Notice of Privacy Practices

Last Updated & Effective Date: September 8, 2026

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Westside Behavioral Care, Inc. (“Westside,” “WBC,” “we,” “us,” or “our”) with respect to protected health information that WBC maintains in its capacity as a healthcare organization subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

WBC provides administrative services that help individuals find behavioral healthcare providers, arrange initial appointments, and support insurance billing and related healthcare operations.

Therapists, prescribers, and other healthcare professionals associated with WBC operate independently in their own private practices or independent groups. They exercise their own clinical judgment and generally maintain their own clinical treatment records. Those Independent Providers may have their own Notices of Privacy Practices and other privacy policies that govern the clinical information they maintain.

This Notice describes WBC’s practices concerning protected health information maintained by WBC. It does not replace an Independent Provider’s Notice of Privacy Practices.

The Health Information WBC Maintains

WBC generally maintains only the information reasonably necessary to perform its administrative, scheduling, insurance, billing, compliance, and related healthcare functions.

Depending on the services involved, this information may include:
– Your name and contact information
– Date of birth or other identifying information
– Appointment and scheduling information
– Insurance plan, member, or eligibility information
– Provider information
– Diagnoses or diagnosis codes when required for billing
– Procedure or billing codes
– Claims, payment, adjustment, and remittance information
– Referral or authorization information
– Communications concerning scheduling, insurance, billing, or administrative matters
– Other information necessary to complete healthcare administrative functions

WBC does not ordinarily create or maintain the psychotherapy notes, detailed treatment plans, prescribing records, or complete clinical treatment records maintained by your Independent Provider.

In limited circumstances, WBC may receive or temporarily maintain clinical records or portions of clinical records. For example, an insurer or other payer may require records as part of a claims review, audit, utilization review, regulatory process, or other permitted healthcare activity. When appropriate, providers may submit those records directly to the requesting organization. In other cases, WBC may assist with gathering and securely transmitting the records.

When WBC receives clinical information for these purposes, we protect that information according to applicable privacy and security requirements and limit its use to the purpose for which it was received or another use permitted or required by law.

Your Rights

You have rights concerning protected health information that WBC maintains about you.

The exact information available from WBC may be different from the clinical record maintained by your Independent Provider. If your request concerns psychotherapy notes, detailed treatment documentation, prescribing records, or another part of your provider’s clinical record that WBC does not maintain, we may direct you to the applicable Independent Provider.

Get an Electronic or Paper Copy of Your Health Information
You may ask to inspect or receive an electronic or paper copy of protected health information about you that WBC maintains in a designated record set and to which you have a right of access.

We generally will provide the information within 30 days of receiving your request. If additional time is permitted and needed, we will notify you as required by law.

We may charge a reasonable, cost-based fee when permitted by law.

Certain information is excluded from the HIPAA right of access, including psychotherapy notes and some information prepared for legal proceedings.

Ask Us to Correct Your Health Information
You may ask WBC to amend information about you that you believe is incorrect or incomplete.

We may deny an amendment request in circumstances permitted by law, including when WBC did not create the information and the person or organization that created it remains available to address the request.

If we deny your request, we will explain the decision in writing and describe any rights you have to submit a statement of disagreement.

We generally will act on an amendment request within 60 days, subject to extensions permitted by law.

If the information you want corrected is part of an Independent Provider’s clinical record rather than a record maintained by WBC, you should submit the request directly to that provider.

Request Confidential Communications
You may ask us to contact you in a particular way or at a particular location.

For example, you may ask us to use a particular telephone number, email address, or mailing address when communicating with you.

We will accommodate reasonable requests as required by law.

Please tell us clearly if there is a communication method that could create a privacy or safety concern for you.

Ask Us to Limit What We Use or Share
You may ask WBC to restrict certain uses or disclosures of protected health information for treatment, payment, healthcare operations, or communications with people involved in your care or payment for care.

We are not generally required to agree to every requested restriction. If we agree to a restriction, we will follow it except where disclosure is permitted or required despite the restriction.

If you pay in full out of pocket for a healthcare service and ask that information about that service not be disclosed to your health plan for payment or healthcare operations, the applicable covered healthcare provider must honor that restriction unless disclosure is required by law.

Because clinical services are provided by Independent Providers, you should also communicate any requested restriction concerning the provider’s records directly to that provider.

Get an Accounting of Certain Disclosures
You may ask WBC for a list of certain disclosures of your protected health information made during the six years before your request.

An accounting does not include every disclosure. For example, HIPAA generally excludes disclosures for treatment, payment, and healthcare operations and certain disclosures you authorized or requested.

We will provide one accounting during a 12-month period without charge. We may charge a reasonable, cost-based fee for additional accountings during the same period after informing you of the cost.

Get a Copy of This Notice
You may request a paper copy of this Notice at any time, even if you received or viewed it electronically.

A current copy is also available on WBC’s website.

Choose Someone to Act for You
If another person has legal authority to act as your personal representative, such as through a valid healthcare power of attorney, guardianship, or other authority recognized by applicable law, that person may exercise appropriate privacy rights on your behalf.

We may verify the person’s identity and authority before acting on a request.

Special rules may apply to parents, guardians, and minors, including circumstances in which a minor has privacy rights concerning particular healthcare information.

File a Complaint
You may contact WBC if you believe your privacy rights have been violated or if you have a concern about our handling of protected health information. Contact:

ATTN: HIPAA Privacy Contact
Westside Behavioral Care, Inc.
PO Box 461570
Aurora, CO 80046-1570
303-986-4197
info@westsidebehavioralcare.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
1-877-696-6775

Information about filing a complaint is available through the HHS Office for Civil Rights.

WBC will not retaliate against you for exercising a privacy right or filing a complaint.

HHS requires an NPP to explain the individual’s complaint rights, identify an appropriate privacy contact, and state that retaliation is prohibited.

Your Choices About Certain Uses and Disclosures

For some uses and disclosures of protected health information, you have a choice about whether information may be shared.

People Involved in Your Care or Payment for Care
Where permitted by law, WBC may share information directly relevant to a person’s involvement in your healthcare or payment for healthcare if you agree, do not object when given the opportunity, or the circumstances otherwise permit the disclosure.

This may include a family member, caregiver, or other person you identify.

If you are unable to express your preference, we may make a disclosure when permitted by law and when, using professional judgment where applicable, the disclosure is believed to be in your best interest.

Because WBC does not direct clinical care, questions about sharing clinical treatment information with family members or others should generally also be addressed with your Independent Provider.

Disaster Relief and Safety Situations
Where permitted by law, information may be shared with an organization assisting in disaster-relief activities or when necessary to prevent or reduce a serious and imminent threat to health or safety.

Applicable federal and Colorado confidentiality requirements may place additional limits on disclosure of behavioral health information.

Marketing
HIPAA requires written authorization for many uses and disclosures of protected health information for marketing.

WBC does not use protected health information to create behavioral advertising profiles or to market unrelated products or services to patients.

If a proposed marketing use requires your authorization, we will obtain it before using or disclosing your protected health information for that purpose.

Sale of Protected Health Information
WBC does not sell protected health information.

If a transaction constituted a sale of protected health information requiring authorization under HIPAA, WBC would obtain the required written authorization before the disclosure.

Psychotherapy Notes
WBC does not ordinarily create or maintain psychotherapy notes.

Psychotherapy notes receive special protection under HIPAA, and most uses or disclosures of psychotherapy notes require the individual’s written authorization unless a specific legal exception applies. Your Independent Provider generally controls and maintains those notes.

Fundraising
WBC does not currently use protected health information for fundraising activities.

HIPAA permits covered entities to use and disclose protected health information for a number of purposes without obtaining a separate authorization each time.

WBC limits its use of protected health information to the functions it performs and applies the minimum-necessary standard where required.

Treatment and Care Coordination
We may use or disclose protected health information to help connect you with an Independent Provider, coordinate an initial appointment, facilitate referrals, or communicate information needed by healthcare professionals involved in your care.

For example, WBC may provide an Independent Provider with the information necessary to identify you and understand the appointment you requested.

The Independent Provider remains responsible for clinical decisions and treatment.

Payment and Insurance Activities
WBC may use and disclose protected health information to obtain payment for healthcare services and perform related insurance functions.

For example, we may:
– Verify insurance eligibility or benefits
– Submit electronic claims
– Include the rendering provider’s NPI and other required information on claims
– Submit diagnosis and procedure codes
– Respond to payment questions
– Process remittance or adjustment information
– Seek authorization when applicable
– Communicate with an insurer about a claim
– Respond to a payer’s claim review or audit
– Obtain documentation reasonably necessary to support payment

WBC contracts with billing professionals and other organizations that may receive protected health information in performing these functions. Where HIPAA requires it, those parties operate under Business Associate Agreements or other legally required privacy protections.

Healthcare Operations
We may use or disclose protected health information to conduct appropriate healthcare operations.

These activities may include:
– Billing and claims administration
– Provider credentialing and payer administration
– Compliance and regulatory activities
– Quality assessment
– Fraud, waste, and abuse prevention
– Internal auditing
– Responding to payer audits
– Legal and risk-management activities
– Information security
– Business planning and administration
– Reviewing the performance of contractors and service providers
– Training personnel whose functions require access to protected health information

Access is limited according to the person’s job responsibilities and the purpose for which the information is needed.

Business Associates and Contractors
WBC uses outside organizations and contractors to perform certain services involving protected health information, such as billing, secure communications, technology, legal, compliance, and related administrative functions.

When HIPAA requires a Business Associate Agreement, WBC requires the business associate to appropriately safeguard protected health information and use or disclose it only as permitted by the agreement and applicable law.

WBC also enters into Business Associate Agreements where WBC performs functions involving protected health information on behalf of another HIPAA-regulated party.

Other Uses and Disclosures Permitted or Required by Law

HIPAA and other laws permit or require protected health information to be used or disclosed in certain circumstances outside ordinary treatment, payment, and healthcare operations.

WBC will make these disclosures only when the requirements of applicable law are satisfied.

Public Health and Safety
We may disclose protected health information for legally authorized public-health and safety activities, such as:
– Preventing or controlling disease
– Reporting adverse events or product problems when applicable
– Reporting abuse, neglect, or domestic violence when legally authorized or required
– Preventing or reducing a serious threat to health or safety

Behavioral health information may be subject to additional restrictions under Colorado or federal law.

Health Oversight
We may disclose protected health information to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensing activities, or government compliance reviews.

Complying With the Law
We will disclose protected health information when federal or state law requires us to do so.

We may also disclose information to the U.S. Department of Health and Human Services when HHS is investigating or evaluating our compliance with HIPAA.

Judicial and Administrative Proceedings
We may disclose protected health information in response to a court or administrative order or, under circumstances permitted by law, in response to a subpoena, discovery request, or other lawful process.

Behavioral health and psychotherapy information may receive protections beyond the general HIPAA standard. WBC will apply additional federal or Colorado requirements when they govern a requested disclosure.

Law Enforcement and Government Functions
We may disclose protected health information for law-enforcement purposes or special government functions when the disclosure is specifically permitted or required by law.

These situations may include legally authorized law-enforcement requests, correctional activities, national-security functions, military activities, or protective services.

Workers’ Compensation
We may use or disclose protected health information as authorized by and to the extent necessary to comply with workers’ compensation laws or similar programs.

Additional Colorado protections may apply to mental health records used in workers’ compensation matters.

Research
WBC does not ordinarily conduct research using patient protected health information.

If WBC participates in research involving protected health information in the future, information will be used or disclosed only with the authorization or other protections required by law.

Organ and Tissue Donation
Where applicable and permitted by law, protected health information may be shared with organ-procurement organizations or similar entities for purposes related to organ, eye, or tissue donation.

Medical Examiners, Coroners, and Funeral Directors
Protected health information may be disclosed to a coroner, medical examiner, or funeral director when permitted by law and necessary for the person’s authorized duties.

Behavioral Health Information and Colorado Law

Because WBC’s activities involve behavioral healthcare, some information may be protected by Colorado laws that impose requirements in addition to HIPAA.

When Colorado law provides greater privacy protection than HIPAA, WBC follows the more protective requirement where applicable.

For example, certain mental health treatment information, confidential communications, records concerning minors, and other sensitive healthcare information may require specific authorization or may be disclosed only under particular legal exceptions.

Nothing in this Notice is intended to reduce privacy or confidentiality rights provided by Colorado law.

Clinical questions concerning the confidentiality of information maintained in your Independent Provider’s treatment record should be directed to that provider.

Substance Use Disorder Records

WBC does not operate a federally assisted substance use disorder treatment program subject to 42 CFR Part 2.

Some Independent Providers may treat individuals with substance-use-related conditions. An Independent Provider’s treatment of such conditions does not by itself mean that WBC operates a Part 2 program.

However, if WBC receives or maintains a patient record that is protected by 42 CFR Part 2, additional federal confidentiality protections may apply.

To the extent WBC maintains Part 2-protected information, WBC will not use or disclose that information in a civil, criminal, administrative, or legislative investigation or proceeding against the patient unless permitted by applicable Part 2 requirements, such as with the patient’s written consent or an appropriate court order and subpoena.

HHS’s current February 2026 NPP model specifically requires HIPAA covered providers that maintain Part 2 records to address these additional protections.

Minors and Personal Representatives

Privacy rights concerning minors can differ depending on who consented to the healthcare, the type of service, applicable Colorado law, and other circumstances.

A parent or legal guardian will generally act as a minor’s personal representative when applicable law gives that person authority to make healthcare decisions for the minor.

There are circumstances in which a minor may have independent confidentiality rights or in which a parent or guardian may not be entitled to particular healthcare information.

WBC and Independent Providers will follow applicable federal and Colorado law when determining who may exercise privacy rights or receive information concerning a minor.

Because Independent Providers maintain their own clinical treatment records, questions about parental access to those records or confidentiality during treatment should be addressed directly with the provider.

HIPAA requires a covered entity to recognize an authorized personal representative subject to applicable state-law rules and exceptions.

Our Responsibilities

WBC is required by law to:
– Maintain the privacy and security of protected health information in its custody
– Use appropriate safeguards to protect that information
– Provide individuals with this Notice describing our legal duties and privacy practices
– Follow the privacy practices described in the Notice currently in effect
– Provide individuals with rights concerning protected health information as required by law
– Notify affected individuals when a breach of unsecured protected health information requires notification under applicable law
– Limit uses and disclosures to the minimum necessary when that requirement applies
– Maintain appropriate agreements with business associates
– Train workforce members concerning applicable privacy requirements
– Maintain appropriate privacy policies and procedures
– Refrain from retaliating against a person who exercises a privacy right or files a complaint

We will not use or disclose protected health information other than as described in this Notice or otherwise permitted or required by law.

For uses or disclosures requiring your written authorization, we will obtain that authorization before proceeding. You may revoke an authorization in writing, except to the extent that action has already been taken in reliance on it or another legal exception applies.

Privacy and Security of Electronic Information

WBC uses administrative, physical, and technical safeguards designed to protect electronic protected health information.

Depending on the function involved, WBC uses systems and service providers intended for healthcare-related communications, insurance billing, scheduling, secure transmission, and related operations.

Access to protected health information is limited to people who require access to perform authorized functions.

Independent Providers generally maintain their own electronic health records and telehealth systems. WBC does not control the security configuration or recordkeeping practices of systems independently selected and operated by those providers.

When WBC makes a HIPAA-appropriate telehealth technology option available to a provider, WBC’s role is limited to providing or supporting the technology. WBC does not routinely access or monitor clinical telehealth sessions. Authorized access may occur when reasonably necessary to provide requested technical support, investigate a technical or security issue, or comply with applicable law.

Website Information

Not all information collected through westsidebehavioralcare.com is necessarily protected health information under HIPAA.

WBC’s separate Privacy Policy explains how information collected through the Website is handled, including Website forms, technical information, analytics, cookies, and privacy rights under other laws.

Our Cookie Policy describes the Website’s limited use of cookies and similar technologies.

When information collected through the Website becomes protected health information subject to HIPAA, WBC handles that information according to applicable HIPAA requirements as well as other applicable law.

Changes to This Notice

WBC may change the terms of this Notice and its privacy practices as permitted by law.

Changes may apply to protected health information WBC already maintains as well as information received after the change takes effect.

When this Notice is materially revised, the updated Notice will be available on WBC’s Website and upon request.

WBC is required to follow the Notice currently in effect. HHS requires covered entities to revise their notices when material privacy practices change and to make the current notice prominently available on a website describing their services.

Questions or Privacy Requests

For questions about this Notice, requests concerning protected health information WBC maintains, or complaints about WBC’s privacy practices, contact:

HIPAA Privacy Contact
Westside Behavioral Care, Inc.
PO Box 461570
Aurora, CO 80046-1570
303-986-4197
info@westsidebehavioralcare.com

If your request concerns your Independent Provider’s clinical treatment record, psychotherapy notes, treatment plan, medication record, or other clinical documentation that WBC does not maintain, please contact the Independent Provider directly.