Notice of Privacy Practices

Who We Are

Aura Integra Behavioral Health, PLLC is a "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA) as defined at 45 CFR § 164.104. For substance use disorder (SUD) treatment records, Aura Integra Behavioral Health, PLLC is also a "program" subject to the heightened confidentiality requirements of 42 CFR Part 2. This Notice applies to all medical and behavioral health records we create and maintain about you.

How We May Use and Disclose Your Health Information

We may use and disclose your protected health information (PHI) for the following purposes:

Treatment

We may share your health information with other physicians, therapists, pharmacies, laboratories, or other healthcare providers involved in your care so that they can provide appropriate treatment.

Payment

We may use and disclose your health information to bill and collect payment for services, including verifying benefits where applicable and processing self-pay transactions.

Healthcare Operations

We may use your health information for quality improvement activities, staff training, licensing, and other operations necessary to run our practice.

As Required by Law

We will disclose your health information when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your health information for public health purposes, such as reporting disease outbreaks, vital events, or adverse events, as authorized by law.

Health Oversight Activities

We may disclose health information to health oversight agencies for activities authorized by law, such as audits, investigations, and licensure actions.

Judicial and Administrative Proceedings

We may disclose health information in response to a court order or, in limited circumstances, in response to a subpoena.

Law Enforcement

We may disclose limited health information to law enforcement officials for purposes such as identifying a suspect, fugitive, witness, or missing person, or in response to a valid court order or legal process, subject to applicable restrictions.

Serious Threats to Health or Safety

Consistent with applicable law and ethical standards, we may disclose health information if we believe in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, or the public (the "duty to warn" / Tarasoff-type disclosure). Massachusetts law recognizes specific exceptions to the psychotherapist-patient privilege for such disclosures. M.G.L. c. 233 § 20B.

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

• Your SUD treatment records generally cannot be disclosed without your specific written consent, except in the following limited circumstances: (a) a bona fide medical emergency; (b) for audit or program evaluation purposes; (c) pursuant to a qualifying court order; or (d) for research, subject to appropriate privacy protections.
• Your SUD records cannot be used to investigate or criminally prosecute you without your written consent or a qualifying court order, even if you consented to disclosure for treatment purposes.
• Under the 2024 Part 2 Final Rule (effective with a compliance date of February 16, 2026), we may obtain a single, broad-based patient consent covering all future uses and disclosures for treatment, payment, and healthcare operations (TPO) purposes. However, a separate, specific written consent is still required for SUD counseling notes, which receive additional protection.
• Any consent you provide for use of your SUD records in civil, criminal, administrative, or legislative proceedings against you cannot be combined with a consent for any other type of disclosure — it must be a distinct, standalone authorization.

Massachusetts-Specific Patient Rights

• Right to Access and Copy Records: You have the right to access and obtain copies of your medical records. M.G.L. c. 111 § 70; M.G.L. c. 112 § 12CC.
• Mental Health Client Confidentiality: Records of mental health treatment are subject to specific confidentiality protections for clients of licensed mental health professionals. M.G.L. c. 112 § 172A.
• Mental Health Records Retention: Mental health treatment records are retained for a minimum of twenty (20) years. M.G.L. c. 123 § 36.
• Psychotherapist-Patient Privilege: Communications between you and your psychotherapist are generally privileged and protected from disclosure in legal proceedings, subject to statutory exceptions. M.G.L. c. 233 § 20B.
• Patients' Rights: You have specific statutory rights as a patient receiving care in Massachusetts. M.G.L. c. 111 § 70E.
• Prescription Monitoring Program (MassPAT) Confidentiality: Information reported to or obtained from the Massachusetts Prescription Awareness Tool is confidential and protected from unauthorized disclosure. M.G.L. c. 94C § 24A.
• PATCH Act – Confidential Explanation of Benefits: You have the right to request that Explanation of Benefits (EOB) communications related to sensitive health services be sent directly to you rather than to a policyholder. M.G.L. c. 176O § 27.

Your Rights Under HIPAA

• Right to Request Restrictions on certain uses and disclosures of your PHI.
• Right to Request Confidential Communications by an alternative means or at an alternative location.
• Right to Inspect and Copy your PHI maintained in your medical record.
• Right to Request Amendment of your PHI if you believe it is incorrect or incomplete.
• Right to an Accounting of Disclosures of your PHI made by us, with certain exceptions.
• Right to a Paper Copy of This Notice at any time, even if you agreed to receive it electronically.
• Right to File a Complaint if you believe your privacy rights have been violated. You may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Ave., S.W., Washington, D.C. 20201, 1-800-368-1019, ocrmail@hhs.gov. You will not be retaliated against for filing a complaint.

Our Duties

• We are required by law to maintain the privacy and security of your protected health information.
• We will abide by the terms of the notice currently in effect.
• We will notify you if a breach occurs that may have compromised the privacy or security of your information, consistent with the breach notification requirements at 45 CFR §§ 164.400–414.

Website Tracking Disclosure

Consistent with the Massachusetts Consumer Protection Act (M.G.L. c. 93A) and recent case law addressing website tracking technologies in the healthcare context (A.J. v. LMND Med. Grp., Inc. (2024)), we disclose the following about this website.

• This website uses no analytics of any kind. There is no Google Analytics, no advertising pixel, and no measurement, tracking, or session-recording script anywhere on this site. We do not know who visits, which pages are read, or how long anyone stays.
• This website sets no cookies. Nothing is written to cookies, to session storage, or to any browser database by any page on this site.
• One thing, and only one thing, is saved on your device. If you use the accessibility button in the bottom-left corner to change how the site looks, those display choices are saved in your browser's local storage under a single entry named aura_a11y_prefs. It records only settings such as larger text, high contrast, increased line spacing, or a dyslexia-friendly font. It contains no name, no contact detail, no health information, no identifier, and no record of which pages you visited, and it is never transmitted anywhere. You can delete it at any time from the notice shown on your first visit, by using Reset everything in the accessibility panel, or by clearing site data in your browser. Nothing else on this site writes to browser storage.
• The contact form on the home page does not transmit anything. It checks that the fields are filled in and then composes a message in your own email application, which you send yourself. Your words stay on your device until you press send in your own mail app. There is no form vendor, no hosted endpoint, and no third-party handler. Web3Forms and EmailJS, which earlier versions of this website used, were removed on August 8, 2026 and the access key was revoked, because those vendors were receiving identifiable information with no Business Associate Agreement in place.
• Secure messaging goes through Spruce. Spruce is the practice's HIPAA-covered phone, text, secure message, and fax line, and a Business Associate Agreement is included in the Spruce plan. Spruce is offered as its own route, at spruce.care/auraintegra, alongside calling or texting and the short contact form. That address opens a connect page with a QR code for the free Spruce app; anything you want to share, you type inside Spruce rather than on this website. Nothing you type on this website is ever appended to that link or passed along with it in any way. Our email is hosted by Google Workspace under a signed Business Associate Agreement.
• The educational self-screeners keep everything in your browser. Questions, answers, and scores are calculated on your own device and are never sent to Aura Integra or to anyone else. They are not stored in any form, including the accessibility entry described above, and they are gone when you close the page. Your answers are never visible to us. Screener pages also send no referrer, so no other site learns which self-assessment you opened.
• There is no clinical intake, no booking widget, and no scheduling link built into this public website. Public forms are contact-only. Please do not send medical, medication, or substance use detail through this website or through ordinary email.
• The patient portal is a separate secure system, and this website only links to it. The portal is hosted by BestNotes, the practice's electronic health record, at auraintegra.portal.bestnotes.com, under a signed Business Associate Agreement. If you choose to create an account there, the registration page asks for your first name, your last name, an email address, and a password you choose, and the pre screen and demographics forms inside it ask for your date of birth and other information. All of that is collected by BestNotes, not by this website. Nothing you type on any page of this site is appended to that link, prefilled into the portal, or passed along with it in any way, and this website is never told whether you opened it.
• No personal health information is collected through website analytics, because there are no website analytics.
• The third parties that touch this website are: Vercel, which hosts the site and receives ordinary technical request information such as IP address and browser type in its server logs. There are no others. Typefaces, styles, scripts, images, audio, and video are all served from this site itself, not from a content delivery network.
• The accessibility controls are ours, not a vendor's. The accessibility panel on this site was built in-house. We deliberately do not use a third-party accessibility overlay such as UserWay, accessiBe, EqualWeb, or AudioEye. Those products load a script from the vendor's own servers and report visitor interaction back to them, which on a psychiatric and addiction practice website would mean an outside company observing people read about opioid treatment. Our panel makes no outside connection of any kind.
• The Join Our Team form works the same way as the contact form. It composes a message in your own email application and transmits nothing from the page. It does not ask for a date of birth, a Social Security number, a home address, or any demographic information.

Contact / Privacy Officer

If you have questions about this Notice or wish to exercise any of the rights described above, please contact our Privacy Officer: