Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL AND BEHAVIORAL HEALTH INFORMATION ABOUT A YOUTH IN DIVNITY’S CARE MAY BE USED AND DISCLOSED, AND HOW A GUARDIAN OR OTHER AUTHORIZED INDIVIDUAL CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies once a youth is referred into DiVnity Behavioral Health Services’ care and covers the protected health information (“PHI”) DiVnity creates or receives in the course of providing residential behavioral health services. It is separate from, and in addition to, the general website privacy notice, which covers only information submitted through this public website before a referral is accepted.

Our commitment to your privacy

DiVnity is required by law to maintain the privacy of protected health information, to provide guardians and authorized individuals with this notice of DiVnity’s legal duties and privacy practices, and to abide by the terms of the notice currently in effect. DiVnity is required to notify affected individuals following a breach of unsecured protected health information.

How DiVnity may use and disclose health information

The categories below describe ways DiVnity is permitted to use and disclose PHI without separate written authorization. Not every use or disclosure in a category is listed, but every permitted use or disclosure falls within one of these categories, and all are subject to the minimum-necessary standard where it applies.

• Treatment. DiVnity may use and disclose PHI to provide, coordinate, or manage care and related services — for example, sharing information among direct-care staff, clinicians, nursing/medical staff, and, when clinically appropriate, other treating providers, hospitals, or step-down programs involved in a youth’s care.
• Payment. DiVnity may use and disclose PHI to bill and collect payment for services from a guardian, an insurer, AHCCCS, or another payer, including eligibility checks, prior authorization, and claims submission.
• Health care operations. DiVnity may use and disclose PHI for internal operations such as quality assessment and improvement, staff training, licensing and accreditation activities, and business planning.
• Guardians and family involvement. Consistent with a guardian’s documented legal authority and any court-ordered restrictions on file, DiVnity may share relevant information with a parent, legal guardian, or other person involved in a youth’s care.
• As required by law. DiVnity will disclose PHI when required to do so by federal, state, or local law, including mandatory reporting of suspected abuse or neglect.
• Public health and safety. DiVnity may disclose PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and for public health activities such as disease reporting where required.
• Health oversight, legal, and judicial proceedings. DiVnity may disclose PHI to a health oversight agency for activities authorized by law, and in response to a court order, subpoena, or other lawful process, generally limited to what the order or process authorizes.
• Law enforcement and correctional/custody purposes. DiVnity may disclose limited PHI to law enforcement under specific, legally defined circumstances, and to the extent necessary to a correctional institution or law enforcement official with lawful custody of a youth.
• Coroners, funeral directors, organ procurement. DiVnity may disclose PHI as necessary for these purposes where applicable.
• Research. DiVnity may use or disclose PHI for research only where permitted by law, generally following review and approval by an institutional review board or privacy board, or with specific authorization.
• Workers’ compensation. DiVnity may disclose PHI as authorized by, and to the extent necessary to comply with, workers’ compensation or similar programs.

Substance use disorder treatment records, where they exist, receive heightened confidentiality protection under 42 CFR Part 2 in addition to HIPAA, and generally may not be disclosed without specific written consent except in narrowly defined circumstances (for example, a medical emergency or as otherwise permitted by that regulation). Any Part 2-covered record is handled under those additional restrictions.

Uses and disclosures that require written authorization

Except as described above, DiVnity will not use or disclose PHI without a guardian’s (or other authorized individual’s) written authorization. This includes, among others, most uses and disclosures of psychotherapy notes, uses or disclosures for marketing purposes, and any disclosure that constitutes a sale of PHI. An authorization may be revoked in writing at any time, except to the extent DiVnity has already acted in reliance on it.

Guardian and youth rights regarding health information

• Right to inspect and copy. Request to inspect and obtain a copy of PHI in the designated record set, with limited exceptions.
• Right to request amendment. Request a correction to PHI believed to be incorrect or incomplete, for as long as DiVnity maintains the record.
• Right to an accounting of disclosures. Request a list of certain disclosures DiVnity has made, other than for treatment, payment, health care operations, and certain other excluded categories.
• Right to request restrictions. Request a restriction on certain uses or disclosures of PHI; DiVnity is not required to agree, except where the disclosure is to a health plan for payment or operations purposes and the service was paid for out of pocket in full.
• Right to request confidential communications. Request that DiVnity communicate about care in a specific way or at a specific location.
• Right to a paper copy. Request a paper copy of this notice at any time, even if it was previously provided electronically.
• Right to be notified of a breach. Receive notification if unsecured PHI is breached in a manner that triggers notification under applicable law.
• Right to choose someone to act for a youth. A parent, legal guardian, or other person with documented legal authority to make health care decisions for a youth may exercise these rights on the youth’s behalf, consistent with that authority and applicable law.

To exercise any of these rights, contact DiVnity’s Privacy Officer using the information below. DiVnity may require a request in writing and may charge a reasonable, cost-based fee for copies where permitted by law.

DiVnity’s duties

DiVnity is required by law to maintain the privacy of PHI, provide this notice of legal duties and privacy practices, notify affected individuals following a breach of unsecured PHI, and abide by the terms of the notice currently in effect.

Changes to this notice

DiVnity reserves the right to change this notice and to make the revised notice effective for PHI it already maintains, as well as PHI it creates or receives in the future. The current notice is available on this page and will be posted at DiVnity facilities and provided at admission.

Questions or complaints

Questions or concerns about these privacy practices, or a request to exercise any right described above, can be directed to DiVnity’s Privacy Officer at [email protected] or (480) 773-8480.

A complaint may also be filed directly with the U.S. Department of Health and Human Services, Office for Civil Rights, by visiting hhs.gov/hipaa/filing-a-complaint. DiVnity will not retaliate against anyone for filing a complaint.

Effective date

This notice is effective as of August 8, 2026.