Privacy Policy

Effective date: October 30, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Blue River Behavioral Health (“Blue River,” “we,” “us”) provides outpatient substance use and mental health treatment for adults in Minnesota, including partial hospitalization (PHP), intensive outpatient (IOP), outpatient (OP), and virtual IOP programs. Your privacy matters to us. This policy explains how we protect your health information, how we use and share it, and the rights you have.

This policy has five parts:

1. Notice of Privacy Practices (HIPAA and Minnesota law)
2. Substance use disorder records (42 CFR Part 2)
3. Your rights
4. Website privacy
5. General provisions

If you have questions, contact our Privacy Officer at (612) 614-0964 or [email protected]. You can ask for a paper or electronic copy of this policy at any time.

1. Notice of Privacy Practices

Our duties. We are required by law to keep your protected health information (PHI) private and secure, to give you this notice, to follow the notice currently in effect, and to tell you if a breach affects your information. We will not use or share your information in ways this notice does not describe unless you give us written permission. You may take back that permission in writing at any time, except for actions we already took based on it.

Minnesota law. The Minnesota Health Records Act (Minn. Stat. 144.291 to 144.298) often gives you more protection than federal law. In many cases it requires your consent before we share your records, even for purposes federal law would allow without consent. When Minnesota law or 42 CFR Part 2 is stricter than HIPAA, we follow the stricter rule.

How we use and share your information, with your consent where the law requires it:

• Treatment. We share information among your Blue River care team, including therapists, our psychiatric provider, and staff who coordinate your care. With your consent, we coordinate with your other providers.
• Payment. We use information to verify your insurance, request authorizations, and bill for services.
• Health care operations. We use information to run our programs, train staff, review the quality of care, and meet licensing and accreditation requirements.
• Business associates. Some vendors help us provide care, such as our electronic health record, telehealth video platform, billing service, and IT support. Each one must sign a Business Associate Agreement that requires it to protect your information.

When the law permits or requires us to share information without your consent. These cases are limited and may be narrower for substance use disorder records (see Section 2):

• When a federal, state, or local law requires it
• To prevent or lessen a serious and imminent threat to the health or safety of you or others
• To report suspected abuse or neglect of a child or a vulnerable adult, as Minnesota law requires
• For public health activities and health oversight, such as audits and licensing inspections
• In response to a valid court order, as described in this policy
• To a medical examiner or coroner, as the law allows
• For workers’ compensation, as the law allows

Uses that always need your written authorization: psychotherapy notes, marketing, and any sale of your information. We do not sell your health information.

Family and friends. We share information with family members or friends involved in your care only with your permission. You decide who takes part in your treatment.

Appointment reminders and contact. We may contact you by phone, text, or email about appointments and your care. Text messages and regular email may not be secure. You can ask us to contact you another way.

2. Substance Use Disorder Records (42 CFR Part 2)

Records that identify you as a person who has applied for or received substance use disorder treatment at Blue River are protected by federal law (42 U.S.C. 290dd-2 and 42 CFR Part 2), in addition to HIPAA and Minnesota law.

• Consent. In general, we share these records only with your written consent. You may give a single consent for all future uses for treatment, payment, and health care operations, and you may revoke it in writing at any time.
• Sharing without consent is limited to cases the federal rules allow, such as a medical emergency, qualified research, audits and program evaluations, reports of suspected child abuse or neglect, reports of crimes on our premises or against our staff, and qualified service organizations that sign an agreement to protect your records.
• Legal proceedings. Your substance use disorder records, or testimony about their content, cannot be used or disclosed against you in any civil, criminal, administrative, or legislative proceeding unless you give specific written consent, or a court issues an order that meets 42 CFR Part 2 requirements together with a subpoena or similar legal mandate.
• Fundraising. If we ever use your records to contact you for fundraising, you will first get a clear and simple way to opt out of those communications. [Confirm whether Blue River fundraises. Remove this item if not.]
• Redisclosure. Anyone who receives your records under a consent must follow the same federal protections.
• Breach notification and complaints work the same way as for other health information (see Section 3).

Violating these federal rules is a crime. You may report suspected violations to the U.S. Department of Health and Human Services (HHS) and to the U.S. Attorney’s Office for the District of Minnesota.

3. Your Rights

• See and get a copy of your records. Ask in writing. We will respond within 30 days and may charge a reasonable, cost-based fee allowed by law.
• Ask us to correct your records. If we deny your request, we will explain why in writing, and you may add a statement of disagreement to your record.
• Ask for confidential communications, such as a different phone number or mailing address.
• Ask us to limit what we use or share. We are not required to agree in every case. If you pay for a service in full out of pocket, you may ask us not to share it with your health plan, and we will agree unless the law requires otherwise.
• Get a list of disclosures we made in the six years before your request, with some exceptions.
• Get a copy of this policy on paper or electronically.
• Choose someone to act for you, such as a health care agent or legal guardian.

Complaints. If you believe your privacy rights were violated, contact our Privacy Officer. You may also file a complaint with the HHS Office for Civil Rights at hhs.gov/ocr/complaints or 1-800-368-1019. We will not retaliate against you for filing a complaint.

4. Website Privacy

This section covers information collected through blueriverbh.com.

What we collect

• Information you give us in forms: name, phone number, email, date of birth, insurance provider, coverage type, member ID, and any message you write.
• Information you share by phone, text, or email with our admissions team.
• Information collected automatically: IP address, browser and device type, pages visited, the site that referred you, and time spent on pages.

Please do not include detailed medical history in website forms. Our admissions team will ask for what is needed in a private conversation.

How we use it: to answer your questions, verify your insurance, schedule an assessment, keep the website working and secure, and meet legal requirements.

What we do not do: we do not sell your personal information, and we do not use the information you send through our forms for third-party advertising. We do not share information that identifies you as seeking substance use or mental health care with advertising or social media platforms.

Cookies and analytics. We use cookies that the website needs to work. We also use these tools:

• Google Analytics helps us understand how visitors use the website, such as which pages they visit and how long they stay. We configure it so that it does not receive information that identifies you or your health.
• Google Search Console shows us how our website appears in Google search results. It does not place cookies on your device or collect information about you.

You can block or delete cookies in your browser settings. The website will still work, although some features may not.

Telehealth. Our virtual sessions use video platforms that meet HIPAA requirements and sign Business Associate Agreements with us.

Sharing. We share website information only with service providers bound by written agreements, with your insurance company when you ask us to verify benefits, and with authorities when the law requires it.

Links to other websites. Our website links to outside sources, such as government health agencies. We are not responsible for the privacy practices of those websites.

5. General Provisions

Security. We protect your information with administrative, physical, and technical safeguards, including encryption, access controls, staff training, and vendors that meet HIPAA requirements. No system is completely secure, and we continue to review our safeguards.

Breach notification. If a breach affects your unsecured health information, we will notify you without unreasonable delay and no later than 60 days after we discover it, and we will notify HHS and others as the law requires.

Record retention. We keep health records for the periods Minnesota law and licensing rules require, then destroy them securely. We keep website inquiry information only as long as we need it or the law requires.

Adults only. Our programs and website are intended for adults 18 and older. We do not knowingly collect information from children under 13 through this website.

Text messages. If you agree to receive text messages, we use them only for appointment reminders and communication about your care. Consent is optional and is not a condition of treatment. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. We do not share your phone number with third parties for their marketing. [Confirm Blue River sends text messages.]

Nondiscrimination and language access. Blue River does not discriminate on the basis of race, color, national origin, sex, age, or disability. We provide free language assistance and communication aids. To ask for help or file a grievance, contact our Privacy Officer.

Changes to this policy. We may change this policy, and the changes will apply to all information we hold. We will post the updated version on this page with a new effective date.

Contact Us

Privacy Officer: Clinical Director
Blue River Behavioral Health
[Street address, Suite]
[City], MN [ZIP]
Phone: (612) 614-0964
Email: [email protected]