Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Substance use disorder records: If you receive treatment through Wavecrest Behavioral Health that includes assessment or care for a substance use disorder, records identifying you as an SUD patient are also protected by federal law under 42 C.F.R. Part 2, in addition to HIPAA. Those records may not be disclosed without your specific written consent except as expressly permitted by Part 2.
1. Who This Notice Applies To
This Notice is issued by Wavecrest Behavioral Health, Inc. ("Wavecrest," "we," "us," or "our"), a California-licensed behavioral health provider (DHCS License #300794AP). Wavecrest is the sole Covered Entity under the Health Insurance Portability and Accountability Act ("HIPAA") responsible for the Protected Health Information ("PHI") described in this Notice.
SameDayPsych (samedaypsych.com) is a marketing and patient-intake channel operated in connection with Wavecrest. Information you submit through SameDayPsych — including forms, phone calls, chat, and scheduling requests — is transmitted to Wavecrest, which handles any resulting PHI under this Notice.
2. Our Legal Duties
We are required by law to:
- Maintain the privacy of your PHI and any SUD records protected by 42 C.F.R. Part 2;
- Provide you with this Notice of our legal duties and privacy practices;
- Notify you following a breach of your unsecured PHI as required by 45 C.F.R. § 164.404; and
- Abide by the terms of the Notice currently in effect.
3. How We May Use and Disclose Your PHI Without Your Written Authorization
3.1 Treatment
We use and disclose PHI to provide, coordinate, and manage your health care — for example, sharing information between clinicians, care coordinators, and referring providers involved in your treatment.
3.2 Payment
We use and disclose PHI to obtain payment for services — for example, to verify insurance eligibility, submit claims, and pursue reimbursement.
3.3 Health Care Operations
We use PHI for our internal operations, including quality assessment, case review, care coordination, staff training, licensing, accreditation, and business planning.
3.4 Business Associates
We may disclose PHI to third-party vendors ("Business Associates") that perform services on our behalf — including electronic health records, telehealth platforms, secure messaging, billing, hosting, call tracking, and analytics providers. Each Business Associate is contractually required under a HIPAA-compliant Business Associate Agreement to safeguard your information. Vendors that receive SUD records also enter a Qualified Service Organization Agreement ("QSOA") as required by 42 C.F.R. § 2.11.
3.5 Individuals Involved in Your Care
Unless you object, we may share limited PHI with a family member, personal representative, or other individual you identify as involved in your care or payment for your care. Additional restrictions under 42 C.F.R. Part 2 apply to any information that would identify you as a patient of a substance use disorder program.
3.6 As Required or Permitted by Law
We may use or disclose PHI without your authorization for public health activities; reporting suspected abuse, neglect, or domestic violence; health oversight activities; judicial and administrative proceedings; law enforcement purposes as permitted by 45 C.F.R. § 164.512(f); coroners, medical examiners, and funeral directors; organ, eye, and tissue donation; research approved by an Institutional Review Board; serious threats to health or safety; specialized government functions; and workers' compensation as authorized by state law. Where 42 C.F.R. Part 2 applies to a specific record, its stricter rules override HIPAA's more permissive disclosures.
3.7 De-Identified and Limited Data Set Information
We may use PHI to create de-identified information under 45 C.F.R. § 164.514, or share a limited data set under a Data Use Agreement, without further authorization.
4. Uses and Disclosures That Require Your Written Authorization
The following will be made only with your written authorization, and you may revoke that authorization at any time in writing (except to the extent we have already relied on it):
- Most uses and disclosures of psychotherapy notes;
- Uses and disclosures for marketing purposes;
- Sale of PHI;
- Any disclosure of SUD records subject to 42 C.F.R. Part 2 that is not expressly permitted by that rule;
- Any other use or disclosure not otherwise described in this Notice or permitted by law.
5. Your Rights Regarding Your PHI
You have the following rights with respect to PHI we maintain about you. To exercise any of these rights, submit your request in writing to the Wavecrest Privacy Officer at the contact information in Section 11.
5.1 Right to Inspect and Copy
You may inspect and receive a copy of your PHI in a designated record set, including in electronic format when we maintain it electronically. We may charge a reasonable, cost-based fee.
5.2 Right to Amend
You may request that we amend PHI you believe is incorrect or incomplete. We may deny your request in limited circumstances; if we do, we will provide a written explanation and you may submit a statement of disagreement.
5.3 Right to an Accounting of Disclosures
You have the right to a list of certain disclosures we have made of your PHI in the six years prior to your request (excluding disclosures for treatment, payment, health care operations, and certain others).
5.4 Right to Request Restrictions
You may request restrictions on certain uses or disclosures of your PHI. We are not required to agree, except that we must agree to your request to restrict disclosure to a health plan of PHI concerning a health care item or service for which you have paid us in full out of pocket.
5.5 Right to Confidential Communications
You may request that we communicate with you in a specific way or at a specific location (for example, by mobile phone only, or at a work address). We will accommodate reasonable requests.
5.6 Right to Be Notified of a Breach
You have the right to be notified in the event of a breach of your unsecured PHI.
5.7 Right to a Paper Copy of This Notice
You have the right to a paper copy of this Notice, even if you have agreed to receive it electronically.
5.8 Right to Choose Someone to Act for You
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.
6. Special Protections for Substance Use Disorder Records (42 C.F.R. Part 2)
Because Wavecrest is a federally-regulated program that provides SUD assessment, referral, or treatment, records that would identify you as a patient of our SUD program are protected by 42 C.F.R. Part 2 in addition to HIPAA.
6.1 What Part 2 Restricts
Under Part 2, we may not tell anyone outside our program that you attend our program, or disclose any information identifying you as having a substance use disorder, unless:
- You consent in writing on a Part 2-compliant consent form;
- The disclosure is expressly permitted by 42 C.F.R. Part 2 (for example, medical emergencies, qualified audits or evaluations, research meeting Part 2 requirements, or communications within the program);
- The disclosure is authorized by an appropriate court order under 42 C.F.R. Part 2, Subpart E; or
- The disclosure is a report of a crime committed on our premises or against our staff, or a report of suspected child abuse or neglect to appropriate state or local authorities as required by law.
6.2 Redisclosure Prohibition
Federal law prohibits any person or entity who receives Part 2-protected information from redisclosing that information except as permitted by Part 2. Recipients must include the following restriction with any disclosure: "This information has been disclosed to you from records protected by Federal confidentiality rules (42 C.F.R. Part 2). The Federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 C.F.R. Part 2."
7. Special Protections for Other Sensitive Information
Some categories of information receive additional protection under federal or state law and may require your specific written consent before disclosure, including:
- HIV/AIDS-related information;
- Mental health records under California law (Cal. Civ. Code § 56.10 et seq., the Confidentiality of Medical Information Act, "CMIA");
- Genetic information under the Genetic Information Nondiscrimination Act ("GINA").
Where these laws impose stricter requirements than HIPAA, we follow the stricter law.
8. Website and Telehealth Information
Information you submit through SameDayPsych website forms (name, contact details, insurance information, or reason for reaching out) is transmitted over encrypted (HTTPS) connections and delivered to Wavecrest's intake systems. If the information you submit constitutes PHI, we handle it under this Notice. If you contact us by telephone, calls may be recorded for quality assurance and clinical documentation purposes; recordings are treated as PHI. Telehealth visits use HIPAA-compliant video, and sessions are not recorded unless you provide separate written consent.
9. Changes to This Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. The current Notice will always be posted at https://samedaypsych.com/privacy with its effective date.
10. Complaints
If you believe your privacy rights have been violated, you may file a complaint with us and with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
To file with us:
Privacy Officer, Wavecrest Behavioral Health, Inc.
Email: privacy@wavecrestbehavioral.com
To file with HHS Office for Civil Rights:
U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue, SW, Washington, D.C. 20201
1-877-696-6775 · hhs.gov/hipaa/filing-a-complaint
11. Contact Us
Wavecrest Behavioral Health, Inc. — Privacy Officer
2913 Pullman Street, Santa Ana, CA 92705
Email: privacy@wavecrestbehavioral.com
DHCS License #300794AP
Verify license: DHCS Licensed & Certified Facilities Map
SameDayPsych (samedaypsych.com) is a marketing and intake channel operated in connection with Wavecrest Behavioral Health, Inc.. Wavecrest is the sole Covered Entity responsible for the Protected Health Information described in this Notice, pursuant to 45 C.F.R. § 164.520.