Privacy policy & notice of privacy practices
Effective Date: January 1, 2026
This Privacy Policy and Notice of Privacy Practices describes how Oxytocin protects, uses, and discloses your personal and protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records), applicable Montana law, and other applicable federal regulations.
Please review this Notice carefully. It explains how your information may be used and disclosed, your privacy rights, and our legal responsibilities regarding your information.
Table of Contents
-
Our Legal Responsibilities
-
How We Use and Disclose Your Health Information
-
Substance Use Disorder Records (42 CFR Part 2)
-
Mental Health Records
-
Telehealth & Electronic Services
-
Phone, Text, Email & Electronic Communications
-
Online Scheduling & Electronic Forms
-
Third-Party Service Providers
-
Minors & Parent/Guardian Rights
-
Your Privacy Rights
-
Data Security & Retention
-
Changes to This Notice
-
Questions or Complaints
1. Our Legal Responsibilities
Oxytocin is required by law to:
-
Maintain the privacy and security of your protected health information (PHI).
-
Provide you with this Notice of Privacy Practices.
-
Notify you following a breach of unsecured protected health information when required by law.
-
Comply with HIPAA, 42 CFR Part 2, applicable Montana statutes, and other federal privacy laws.
We are required to follow the privacy practices described in this Notice.
2. How We Use and Disclose Your Health Information
Treatment
We may use and disclose your health information to provide, coordinate, or manage your care. This may include communication among clinicians, medical providers, peer support specialists, care managers, laboratories, pharmacies, hospitals, and other healthcare professionals involved in your treatment.
Payment
We may use and disclose your health information for payment purposes, including:
-
Insurance billing
-
Prior authorizations
-
Claims submission
-
Coordination of benefits
-
Payment collection
Please note that some services, including certain court-ordered evaluations and educational programs, are not billable to insurance.
Health Care Operations
We may use your information to:
-
Improve the quality of care
-
Conduct quality assurance activities
-
Maintain accreditation
-
Train staff
-
Perform audits
-
Meet licensing and regulatory requirements
-
Operate our organization
Individuals Involved in Your Care
With your written authorization or as otherwise permitted by law, we may share relevant information with family members, legal guardians, or other individuals involved in your care or payment.
Required by Law
We may disclose information when required by federal or Montana law, including reporting requirements related to abuse, neglect, court orders, public health reporting, or threats to health or safety.
3. Substance Use Disorder Records (42 CFR Part 2)
Because Oxytocin provides Substance Use Disorder treatment services, many client records are protected under 42 CFR Part 2, a federal law that provides additional confidentiality protections beyond HIPAA.
Except as specifically permitted by law, your written consent is required before we disclose information identifying you as having received substance use disorder services.
Disclosures without your written consent are limited to situations specifically authorized by federal law, including certain medical emergencies, research, audits, evaluations, and court orders that meet the requirements of 42 CFR Part 2.
4. Mental Health Records
Mental health records are protected under HIPAA and applicable Montana law.
Certain psychotherapy notes receive additional legal protections and generally cannot be disclosed without your separate written authorization, except in limited circumstances permitted by law.
5. Telehealth & Electronic Services
Oxytocin provides telehealth services through secure, HIPAA-compliant technology.
Although reasonable safeguards are used, electronic communications involve inherent privacy risks, including technical failures or unauthorized access beyond our control.
By participating in telehealth or submitting information electronically, you acknowledge these risks and consent to electronic communication when appropriate.
6. Phone, Text, Email & Electronic Communications
By providing your telephone number or email address, you authorize Oxytocin to communicate with you regarding:
-
Appointment reminders
-
Scheduling changes
-
Billing questions
-
Care coordination
-
Administrative communications
-
Requests for documentation
These communications are not used for marketing purposes.
Text Message Opt-Out
You may stop receiving text messages at any time by replying:
STOP
Privacy Statement
No mobile information, text messaging opt-in data, or consent information will be shared with third parties or affiliates for marketing or promotional purposes.
Text messaging originator opt-in data and consent will only be shared with messaging aggregators and service providers necessary to deliver text message services.
7. Online Scheduling & Electronic Forms
Information submitted through our website, online scheduling platform, or electronic intake forms becomes part of your designated record set, when applicable, and is protected under HIPAA, 42 CFR Part 2, and applicable Montana law.
8. Third-Party Service Providers
Oxytocin utilizes trusted third-party vendors to support operations, including:
-
Electronic Health Records
-
Secure telehealth platforms
-
Appointment scheduling
-
Billing services
-
Payment processing
-
Website hosting
-
Secure messaging
-
Electronic forms
-
Analytics necessary for website performance
These vendors are contractually required to safeguard protected information in accordance with applicable federal privacy laws.
Required Privacy Statement
All categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties except messaging aggregators and providers necessary to deliver text messaging services.
9. Minors & Parent/Guardian Rights
Oxytocin provides behavioral health and substance use disorder services to adolescents and minors as permitted under Montana law.
Parents or legal guardians generally have rights regarding their child's treatment information. However, Montana law recognizes certain circumstances in which minors may consent to treatment or have confidentiality rights independent of a parent or guardian.
When permitted by Montana law, Oxytocin will protect a minor's confidentiality in accordance with applicable legal requirements.
Only information necessary to provide treatment, coordinate care, and comply with legal requirements is collected.
10. Your Privacy Rights
You have the right to:
-
Inspect and obtain copies of your health records (subject to applicable federal and Montana law)
-
Request amendments to your record
-
Receive an accounting of disclosures
-
Request restrictions on certain disclosures
-
Request confidential communications
-
Receive a paper copy of this Notice
-
Receive notification of certain data breaches
-
File a complaint without fear of retaliation
Some requests may be denied when permitted by federal or Montana law.
Requests should be directed to our Privacy Officer.
11. Data Security & Retention
Oxytocin maintains administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, or disclosure.
Records are retained in accordance with applicable Montana record retention requirements, federal regulations, contractual obligations, and professional standards.
When information is no longer required, it is securely destroyed or permanently de-identified as permitted by law.
12. Changes to This Notice
Oxytocin reserves the right to modify this Privacy Policy and Notice of Privacy Practices at any time.
Updated versions will be posted on our website and will apply to all information maintained by Oxytocin unless otherwise required by law.
13. Questions or Complaints
If you have questions about this Notice or wish to exercise your privacy rights, please contact:
Privacy Officer
Oxytocin
Phone: (406) 314-6565
If you believe your privacy rights have been violated, you may file a complaint with Oxytocin or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).
You will not be retaliated against for filing a complaint.
Filing a complaint with Oxytocin does not affect your right to file a complaint directly with the U.S. Department of Health and Human Services.