Notice of Privacy Practices

Effective Date: February 16, 2026

RIVERVALLEY CONSULTING SERVICES, INC. & Affiliates
(“The Company”)

1100 Walnut Street; Owensboro, Kentucky 42301

This Notice describes how your health information may be used and disclosed, your rights regarding that information, and how to file a complaint if you believe your privacy rights have been violated.

This Notice applies to health information protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and to substance use disorder treatment records protected by federal law (42 U.S.C. § 290dd-2 and 42 CFR Part 2).

You have the right to receive a copy of this Notice in paper or electronic form. If you have questions, please contact our Privacy Officer at (270) 689-6621 or info@rvbh.com.

I. Who Will Follow This Notice

This Notice applies to RiverValley Consulting Services, Inc. and the following affiliated entities:

Acumen Counseling Services, Inc.
RiverValley Behavioral Health, Inc.
Behavioral Health Services, Inc.
CigarFactory Complex, Inc.
Green River Independent Living II
Green River Independent Living III
Henderson Group Home

These entities may share health information with each other for treatment, payment, and health care operations as permitted by law.

Important: Substance use disorder treatment records protected by 42 CFR Part 2 are not shared among affiliates for treatment, payment, or health care operations unless permitted by Part 2 and, in most cases, only with your written consent, except in the limited circumstances described in Section V of this Notice.

II. Your Rights

You have the following rights regarding your health information.

Access To Your Records

You may request an electronic or paper copy of your medical record and other health information we maintain about you. We will provide the information within 30 days. A reasonable, cost-based fee may apply.

Request an Amendment

You may request that we correct information you believe is incorrect or incomplete. We may deny your request but will explain the reason in writing within 60 days.

Request Confidential Communications

You may request that we contact you in a specific way or at a specific location. We will accommodate reasonable requests.

Request Restrictions

You may request restrictions on our use or disclosure of your health information for treatment, payment, or health care operations. We are not required to agree, except as described below. If we agree, we will honor the restriction except in an emergency.
If you pay for a health care item or service out-of-pocket in full, you may request that we not disclose information about that service to your health plan for payment or health care operations. We are required to agree unless disclosure is required by law.
In most cases, we may not disclose your substance use disorder treatment records without your written consent. If you provide written consent for treatment, payment, or health care operations, you may request a restriction under 42 CFR § 2.26. We will consider your request but are not required to agree.

Receive an Accounting of Disclosures

You have the right to request certain information about disclosures of your health information:

HIPAA records: You may request an accounting of disclosures made during the six (6) years prior to your request, excluding disclosures for treatment, payment, health care operations, and certain other permitted disclosures.
Electronic substance use disorder treatment records (Part 2): You may request an accounting of disclosures made with consent during the three (3) years prior to your request, including disclosures for treatment, payment, and health care operations, where such disclosure was made through an electronic health record, as provided in 42 CFR § 2.25.
Intermediary disclosures (Part 2): If you provided consent using a general designation through an intermediary, you may request a list of entities to whom your records were disclosed during the three (3) years prior to your request, as provided in 42 CFR § 2.24.

One accounting per year is free. Additional requests within 12 months may incur a reasonable, cost-based fee.

Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights. We will verify their authority before acting.

File a Complaint

You may file a complaint with our Privacy Officer using the contact information above. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

III. Your Choices

In certain situations, you may tell us your preferences about how we share your information.

You may ask us to:

Share information with family members or others involved in your care
Share information in a disaster relief situation
Include your information in a facility directory

If you are unable to communicate your preferences, we may share information if we believe it is in your best interest or necessary to prevent a serious and imminent threat to health or safety.

We will not use or disclose your information for the following without your written authorization:

Marketing
Sale of your information
Most uses and disclosures of psychotherapy notes

Fundraising

We may contact you for fundraising purposes. You may opt out of receiving fundraising communications at any time.

IV. Uses and Disclosures Without Consent Under HIPAA

The following disclosures apply to health information protected by HIPAA and are allowed or required without your permission.

[Note] Substance use disorder treatment records protected by 42 CFR Part 2 may only be disclosed without your written consent in the limited circumstances described in Section V, below.

Treatment

We may use or disclose your health information to provide, coordinate, or manage your care.

Example: A doctor treating you for an injury asks another doctor about your overall health condition.

Payment

We may use or disclose your health information to bill and obtain payment for services.

Example: We give information about you to your health insurance plan so it will pay for your services.

Health Care Operations

We may use or disclose health information to operate and improve our services.

Example: We may review patient records to evaluate the performance of our staff, improve treatment programs, conduct quality improvement activities, train employees, or ensure we are complying with legal and accreditation requirements.

Other Uses and Disclosures Permitted or Required by Law

We may disclose health information as permitted or required by law, including:

Public health activities
Reporting abuse, neglect, or domestic violence
Health oversight activities
Judicial or administrative proceedings
Law enforcement purposes
Workers’ compensation claims
Specialized government functions
Organ and tissue donation
Work with coroners, medical examiners, or funeral directors

We must meet all legal requirements before making these disclosures.

V. Confidentiality of Substance Use Disorder Treatment Records (42 CFR Part 2)

Substance use disorder treatment records are protected by federal law (42 U.S.C. § 290dd-2 and 42 CFR Part 2).

Except as described below, we may not use or disclose your substance use disorder treatment records without your written consent.

Where Part 2 applies and is more restrictive than HIPAA, Part 2 controls.

Disclosures Without Your Written Consent

Federal law permits limited disclosures without your written consent:

Within our substance use disorder treatment program or to an entity with direct administrative control over the program, as permitted by 42 CFR § 2.12(c)(3), for purposes of treatment, payment, or health care operations.
To qualified service organizations that have agreed in writing to protect your information.
For approved research, audit, or program evaluation activities.
To report a crime committed on our premises or against program personnel.
To medical personnel in a medical emergency.
To report suspected child abuse or neglect.
When authorized by a court order issued in accordance with 42 CFR §§ 2.61–2.67.

Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings without your specific written consent or a qualifying court order.

Consent for Treatment, Payment, and Health Care Operations

You may provide a single written consent for future uses and disclosures for treatment, payment, and health care operations. You may revoke your consent in writing at any time, except to the extent we have already acted on it.

Records disclosed pursuant to your written consent for treatment, payment, or health care operations may be redisclosed by the recipient as permitted by HIPAA, consistent with 42 CFR § 2.22.

VI. Our Responsibilities

We are required by law to:

Maintain the privacy and security of your protected health information
Notify you promptly of a breach affecting your information
Follow the privacy practices described in this Notice
Provide you with a copy of this Notice

We will not use or disclose your information in ways not described here without your written authorization. You may revoke your authorization in writing at any time.

VII. Changes to This Notice

We may revise this Notice at any time. Changes will apply to all information we maintain. The revised Notice will be available upon request, in our office, and on our website.