HIPAA Compliance

1. Our HIPAA Status

The Health Insurance Portability and Accountability Act (HIPAA) applies primarily to Covered Entities — healthcare providers, health plans, and healthcare clearinghouses — and their Business Associates who handle Protected Health Information (PHI) on their behalf.

InpatientRehabPlacement.com is an independent treatment directory website. We are not a healthcare provider, health plan, or clearinghouse, and are therefore not a Covered Entity under HIPAA. We do not provide medical services, make clinical decisions, or maintain medical records.

That said, because we operate in the healthcare information space, we design our data practices with privacy as a core principle. The sections below describe how we handle health-related information you may share with us.

2. We Do Not Collect Protected Health Information (PHI)

Protected Health Information (PHI) includes any individually identifiable health information created, received, maintained, or transmitted by a Covered Entity — such as diagnoses, treatment histories, insurance information, or other health data linked to an individual.

Our website is designed to not collect PHI:

• Our contact forms ask only for name, phone, email, and state — not medical history or diagnoses
• We do not integrate with Electronic Health Record (EHR) systems
• We do not receive or store clinical records from treatment facilities
• We do not process insurance claims or handle healthcare billing

3. Information You Choose to Share

If you voluntarily share health-related information — for example, mentioning a specific substance use concern or co-occurring condition when speaking with one of our advisors — we treat that information as strictly confidential. Specifically:

• We use it only to connect you with appropriate treatment resources
• We do not share it with third parties for marketing purposes
• We do not publish, sell, or aggregate it
• We retain advisor notes only as long as necessary to assist you

We strongly recommend not including sensitive health details in web contact forms. Instead, call us directly to discuss your situation in a private, voice-based conversation.

4. Call Recording & Tracking

Phone numbers displayed on this site are managed through CallRail, a call-tracking platform. Calls to our number may be:

• Logged (caller ID, duration, time) for quality assurance and lead tracking
• Recorded for quality assurance purposes

You will be notified at the start of any recorded call. Call data is used solely by InpatientRehabPlacement.com and is not shared with treatment facilities without your explicit consent. Call recordings are retained for up to 12 months.

If you prefer a completely untracked conversation, we encourage you to call treatment facilities directly using the contact information listed on their SAMHSA profile or their own websites.

5. Treatment Providers & HIPAA

The treatment facilities listed in our directory are independent entities. Many of them are Covered Entities under HIPAA. When you contact or enroll in a treatment facility:

• That facility's own HIPAA Notice of Privacy Practices governs how they handle your health information
• You have the right to receive their Notice of Privacy Practices before treatment begins
• You have the right to authorize or restrict disclosures of your health information
• Substance use treatment records may have additional protections under 42 CFR Part 2, which provides stricter confidentiality requirements than standard HIPAA

We recommend requesting and reading each facility's Notice of Privacy Practices before beginning treatment.

6. Your Health Information Rights

While InpatientRehabPlacement.com is not a HIPAA Covered Entity, we respect the spirit of health information privacy rights:

• Right to know: You may ask us what information we have about you
• Right to deletion: You may request that we delete any personal information we hold about you
• Right to correction: You may request correction of inaccurate information
• No retaliation: We will never refuse service or retaliate for privacy requests

See our Privacy Policy for full details on your data rights, including CCPA and GDPR rights.

7. Security Practices

We use the following security measures to protect any information you share with us:

• HTTPS encryption on all pages and form submissions
• Access controls: Only authorized staff can access contact information
• Vendor agreements: Third-party service providers (CallRail, analytics) operate under confidentiality commitments
• Data minimization: We collect only what is necessary to help you find treatment resources

8. Contact Us

For questions about how we handle health-related information, or to submit a privacy request: