Privacy Policy

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review this Notice carefully.

Your health record contains personal information about you and your health. State and federal law protects the confidentiality of this information. “Protected health information” or “PHI” is information about you, including demographic information that may identify you and relates to your past, present or future physical or mental health or condition and related health care services. The confidentiality of mental health and substance use disorder records is specifically protected by state and/ or federal law and regulations. Rosecrance, Inc., Rosecrance Health Network, , Rosecrance Jackson Centers, Inc., Rosecrance Therapies, LLC, North Central Behavioral Health Services, Inc. and Aspen Counseling & Consulting, LLC (collectively the “Covered Entities”) are required to comply with these additional restrictions. This includes a prohibition, with very few exceptions, on informing anyone outside the program that you attend/attended the program or disclosing any information that identifies you as a person receiving mental health or substance use disorder treatment. If you suspect a violation, you may file a report to the appropriate authorities in accordance with state and federal regulations. Additionally, the Covered Entities included in this joint Notice will share protected health information with each other, as necessary, to carry out treatment, payment and healthcare operations. Covered Entities must legally maintain the privacy and security of your PHI and follow the duties and privacy practices described in this notice. Covered Entities will not use or share information other than as described here unless authorized in writing.

How We May Use and Disclose Health Information About You

•For treatment. We may use medical and clinical information about you to provide you with treatment orservices, coordinating care, or managing your treatment. If you receive substance use disorder treatment,we may disclose PHI to other providers after obtaining a single consent for all future uses and disclosuresfor treatment purposes. If you do not receive substance use care from Rosecrance, we may coordinate yourcare with other providers without your consent. For example, Covered Entities may need to refer you tothe care of another provider.

•For payment. We may use and disclose protected health information about you so that we can receivepayment for the treatment services provided to you. If you receive substance use disorder treatment, wemay disclose PHI to other providers after obtaining a single consent for all future uses and disclosures forpayment purposes. If you do not receive substance use care from Rosecrance, we may disclose yourprotected information for this limited purpose without your consent. Examples of payment-relatedactivities are making a determination of eligibility or coverage for insurance benefits, processing claims with your insurance company, reviewing services provided to you to determine medical necessity, orundertaking utilization review activities. If it becomes necessary to use collection processes due to lack ofpayment for services, we will only disclose the minimum amount of PHI necessary for purposes of collection.

•For health care operations. We may use and disclose your protected health information for certainpurposes in connection with the operation of our programs, including, but not limited to, qualityassessment activities, employee review activities, licensing, and conducting or arranging for other businessactivities. If you receive substance use disorder treatment, we may disclose PHI to third parties afterobtaining a single consent for all future uses and disclosures for health care operation purposes. If you donot receive substance use care from Rosecrance, we may disclose your protected information for thislimited purpose without your consent. For example, we may share your PHI with third parties that performvarious business activities (e.g., billing or typing services) provided we have a written contract with thebusiness that requires it to safeguard the privacy of your PHI. For training or teaching purposes PHI will bedisclosed only with your authorization.

ROSECRANCE AND AFFILIATES Notice of Privacy Practices

Version #: 5 Approved Date: 2/11/26

• Required by law. Under the law, we must disclose your PHI to you upon your request. In addition, we must make disclosures to the Secretary of the Department of Health and Human Services for the purpose of investigating or determining our compliance with the requirements of the Privacy Rule.

• Without authorization. Applicable law also permits us to disclose information about you without your authorization in a limited number of other situations, such as with a court order. These situations are explained below.

• Health Oversight. We may disclose PHI to a health oversight agency for activities authorized by law, such as for audits, investigations, and inspections. Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third- party payors) and peer review organizations performing utilization and quality control. If we disclose PHI for clients who receive substance use disorder services to a health oversight agency, we will have an agreement in place that requires the agency to safeguard the privacy of your information.

• Public Health. We may disclose your PHI for public health activities to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or if directed by a public health authority, to a government agency that is collaborating with that public health authority. If you receive substance use disorder services, your records will be de-identified before such disclosure according to the standards established by federal law. In certain circumstances outlined in the Privacy Regulations, we may disclose your PHI to a person who is subject to the jurisdiction of the Food and Drug Administration with respect to the reporting of certain occurrences involving food, drugs, or other products distributed by such person. In certain limited circumstances, we may also disclose your PHI to a person that may have been exposed to a communicable disease or may otherwise be at risk of spreading or contracting such disease, if such disease is authorized by law. For example, we may disclose PHI regarding the fact that you have contracted a certain communicable disease to a public health authority authorized by law to collect or receive such information.

• Fundraising. Covered Entities may use your protected health information to communicate with you to request a donation for a fundraising effort in support of or on the behalf of Covered Entities. You have the right to opt out of receiving fundraising communications. You can write to the Development Coordinator at 1021 N. Mulford Road, Rockford, Illinois 61107 or email giving@rosecrance.org with your request to opt out of future communications.

• Program Evaluation. We may use your protected health information to contact you for evaluation and follow-up studies conducted by Covered Entities staff in order to determine the effectiveness of Covered Entities services. Covered Entities may also disclose PHI to external program evaluators (including the Secretary of HHS for HIPAA rules, compliance, and enforcement purposes), with an agreement in place, if substance use disorder records are requested to be sent to or taken with the evaluator.

• Medical Emergencies. We may use or disclose your protected health information in a medical emergency situation to medical personnel only and as legally permissible if you have received substance use disorder services. If you have received mental health services only, Covered Entities can disclose your information without your consent in a medical emergency more broadly.

ROSECRANCE AND AFFILIATES Notice of Privacy Practices

Version #: 5 Approved Date: 2/11/26

• Coordination of Care: For clients who receive mental health services, Covered Entities may disclose PHI to other health providers for the purposes of continuity of care without your consent. The purpose of coordination will be limited to admission, treatment, planning, discharge, or governmentally mandated public health reporting. For clients who receive substance use services and situations that are not emergencies, your consent is needed to coordinate care with third parties.

• Mandated Reporting. We may use your protected health information in order to comply with rules and regulations mandating Covered Entities staff to report to law enforcement or government agencies. Examples of situations where reporting may be necessary include abuse and neglect, FOID reporting to DHS, and duty to warn situations. Duty to warn situations occur when someone indicates a specific act of violence towards themselves or another individual.

• Deceased Client. We may disclose PHI regarding deceased clients for the purpose of determining the cause of death, in connection with laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

• Research. We may disclose PHI to researchers if (a) an Institutional Review Board reviews and approves the research and waiver to the authorization requirement; (b) the researchers establish protocols to ensure the privacy of your PHI; (c) the researchers agree to maintain the security of your PHI in accordance with applicable laws and regulations; and (d) the researchers agree not to redisclose your protected health information except back to Covered Entities.

• Criminal Activity on Program Premises/Against Program Personnel. If you receive substance use disorder services, we may disclose your PHI to the law enforcement officials if you have committed a crime on program premises or against program personnel or have threatened to do so. If you receive mental health services, your information may be disclosed if Covered Entities believe a violation of criminal law or other serious incident has occurred in Covered Entities program.

• Legal. We may disclose your PHI to respond to lawsuits and legal actions. If you are involved in a legal issue where Rosecrance is not a party, Rosecrance may disclose your information for situations involving family matters, worker’s compensation, civil actions, or other legal issues either with your authorization or without your authorization if we receive a court order. If a court orders the release of your substance use treatment records for a legal proceeding against you, we will notify you in writing and give you written notice and an opportunity to be heard.

• Court Order. We may disclose your PHI if a court issues an appropriate order and follows required procedures.

• Special Government Functions. If you are an active military member or veteran, we may disclose your PHI as required by military command authorities. We may disclose your PHI to authorized federal officials for national security and intelligence reasons and to the Department of State for medical suitability determinations.

• With Authorization. We must obtain written authorization from you for all other uses and disclosures of your PHI.

• Redisclosure. If your PHI is disclosed pursuant to any of the reasons listed above, your PHI may be disclosed again by the recipient of your PHI from Rosecrance, or “redisclosed,” and will no longer be protected by confidentiality laws.

ROSECRANCE AND AFFILIATES Notice of Privacy Practices

Version #: 5 Approved Date: 2/11/26

Your Rights Regarding Your PHI

You have the following rights regarding PHI we maintain about you. To exercise any of these rights, please submit your request in writing to the Medical Records Department at 1021 N. Mulford Rd., Rockford, IL 61107 or medicalrecords@rosecrance.org. If you have any questions, you may contact the Privacy Officer at 815-391-1000 or privacy@rosecrance.org.

• Right to Revocation. It is your right to revoke any of your authorizations at any time by sending written notification to the Medical Records Department to the addresses listed above.

• Right of Access to Inspect and Copy. You have the right, which may be restricted only in exceptional circumstances, to inspect and copy PHI that is maintained in a “designated record set.” A designated record set contains mental health/medical and billing records and any other records that are used to make decisions about your care. Your right to inspect and copy PHI will be restricted only in those situations where there is compelling evidence that access would cause serious harm to you or if the information is contained in separately maintained psychotherapy notes. We may charge a reasonable, cost-based fee for copies. If your records are maintained electronically, you may also request an electronic copy of your PHI. You may also request that a copy of your PHI be provided to another person.

• Right to Amend. If you feel that the PHI, we have about you is incorrect or incomplete, you may ask us to amend the information although we are not required to agree to the amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us. We may prepare a rebuttal to your statement and will provide you with a copy. Please contact the Privacy Officer if you have any questions.

• Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures that we make of your PHI. We may charge you a reasonable fee if you request more than one accounting in any 12-month period.

• Right to Request Restrictions. You have the right to request a restriction or limitation on the use or disclosure of your PHI for treatment, payment, or health care operations. We are not required to agree to your request unless the request is to restrict disclosure of PHI to a health plan for purposes of carrying out payment or health care operations, and the PHI pertains to a health care item or service that you paid for out of pocket. In that case, we are required to honor your request for a restriction.

• Right to Request Confidential Communication. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. We will accommodate reasonable requests. We may require information regarding how payment will be handled or specification of an alternative address or other method of contact as a condition for accommodating your request. We will not ask you for an explanation of why you are making the request.

• Breach Notification. If there is a breach of unsecured PHI concerning you, we may be required to notify you of this breach, including what happened and what you can do to protect yourself.

• Right to a Copy of this Notice. You have the right to a copy of this notice.

ROSECRANCE AND AFFILIATES Notice of Privacy Practices

Version #: 5 Approved Date: 2/11/26

Complaints

If you believe we have violated your privacy rights, you have the right to file a complaint in writing with our Privacy Officer at 1021 North Mulford Road, Rockford, IL 61107, 815.391.1000. You may also file a complaint with the Secretary of Health and Human Services at 200 Independence Avenue, S.W. Washington, D.C. 20201 or by calling 202.619.0257. We will not retaliate against you for filing a complaint.

Confidentiality of Substance Use Disorder Treatment Records

The confidentiality of substance use disorder treatment records is protected by additional federal law and regulations. The Covered Entities are required to comply with these additional restrictions. This includes a prohibition, with very few exceptions, on informing anyone outside the Covered Entities that you attend a substance use treatment program or disclosing your substance use disorder counseling notes without your specific consent. Some of the exceptions to this general rule include:

• The disclosure is allowed by a court order.

• The disclosure is made to medical personnel in a medical emergency.

• The disclosure is with your written consent.

Confidentiality of Mental Health Treatment Records

The confidentiality of mental health client records is protected by state law and regulations. The Covered Entities are required to comply with these additional restrictions. This includes a prohibition, with limited exceptions, on informing anyone outside the Covered Entities that you are a recipient of mental health treatment or disclosing any information that identifies you as a recipient of mental health services. Some of the exceptions to this general rule include:

• The disclosure is allowed by a court order.

• The disclosure is made to medical personnel in a medical emergency.

• The disclosure is with your written consent

• The disclosure for purposes of health information exchange, in accordance with the requirements of the Illinois Mental Health and Developmental Disabilities Confidentiality Act or Iowa Code Chapter 228. Unless you have chosen to opt out of the health information exchange as specified in that Act.

The violation of state laws or regulations by this program is a crime. If you suspect a violation, you may file a report to the appropriate authorities in accordance with state law.

If you have any questions about this Notice of Privacy Practices, please contact our Privacy Officer:

Privacy Officer

1021 North Mulford Road Rockford, IL 61107

815.387.1000

This Notice of Privacy Practices describes how we may use and disclose your protected health information (“PHI”) in accordance with all applicable law. It also describes your rights regarding how you may gain access to and control your PHI. We are required by law to maintain the privacy of PHI and to provide you with notice of our legal duties and privacy practices with respect to PHI. We are required to abide by the terms of this Notice of Privacy Practices. We reserve the right to change the terms of our Notice of Privacy Practices at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time. We will make available a revised Notice of Privacy Practices by posting a copy on our website: www.rosecrance.org, sending a copy to you in the mail upon request, or providing one to you at your next appointment.

Effective Date: February 16, 2026