Privacy Policy

Effective Date: 6/24/2025

Last Updated: 6/24/2025

This Privacy Policy applies to all communications and information collected through our secure text messaging platform and related healthcare services. As a mental health provider, we are committed to protecting your protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws.

HIPAA Notice of Privacy Practices

This Policy serves as our HIPAA Notice of Privacy Practices for text messaging communications. By using our text messaging platform, you acknowledge that you have received and understand this notice and consent to the collection, use, and disclosure of your PHI as described herein.

What Health Information We Collect

Patient Communications: When you use our text messaging platform, we collect and store:

• All text messages sent between you and our clinical staff
• Appointment scheduling requests and confirmations
• Treatment-related questions and responses
• Crisis or urgent care communications
• Payment and insurance-related inquiries

Technical Information: Our secure platform automatically collects:

• Message delivery timestamps and read receipts
• Device information and phone numbers
• Technical logs for security and audit purposes
• Platform usage analytics (de-identified)

Clinical Documentation: Healthcare staff may document:

• Relevant portions of text conversations in your medical record
• Clinical observations based on communications
• Treatment plan updates resulting from text interactions

How We Use Your Health Information

We use your PHI collected through text messaging for:

Treatment: Providing direct patient care, consultation between providers, and coordinating your mental health treatment

Payment: Processing insurance claims, billing inquiries, and payment arrangements discussed via text

Healthcare Operations: Quality improvement, staff training, compliance monitoring, and platform security

Emergency Situations: Responding to crisis communications and coordinating emergency interventions when necessary

Text Messaging Security and Encryption

Opt in: By opting in to receive SMS messages from Meridian Behavioral Health you agree to receive
text messages regarding Meridian Behavioral Health Services.
Data Rates and Frequency: Standard message and data rates may apply. Message
frequency may vary. 
Opt out: You can opt out at any time by replying STOP or calling us at 502-409-6993 to request mobile opt out. 
Help: For help please reply HELP or reach out to us at 502-409-6993.
Consent: Mobile opt in data or consent will not be shared with third parties for marketing
or promotional purposes. 
We respect your privacy, you can view our full privacy policy here Privacy Policy.

Technical Safeguards:

• All messages are encrypted in transit using industry-standard TLS encryption
• Messages are encrypted at rest on HIPAA-compliant servers
• Access is restricted through multi-factor authentication
• Automatic session timeouts and device locking requirements

Administrative Safeguards:

• Only authorized clinical staff have access to patient communications
• All access is logged and regularly audited
• Staff receive ongoing HIPAA and security training
• Incident response procedures for potential breaches

Important Limitations of Text Messaging

Emergency Communications: DO NOT use text messaging for:

• Mental health emergencies or suicidal thoughts
• Requests for urgent psychiatric medications
• Situations requiring immediate clinical intervention

For emergencies, call 911 or go to your nearest emergency room.

Clinical Limitations: Text messaging is not appropriate for:

• Detailed therapy sessions or complex clinical discussions
• Sharing sensitive documents or detailed medical history
• Discussing highly confidential matters better suited for secure phone or in-person visits

Data Retention and Deletion

Message Retention: Text communications are retained for seven (7) years from the last date of service, in compliance with state record retention requirements.

Automatic Deletion: Messages are automatically purged from our systems after the retention period expires.

Patient Requests: You may request copies of your text communications or earlier deletion, subject to legal and clinical requirements.

Your HIPAA Rights

You have the right to:

Access: Request copies of your text message communications and related PHI.

Amendment: Request corrections to inaccurate information in your communications.

Restriction: Request limitations on how we use or disclose your text communications.

Alternative Communication: Request to receive communications through alternative methods.

Accounting: Receive an accounting of disclosures of your PHI for purposes other than treatment, payment, or operations.

Complaint: File complaints about our privacy practices with us or any appropriate governmental agency.

Consent for Electronic Communications

By using our text messaging platform, you provide informed consent for:

• Electronic transmission of your PHI via secure text messaging
• Storage of communications on HIPAA-compliant servers
• Access by authorized clinical staff for treatment purposes
• Documentation of relevant communications in your medical record

Withdrawal of Consent: You may withdraw consent for text messaging at any time by contacting our Privacy Officer. Withdrawal will not affect previously sent communications.

Business Associate Agreements

Our text messaging platform is provided by Broadvoice, a HIPAA-compliant business associate. We maintain a signed business associate agreement ensuring they:

• Implement appropriate safeguards for your PHI.
• Use information only as permitted by our agreement.
• Report any security incidents or breaches immediately.
• Return or destroy PHI when the relationship ends.

Disclosures of Your Health Information

We may disclose your text communications without authorization when:

Required by Law: Court orders, subpoenas, or regulatory investigations.

Public Health and Safety: Reporting suspected abuse, communicable diseases, or threats of violence.

Treatment Coordination: Sharing with other healthcare providers involved in your care (with appropriate consents).

Business Operations: Limited sharing with our business associates under signed agreements.

State Privacy Law Compliance

In addition to HIPAA, we comply with Kentucky, Arizona, and Washington mental health privacy laws, including:

• Enhanced protections for psychotherapy notes.
• Specific consent requirements for mental health communications.
• Mandated reporting obligations for mental health providers.
• Patient rights under state mental health codes.

Data Security Measures

Physical Safeguards:

• Secure data centers with restricted access.
• Encrypted backup systems.
• Secure disposal of electronic media.

Network Security:

• Firewall protection and intrusion detection.
• Regular security assessments and penetration testing.
• Secure network architecture with access controls.

Workforce Training:

• Regular HIPAA and security training for all staff.
• Background checks for personnel with PHI access.
• Confidentiality agreements and sanctions policy.

Breach Notification

In the event of a security breach affecting your PHI:

• We will investigate and contain the incident immediately.
• You will be notified within 60 days if required by law.
• We will provide details about the breach and steps being taken.
• We will notify appropriate regulatory authorities as required.

Minimum Necessary Standard

We limit access to and use of your text communications to the minimum necessary to accomplish the intended purpose, whether for treatment, payment, or healthcare operations.

Contact Information and Complaints

Privacy Officer:

Seanne Hartweck, 502-409-6993 ext 114

Policy Updates

We reserve the right to change this Privacy Policy. Material changes will be:

• Posted prominently in our office and on our website
• Communicated via secure text message to active platform users
• Available upon request at any time

Current Version: This Policy is effective as of the date listed above and supersedes all previous versions.

---

Patient Acknowledgment: By using our text messaging platform, you acknowledge that you have received, read, and understand this Privacy Policy and consent to the practices described herein.