HIPAA Notice of Privacy Practices
Last updated: February 1, 2026
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Our Duties
Rimal Health is required by law to maintain the privacy of protected health information (PHI), provide you with notice of our legal duties and privacy practices, and notify you in the event of a breach of your unsecured PHI. We are required to follow the terms of the notice currently in effect.
How We May Use and Disclose Your PHI
Treatment
We may use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, we may share your information with your pharmacy to fill a prescription.
Payment
We may use your PHI to bill and collect payment for services. Note: We do not bill insurance for our $50/month service fee; however, your pharmacy may bill insurance for medications.
Healthcare Operations
We may use your PHI for internal operations such as quality improvement, training, and business management, consistent with HIPAA requirements.
Required by Law
We will disclose your PHI when required to do so by federal, state, or local law, such as mandatory reporting requirements.
Uses and Disclosures Requiring Authorization
We will obtain your written authorization before using or disclosing your PHI for purposes not described above, including:
- Marketing communications
- Sale of your PHI
- Most uses of psychotherapy notes
- Substance use disorder treatment records (42 CFR Part 2)
You may revoke an authorization at any time in writing.
Special Protections for Substance Use Disorder Records (42 CFR Part 2)
Rimal Health is a substance use disorder (SUD) treatment program. As such, your treatment records are protected by federal confidentiality regulations at 42 CFR Part 2, in addition to the HIPAA Privacy Rule. These regulations provide heightened protections for your SUD treatment records.
How 42 CFR Part 2 Protects Your Records
- Consent Required for Most Disclosures: Generally, Rimal Health cannot disclose your SUD treatment records without your specific written consent, except in limited circumstances such as a medical emergency, to qualified personnel for audit or evaluation purposes, or as required by a court order that meets the requirements of 42 CFR Part 2.
- Single Consent for Treatment, Payment, and Operations: With your written consent, Rimal Health may use and disclose your SUD treatment records for treatment, payment, and health care operations (TPO). This consent covers future disclosures for these purposes and remains in effect until you revoke it or your treatment relationship ends.
- Protection in Legal Proceedings: Your SUD treatment records cannot be used in any civil, criminal, administrative, or legislative proceeding against you unless you provide specific written consent or a court issues an order meeting the requirements of 42 CFR Part 2 (Subpart E). This protection applies even if your records are subpoenaed.
- Redisclosure Limitations: When your records are disclosed with your consent, recipients are notified that the records are protected by 42 CFR Part 2 and that unauthorized redisclosure is prohibited. However, once records are disclosed pursuant to your TPO consent, recipients who are HIPAA covered entities or business associates may further use and disclose the records in accordance with HIPAA regulations.
Your Rights Under 42 CFR Part 2
- Right to Revoke Consent: You may revoke your consent to use and disclose your SUD treatment records at any time by submitting a written request to support@rimalhealth.com. Revocation is not effective for disclosures already made in reliance on your consent. Please note that revoking consent may affect our ability to continue providing treatment.
- Right to an Accounting of Disclosures: You have the right to receive a list of disclosures of your SUD treatment records made with your written consent for up to three (3) years prior to your request. To request an accounting, contact us at support@rimalhealth.com.
- Right to Request Restrictions: You may request that Rimal Health restrict certain uses or disclosures of your SUD treatment records. We are not required to agree to all restrictions, but we will consider your request and notify you of our decision. To request a restriction, contact us at support@rimalhealth.com.
Complaints
If you believe your rights under 42 CFR Part 2 have been violated, you may file a complaint with:
- Rimal Health at support@rimalhealth.com
- The U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint
We will not retaliate against you for filing a complaint.
Your Rights
Right to Access
You have the right to inspect and obtain a copy of your PHI maintained in our records. Requests may be submitted in writing to support@rimalhealth.com.
Right to Amend
You may request that we amend PHI you believe is incorrect or incomplete. We may deny the request if the information was not created by us or is accurate and complete.
Right to an Accounting of Disclosures
You may request a list of disclosures of your PHI. For general health information, this covers disclosures made in the past six years for purposes other than treatment, payment, or operations. For substance use disorder treatment records protected by 42 CFR Part 2, you may request an accounting of disclosures made with your written consent for up to three years prior to your request, including disclosures for treatment, payment, and operations.
Right to Request Restrictions
You may request restrictions on how we use or disclose your PHI. We are not required to agree, but will notify you of our decision.
Right to Confidential Communications
You may request that we communicate with you about your PHI by alternative means or at alternative locations (e.g., contact you only by email).
Right to a Paper Copy of This Notice
You may request a paper copy at any time, even if you previously agreed to receive it electronically.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us at support@rimalhealth.com or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.
Contact Our Privacy Officer
Privacy Officer, Rimal Healthsupport@rimalhealth.com