clinical documentation, or provide records to The Joint Commission as part of an accreditation survey.

4. Other uses and disclosures allowed or required by law

In a small number of situations, federal law lets us use or share information without your written consent. Each of these is narrow, and Part 2 limits several of them more tightly than HIPAA does.

Medical emergencies. We may share information with medical personnel to the extent necessary to treat a condition that poses an immediate threat to your health and requires immediate medical intervention. We document every such disclosure in your record.

Reports of suspected child abuse or neglect. California law requires us to report suspected child abuse or neglect, and Part 2 permits the initial report. Part 2 records may not be used in any resulting civil or criminal proceeding without your written consent or a court order.

Reports of suspected elder or dependent adult abuse. California law requires these reports as well.

A crime on our premises or against our staff. We may report to law enforcement a crime committed at the program or against program personnel, and may give the circumstances of the incident, including the suspect's name, address, and last known whereabouts.

Serious threat to health or safety. Where California law requires or permits us to warn of a serious and imminent threat, we may make that disclosure.

Research. We may disclose information for research that meets the specific conditions in 42 CFR 2.52, which requires independent review and protections for your identity. Researchers may not redisclose your information except back to us.

Audit and evaluation. Government agencies, accreditors, and auditors — including the California Department of Health Care Services, which certifies us, and The Joint Commission, which accredits us — may review records to evaluate the program. Information obtained in an audit or evaluation may not be used to investigate or prosecute you.

Qualified service organizations. We may share what is needed with organizations that provide services to us, such as laboratory, billing, or data processing services, under a written agreement that binds them to Part 2.

Court order. A court may order disclosure of Part 2 records, but only after you or the record holder receive notice and an opportunity to be heard, and only under the strict standards in 42 CFR Part 2, subpart E. A subpoena alone is not enough.

Deceased patients. Limited disclosures may be made relating to the cause of death as required by state law, and to a personal representative in some circumstances.

Required by law. Where another law requires a disclosure and Part 2 permits it, we will make it, limited to what the law requires.

Some disclosures that HIPAA would allow for other providers are not available to us because Part 2 is stricter. Without your written consent or a court order, we will not disclose your records for general law enforcement investigations, for most public health reporting that would identify you as a patient here, to a coroner or medical examiner beyond what state law on cause of death requires, in response to a subpoena that is not accompanied by a qualifying court order, or to a correctional institution.

5. Uses that require your written consent or authorization

Any use or disclosure not described in this notice will be made only with your written consent or authorization. This includes:

• SUD counseling notes and psychotherapy notes. These are the private notes a clinician keeps separate from the rest of your record to document a counseling session. They require their own specific consent, separate from any general consent you sign, and separate from a consent for treatment, payment, and operations.
• Marketing. We will not use your information to market a product or service to you without your written authorization.
• Sale of your information. We do not sell your health information, and we would not do so without your written authorization. For example, we would never provide your contact details to a referral broker, lead generator, or advertiser in exchange for payment.
• Use in legal proceedings against you. See section 6 below.

You may revoke a written consent or authorization at any time, in writing, except to the extent we have already relied on it. Ask our Privacy Officer for the form.

6. Special protection in legal proceedings

This is one of the strongest protections Part 2 gives you, and it is worth stating in full.

In plain terms: your treatment records here cannot be used to investigate or prosecute you, and cannot be used against you in a lawsuit, a licensing action, or a legislative proceeding, unless you specifically consent in writing or a court issues a qualifying order after you have had a chance to object. A consent for use in a legal proceeding cannot be bundled with any other consent — it must stand alone.

This protection follows the records. Even when another provider or health plan lawfully receives your Part 2 records from us, they still cannot be used against you in a proceeding without your specific consent or a court order.

7. Redisclosure by others

If you give a broad consent allowing us to share your records with another HIPAA covered entity or its business associate for treatment, payment, or health care operations, that recipient may share the records again as HIPAA permits, without asking you each time. The exception described in section 6 still applies: the records cannot be used against you in a legal proceeding.

More generally, information that is disclosed under this notice may be redisclosed by the person who receives it, and at that point it may no longer be protected by these rules. If you are asking us to send records somewhere, and you are unsure what the recipient will do with them, ask us before you sign.

8. Fundraising and marketing

We do not use your information to contact you for fundraising, and we do not use it for marketing. If that ever changes, we will revise this notice first, and you would have the right to opt out of fundraising communications at the time you were contacted.

9. Your rights

You have the following rights regarding your health information. To exercise any of them, contact our Privacy Officer using the details in section 12. Most requests must be in writing, and we will give you the form.

Get a copy of your record

You may inspect and get a copy of your health information, in paper or electronic form. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies. In limited circumstances we may deny access, and if we do, you may ask for that denial to be reviewed.

Ask us to correct your record

If you believe information in your record is wrong or incomplete, you may ask us to amend it. We will respond within 60 days. If we deny the request, we will explain why in writing, and you may submit a statement of disagreement that becomes part of your record.

Ask for a restriction on how we use or share your information

You may ask us to limit how we use or disclose your information for treatment, payment, or health care operations. We do not have to agree, with one exception: if you pay for a service in full, out of pocket, and ask us not to tell your health plan about it, we must honor that request.

Ask us to communicate with you a certain way

You may ask us to contact you only at a particular phone number or address, or only by a particular method. We will accommodate reasonable requests, and we will not ask you why.

Get a list of who we shared your information with

You may request an accounting of disclosures we have made. For electronic records, you may request an accounting covering the past three years of disclosures for treatment, payment, and health care operations. For other disclosures, you may request an accounting covering the past six years, excluding certain categories such as disclosures you authorized. If an intermediary handled your records, you may also request a list of the disclosures it made in the past three years. The first accounting in any twelve-month period is free.

Get a paper or electronic copy of this notice

You may ask for a copy of this notice at any time, even if you agreed to receive it electronically. We will give you one promptly.

Discuss this notice with someone

You have the right to discuss this notice with our Privacy Officer. Contact details are in section 12.

Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian or personal representative, that person can exercise these rights on your behalf. We will confirm the person has that authority first.

Be notified if your information is breached

You have the right to be notified if there is a breach of your unsecured health information.

10. Our legal duties

We are required by law to maintain the privacy and security of your health information, to give you this notice of our legal duties and privacy practices, and to notify you following a breach of your unsecured information.

We are required to abide by the terms of the notice that is currently in effect.

We reserve the right to change this notice, and to make the changed notice apply to information we already have as well as to information we receive in the future. If we make a material change, we will post the revised notice on this page and at our office, and we will make copies available at the front desk. The revised notice will show a new effective date.

11. How to complain

If you believe your privacy rights have been violated, you may complain to us, to the U.S. Department of Health and Human Services, or to both. You may do both at the same time.

To complain to us, contact our Privacy Officer by phone at (747) 217-0070, by email at Info@eternityrecovery.com, or by mail at Eternity Recovery Center, Attn: Privacy Officer, 16946 Sherman Way, Suite 400, Van Nuys, CA 91406. Put your complaint in writing if you can, and describe what happened and when. We will look into it and respond.

To complain to the federal government, file with the HHS Office for Civil Rights. You can file online through the OCR complaint portal, call 1-800-368-1019 (TDD 1-800-537-7697), or write to Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201. Guidance on the process is on the HHS complaint page. A complaint must generally be filed within 180 days of when you knew the violation occurred.

You will not be retaliated against for filing a complaint. We will not deny you treatment, penalize you, or treat you differently in any way because you complained.

12. Contact, changes, and effective date

For questions about this notice, to exercise any of your rights, or to request a paper copy, contact:

This notice is effective August 4, 2026. It supersedes any earlier notice of privacy practices issued by Eternity Recovery Center.

Prepared to the requirements of 45 CFR 164.520 and 42 CFR 2.22. Note that 45 CFR 164.520(b)(1)(ii)(F), (G), and (H) — the notice provisions added by the 2024 reproductive health care privacy rule — were vacated nationwide on June 18, 2025 in Purl v. HHS, No. 2:24-cv-00228-Z (N.D. Tex.); the substance use disorder notice provisions were left in place and remain required, per the HHS fact sheet on that rule.

See also our website privacy policy, which covers information collected through this website rather than through treatment.