Last Updated: July 7, 2026 · Effective Date: July 7, 2026
THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Your Information. Your Rights. Our Responsibilities.
This Notice explains how Genesis House powered by United Recovery Project (“Genesis House,” “we,” “us,” or “our”) — a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) — may use and share your health information, and how you can exercise your rights regarding that information.
We operate a residential treatment facility at 4865 40th Way S, Lake Worth, FL 33461. Our main phone is (888) 699-9395.
Availability of this Notice. A copy of this Notice is posted at our facility and is available on our website at genesishouse.net/about-us/privacy-practices/; you may request a paper copy at any time at no charge by contacting our Privacy Officer (see contact information below).
Because Genesis House provides substance-use-disorder (SUD) treatment services, your records are dual-protected — by HIPAA and by the Federal confidentiality regulations at 42 C.F.R. Part 2 (implementing 42 U.S.C. § 290dd-2). Where these two frameworks overlap, the stricter standard applies.
General confidentiality rule. The confidentiality of records that would identify you as someone who has applied for or received substance-use-disorder treatment is protected by Federal law and regulations (42 C.F.R. Part 2). Generally, we may not tell a person outside Genesis House that you attend the program, or disclose any information identifying you as having a substance use disorder, unless:
Single consent for treatment, payment, and health-care operations. Consistent with the 2024 amendments to Part 2, if you provide a single written consent for uses and disclosures for treatment, payment, and health-care operations (TPO), we — and other HIPAA covered entities and business associates who receive your records under that consent — may use and redisclose those records for TPO as permitted by HIPAA, until you revoke your consent in writing.
Crime or threat — not protected. Federal law and regulations do not protect information about a crime you commit — whether on Genesis House premises or against any person who works for Genesis House — or any threat to commit such a crime.
Use in legal proceedings. Your substance-use-disorder records — and any testimony relaying their content — may not be used or disclosed to initiate or substantiate any criminal charges against you, or in any civil, criminal, administrative, or legislative proceeding against you, without your written consent or a court order issued after notice and an opportunity to be heard, as provided in 42 C.F.R. §§ 2.61–2.67. A court order authorizing use or disclosure must be accompanied by a subpoena or other lawful mandate; a subpoena, discovery request, or ordinary court order is not, by itself, sufficient.
Your Part 2 rights. Under the current Part 2 rule, you have the right to an accounting of certain disclosures, the right to request restrictions on disclosures for TPO, the right to a copy of this Notice, and the right to be notified in the event of a breach of your Part 2 records. Violation of Part 2 by a treatment program is a violation of Federal law.
To report a violation. You may report a suspected violation of 42 C.F.R. Part 2 to the U.S. Department of Health and Human Services, Office for Civil Rights (HHS OCR), which administers and enforces the Part 2 regulations (contact details appear under “How to File a Complaint” below). You may also raise concerns with the Substance Abuse and Mental Health Services Administration (SAMHSA).
Your “Protected Health Information” (PHI) includes any individually identifiable health information we create or receive — written, spoken, or electronic.
We may use and share your PHI for the following purposes without your written authorization, subject to the stricter limits of 42 C.F.R. Part 2 for SUD records:
Treatment. We share your PHI among our clinical and support staff, and with other health-care providers involved in your care (for example, a hospital, physician, or specialist), to coordinate and provide your treatment. For SUD records, we require your written consent before sharing with other providers unless an exception under 42 C.F.R. Part 2 applies.
Payment. We may use and share your PHI to bill and receive payment from your health insurer or another payer. This includes verifying coverage, obtaining prior authorization, and submitting claims.
Health-Care Operations. We may use and share your PHI to carry out activities necessary to run our facility — such as quality-improvement reviews, staff training and competency assessments, compliance activities, licensing, accreditation, and business management.
Right to restrict payment/operations disclosure (out-of-pocket). If you pay for a service entirely out of pocket, you may ask us not to share information about that service with your health insurer for payment or operations purposes. We will honor that request unless a law requires us to share the information.
Beyond treatment, payment, and operations, we may use or share your PHI in the following circumstances as permitted or required by law. For SUD records, additional 42 C.F.R. Part 2 restrictions apply; we will follow the stricter rule.
Required by law. We will disclose your PHI when required by federal, state, or local law.
Public-health activities. We may share PHI with public-health authorities for activities such as preventing or controlling disease, reporting births and deaths, reporting child abuse or neglect, reporting reactions to medications, and notifying persons who may have been exposed to a disease.
Health oversight activities. We may share PHI with government agencies for oversight activities authorized by law — for example, audits, inspections, and investigations related to the health-care system.
Abuse, neglect, or domestic violence. We may share PHI about a victim of abuse, neglect, or domestic violence with government authorities authorized to receive such reports, as required or permitted by law.
Judicial and administrative proceedings. We may share PHI in response to a court or administrative order. We may also share PHI in response to a subpoena, discovery request, or other lawful process if certain conditions are met. For substance-use-disorder records protected by 42 C.F.R. Part 2, a subpoena, discovery request, or ordinary court order is not sufficient on its own — disclosure or use in a legal proceeding requires your written consent or a court order that meets the specific requirements of 42 C.F.R. §§ 2.61–2.67 (including, where applicable, §§ 2.63–2.65).
Law enforcement. We may share limited PHI with law enforcement in specific circumstances permitted by law, such as to identify or locate a suspect, report a crime on our premises, or respond to a court order or subpoena.
Serious threat to health or safety. We may share PHI when necessary to prevent a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to someone who can prevent or lessen the threat.
Workers’ compensation. We may share PHI to the extent authorized by and necessary to comply with workers’ compensation laws.
Military and veterans. If you are an armed forces member, we may share PHI as required by military command authorities.
National security and intelligence. We may share PHI with authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Correctional institutions. If you are an inmate of a correctional institution, we may share PHI necessary for your health or the health and safety of others.
Organ and tissue donation. We may share PHI with organ procurement organizations or other entities for organ, eye, or tissue donation and transplantation.
Research. We may share PHI for research under specific conditions — for example, when an Institutional Review Board has approved a waiver of individual authorization or when the research involves only information about deceased persons.
Coroners, medical examiners, and funeral directors. We may share PHI with a coroner or medical examiner for identification or cause-of-death purposes, and with funeral directors as necessary.
De-identified information. We may use or share health information that has been de-identified in accordance with HIPAA standards; de-identified information is no longer PHI and is not subject to this Notice.
Business Associates. We share PHI with third-party vendors and contractors (“Business Associates”) who perform services on our behalf — such as billing, records management, IT support, legal or accounting services, and laboratory analysis. Each Business Associate is required by contract to safeguard your PHI.
No facility directory. Because of the heightened confidentiality protections that apply to substance-use-disorder treatment under 42 C.F.R. Part 2, Genesis House does not maintain a patient/resident directory and will not confirm or deny to callers or visitors whether an individual is present at, or is a patient of, our facility without that individual’s Part 2-compliant written consent (or as otherwise permitted by law, such as a medical emergency or a qualifying court order).
Individuals involved in your care. Unless you object, we may share relevant PHI with a family member, close friend, or other person you identify as involved in your care or payment for your care, to the extent permitted under 42 C.F.R. Part 2 and HIPAA. If you are incapacitated or in an emergency, we may share information with such persons if it is in your best interest and consistent with applicable law.
We will not use or share your PHI for the following purposes unless you sign a written authorization:
Revoking an authorization. If you give us written authorization, you may revoke it at any time. Your revocation will not affect uses and disclosures already made in reliance on the authorization. To revoke, submit a written request to our Privacy Officer (contact information below).
We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
You have the following rights. To exercise any of these rights, contact our Privacy Officer (see contact information below). We may ask you to submit your request in writing.
You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or a summary in the form you request if technically feasible. We may charge a reasonable cost-based fee.
We may deny your request in limited circumstances. If we deny your request, we will tell you why and, in some cases, you may ask for a review of our denial.
Under the current 42 C.F.R. Part 2 rule, your right to access and obtain a copy of your substance-use-disorder records generally follows the same standard as the HIPAA right of access described above.
You can ask us to correct health information about you that you believe is incorrect or incomplete. Send us a written request and explain why the information should be corrected. We may say “no” for specific reasons permitted by law, and if we do, we will tell you why in writing.
You can ask for a list (accounting) of the times we have shared your health information, for up to six years before the date you ask, identifying who received the information and why. The accounting does not include disclosures for treatment, payment, operations, or certain other purposes. We will respond to your request within 60 days.
You can ask us to limit how we use or share your PHI for treatment, payment, or health-care operations, or to limit what we share with family members or others involved in your care. We are not always required to agree to your request, but we will tell you if we cannot honor it. If we agree, we will follow the restriction unless you are in an emergency situation.
If you pay for a service entirely out of pocket and ask us not to share information about that service with your health insurer, we are required to honor that request.
You can ask us to contact you in a specific way — for example, at a specific phone number or mailing address — or to avoid leaving messages at a certain number. We will say “yes” to all reasonable requests.
You can ask for a paper copy of this Notice at any time, even if you have agreed to receive it electronically. We will provide a paper copy promptly at no charge.
We are required by law to notify you, without unreasonable delay and no later than 60 days after discovery, if a breach of your unsecured PHI occurs.
We are required by law to:
We reserve the right to change our privacy practices and the terms of this Notice of Privacy Practices, consistent with applicable law, at any time. If we make a material change, we will revise this Notice and post the updated version in our facility and on our website. The new Notice will apply to all PHI we maintain, including information created or received before the change. You may request a copy of the current Notice at any time.
To exercise any right described in this Notice, or to ask a question about our privacy practices, contact our Privacy Officer:
Privacy Officer Michael Avellino Chief Marketing Officer Genesis House powered by United Recovery Project 4865 40th Way S Lake Worth, FL 33461 United States Phone: (888) 699-9395 Fax: 561-439-4864 Email: Mavellino@urpfl.com
If you believe Genesis House has violated your privacy rights, you have the right to file a complaint. We will not retaliate against you for filing a complaint.
Submit a written complaint to our Privacy Officer at the address, phone, fax, or email shown above.
You may also file a complaint with:
U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue SW Washington, DC 20201 Phone: 1-800-368-1019 (TTY: 1-800-537-7697) Online complaint portal: https://ocrportal.hhs.gov/ocr Complaint information: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
Genesis House is accredited by The Joint Commission. If you have a concern about the quality or safety of your care that we have not been able to resolve, you may contact The Joint Commission. This channel is for quality-and-safety concerns; complaints about the privacy of your health information should be directed to HHS OCR as described above.
The Joint Commission Office of Quality and Patient Safety One Renaissance Boulevard Oakbrook Terrace, IL 60181 Phone: 1-800-994-6610 Online: submit a patient safety event report at www.jointcommission.org
This Notice of Privacy Practices is effective as of July 7, 2026.
| Version | Effective Date | Summary of Changes |
| 1.0 | July 7, 2026 | Initial publication. |