PRIVACY POLICY

Your Privacy.
Our Priority.

Effective Date: 10/08/2026 | Last Updated: 10/08/2026

Winds of Change Recovery (“Winds of Change Recovery,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals who visit our website and individuals who receive care through our programs, including our Intensive Outpatient Program, Hope House, Ray’s House, and Gift of Recovery. This Privacy Policy explains how we collect, use, disclose, and protect information, and how it relates to our obligations under the Health Insurance Portability and Accountability Act (HIPAA) and, where applicable, 42 CFR Part 2, the federal regulation governing the confidentiality of substance use disorder patient records.

This Privacy Policy applies to our website. It does not replace our formal Notice of Privacy Practices (NPP), which governs how we use and disclose Protected Health Information (PHI) for patients receiving clinical care. A copy of our Notice of Privacy Practices is provided to every client at intake and is available upon request. Where this website policy and the Notice of Privacy Practices differ regarding PHI, the Notice of Privacy Practices controls.

“

“ Real people.
Real recovery.
Real change. ”

1. Our Commitment to HIPAA and 42 CFR Part 2

Winds of Change Recovery is a covered entity under HIPAA and, because we provide substance use disorder treatment, our patient records are also protected under 42 CFR Part 2.

HIPAA protects Protected Health Information (PHI) — information that identifies an individual and relates to their health condition, treatment, or payment for care.
42 CFR Part 2 provides additional, stronger protections specifically for records that would identify someone as having sought or received substance use disorder treatment. Under Part 2, we generally cannot disclose information that identifies a patient as a current or former patient of our program without the patient's specific written consent, except in narrowly defined circumstances such as medical emergencies, court orders meeting Part 2 requirements, or as otherwise permitted by law.

Where HIPAA and 42 CFR Part 2 impose different standards, we follow whichever standard is more protective of patient privacy.

2. Information We Collect

Information you provide directly, such as when you submit a contact form, request a confidential consultation, call our admissions line, or communicate with us by email:

Information collected automatically when you visit our website:

We do not require you to identify yourself or a loved one as seeking treatment in order to browse our website generally. Any information you voluntarily submit through a form is treated as confidential under this Policy and, once associated with an individual seeking or receiving care, may be subject to 42 CFR Part 2 protections.

3. How We Use Information

We use information collected through this website to:

Respond to inquiries and consultation requests
Verify insurance coverage, when requested
Communicate with individuals about admissions and treatment options
Improve our website and services
Comply with applicable legal and regulatory requirements

We do not sell personal information or PHI. We do not use information that identifies someone as seeking or receiving substance use disorder treatment for marketing purposes without specific, written, and time-limited consent, consistent with 42 CFR Part 2.

4. When We Disclose Information

We disclose PHI and Part 2-protected information only as permitted or required by law, including:

With your written consent — for example, to coordinate care with another provider or communicate with a family member you've authorized.
For treatment, payment, and healthcare operations, as permitted under HIPAA and consistent with Part 2 requirements.
In a medical emergency, to the extent necessary to protect the health or safety of the patient or another person.
As required by law, such as in response to a valid court order that meets 42 CFR Part 2's specific requirements — a standard subpoena alone is generally not sufficient to compel disclosure of Part 2-protected records.
To our business associates, who are contractually bound to protect PHI under HIPAA Business Associate Agreements. [Insert list or category of business associates — e.g., EHR platform, insurance verification service, answering service — for accuracy.]

Re-disclosure notice required under 42 CFR Part 2: “This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of information that identifies a patient as having a substance use disorder unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose.”

5. Cookies, Analytics, and Third-Party Tools

[Compliance flag — requires confirmation before publishing]

If this website uses analytics tools (such as Google Analytics), advertising pixels (such as the Meta/Facebook Pixel or Google Ads remarketing tags), chat widgets, or third-party form providers, those tools may collect information about site visitors — including visitors who arrive after searching for addiction treatment. Under 42 CFR Part 2, allowing a third-party advertising or analytics platform to receive information that could identify someone as seeking substance use disorder treatment can constitute an impermissible disclosure, even without a name attached, depending on how the tool is configured.

Before this policy is published, please confirm with your web development and compliance team:

Which analytics or advertising tools are active on wocrecovery.com
Whether any forms transmit data to third parties without a signed Business Associate Agreement and, where applicable, Part 2-compliant consent
Whether IP addresses and device identifiers collected via ads/pixels are configured to avoid re-identifying individuals as patients

Once confirmed, this section should be updated to accurately describe:

6. Your Rights

If you are a patient of Winds of Change Recovery, you have the right to:

Request access to your medical records
Request an amendment to your records
Request a restriction on certain uses or disclosures
Request an accounting of disclosures
Request confidential communications
Revoke a previously signed consent for disclosure, in writing, at any time (revocation does not affect disclosures already made in reliance on that consent)
File a complaint with Winds of Change Recovery or with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated, without fear of retaliation

Full details of these rights are described in our Notice of Privacy Practices, provided at intake and available upon request.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect PHI and personal information in accordance with HIPAA’s Security Rule. This includes access controls, encryption where appropriate, and staff training on confidentiality requirements, including 42 CFR Part 2. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's Privacy

If you have questions about this Privacy Policy, our privacy practices, or wish to file a complaint, please contact:

Our website is intended for adults seeking information about treatment for themselves or a loved one. We do not knowingly collect personal information from children under 13 through this website.

[If Gift of Recovery serves adolescents, this section should be reviewed separately to address any minor-specific consent and disclosure requirements under state law and 42 CFR Part 2.]

9. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page reflects the most recent revision. Material changes affecting how PHI is used or disclosed will also be reflected in an updated Notice of Privacy Practices where applicable.

10. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or wish to file a complaint, please contact:

Privacy Officer: [Insert Name/Title]
Winds of Change Recovery
Phone: (713) 205-6298
Email: info@wocrecovery.com

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints, or with the Substance Abuse and Mental Health Services Administration (SAMHSA) regarding 42 CFR Part 2 concerns.

Pre-Publication Compliance Notes

Before this goes live, I’d strongly recommend:

A healthcare/HIPAA compliance attorney reviews this document — privacy policy language carries real legal liability, and only counsel familiar with WOC's actual data flows can confirm this is accurate and complete.
Someone technical audits the actual website for analytics/ad pixels and confirms whether Section 5's compliance flag applies — this is the single biggest real-world risk area for addiction treatment websites right now, and it's a common gap.
Business associates are actually listed in Section 4 rather than left as a placeholder.

Want me to also draft the shorter, plain-language HIPAA Notice of Privacy Practices that’s typically handed to patients at intake, separate from this website policy?

Questions About Your Privacy?

We're here to help. Contact us for any privacy-related questions or concerns.

Your Privacy.Our Priority.