Effective Date: February 1, 2026
Notice of Privacy Practices of CompDrug
This notice describes:
• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH COMPDRUG AT (614) 224-4506 IF YOU HAVE ANY QUESTIONS.
Substance Use Disorder Records
The confidentiality of substance use disorder records are afforded stricter laws than a typical health record. Federal law (42 CFR Part 2 or “Part 2”) protects your substance use treatment information. This includes records that show who you are, your diagnosis, how you are doing in treatment, or the treatment you receive. The law applies to programs that provide substance use education, prevention, treatment, recovery services, or research that are funded, supported, or regulated by the U.S. government.
Why Special Protections
Substance use disorder records have special privacy protections because some people may avoid treatment if they fear judgment, discrimination, or legal trouble. These laws help protect patients so they can get care without fear of stigma.
Our Uses and Disclosures
CompDrug Personnel
We will use your Health Information within our program among the personnel having a need for the information to provide, coordinate, or manage your treatment. For example, staff members and other personnel may need to know and discuss your PHI to carry out your treatment and to evaluate your response to treatment.
Healthcare Operations
We may use and share your Part 2 health information to help provide your treatment and coordinate your care. This helps our staff work together to give you safe, quality services. With your written permission for Treatment, Payment, and Health Care Operations (TPO), we may also share your information with other providers, health plans, or agencies involved in your care or payment. If your information is shared under a TPO consent, the person or organization that receives it may share it again only in limited ways allowed by law. Example: A doctor treating you for an injury asks another doctor about your overall health condition.
Medical Emergencies
We may disclose your Health Information to medical personnel for the purpose of treating you in a medical emergency.
Business Associates
We may disclose Health Information to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. All of our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
Secretary of Health and Human Services
We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with our legal requirements to maintain the confidentiality of your PHI.
Research
Under certain circumstances, we may use and disclose Health Information for research. Your Health Information will never be published without your written authorization.
Central Registry
If enrolled in a Medication Assisted Treatment Program at this facility, your Health Information may be released to the Central Registry within the State of Ohio.
Crimes on Premises
We may disclose your Health Information to report a crime committed by you on our premises or against our personnel or any threat to commit such a crime.
Audits
We may disclose Health Information to a health oversight agency for activities authorized by law. These oversight activities include but are not limited to audits, inspections, and licensure. These agencies are required to maintain the privacy of your Health Information.
Court Order
Under certain circumstances, we may disclose your PHI as allowed by a court order. For example, your PHI will only be disclosed based on a court order (1) after notice and an opportunity to be heard is provided to you or us; and (2) if the court order is accompanied by a subpoena or other similar legal mandate compelling disclosure before the PHI is used or disclosed.
Your Rights
Right to Request Restrictions
You have the right to request a restriction on the Health Information we use or disclose for treatment, payment, or health care operations. To request a restriction, you must make your request, in writing, and it must be specific with whom the restriction is to apply.
We are not required to agree to your request unless you are asking us to restrict the use and disclosure of your Protected Health Information to a health plan for payment or health care operation purposes and such information you wish to restrict pertains to an item or service that you’ve paid us out of pocket and in full. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment.
Right to an Accounting of Disclosures
You have the right to request a list of certain disclosures we have made of your Health Information for purposes other than treatment, payment and health care operations (TPO) or for which you provided written authorization. To request an accounting of disclosures, you must make your request, in writing.
You can ask for a list of the times we’ve shared your Health Information for three years prior to the date you ask, who we shared it with, and why. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests. We will notify you of the fee to be charged (if any) at the time of the request.
Right to Inspect & Copy
You have the right to inspect and copy your Health Information. This includes medical and billing records, other than psychotherapy notes. To inspect your Health Information, you must make your request, in writing, to the Privacy Officer.
To copy your Health Information, you must make your request in writing to Medical Records. We have up to 30 days to make your Health Information available to you and we may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. Under limited circumstances, we may deny your request. If we do deny your request, you have the right to have the denial reviewed by a licensed healthcare professional who was not directly involved in the denial of your request, and we will comply with the outcome of the review.
Right to Amend
If you feel that the Health Information we have is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment as long as the information is kept by our office, provided that the information was created by CompDrug. To request an amendment, put in writing what needs to be amended and provide the reason to support your request, to the Privacy Officer. If we deny an amendment, we will provide the rationale for denial to you in writing. You may write a Statement of Disagreement if your request is denied. This statement will be maintained as part of your Health Record and will be included with any disclosure.
Right to Confidential Communications
You have the right to request that we communicate with you about your Health Information in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. To request confidential communications, you must make your request, in writing. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests.
Right to Get Notice of a Breach
You have the right to be notified of a breach of any of your unsecured Health Information.
Get a Copy of this Privacy Notice
You have the right to a paper and electronic copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice from our web site, compdrug.org. To obtain a paper copy of this notice, you can visit our facility or make your request to the Privacy Officer.
Additional Limits on Health Information
CompDrug chooses to limit how patient information is used and shared. We do not keep psychotherapy notes as defined by HIPAA, and we do not ask patients to share their information for fundraising. Because we do not use information in these ways, you will not be asked to authorize them.
Our Responsibilities
We are required by law to keep your records private. We must tell you about our privacy responsibilities and how we protect your records. If there is a breach of unsecured records, we will notify patients who are affected.
We must follow the terms in the privacy notice that is currently in effect.
We may update this privacy notice from time to time. If we make changes, the updated notice may apply to records we already have and to new records we receive in the future. When we update the notice, we will provide you with the revised notice and tell you how to get a copy.
Complaints
File a complaint if you feel your rights are violated
If you feel we have violated your privacy rights, you have the right to file a complaint in writing with us or with the Department of Health and Human Services contacts below. We will not retaliate against you for filing a complaint.
U.S. Department of Health and Human Services Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201
1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints/
Contact
CompDrug
Attn: Privacy Officer
547 E 11th Avenue
Columbus, OH, 43211
(614) 224-4506
Effective Date: February 1, 2026