HIPAA

HIPAA Notice of Privacy Practices

Effective Date: July 1, 2025  |  Revised: July 2026  |  Updated per February 16, 2026 HHS Final Rule

Authority: 45 CFR §164.520; HITECH Act (Pub. L. 111-5); 42 CFR Part 2 (SUD Records)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.   This notice is required by federal law (45 CFR §164.520). You have the right to a paper copy of this notice upon request at any time.   UPDATED FEBRUARY 2026: This notice now includes required disclosures about substance use disorder (SUD) records per the 2024 HIPAA Privacy Rule Final Rule (45 CFR §164.520; 42 U.S.C. §290dd-2; 42 CFR Part 2), effective February 16, 2026.

1.  Who We Are and Our HIPAA Status

Assurance Benefits Corp. (abc-incorp.com) is a licensed insurance agency in Arizona. In providing insurance brokerage services, we may function as a Business Associate (45 CFR §160.103) to covered entities (insurance carriers and group health plans) when we handle Protected Health Information (PHI) on their behalf. We execute Business Associate Agreements (BAAs) with all covered entity partners per 45 CFR §164.504(e).

This Notice describes our practices regarding PHI we receive or create in providing insurance services to you, including quoting, enrollment, claims assistance, and plan administration.

2.  What Is Protected Health Information (PHI)?

PHI is any individually identifiable health information in any form — oral, written, or electronic — relating to your:

  • Past, present, or future physical or mental health condition
  • Provision of health care to you
  • Payment for health care services

This includes information created during insurance quoting, enrollment, and related administrative functions. We apply the Minimum Necessary Standard (45 CFR §164.502(b)) — using and disclosing only the minimum PHI necessary to accomplish each purpose.

3.  Special Protections for Substance Use Disorder (SUD) Records

Authority: 42 U.S.C. §290dd-2; 42 CFR Part 2; 2024 HIPAA Privacy Rule Final Rule, effective February 16, 2026

NEW — Required as of February 16, 2026 Federal law provides special protections for records of substance use disorder (SUD) treatment from programs that receive federal assistance (42 CFR Part 2 programs). If we receive such records about you, they are protected under BOTH HIPAA and 42 CFR Part 2.

What Are Part 2 SUD Records?

Records from federally assisted substance use disorder treatment programs — including records of identity, diagnosis, prognosis, or treatment of any patient — that are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.

How SUD Records Are Protected

If we receive SUD records subject to 42 CFR Part 2:

  • Those records CANNOT be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you, unless based on your written consent OR a court order issued after notice and an opportunity to be heard
  • Those records have ADDITIONAL protections beyond standard HIPAA — they may not be shared with law enforcement, used to investigate or prosecute you, or disclosed without your consent except in very limited circumstances
  • You have the right to be informed when we receive Part 2 SUD records about you
  • Your consent to disclose Part 2 SUD records must identify the specific records to be disclosed, the name of the person/organization to receive the records, and the purpose of the disclosure

Permitted Disclosures of SUD Records Without Your Authorization

  • Medical emergencies — when necessary to meet a bona fide medical emergency
  • Research, audit, or program evaluation — subject to strict confidentiality protections
  • Court order — only after notice and opportunity to be heard is provided
  • Suspected child abuse or neglect — to the extent permitted by state law
  • Communications within our organization — only to those with a need to know for treatment, payment, or operations

Your Rights Regarding SUD Records

  • Right to written notice when Part 2 SUD records about you are received or disclosed
  • Right to withhold consent for disclosure — we cannot disclose Part 2 SUD records without your specific written authorization, except as listed above
  • Right to revoke consent — you may revoke authorization for disclosure of SUD records at any time, except where we have already acted on it
  • Right to file a complaint if you believe your SUD record protections have been violated — with us or with HHS Office for Civil Rights

Combined Notice

Where we function as both a HIPAA covered entity/business associate and handle Part 2 SUD records, this combined notice satisfies both the HIPAA NPP requirement (45 CFR §164.520) and the Part 2 patient notice requirement (42 CFR §2.22), as permitted by the 2024 Final Rule.

4.  Permitted Uses and Disclosures Without Your Authorization

Per 45 CFR §164.502, we may use or disclose PHI without your written authorization for:

A. Treatment, Payment, and Health Care Operations (TPO)

  • Treatment: Sharing health information with your healthcare providers or insurance carriers to facilitate care and coverage
  • Payment: Processing claims, determining eligibility, coordinating benefits, and adjudicating claims on your behalf
  • Health Care Operations: Quality improvement, compliance auditing, business management, training, and administrative functions

B. Required by Law

  • Court orders, legal subpoenas, and legally authorized regulatory demands
  • Audits and investigations by CMS, HHS Office for Civil Rights, and the Arizona Department of Insurance
  • State-required reporting obligations under applicable insurance regulations

C. Public Health and Safety (45 CFR §164.512)

  • Disease surveillance, injury reporting, and public health monitoring (§164.512(b))
  • FDA product safety notifications (§164.512(b)(1)(iii))
  • Preventing or lessening a serious and imminent threat to health or safety (§164.512(j))

D. Health Oversight Activities (45 CFR §164.512(d))

  • Government audits, investigations, inspections, and licensure activities
  • Government programs that provide public benefits

E. Business Associates (45 CFR §164.504(e))

  • Vendors performing services on our behalf (IT, document management, billing) under executed BAAs that impose the same HIPAA protections

F. De-Identified Information

  • Information from which all individual identifiers have been removed per 45 CFR §164.514 may be used for any lawful purpose

5.  Uses and Disclosures Requiring Your Written Authorization

We obtain your signed HIPAA authorization (45 CFR §164.508) before using or disclosing PHI for:

  • Marketing purposes (including most subsidized treatment communications)
  • Sale of PHI — we do not sell PHI
  • Psychotherapy notes — most uses require authorization
  • Any use or disclosure not described in this Notice

**Revoking Authorization:** You may revoke a written authorization at any time by submitting a written request. Revocation is effective from the date received and does not apply to uses or disclosures already made in reliance on your authorization.

6.  Your Individual Rights Under HIPAA

Right to Access PHI (§164.524) Inspect and receive copies of your PHI. We respond within 30 days. Fees may apply for copying. We may deny access in limited circumstances with right to review.Right to Amend PHI (§164.526) Request corrections to inaccurate or incomplete PHI. We respond within 60 days. We may deny amendments we believe are accurate.
Right to Accounting of Disclosures (§164.528) Receive a list of certain disclosures made during the past 6 years. Does not include disclosures for TPO, to you, or with your authorization.Right to Restrict Disclosures (§164.522(a)) Request restrictions on uses or disclosures of PHI. We MUST honor requests to restrict disclosures to health plans for services you pay entirely out-of-pocket.
Right to Confidential Communications (§164.522(b)) Request we contact you by a specific means or at a specific location. We accommodate reasonable requests without requiring explanation.Right to a Paper Copy of This Notice Receive a paper copy at any time upon request, even if you previously agreed to receive it electronically. No fee for first copy.

How to Exercise Your HIPAA Rights

Submit requests in writing to our Privacy Officer:

PRIVACY OFFICER — ASSURANCE BENEFITS Phone: 623-780-0077 Web: abc-incorp.com/contact-2   We acknowledge requests within 5 business days and respond within the regulatory timeframe. Identity verification required. No adverse action taken for exercising any HIPAA right.

7.  Our HIPAA Legal Duties

  • Maintain the privacy of your PHI as required by federal law
  • Provide you this Notice of Privacy Practices — abide by its current terms
  • Notify you of a breach of your unsecured PHI within 60 days of discovery (45 CFR §164.404)
  • Apply the Minimum Necessary Standard — limit PHI use to what is needed
  • Not use or disclose PHI in ways not permitted or required by HIPAA
  • Not condition treatment or benefits on signing an authorization for prohibited purposes
  • Not retaliate against you for filing a complaint, refusing to sign an authorization, or exercising any HIPAA right

Breach Notification (45 CFR §164.404)

If we discover a breach of your unsecured PHI, we will notify you within 60 days. Notification will include: description of the breach; types of PHI involved; steps you should take to protect yourself; steps we are taking to investigate and mitigate harm; and our contact information. Breaches affecting 500 or more individuals in a state will also trigger notification to HHS and prominent media outlets in that area.

8.  How to File a HIPAA Complaint

You have the right to file a complaint if you believe your HIPAA privacy rights have been violated. You will NOT be retaliated against for filing a complaint.

File a Complaint With: 1. OUR PRIVACY OFFICER:    Phone: 623-780-0077  |  Web: abc-incorp.com/contact-2   2. HHS OFFICE FOR CIVIL RIGHTS (OCR):    Website: hhs.gov/hipaa/filing-a-complaint    Phone: 1-800-368-1019  |  TDD: 1-800-537-7697    Mail: Office for Civil Rights, U.S. Dept. of Health and Human Services          200 Independence Ave SW, Washington, DC 20201   3. ARIZONA DEPARTMENT OF INSURANCE AND FINANCIAL INSTITUTIONS (DIFI):    difi.az.gov  |  602-364-3100

9.  Changes to This Notice

We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain, including PHI created or received before the revision. We will post the revised Notice on our website and make paper copies available upon request. We will distribute the revised Notice to active clients as required by 45 CFR §164.520(b)(3). The effective date at the top of this Notice indicates the currently applicable version.

This Notice was updated in July 2026 to incorporate substance use disorder (SUD) record protections required by the 2024 HIPAA Privacy Rule Final Rule, effective February 16, 2026 (42 U.S.C. §290dd-2; 42 CFR Part 2).

This HIPAA Notice of Privacy Practices is required by 45 CFR §164.520 (HIPAA Privacy Rule) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act (Pub. L. 111-5). Updated July 2026 to comply with the 2024 HIPAA Privacy Rule Final Rule regarding substance use disorder records (42 U.S.C. §290dd-2; 42 CFR Part 2), effective February 16, 2026. This combined notice satisfies both 45 CFR §164.520 and 42 CFR §2.22. (C) 2026 Assurance Benefits Corp. | Licensed in Arizona | Not affiliated with any government agency.