HELEN ROSS MCNABB CENTER, Inc.
200 Tech Center Drive
Knoxville, Tennessee 37912
Effective March 18, 2026
YOU HAVE THE RIGHT TO RECEIVE A COPY OF THIS NOTICE. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND HOW TO FILE A HIPAA COMPLAINT. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this Privacy Notice, please contact our Privacy Officer, Paula Hudson. You may reach her via mail at Helen Ross McNabb Center, 200 Tech Center Dr., Knoxville, TN 37912; via phone at (865) 637-9711 or Toll Free 1-800-255-9711, or via email at Paula.Hudson@mcnabb.org.
Legal Obligations
The HELEN ROSS MCNABB CENTER (“Provider”) is required to (i) maintain the privacy of all health information within its organization;(ii) provide this Notice of Privacy Practices (“Notice”) to you; (iii) inform you of our legal obligations; and (iv) advise you of additional rights concerning Protected Health Information (defined below). Affected individuals have the right to, and will, receive notification following any breach of unsecured Protected Health Information. Provider shall follow the privacy practices contained in this Notice from its effective date and continue to do so until this Notice is changed or replaced.
Provider reserves the right to change privacy practices and the terms of this Notice at any time. Any changes made in these privacy practices will be effective for all Protected Health Information that is maintained by Provider or its Business Associates, including Protected Health Information created or received before the changes were made. We may update our Notice of Privacy Practices in the event revisions are made. The most current version will always be available on our website and upon request at our service locations. You may request a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically.
Certain services provided by this organization may be subject to confidentiality laws that provide greater privacy protections than those described in this Notice. These laws may apply to specific types of health information or services and may restrict how information can be used or disclosed. When such laws apply, we will comply with the more protective requirements. Examples include federal laws protecting substance use disorder treatment records, services funded through federal victim assistance programs, and other laws that apply to specific services provided by this organization.
Organizations Covered by This Notice
This Notice applies to the privacy practices of Provider and all health care providers involved in your care and treatment on behalf of Provider.
Our Uses and Disclosures of Your PHI
Protected Health Information (“PHI”), as defined by 45 CFR 160.103, is information collected from an individual that relates to the past, present, or future physical or mental health condition of an individual, the provision of health care to an individual, or payment for provision of health care to the individual which identifies the individual or for which there is a reasonable basis to believe that the information can be used to identify the individual.
This Notice describes how we may use and disclose your PHI to carry out treatment, payment, or healthcare operations and for other purposes that are permitted or required by law. When using or disclosing your protected health information, we will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, except where the law allows or requires us to disclose the full information, such as for treatment purposes, disclosures to you, or other circumstances permitted by law. This Notice also describes your rights regarding PHI that we maintain about you and a brief description of how you may exercise these rights. We will use and disclose your PHI as described in each category listed below. Other uses and disclosures not described in this Notice will only be made with your authorization. Once given, such authorization may be revoked by you in writing, except to the extent Provider has already taken action in reliance thereon, or if the authorization was obtained as a condition to obtaining insurance coverage, and other law provides the insurer with the right to contest the claim.
Treatment: Your PHI may be disclosed to a doctor or other health care provider who asks for it in connection with the provision of treatment to you or is otherwise involved in your care. For example, we may share information with a hospital to coordinate your care. Provided, however, that the disclosure of any psychotherapy notes (as defined by 45 CFR 164.501) will require your prior authorization.
Payment: Your PHI may be used or disclosed to file a claim for payment of services provided to you by Provider, doctors, or other health care providers.
Health Care Operations: Your PHI may be used and disclosed to conduct our business, such as quality assessment and improvement activities; to engage in care coordination or case management; to pursue any right of recovery, reimbursement, and/or subrogation; for purposes of accreditation; and in connection with conducting and arranging legal and related services. It may also be used in connection with disease management, case management, conducting or arranging for medical review, legal services, auditing functions, fraud/abuse detection and compliance programs, business planning and development, business management, ensuring the safety of our patients, doctors, and other health care providers, and general administrative activities. We may use technology tools, including artificial intelligence (AI) or automated documentation systems, to assist clinicians in documenting services, coordinating care, and supporting administrative operations. These tools support our workforce and do not replace the professional judgement of clinicians.
Authorizations: You may provide written authorization that will permit Provider to disclose your PHI to anyone for any purpose. You may revoke this authorization in writing at any time, but this revocation will not affect any use or disclosure permitted by your authorization while it was in effect. Unless you provide written authorization, or authorize the use of an electronic signature that is documented in your clinical record during a telehealth service or other remote communication, we cannot use or disclose your Protected Health Information (PHI) for any purpose other than those described in this Notice. When an electronic signature is authorized verbally, a staff member will adhere to the telehealth electronic attestation workflow by confirming your identity, reviewing the form with you, and documenting your authorization and intent to sign electronically in your clinical record.
Medical Emergencies: PHI may be released to the extent necessary to avert a serious threat to your health or safety or to the health or safety of others. PHI may be disclosed to physicians, hospitals, emergency departments, ambulance providers, or other professionals to provide emergency treatment or coordinate care. If you are unable to provide consent due to your medical condition, we may share information as necessary to ensure your safety and appropriate care. In the event of a natural disaster or emergency (such as a tornado, flood, wildfire, or similar event), we may share limited PHI with disaster relief organizations (such as the American Red Cross or similar agencies) to help coordinate your care, notify family members or others involved in your care of your location and general condition, and assist in reunification efforts. When possible, we will give you the opportunity to agree or object to these disclosures. If you are unable to do so due to the emergency circumstances, we will use our professional judgment to determine whether the disclosure is in your best interest.
Personal Representative: If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make reasonable efforts to verify that such a person has this authority and can act for you before we take actions initiated by them. Your PHI may be disclosed to a family member, friend, or other person to the extent necessary to help with your health care or with payment for your health care, but only if you agree we may do so, as described in the Individual Rights section of this Notice below.
Plan Sponsors: Your PHI may be disclosed to your group plan sponsor or insurance provider in order to perform plan administration functions. Please see your plan documents for a full description of the limited uses and disclosures the plan sponsor may make of your PHI in order to administer your group health plan.
Underwriting: Your PHI may be disclosed for underwriting, premium ratings, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or benefits; provided, however, that we will not use or disclose your genetic information for such purposes. Your PHI will not be used or further disclosed for any other purpose, except as required by law.
Marketing; Sale; Fundraising: Your PHI will not be disclosed in a manner constituting a sale without your authorization. Your PHI may be used to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you. Your PHI may be disclosed to a Business Associate or other associate to assist us in these activities (unless the information is provided to you by a general newsletter or in person or is for products or services of nominal value). Provider may elect to contact you regarding fundraising efforts; however, you have the right to opt out of receiving such communications. To opt-out of any marketing or fundraising communications, contact the Privacy Officer listed at the top of this Notice.
Research: Your PHI may be used or disclosed for research purposes in limited circumstances. PHI of a deceased person may only be disclosed to a coroner, medical examiner, funeral director or organ procurement organization upon receipt of a judicial subpoena or court order or upon receipt of an authorization signed by the decedent’s appointed executor or personal representative.
As Required By Law: Your PHI may be used or disclosed as required by state or federal law. For example, PHI must be disclosed to the U.S. Department of Health and Human Services upon request for purposes of determining compliance with federal privacy laws. PHI may also be disclosed as follows: when required by worker’s compensation or similar laws; to a government agency authorized to oversee the health care system or government programs or its contractors; to respond to organ and tissue donation request; to respond to legal actions and lawsuits by court order or subpoena; and to public health authorities for public health purposes.
Reproductive Health Information: Federal law provides additional privacy protections for certain reproductive health information. We will not use or disclose your protected health information for the purpose of conducting a criminal, civil, or administrative investigation into, or imposing liability on, any person for seeking, obtaining, providing, or facilitating lawful reproductive health care. When a request is made for health information that could potentially be used for such purposes (for example, requests from law enforcement, courts, or other governmental authorities), federal law may require the requesting party to provide a signed attestation confirming that the request is not for a prohibited purpose before we can disclose the information. If such an attestation is required and is not provided, we will not disclose the requested information. These protections apply only to lawful reproductive health care and do not prevent disclosures that are otherwise required by law or permitted under federal privacy regulations.
Court or Administrative Order: PHI may be disclosed in response to a court or administrative order, subpoena, discovery request or other lawful process, under certain circumstances. We may also disclose your PHI in response to a third-party’s discovery request, subpoena, court order, or other lawful process. However, certain categories of records, including substance use disorder treatment records protected under federal law (42 CFR Part 2) or records protected under other confidentiality laws (such as federally funded victim assistance services), may require a specific court order or additional legal authorization before disclosure.
Law Enforcement: We may disclose protected health information to law enforcement officials only in limited circumstances and only when permitted by applicable federal and state law. For example, we may disclose information in response to a court order, warrant, or grand jury subpoena, or when required by law to report certain crimes, injuries, abuse, neglect, or threats to health or safety. We may also disclose limited information to assist law enforcement in locating or identifying a suspect, fugitive, material witness, or missing person, when permitted by law. Certain categories of information maintained by this organization may be protected by laws that provide greater confidentiality protections than those described in this Notice. When those laws apply, they may prohibit disclosure of information to law enforcement without a specific court order or other legal authorization. Examples include federal laws protecting substance use disorder treatment records, victim assistance service records, and other laws that apply to certain services provided by this organization. In some cases, a subpoena, warrant, or investigative request alone may not be sufficient to authorize disclosure of certain records. When these laws apply, we will follow the more protective legal requirements.
Victim of Abuse: PHI may be released to appropriate authorities based on our reasonable assumption that you are a possible victim of abuse, neglect or domestic violence or the possible victim of other crimes.
Military Authorities; National Security: PHI of Armed Forces personnel may be disclosed to Military authorities under certain circumstances. PHI may be disclosed to authorize federal officials as required for lawful intelligence, counterintelligence, and other national security activities.
Your Rights
Access: You have the right to review or obtain copies of your PHI, with limited exceptions. Certain mental health records are protected under Tennessee law (Title 33). In limited circumstances, access to records may be restricted if disclosure could cause serious harm to you or others. You may request a format other than photocopies, which will be accommodated unless Provider cannot practicably do so. You must make the request in writing to obtain access to your PHI. You may obtain a form to request access by contacting the Privacy Officer at the top of this Notice, you may send us a letter requesting access to the address located at the top of this Notice, or you may send us an email at hrmcrecords@mcnabb.org. If you prefer, we will prepare a summary or explanation of your PHI. For an explanation of the fees charged for preparing an explanation or summary, please contact our Privacy Officer at the location stated above. If we approve your request, we will provide the records to you within 10 business days. If there will be a delay, we will provide you with the reason for the delay and an estimated timeframe for receipt within 10 business days. If additional time is required, we may extend the response period as permitted by federal law and will notify you in writing. If we deny your request to access your health information, we will notify you in writing why the request was denied within 10 business days.
Accounting: You have the right to receive an accounting of the disclosures of your PHI by Provider or by a Business Associate of Provider. This accounting will list each disclosure that was made of your PHI for any reason other than treatment, payment, health care operations, disclosures made in response to an authorization signed by you, and certain other activities for the prior six (6) years. This accounting will include the date the disclosure was made, the name of the person or entity to whom the disclosure was made, a description of the PHI disclosed, the reason for the disclosure, and certain other information. If you request an accounting more than once in a 12-month period, there may be a reasonable cost-based charge for responding to these additional requests. For a more detailed explanation of the fee structure, please contact our Privacy Officer listed at the top of this Notice.
Restrictions on Use and Disclosure: You have the right to request restrictions on Provider’s use or disclosure of your Protected Health Information, including to your health plan, provided that you pay out-of-pocket in full for any such items or services except for in certain limited circumstances. Provider is not required to agree to these additional requests. If Provider is in agreement with the restrictions, Provider will honor the request except in an emergency or as otherwise specifically described herein.
Any agreement to restrictions on the use and disclosure of your PHI must be in writing and signed by an authorized individual on behalf of Provider. Provider will not be bound unless the agreement is so memorialized in writing.
Communications: You have the right to request confidential communications about your PHI by alternative means or to alternative locations. You must inform Provider that confidential communication by alternative means or to alternative locations is required to avoid endangering you. You must make your request in writing. Provider will accommodate the request if it is reasonable and specifies the alternative means or location.
Amendment of Protected Health Information: You have the right to request that Provider amend your PHI. Your request must be in writing, and it must explain why the information should be amended. Provider may deny your request if the PHI you seek to amend was not created by Provider or for certain other reasons. If your request is denied, Provider shall provide a written explanation of the denial. You may respond with a statement of disagreement to be appended to the information you wanted amended. If Provider accepts your request to amend the information, Provider will make reasonable efforts to inform others, including the people you name, of the amendment and to include the changes in any future disclosures of that information.
Notice of Breach: In the event that there is a breach involving your unsecured PHI, we will notify you within 60 days of discovery of the breach, and we will take steps to mitigate any harm that might reasonably be anticipated by the breach.
Confidentiality of Substance Abuse Records
Certain records related to substance use disorder (SUD) diagnosis, treatment, or referral for treatment are protected by a federal law known as 42 CFR Part 2. These laws provide additional privacy protections beyond those that apply to other types of health information. In general, we may not disclose information that identifies you as having or having had a substance use disorder, or that relates to your substance use disorder treatment, unless you provide written consent (including electronic signature), the disclosure is permitted by federal law, or the disclosure is ordered by a court that complies with federal law.
With your written consent, your substance use disorder information may be used or disclosed for purposes of treatment, payment, and health care operations as permitted by federal law. Once disclosed with your consent, recipients may re-disclose the information in accordance with applicable federal and state privacy laws, including federal confidentiality protections governing substance use disorder records. However, federal law places limits on how substance use disorder information may be used or shared.
Federal law prohibits the recipient of substance use disorder information from using or disclosing it to investigate or prosecute you for a substance use disorder unless authorized by a court order or otherwise permitted by law. Federal law allows disclosure of substance use disorder records without your written consent in certain limited circumstances, including:
- Medical emergencies when information is needed to treat a serious threat to your health or safety
- Court orders issued in accordance with federal law
- Scientific research, audits, or program evaluations conducted in accordance with federal regulations
- Reporting suspected child abuse or neglect as required by law
- Crimes committed at a treatment program or against program personnel
You have rights regarding your substance use disorder treatment records, including the right to request access to your records, the right to request an amendment to your records, the right to receive an accounting of certain disclosures, and the right to receive notification of a breach of your protected information. These rights are explained in more detail in the “Your Rights” section of this Notice.
Questions and Complaints
If you wish to opt out of certain communications as described above, or to request that we communicate with you by alternative means or at alternative locations, you may contact Provider’s Privacy Officer at the address or number set forth above. If you are concerned that Provider has violated your privacy rights, or you disagree with a decision made about access to your PHI or in response to a request you made to amend or restrict the use or disclosure of your PHI, you may contact us or submit a complaint using the contact information above. You may also submit a written complaint to the U.S. Department of Health and Human Services or the United States Attorney for the judicial district in which the violation occurred. Violations of federal confidentiality protections for substance use disorder records may also be reported to the Substance Abuse and Mental Health Services Administration (SAMHSA). The address to file a complaint with the U.S. Department of Health and Human Services will be provided upon request. We support your right to protect the privacy of your PHI. There will be no retaliation in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.
Provider’s Privacy Officer’s contact information is as follows:
Privacy Officer
Paula Hudson
Helen Ross McNabb Center
200 Tech Center Drive
Knoxville, TN 37912
(865) 637-9711
Toll Free 1-800-255-9711
Email: Paula.Hudson@mcnabb.org
