Part A — Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Our Commitment to Your Privacy
The Rose House is committed to protecting the privacy of your health information. We are required by law to maintain the privacy of your protected health information (PHI), to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect. We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain. If we make a material change, we will post the updated Notice on our website and make copies available upon request.
The Rose House provides mental health and substance use disorder treatment. Your records receive protection under HIPAA (45 CFR Parts 160 and 164), and substance use disorder records receive additional protection under federal law (42 CFR Part 2). Mental health records receive additional protection under Colorado law.
How We May Use and Disclose Your Health Information
The following describes the ways we may use and disclose your PHI. Some uses and disclosures of substance use disorder records require your specific written consent, as described in the “Special Protections” section below.
Treatment. We may use and disclose your PHI to provide, coordinate, or manage your care, including sharing among members of your treatment team and, where appropriate and authorized, with outside providers involved in your care.
Payment. We may use and disclose your PHI to obtain payment for services, including billing your insurer and verifying coverage, consistent with applicable consent requirements.
Health Care Operations. We may use and disclose your PHI for operations such as quality assessment, staff training and evaluation, licensing, accreditation, and business management.
Business Associates. We may share your PHI with third parties that perform services on our behalf (for example, billing or auditing). Each is required by written agreement to protect your PHI.
Special Protections for Substance Use Disorder Records (42 CFR Part 2)
Records that would identify you as someone who has applied for or received substance use disorder treatment are protected by federal law and regulations (42 CFR Part 2). We generally may not disclose these records without your written consent, except in limited circumstances permitted by law (such as a medical emergency, certain audits, or as ordered by a court). Federal law also prohibits anyone who receives these records from us from redisclosing them, except as permitted by 42 CFR Part 2. Violation of these protections is a crime that may be reported to appropriate authorities.
Special Protections for Mental Health Records
In addition to HIPAA, your mental health records are protected under Colorado law. We disclose mental health information only as permitted by state and federal law, and certain disclosures require your written authorization.
Uses and Disclosures That Require Your Written Authorization
The following always require your written authorization: most uses and disclosures of psychotherapy notes; uses and disclosures of PHI for marketing; the sale of PHI; and any other use or disclosure not described in this Notice. If you authorize a use or disclosure, you may revoke it in writing at any time, and the revocation will apply going forward.
Uses and Disclosures Permitted Without Your Authorization
Subject to the substance use disorder protections above, we may use or disclose your PHI without your authorization in these situations, as permitted or required by law:
- When required by federal, state, or local law
- For public health activities, such as preventing disease or reporting to public health authorities
- To report suspected abuse, neglect, or domestic violence
- For health oversight activities such as audits and inspections
- In judicial or administrative proceedings, in response to a valid order or process
- To law enforcement, in limited circumstances permitted by law
- To coroners, medical examiners, and funeral directors as necessary
- For organ or tissue donation, if applicable
- For research, only with your written authorization or as otherwise permitted by law
- To prevent or lessen a serious and imminent threat to the health or safety of you or others
- For specialized government functions, such as military or national security
- For workers’ compensation, as authorized by law
Your Rights Regarding Your Health Information
Access and copies. You may inspect and request a copy of your health information. Requests should be made in writing. A reasonable, cost-based fee may apply.
Amendment. If you believe your information is incorrect or incomplete, you may request an amendment in writing. We may deny the request in certain cases, and you may submit a statement of disagreement.
Accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.
Restrictions. You may request restrictions on certain uses and disclosures. We are not required to agree, except that we must agree to restrict disclosure to a health plan for a service you paid for in full out of pocket, where permitted by law.
Confidential communications. You may request that we communicate with you in a specific way or at a specific location (for example, only by mail).
Paper copy. You may request a paper copy of this Notice at any time.
Breach notification. You have the right to be notified if there is a breach of your unsecured PHI.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.
Privacy Officer The Rose House Allison Hill 601 Snowpeak Ln Lafayette, CO 80026, 720-471-0780, ahill@therosehouse.com
U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201
Part B — Website Privacy & Cookies Policy
This part explains how we handle information collected through therosehouse.com (the “Site”). It applies to visitors to our public website and is separate from the Notice of Privacy Practices in Part A above, which governs protected health information.
Information We Collect
Information you provide to us. Information you choose to give us when you complete a form, request information, or contact us — such as your name, email address, phone number, and the content of your message.
Information collected automatically. When you visit the Site, some information may be collected automatically through cookies and similar technologies, such as your IP address, device and browser type, the pages you view, and how you reached and moved through the Site.
Cookies and Tracking Technologies
We use cookies and similar technologies to operate the Site and understand how it is used:
- Strictly necessary — required for the Site to function; always active.
- Analytics and performance — Google Analytics 4 (GA4), to understand how the Site is used.
- Call tracking — CallRail, to understand which pages and sources lead to phone calls. CallRail processes this information as our service provider under a business associate agreement with The Rose House.
We do not run advertising or use the Site to target ads.
Non-essential cookies load only after you consent through our cookie banner. You can change your choices at any time using the “Cookie Settings” link location, e.g., in the footer.
How We Use and Share Site Information
We use this information to respond to your inquiries, operate and improve the Site, and understand how it is used. We share it only with the service providers who help us operate the Site, such as our analytics and call-tracking providers, under agreements consistent with our HIPAA obligations. We do not sell your personal information.
Your Privacy Choices and Rights
Colorado residents have rights under the Colorado Privacy Act, including the right to access, correct, and delete personal data, to obtain a portable copy, to opt out of targeted advertising, the sale of personal data, and certain profiling, and to appeal a denied request. Because health information is treated as sensitive data under Colorado law, we obtain consent before processing it where required.
California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information, and to opt out of sale or sharing.
Washington and Nevada residents have additional rights regarding consumer health data, described in the “Consumer Health Data” section below.
To make a request, contact us at ahill@therosehouse.com. We will not discriminate against you for exercising your rights.
Consumer Health Data (Washington and Nevada Residents)
Because The Rose House provides mental health and substance use disorder treatment, information indicating that you have sought or received our services may be considered “consumer health data” under Washington’s My Health My Data Act and Nevada’s SB 370. This section applies to residents of those states and describes how we handle such data collected through the Site. For Washington residents, this section serves as our Consumer Health Data Privacy Policy under the My Health My Data Act.
Categories of consumer health data we collect. Contact details you submit (name, email, phone), the content of your inquiry, and the fact of your interest in our treatment services; and, where applicable, identifiers and activity data collected automatically (such as IP address and pages viewed).
Sources. Directly from you when you complete a form or contact us, and automatically through cookies and similar technologies when you use the Site.
How we use it. To respond to your inquiry, help connect you with care, and operate and improve the Site.
How we share it, and with whom. We share consumer health data only with the service providers that help us operate the Site and respond to you — currently our analytics provider (Google, for GA4) and our call-tracking provider (CallRail) — under agreements that restrict their use of the data. The categories of third parties are: analytics providers; call-tracking providers; and, where required by law, government, regulatory, or law-enforcement bodies. We do not sell consumer health data, and we do not share it for targeted advertising.
Consent. Non-essential collection through cookies occurs only after you consent through our cookie banner. Where required by law, we obtain your consent before collecting or sharing your consumer health data.
Your rights. You may withdraw your consent, and you may request to access or delete your consumer health data, by contacting us at ahill@therosehouse.com. We will confirm and honor your request as required by law, and we will not discriminate against you for exercising these rights.
No geofencing. We do not use geofencing to identify, track, or collect data from you based on your proximity to any health care facility.
Global Privacy Control
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of targeted advertising and sale where required, including for Colorado residents.
Children’s Privacy
The Site is not directed to children under 16, and we do not knowingly collect their personal information.
Changes to This Policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent version, and material changes will be posted on this page.
Contact Us
The Rose House – 601 Snowpeak Ln Lafayette CO 80026. ahill@therosehouse.com | 720-471-0780