Elk Ridge Recovery
Privacy Policy
Website Privacy Policy and Notice of Privacy Practices
Effective date: October 20, 2026
Elk Ridge Recovery respects the privacy of people who visit our website, contact us, and receive our services. This policy explains our website information practices. The Notice of Privacy Practices that follows explains how we handle protected health information, including substance use disorder treatment records, and describes your rights.
Visiting our website, submitting an inquiry, or acknowledging receipt of this notice does not waive your privacy rights or give us permission to use or disclose health information when a separate authorization or consent is required.
1. Information we collect
We collect information you choose to provide when you contact us, request a callback, ask about services, or submit an insurance inquiry. This may include your name, contact information, insurance details, and the information in your message. Information collected during admission or treatment may also include medical history, assessments, care records, and payment information.
Our website may collect technical information such as IP address, browser and device information, referring pages, pages visited, and the date and time of a visit through server logs, cookies, and similar tools. Some information collected online may qualify as protected health information depending on the circumstances; its protections do not depend solely on whether you are already a patient.
2. How we use information
We use information to respond to requests, coordinate admissions and care, verify benefits when requested, communicate with you, operate and secure our website, prevent misuse, and meet legal obligations. Any use of protected health information is subject to the Notice of Privacy Practices and applicable law.
We do not sell personal information or share it with third parties for their own marketing. We do not disclose protected health information to advertising platforms without a valid legal basis and any required authorization or consent.
3. Service providers and other disclosures
We may use service providers for functions such as website hosting, communications, records management, and billing. We limit their access to information needed for authorized services and require confidentiality and safeguards appropriate to their role, including business associate or other agreements when required by law. A vendor relationship does not by itself authorize disclosure of protected health information.
We may disclose information with your permission or when applicable law permits or requires it. Requests from courts, law enforcement, or other third parties are reviewed for legal authority. A subpoena alone does not override the additional protections for substance use disorder records described below.
Website privacy practices continued
4. Cookies, analytics, and tracking
Cookies are small files stored on your device. Website tools may help maintain functionality, protect against abuse, and understand website use. Browser settings can limit or delete cookies, although some features may be affected. Disabling cookies does not necessarily stop server logging or every type of tracking.
We may use website analytics, security, call-tracking, and advertising measurement tools to understand website performance, protect the site, and identify how people find or contact us. We do not use protected health information for targeted advertising or cross-context behavioral advertising. We do not intentionally configure these tools to receive the contents of intake or contact forms, diagnoses, medications, symptoms, reasons for seeking treatment, insurance information, or other protected health information for advertising purposes. We review our website tools and configurations to limit the collection and disclosure of protected health information, and when a vendor handles protected health information on our behalf, we require an appropriate agreement when required by law.
A cookie preference or continued website use is not a substitute for a HIPAA authorization or Part 2 consent. We apply the health information protections described in this notice to information that qualifies for those protections.
5. Email, phone, and text communications
Please use general contact forms and ordinary email for basic inquiries, and avoid sending detailed medical records or other sensitive information through those channels. Contact us to arrange an appropriate way to provide health information. Ordinary email and text messages can carry privacy risks. Tell us if you need an alternative contact method or restrictions on voicemail messages.
Where you have agreed to receive text messages, we use your number for the purposes disclosed when you enrolled. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for assistance. Mobile opt-in information and text message consent are not shared with third parties or affiliates for marketing or promotional purposes. Service providers may process this information only to support authorized messaging services.
You may opt out of promotional email using its unsubscribe link or by contacting us. Communication preferences do not eliminate communications we are legally required to provide or records we are legally required to retain. The website is not an emergency service.
6. Security and retention
We use administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or loss. We limit access according to job responsibilities. No system can guarantee absolute security; this does not reduce our legal responsibilities or your rights.
We retain information for the periods needed to provide services and meet applicable recordkeeping, legal, and operational requirements, and securely dispose of it when no longer needed. A request to delete website information does not necessarily require deletion of medical records that must be retained.
7. Your choices, outside links, and updates
Contact our privacy contact below to request access to, correction of, or deletion of website information, or to ask about applicable privacy rights. We may verify your identity and will explain any legal limits. Patient record rights are described in the next section. External websites have their own privacy practices. This website is directed to adults; contact us if a child has submitted information so we can respond as required by law.
We will post material changes and the updated effective date here and provide additional notice or obtain consent when required. Changes cannot retroactively authorize a use or disclosure prohibited by law.
Notice of Privacy Practices of Elk Ridge Recovery
Effective date: October 20, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice describes:
• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH STACIE JENSEN, CCA, RHIT, PRIVACY CONTACT (HUMAN RESOURCES), AT 801-879-9671 OR [email protected] IF YOU HAVE ANY QUESTIONS.
Who and what this notice covers
This notice applies to Elk Ridge Recovery and its workforce in providing our services. Protected health information (PHI) includes identifiable information about your health, care, or payment for care, whether spoken, written, or electronic. Federal law also protects records identifying a person as having applied for or received substance use disorder services from a program subject to 42 CFR Part 2 (“Part 2 records”).
We follow HIPAA and, where applicable, Part 2 and other federal and state privacy laws. When a law provides greater protection, we follow the more protective requirement. The special Part 2 rules below limit the general HIPAA permissions described in this notice.
Our responsibilities
We are required by law to maintain the privacy of your protected records, provide this notice, follow the notice currently in effect, and notify affected individuals following a breach of unsecured protected information as required by law. We use safeguards to protect records and limit uses, disclosures, and requests to the minimum necessary when that rule applies.
Treatment, payment, and health care operations
HIPAA generally permits use and disclosure of PHI for the following purposes. For Part 2 records, we first obtain the required written consent unless a specific Part 2 exception applies:
Treatment: We use information to assess your needs, plan care, and coordinate with professionals treating you. For example, we may share medication information with a treating clinician to support safe care.
Payment: We use information to verify coverage, obtain authorization, submit claims, and collect payment. For example, we may provide a health plan with information needed to process a claim.
Operations: We use information to manage services, review quality, train personnel, and perform appropriate administrative functions. For example, authorized staff may review records to evaluate care. Contractors handling protected records must meet applicable confidentiality requirements.
Consent and substance use treatment records
Your consent and authorization choices
You may give one written consent for all future uses and disclosures of your Part 2 records for treatment, payment, and health care operations. You may also discuss a more limited consent with us. For example, you may authorize disclosure to a particular clinician. A general treatment consent is not permission to release your records for every purpose.
When Part 2 records are disclosed under your treatment, payment, and operations consent to a HIPAA covered entity or business associate, that recipient may redisclose them as HIPAA permits, subject to the restrictions on proceedings against you described below.
We obtain written authorization or consent for uses and disclosures not described in this notice or otherwise permitted by law. Most uses and disclosures of separately maintained psychotherapy notes and substance use disorder counseling notes require specific written permission, subject to limited legal exceptions. A general Part 2 treatment, payment, and operations consent does not authorize disclosure of separately maintained SUD counseling notes.
We do not sell your PHI. Marketing uses or disclosures requiring authorization will occur only with your written authorization. If we conduct fundraising using protected records, we will first provide any required clear opportunity to opt out; you can decline future fundraising contacts without affecting care or payment.
You may revoke written authorization or consent by contacting our privacy contact in writing, except to the extent we have already acted in reliance on it. A special consent for disclosures to criminal justice officials who referred you for treatment may have a limited revocation period allowed by 42 CFR 2.35; any such condition will be explained in that consent. Court-referred treatment does not eliminate your privacy rights.
Family, representatives, and referrals
You may identify family members or others involved in your care or payment with whom you want us to communicate. For information governed only by HIPAA, we may share relevant information with your agreement or opportunity to object, or in limited circumstances based on professional judgment when you cannot express a choice. We will obtain written Part 2 consent when required before sharing SUD records, including confirmation that you are a patient. A referral from an employer, family member, or other organization does not automatically entitle that person to treatment updates.
Investigations and legal proceedings
Part 2 records, and testimony describing their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a qualifying Part 2 court order. Consent for proceedings must be separate from consent for other purposes.
Before disclosure under a court order, you or the record holder must receive notice and an opportunity to be heard when required by law. An authorizing court order must also be accompanied by a subpoena or similar legal mandate compelling disclosure. A subpoena alone is insufficient. Different procedures may apply to investigations of our program; applicable Part 2 safeguards still apply.
Other permitted or required disclosures
Limited Part 2 exceptions without written consent
We may use or disclose Part 2 records without your written consent only within a specific legal exception and its conditions. These exceptions include:
Internal communications and qualified service organizations: Necessary communications among personnel within our program, or with an entity having direct administrative control, for duties connected with SUD services; and services provided by qualified service organizations under required agreements.
Medical emergencies: Information needed by medical personnel to address a bona fide medical emergency when prior consent cannot be obtained. Limited disclosures may also help the Food and Drug Administration notify patients or clinicians of a dangerous product.
Public health: Information disclosed to public health authorities under the Part 2 public health exception must be de-identified under HIPAA standards.
Research, audits, and evaluations: Disclosures may be made for qualifying scientific research or authorized audits and program evaluations, subject to legal eligibility, safeguards, agreements, and restrictions on further use. These exceptions do not give unrestricted access to records or permit reports identifying patients to be publicly released.
Child abuse or neglect: We may make a report required by state law. That reporting exception does not authorize unrestricted access to the underlying treatment records.
Crimes on premises or against personnel: We may disclose limited information about a crime or threat of crime committed by a patient on program premises or against program personnel, as Part 2 permits.
Cause of death: We may disclose identifying information about a deceased patient as permitted by laws governing collection of vital statistics or cause-of-death inquiries.
Court orders and oversight: We may disclose records under qualifying Part 2 court orders and accompanying legal process, or to authorities as Part 2 permits for compliance oversight. The restrictions on proceedings against you continue to apply.
Other HIPAA permissions
For PHI not subject to Part 2 or other stricter restrictions, HIPAA may permit or require disclosures for public health reporting, product safety, abuse or neglect reporting, health oversight, approved research, organ or tissue donation, coroners or funeral directors, workers’ compensation, and certain law enforcement or government functions. We may also disclose information to avert a serious and imminent threat when legally permitted, respond to qualifying judicial processes, and cooperate with HHS privacy investigations. Each disclosure must satisfy the applicable legal conditions.
These general HIPAA permissions do not independently authorize disclosure of Part 2 records. We review the applicable restrictions before responding and do not treat a general request for records as sufficient permission.
Your rights and how to exercise them
Contact the privacy contact below for help exercising these rights. We may ask you to submit a request in writing and verify your identity. A legally authorized personal representative may act for you after we verify their authority and any applicable limitations.
Access and correction
You may ask to inspect or obtain an electronic or paper copy of records available under HIPAA. We generally respond within 30 days, subject to a permitted extension or a shorter applicable deadline. We may charge only fees allowed by law. If access is denied, we will explain why and describe any available review rights.
You may request amendment of information you believe is incorrect or incomplete. We generally respond within 60 days, subject to a permitted extension or a shorter applicable deadline. If we deny the request, we will explain our reasons and your right to submit a statement of disagreement.
Confidential communications and restrictions
You may request a different contact method or mailing address. We will accommodate reasonable requests. You may also request limits on information used or disclosed for treatment, payment, and operations, including disclosures covered by a prior Part 2 consent. We generally do not have to agree, but will honor an agreed restriction except as the law permits, such as for emergency treatment.
If you or someone other than your health plan pays for an item or service in full, you may require us not to disclose information solely about that item or service to your health plan for payment or health care operations, unless disclosure is required by law. Please tell us before we submit a claim.
Accounting and lists of disclosures
You may request an accounting of disclosures covered by HIPAA for up to six years before your request. Exceptions include many treatment, payment, operations, and authorized disclosures. One accounting in a 12-month period is free; we will tell you in advance about any permitted charge for additional requests.
For disclosures of Part 2 records through an intermediary covered by 42 CFR 2.24, you may request from that intermediary a list identifying recipients for the preceding three years. Ask us for help identifying the intermediary. Additional Part 2 accounting rights apply according to their regulatory compliance dates; we will explain which requirements apply when you make your request.
Copies, questions, and complaints
You may request a paper or electronic copy of this notice, including a paper copy after agreeing to electronic delivery. You may discuss the notice with our privacy contact and choose not to receive fundraising communications.
If you believe your rights have been violated, submit a complaint by phone, email, or mail to our privacy contact. You may also file a HIPAA or Part 2 complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/hipaa/filing-a-complaint/index.html, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201. We will not retaliate against you for making a complaint.
Contact information and notice changes
Privacy contact
Elk Ridge Recovery
Privacy Contact: Stacie Jensen, CCA, RHIT (Human Resources)
2601 Jasper Road
Great Falls, MT 59404
Phone: 801-879-9671
Email: [email protected]
Website: https://elkridgerecovery.com
Please request a secure method before sending detailed medical information or records with your question or complaint.
Changes to this notice
We reserve the right to change our privacy practices and this notice as permitted by law and to apply the revised notice to records we already maintain as well as records created in the future. We will not implement a material change before the revised notice takes effect unless the law requires it. The updated notice will show its effective date and will be available on our website, at our facility, and upon request.
We provide this notice at the time required by law, including at first service or admission, subject to applicable emergency or incapacity exceptions. When required, we seek written acknowledgment of receipt. Acknowledgment confirms receipt only; it is not consent to use or disclose your information.
Additional state protections
We comply with applicable Montana health information confidentiality requirements and other laws that provide stronger protection than HIPAA. Where additional permission is required for a particular category of information, we obtain it before disclosure.