Your Privacy & Rights

---

Colorado Data Breach Notification (C.R.S. § 6-1-716)

In the event of a security breach involving your personal identifying information, Back On Track will notify you within 30 days of determining the breach occurred, in accordance with Colorado’s data breach notification law — which is stricter than the federal 60-day HIPAA requirement.

Information We Will Never Disclose Without Your Written Consent

• Your records to employers

• Your records to law enforcement (except as required by court order meeting 42 CFR Part 2 standards)

• Your HIV/AIDS status (protected under C.R.S. § 25-4-1404)

• Your information for marketing purposes

• Sale of your health information to any third party

Our Responsibilities

Back On Track is required to:

• Maintain the privacy and security of your PHI

• Provide you with this notice and obtain written acknowledgment of receipt

• Notify you promptly in the event of a breach

• Follow the terms of this notice

• Train all workforce members on HIPAA, 42 CFR Part 2, and Colorado privacy requirements

• Designate a Privacy Officer responsible for compliance

Changes to This Notice

We reserve the right to revise this notice at any time. Changes will apply to information already maintained as well as information received after the revision date. The updated notice will be posted on our website, made available at our facility, and provided upon request.

Colorado Attorney General’s Office

Consumer Protection Section

1300 Broadway, 7th Floor

Denver, CO 80203

(720) 508-6000

coag.gov

U.S. Department of Health and Human Services

Office for Civil Rights — Region VIII

1961 Stout Street, Room 08-148

Denver, CO 80294

(800) 368-1019

www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be penalized or retaliated against for filing a complaint.

Contact Us

For questions about this notice, your privacy rights, or to submit a request:

Back On Track

2821 S. Parker Road Ste 707

Aurora, CO 80014

303-550-5339

Backtrack.pro

By signing our intake documentation, you acknowledge that you have received a copy of this Notice of Privacy Practices and have been given the opportunity to ask questions.