Privacy Policy

1Eleven LLC (“1Eleven,” “we,” “us,” or “our”) is an outpatient addiction and mental health treatment provider in Greensboro, North Carolina. Protecting your privacy is part of protecting your recovery, and we treat that responsibility seriously.

This Privacy Policy (“Policy”) explains how we collect, use, disclose, and safeguard information, including your protected health information (“PHI”), in accordance with the Health Insurance Portability and Accountability Act (“HIPAA”), the federal confidentiality rules for substance use disorder patient records at 42 C.F.R. Part 2 (“Part 2”), and applicable North Carolina law.

Who This Policy Applies To

This Policy covers:

• Visitors to our website, including anyone who submits a contact or insurance verification form
• Prospective clients who call, text, or otherwise reach our admissions team
• Current and former clients of our partial hospitalization (PHP), intensive outpatient (IOP), and outpatient (OP) programs
• Family members, referral partners, and others who share information with us in connection with a client’s care

Information We Collect

Information you give us directly. When you call us, complete a form on our site, or begin the admissions process, we may collect your name, phone number, email address, insurance provider and policy information, the reason you are reaching out, and anything else you choose to tell us.

Protected health information. If you enter our care, we collect the information necessary to treat you and to bill for that treatment. This includes medical and behavioral health history, assessment results, diagnoses, treatment and progress notes, medication and prescribing records, drug screening results, records from other providers, insurance and payment records, and emergency contact information.

Sensitive personal information. Depending on your circumstances, this may include a Social Security number, driver’s license or state identification number, financial account information, and demographic information such as date of birth.

Information collected automatically. When you visit our website, our servers and service providers may log your IP address, device and browser type, operating system, pages viewed, time spent on the site, referring page, and general geographic region. We also use cookies and similar technologies as described below.

How We Use Your Information

We use PHI for treatment, payment, and health care operations, and otherwise as permitted or required by law. In practice, that means we use it to:

• Provide, coordinate, and manage your clinical care, including with outside providers involved in your treatment
• Verify your insurance benefits, obtain prior authorizations, and bill your health plan
• Run quality improvement, accreditation, licensing, audit, training, and compliance activities
• Respond to your admissions inquiry and follow up about care you asked us about
• Contact you about appointments, treatment alternatives, and aftercare
• Operate, secure, and improve our website
• Meet our legal, regulatory, and accreditation obligations

We do not sell your personal information or your PHI. We do not use or disclose PHI for marketing purposes, and we do not disclose PHI to advertising platforms, without your written authorization.

Special Protections for Substance Use Disorder Records

Records that identify you as someone who has applied for, received, or been referred for substance use disorder treatment receive protection under federal law that is stronger than HIPAA alone. Under 42 C.F.R. Part 2:

• We generally may not tell anyone outside our program that you are a client here, or disclose any information identifying you as having a substance use disorder, without your written consent.
• That protection applies to family members, employers, schools, and anyone else who contacts us about you, unless you have signed a consent naming them.
• Federal law and regulations do not protect any information about a crime committed by a client either at the program or against any person who works for the program, or about any threat to commit such a crime.
• Federal law and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.
• Your records may not be used to investigate or prosecute you in a criminal matter unless a court issues an order that meets the specific requirements of Part 2.
• Limited exceptions allow disclosure without consent, including a bona fide medical emergency, disclosures to a qualified service organization that provides services to our program, program audits and evaluations, and research conducted under federal safeguards.

Under the 2024 revisions to Part 2, a single consent can, if you choose, permit disclosure for treatment, payment, and health care operations on an ongoing basis, and you may revoke that consent in writing at any time except to the extent it has already been acted on. We will provide you with our Notice of Privacy Practices describing these rights in full, and you may request a copy at any time.

How and When We Share Information

We share information only as needed and only as the law allows:

• With people involved in your care, such as treating providers, laboratories, pharmacies, and, where you have consented, family members or a designated support person
• With your health plan, for verification, authorization, claims, and payment
• With business associates and qualified service organizations, such as our electronic health record vendor, billing company, and IT providers, each of which is bound by a written agreement requiring them to protect your information
• For public health and safety, including reporting suspected abuse or neglect, responding to a serious and imminent threat to your health or safety or that of another person, and required public health activities
• As required by law, including in response to a valid court order, subpoena, or lawful government request, and to the U.S. Department of Health and Human Services when it is reviewing our compliance

Any disclosure not described in this Policy or in our Notice of Privacy Practices will be made only with your written authorization, which you may revoke at any time.

Cookies, Analytics, and Website Tracking

Our website uses cookies and similar technologies to keep the site working properly, remember your preferences, measure traffic, and understand which pages people find useful. Some of these tools are provided by third parties, such as web analytics providers.

We take particular care with tracking technologies on a behavioral health website. We do not knowingly configure advertising or analytics tools in a way that discloses your PHI or identifies you as a current or prospective client to a third party.

You can disable or delete cookies through your browser settings, and most analytics providers offer their own opt out tools. Blocking cookies may affect how parts of the site function. Where required, we honor recognized browser based opt out signals, such as Global Privacy Control.

Calls, Texts, and Forms

When you submit a form or send us your phone number, you are giving us permission to contact you about your inquiry by phone, text, or email. Message and data rates may apply, and you can opt out at any time by replying STOP or by telling the person you are speaking with. Consent to be contacted is never a condition of receiving treatment.

Please do not include detailed clinical information in a website form or an unencrypted email. Standard email and text messaging are not fully secure. If you need to share sensitive details, call us and we will find a secure way to receive them.

Your Rights Under HIPAA

You have the right to:

• Access. Inspect and obtain a copy of your health record, in electronic form where we maintain it that way.
• Amend. Ask us to correct information you believe is inaccurate or incomplete.
• An accounting of disclosures. Receive a list of certain disclosures we have made of your information.
• Request restrictions. Ask us to limit how we use or disclose your information. We will honor a request to withhold information from your health plan when you pay for a service in full out of pocket.
• Confidential communications. Ask us to contact you at a specific number, address, or in a specific way.
• A paper copy. Receive a paper copy of our Notice of Privacy Practices, even if you agreed to receive it electronically.
• Revoke an authorization. Withdraw permission you previously gave, in writing, except where we have already acted on it.
• Breach notification. Be notified if your unsecured PHI is involved in a breach.
• Complain. File a complaint with us or with federal or state authorities without fear of retaliation.

Your Rights Under North Carolina Law

North Carolina does not currently have a comprehensive consumer data privacy statute. Information governed by HIPAA and 42 C.F.R. Part 2 is handled under those federal frameworks, and your rights in that information are the HIPAA and Part 2 rights described above.

For information outside those frameworks, such as data collected from general website visitors, you may contact us using the details below to ask what information we hold about you, to request that we correct inaccuracies, or to request deletion. We will review your request, respond as promptly as we reasonably can, and tell you if we are unable to fulfill it and why. Nothing in this section limits any right you have under North Carolina law, including North Carolina’s consumer protection and identity theft protection statutes.

Data Security

We maintain an information security program with administrative, technical, and physical safeguards designed to protect your Personal Information and PHI against unauthorized access, use, disclosure, alteration, and destruction. These measures include role based access controls, unique user credentials, encryption of data in transit and at rest where appropriate, secure disposal of records, workforce training on confidentiality and Part 2 requirements, business associate and qualified service organization agreements, and ongoing risk assessment.

No system is perfectly secure. If a breach of unsecured PHI or of personally identifiable information occurs, we will notify affected individuals and the appropriate authorities as required by the HIPAA Breach Notification Rule, 42 C.F.R. Part 2, and North Carolina’s Identity Theft Protection Act, N.C. Gen. Stat. §§ 75-61 and 75-65.

How Long We Keep Information

We retain clinical records for the period required by North Carolina licensing rules, federal regulation, and our accreditation standards, and we retain other information only as long as it serves the purpose it was collected for or as long as the law requires. When a record reaches the end of its retention period, we destroy it in a way that protects confidentiality.

Third Party Service Providers

We work with vendors who need access to information to do their jobs, including our electronic health record system, billing and revenue cycle partners, laboratory services, IT and hosting providers, and communication platforms. Each is bound by a business associate agreement, a qualified service organization agreement, or both, and each is required to protect your information under the same standards that apply to us and to use it only for the purpose we engaged them for.

Links to Other Websites

Our site may link to resources operated by others, such as insurance carriers, government agencies, or community organizations. We do not control those sites and are not responsible for their privacy practices. We encourage you to read the privacy policy of any site you visit.

Children’s Privacy

Our programs serve adults, and our website is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information through our website, please contact us and we will delete it.

Changes to This Policy

We review this Policy at least annually and revise it whenever our practices or the law change in a meaningful way. The current version is always posted on this page with its effective date. We reserve the right to make changes effective for information we already maintain, and we will notify you of material changes affecting how we handle your PHI.

Contact Us

To ask a question about this Policy, exercise any of the rights described above, or request a copy of our Notice of Privacy Practices, contact our Privacy Officer:

1Eleven LLC
2301 N Church Street, Greensboro, NC 27405, USA
contact@1elevennc.com

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer, or directly with:

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue SW, Washington, D.C. 20201
1-877-696-6775 | ocrportal.hhs.gov/ocr/complaints

Complaints about the confidentiality of substance use disorder records under 42 C.F.R. Part 2 may also be submitted to the Department of Health and Human Services. Questions about your rights under North Carolina consumer protection law may be directed to the North Carolina Department of Justice, Consumer Protection Division, at ncdoj.gov.

We will never retaliate against you, deny you care, or treat you differently for filing a complaint.