top of page

Privacy Policy

Thrive Community Services, LLC Notice of Privacy Practices
Updated 9/17/2026

THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE

REVIEW IT CAREFULLY. Thrive Community Services, LLC (THRIVE) is required by the Health Insurance Portability and Accountability Act of 1996 and its corresponding regulations, as either is amended from time to time (collectively, HIPAA) to maintain the privacy of protected health information (PHI) and to provide notice of our legal duties and privacy practices regarding PHI.

THRIVE complies with HIPAA, as well as any other federal or state law that gives greater privacy protections than HIPAA, including for substance use disorder records, and  Medicaid applicants and recipients.  Thrive provides behavioral health and substance use disorder services. Some records maintained by Thrive may receive additional confidentiality protections under federal law governing substance use disorder patient records, 42 CFR Part 2 (“Part 2”).

This Notice fulfills applicable notice requirements under HIPAA and 42 CFR Part 2. If you have questions about any part of this notice or want further information about information practices at THRIVE, please contact the THRIVE privacy officer at 208-376-7083 or by email at privacy@thrivecommunityservices.org.

 

OUR RESPONSIBILITIES:

Thrive is required by law to maintain the privacy and security of your protected health information and Part 2 records; follow the duties and privacy practices described in the Notice currently in effect; provide you with a copy of this Notice; and notify you as required by law if a breach occurs that may have compromised the privacy or security of your information. We will not use or disclose your information other than as described in this Notice unless you authorize us to do so or the use or disclosure is otherwise permitted or required by law.

 

UNDERSTANDING YOUR PHI:

Each time we serve you, a record is created that contains your health or financial information. This record generally contains information about your condition, the service we provided, or how we got paid. This record is your PHI. We may use or disclose this PHI to:

  • plan your care and treatment;

  • communicate with other healthcare professionals involved in your care;

  • document the care you receive;

  • educate healthcare professionals;

  • provide information for medical research;

  • provide information to public health officials;

  • evaluate and improve the care we provide; or,

  • obtain payment for the care we provide.

Understanding what is in your PHI and how it is used helps you to ensure it is accurate, better understand who may access it, and make more informed decisions when authorizing disclosures to others.

ADDITIONAL PROTECTIONS FOR SUBSTANCE USE DISORDER RECORDS:

Thrive provides substance use disorder services and maintains records that may be protected by federal confidentiality law, including 42 U.S.C. § 290dd-2 and 42 CFR Part 2 (“Part 2”).

Part 2 provides additional confidentiality protections for records that identify an individual as having received, sought, or been referred for substance use disorder diagnosis, treatment, or referral for treatment from a federally assisted Part 2 program.

Thrive generally must obtain your written consent before using or disclosing your Part 2 records unless the use or disclosure is otherwise permitted by Part 2. You may provide a single consent permitting future uses and disclosures of your Part 2 records for treatment, payment, and health care operations as permitted by federal law.

Part 2 permits certain uses and disclosures without your consent when specific legal requirements are met. These may include certain communications within Thrive and with qualified service organizations, bona fide medical emergencies, certain research, audits and evaluations, reporting suspected child abuse or neglect as required by law, certain crimes on program premises or against program personnel, certain cause-of-death inquiries, and disclosures authorized by a qualifying Part 2 court order.

When Part 2 records are disclosed pursuant to a valid consent for treatment, payment, and health care operations to a HIPAA covered entity or business associate, the recipient may use and redisclose the records as permitted by HIPAA, subject to applicable Part 2 restrictions.

Part 2 records generally may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless you provide specific written consent or the use or disclosure is authorized by a qualifying Part 2 court order and other legal process as required by federal law. Part 2 records generally may not be used to initiate or substantiate criminal charges against you or to conduct a criminal investigation of you except as specifically permitted by federal law.

You may file a complaint with Thrive or the U.S. Department of Health and Human Services Office for Civil Rights if you believe your Part 2 confidentiality rights have been violated. Thrive will not retaliate against you for filing a complaint.

ADDITIONAL PROTECTIONS FOR MEDICAID RECIPIENTS:

The confidentiality of records about Medicaid recipients is protected not only by HIPAA, but also the additional privacy protections of federal and state Medicaid law. See federal statute 42 USC 1396a(a)(7), as well as federal regulation 42 CFR Part 431, Subpart F.

This means that we are limited in what PHI we can disclose about Medicaid recipients, without their consent, even when the HIPAA requirements are met.

Generally, we may not tell someone that a client has applied for or receives Medicaid-funded services unless the reason for the disclosure is directly connected with the running or investigation of the applicable Medicaid program, and even then only if the intended recipient has in place privacy protections no less stringent than ours. This limitation also applies to any information that an intended recipient could reasonably use to figure out that the client has applied for or is receiving Medicaid. This additional protection for Medicaid recipients applies even as against courts and law enforcement, and survives the death of the person.

USES OR DISCLOSURES THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION:

THRIVE may access, use, or share your PHI without authorization for the following purposes:

Treatment. We may use or disclose your PHI to provide services to you, including possible treatment options, health-related benefits or services, or alternatives that may be of interest to you. We may use or disclose your PHI to contact you with appointment or other reminders. We may share your PHI with doctors, nurses, therapists, or others to coordinate or manage your services. Different programs within THRIVE may share your PHI to coordinate the different things you need, or to support or maintain your continuum of care.

Payment. We may use or disclose your PHI so that the services you receive can be billed.

Operations. We may use or disclose your PHI for healthcare operations, including to review your services or to evaluate the performance of our employees.

OTHER USES OR DISCLOSURES THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION:

Persons Involved in Your Care or Payment for Your Care: Unless you object, we may disclose your PHI to a friend or family member who is involved in your care, including in the event of your death (unless you have told us ahead of time not to do so). Any PHI disclosed would be limited to PHI directly relevant to that person’s involvement in your care. Unless you object, we may also disclose your PHI to someone who helps pay for your care. Any PHI disclosed would be limited to PHI directly relevant to that person’s involvement in paying for your care.

Required By Law: We may use or disclose your PHI to the extent it is required by law. You would be notified, if required by law, of any use or disclosure.

Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information.

Communicable Diseases: We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law, or other activities necessary for appropriate oversight of the healthcare system, government benefit programs, other government regulatory programs, or civil rights laws.

Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of abuse or neglect. Any disclosure would be made consistent with the requirements of applicable law(s).

Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal (to the extent the disclosure is expressly authorized), and in certain conditions in response to a subpoena, discovery request, or other lawful process.

Law Enforcement: We may disclose your PHI, as long as applicable legal requirements are met, for law enforcement purposes.

Coroners, Medical Examiners, or Funeral Directors: We may disclose your PHI to a coroner or medical examiner for identification purposes, cause-of-death determinations, or for a coroner or medical examiner to perform other duties authorized by law.

Criminal Activity: We may disclose your PHI if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of others.

Disaster Relief: We may disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, or location.

Workers’ Compensation: We may disclose your PHI as authorized to comply with workers’ compensation laws or other similar legally established programs.

Required Uses and Disclosures: We must make disclosures when required by the secretary of the federal department of health and human services to investigate or determine our compliance with the requirements of HIPAA.

USES OR DISCLOSURES REQUIRING YOUR AUTHORIZATION:

There are certain uses or disclosures of your PHI that would require your authorization, including:

  • most uses or disclosures of psychotherapy notes;

  • uses or disclosures of your PHI for marketing purposes; or,

  • any sale of PHI.

We do not market or sell your PHI.

Other uses or disclosures not described in this notice would only be made with your consent. You may revoke your consent, in writing, at any time. If you revoke your consent, you understand that we are not able to undo any disclosures that we have already made to others, and we are required to keep our records of the services we provided to you.

YOUR RIGHTS:

Right to Inspect and Copy: You have the right to inspect and copy your PHI. Generally, this includes medical and billing records, but does not include psychotherapy notes or information compiled in reasonable anticipation of (or for use in) a civil, criminal, or administrative action or proceeding. To inspect and copy your PHI, you must submit a written request at the site of service or to the THRIVE privacy officer. If you request a copy, we may charge a fee for the cost of copying, mailing, or other supplies associated with your request. We may deny your request to inspect and copy in certain circumstances. If you are denied access to your PHI, you may request that the denial be reviewed.

Right to Amend: If you believe that your PHI is incorrect or incomplete, you may ask us to amend (correct) the information. You have the right to request an amendment as long as the information is kept by or for THRIVE. To request an amendment, your request must be made in writing and submitted at the site of service or to the THRIVE privacy officer. In addition, you must provide a reason to support your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

  • was not created by us, unless the person or entity that created the PHI is no longer available to make the amendment;

  • is not part of the PHI kept by or for THRIVE;

  • is not part of the PHI that you would be permitted to inspect or copy; or,

  • is accurate and complete.

Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI as provided by law. The accounting will not include certain disclosures that are excluded from the accounting requirement. To request an accounting, you must submit your request in writing at the site of service or to the Thrive Privacy Officer. Your request must identify the time period requested, which generally may not exceed six years.

Right to Request Restrictions: You have the right to request a restriction or limitation on your PHI that we use or disclose for treatment, payment, operations, or to someone who is involved in your care or the payment of your care (like a family member or friend). We are not required to agree to your request for restrictions unless it is for payment or operations and you use your own funds to pay, in full, for a healthcare service. If we do agree, we would comply with your request unless your PHI is needed to provide emergency treatment to you. To request restrictions, you must make your request in writing at the site of service or to the THRIVE privacy officer. In your request you must tell us: (1) what information you want to limit, (2) whether you want to limit our use, disclosure, or both; and (3) against whom you want the limits to apply.

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. To request confidential communications, you must make your request in writing at the site of service or to the THRIVE privacy officer. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of this Notice: You have a right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice by contacting us.

Right to Breach Notification: If a breach occurs involving your unsecured protected health information or unsecured Part 2 records and notification is required by law, Thrive will notify you as required by applicable federal law.

CHANGES TO THIS NOTICE:

We are required to follow this notice and any updates to this notice. We may update this notice from time to time. Any update to this notice may affect your PHI we already have or may have in the future.

We post a copy of the current notice at our primary business office and at each site where we provide services. You may also obtain a copy of the current notice by calling us at 208-376-7083 and requesting a copy be sent to you in the mail or by asking for one any time you are at our business office or service sites.

COMPLAINTS:

If you believe your privacy rights have been violated, you may file a complaint with the Thrive Privacy Officer or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). The Thrive Privacy Officer can assist you with filing a complaint if you request help. Thrive will not retaliate against you for filing a complaint. The privacy officer can assist you with writing your complaint if you request their help. We do not retaliate against anyone for filing a complaint.

To file a complaint with Thrive contact the privacy officer at the following address: Attn: Privacy Officer, 12553 W. Explorer Dr, Suite 190, Boise, ID 83713 or email privacy@thrivecommunityservices.org.

To file a complaint with USDHHS, write to them at the following address: Secretary, Health and Human Services

Office of Civil Rights, US Department of Health and Human Services 200 Independence Avenue, SW Room 509F, HHH Building Washington, DC 20201

You can also file a complaint with USDHHS by phone at 866-627-7748 or 866-778-4989 (TTY).

CONTACT INFORMATION:

This Notice fulfills applicable notice requirements under HIPAA and 42 CFR Part 2. If you have questions about any part of this notice of privacy practices or you want further information concerning privacy practices at Thrive Community Services, please contact privacy@thrivecommunityservices.org

​

bottom of page