Legal Notices

Privacy Policy &
Notice of Privacy Practices

This page covers two distinct privacy matters: how Vitalia Care Services handles information collected through this website, and how we handle the protected health information (PHI) of individuals receiving our services under HIPAA.

Effective: February 16, 2026 Last Reviewed: July 2026 HIPAA Covered Entity

Required HIPAA Header

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

HIPAA Notice of Privacy Practices

Vitalia Care Services is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This means we are required by law to maintain the privacy of your protected health information (PHI), provide you with this notice of our legal duties and privacy practices, abide by the terms of the notice currently in effect, and notify you in the event of a breach of your unsecured PHI.

This Notice of Privacy Practices is effective as of February 16, 2026 and applies to all protected health information created, received, maintained, or transmitted by Vitalia Care Services in connection with your care.

What Is Protected Health Information?

Protected Health Information (PHI) is any information that relates to your past, present, or future physical or mental health condition, the care you receive, or the payment for that care, when the information can be used to identify you. PHI includes, but is not limited to:

Your name, address, date of birth, and Social Security number when combined with health information
Your medical diagnoses, medications, and treatment records
Your Individual Support Plan (ISP) and service records
Medication Administration Records (MAR) and health care notes
Billing and payment records related to your services
Information shared by your physicians, case managers, or other service providers

Oregon law provides additional protections for particularly sensitive categories of health information, including mental health records, substance use disorder records, HIV/AIDS information, and reproductive health information. Vitalia Care Services applies the more protective standard where Oregon law is stricter than HIPAA.

Permitted Uses & Disclosures Without Your Authorization

The law permits Vitalia Care Services to use or disclose your PHI in the following circumstances without your separate written authorization:

Treatment

We may use and share your PHI to provide you with care and coordinate treatment among your care team. This includes sharing information with your physicians, nurses, behavioral specialists, case managers, and other providers involved in your care.

Payment

We may use and share your PHI as necessary to bill for and receive payment for the services we provide. This includes sharing information with Oregon Medicaid (OSIPM), Healthier Oregon, and other authorized payers.

Health Care Operations

We may use and share your PHI for our internal operations, including quality improvement activities, staff training, compliance reviews, and program evaluation, to the minimum extent necessary.

Required by Law

We may disclose your PHI when required by federal, state, or local law, including:

Mandatory abuse and neglect reporting under Oregon law and OAR 411-323-0063
Public health reporting to authorized agencies
Health oversight activities by ODHS/ODDS licensing and regulatory staff
Judicial and administrative proceedings in response to a court order or subpoena
Law enforcement purposes as specifically limited by HIPAA
Serious threats to health or safety when disclosure may prevent or lessen the threat

ODDS & CDDP Coordination

As an ODDS-licensed and endorsed provider, we share PHI as necessary with the Oregon Office of Developmental Disabilities Services, your local CDDP (Washington County), and authorized case management entities for purposes of service coordination, ISP development, and program oversight. This is permitted under HIPAA as treatment, health care operations, and legally required disclosures.

Important — Redisclosure Notice (Required by 45 CFR 164.520)

Once Vitalia Care Services discloses your protected health information to another person or organization as permitted by HIPAA, that information may be subject to redisclosure by the recipient and may no longer be protected under the HIPAA Privacy Rule. Other laws may continue to protect certain categories of information after redisclosure (for example, SUD records protected under 42 CFR Part 2 carry restrictions on certain redisclosures as described below). You should be aware of this when authorizing disclosures.

Uses & Disclosures Requiring Your Written Authorization

Vitalia Care Services will not use or share your PHI for purposes other than those described above without your written authorization, except as otherwise required by law. You may authorize us to share your PHI with family members, legal representatives, schools, employers, insurance companies, or others not otherwise permitted.

You have the right to revoke a written authorization at any time by notifying us in writing. The revocation does not affect any uses or disclosures made before we received your revocation.

We will never use or share your PHI for marketing purposes or sell your PHI without your explicit written authorization.

Your Rights Regarding Protected Health Information

Right to access your records — You have the right to inspect and obtain a copy of your PHI maintained in a designated record set. We must respond within 30 days. Reasonable copying fees may apply. We may not deny access to records we maintain electronically if you request electronic format.

Right to amend your records — You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny the request under certain circumstances but must document your disagreement if we do.

Right to an accounting of disclosures — You have the right to request a list of certain disclosures of your PHI we have made, including to whom, when, and for what purpose, for the six years prior to your request.

Right to request restrictions — You have the right to request that we restrict certain uses or disclosures of your PHI. We are not required to agree to all restrictions, but if we do agree, we must honor the restriction except in emergencies.

Right to confidential communications — You have the right to request that we communicate with you about your health information in a specific way or at a specific location. We will honor reasonable requests.

Right to a paper copy of this notice — You have the right to receive a paper copy of this Notice of Privacy Practices at any time, even if you received this notice electronically. Contact us to request a copy.

Right to file a complaint — You have the right to file a complaint with Vitalia Care Services or with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

Our Duties Under HIPAA

Vitalia Care Services is required by law to:

Maintain the privacy and security of your protected health information
Provide you with this notice of our legal duties and privacy practices
Notify you if a breach occurs that may have compromised the privacy or security of your information
Abide by the terms of the notice that is currently in effect
Not use or share your information other than as described in this notice or as authorized by you, except as required by law

We maintain written policies and procedures covering HIPAA Privacy, Security, and Breach Notification requirements, reviewed and updated at least annually. All staff receive HIPAA training upon hire and annually thereafter, as required by OAR 411-323-0060 and HIPAA regulations. This notice has been updated as required by the HHS Final Rule effective February 16, 2026, including Part 2-related NPP provisions under 42 CFR Part 2 (see Special Protections for SUD Records below).

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

As required by the HHS Final Rule effective February 16, 2026, this notice now includes the following required disclosures regarding substance use disorder (SUD) records under 42 CFR Part 2.

Some of the health information Vitalia Care Services creates, receives, or maintains in the course of care coordination and service delivery may relate to substance use disorder (SUD) diagnosis, treatment, or referral for treatment. This information may be subject to additional federal confidentiality protections under 42 CFR Part 2, which provides greater privacy protections than HIPAA for certain records.

Required Statement — 42 CFR Part 2 (Effective February 16, 2026)

To the extent that we have your substance use disorder patient records, subject to 42 CFR Part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena.

What This Means for You

When 42 CFR Part 2 protections apply to your SUD records, Vitalia Care Services is subject to stricter requirements than standard HIPAA, including:

Written consent required for treatment, payment, and health care operations: Unlike other protected health information, use or disclosure of SUD records protected under Part 2 generally requires your written consent, even for purposes of treatment coordination, payment, and health care operations. Exceptions apply for emergencies and as otherwise specified under Part 2.
Prohibition on use in legal proceedings: We cannot use or share your SUD records in any civil, criminal, administrative, or legislative investigation or proceeding against you without (1) your written consent or (2) a qualifying court order accompanied by a subpoena or other legal requirement compelling disclosure.
Redisclosure restrictions: Recipients of your SUD records who receive them pursuant to a lawful consent or legal process remain subject to Part 2’s restrictions. However, records shared under a general treatment, payment, and operations (TPO) consent may be redisclosed by HIPAA covered entities and business associates in accordance with the HIPAA Privacy Rule.
Right to restrict: You have the right to request that Vitalia Care Services restrict certain uses and disclosures of your SUD records, including where a general consent for treatment, payment, and operations has been given.

If You Have Questions About Your SUD Records

If you have questions about whether specific records are protected under 42 CFR Part 2 or how to exercise your rights regarding SUD records, contact us at (971) 284-6950 or info@vitaliacareservices.com. You may also contact the HHS Office for Civil Rights at 1-800-368-1019 or file a complaint at hhs.gov/ocr.

Note on Reproductive Health Privacy

HHS published HIPAA Privacy Rule amendments in April 2024 related to reproductive health care. In June 2025, a federal district court (Purl v. HHS, N.D. Tex.) vacated those provisions. HHS has confirmed those amendments are not currently enforceable. This notice does not include reproductive health-specific NPP provisions, consistent with HHS guidance as of July 2026.

Breach Notification

If Vitalia Care Services discovers a breach of unsecured PHI that affects you, we are required to notify you without unreasonable delay and no later than 60 days after discovering the breach (Oregon law requires notification within 45 days for breaches of personal information; we apply the stricter Oregon standard). Notice will be provided by first-class mail to your most recent known address, or by email if you have agreed to electronic notice.

If a breach affects more than 500 Oregon residents, Vitalia Care Services is also required to notify the Oregon Attorney General and provide notice to media outlets serving the affected area.

Website Privacy Policy

This section applies to information collected through the Vitalia Care Services website at vitaliacareservices.com.

Information We Collect

Information you provide directly

When you use our online forms (the support request form or the job application form), you voluntarily provide information including your name, contact information, county of residence, preferred language, and which of our programs you are interested in. This information is submitted through Netlify Forms, a third-party form processing service.

We collect only the information necessary to respond to your inquiry or evaluate your application. We do not collect payment information through this website, and we do not collect diagnosis, medical, or clinical information through this website.

Information collected automatically

This website does not use tracking cookies, advertising pixels, or third-party analytics scripts. We do not track your browsing behavior across other websites. The only data automatically associated with your visit is standard server log information (such as your IP address and browser type) retained by Netlify’s infrastructure, which we do not use for marketing or profiling purposes.

What we do NOT collect

We do not collect diagnosis, treatment records, Medicaid status, or clinical support needs through this website
We do not use advertising cookies or sell data to advertisers
We do not use Facebook Pixel, Google Analytics, or similar tracking tools
We do not collect Social Security numbers or government ID numbers through this website
We do not collect payment card information

How Information Is Used

Information submitted through website forms is used solely to:

Respond to your support or service inquiry
Evaluate and process job applications
Contact you to discuss next steps

We do not use website form submissions for marketing, advertising, or to build profiles for sale to third parties. Form submissions are received by Vitalia Care Services staff via Netlify’s notification system and stored in Netlify’s form dashboard for operational use only.

Third-Party Services

This website uses the following third-party services:

Netlify — Website hosting and form processing. Netlify’s privacy policy governs data processed through their infrastructure. Vitalia Care Services has reviewed Netlify’s data handling practices. Netlify is hosted in the United States.
Google Fonts — Typography served from Google’s CDN. Loading fonts from Google’s servers may cause your IP address to be transmitted to Google. We use only the Inter font family from this service.

No other third-party scripts, pixels, or services are used on this website. All imagery on this site is served from our own servers.

No PHI Is Collected Through This Website

Vitalia Care Services has designed this form to collect only contact and program interest information. No Protected Health Information (PHI) as defined under HIPAA — including diagnosis, treatment records, Medicaid status, or clinical support needs — is collected through this form. As a result, Netlify is not acting as a Business Associate under HIPAA in connection with this form, and a Business Associate Agreement is not required for this use. Clinical information is gathered separately during a direct intake call with Vitalia staff.

Oregon Consumer Privacy Act (OCPA)

The Oregon Consumer Privacy Act (effective July 1, 2024) applies to organizations that process personal data of 100,000+ Oregon consumers annually. As a small residential care provider, Vitalia Care Services does not currently meet this threshold. PHI processed in connection with HIPAA is excluded from OCPA requirements. However, we honor the spirit of OCPA and do not sell personal data or use it for targeted advertising.

Your Rights Regarding Website Information

If you have submitted information through our website and wish to:

Request a copy of the information we have on file for you
Request correction of inaccurate information
Request deletion of your information from our records
Ask questions about how your information has been used

Oregon Confidentiality of Records

Vitalia Care Services maintains the confidentiality of all individual records as required by OAR 411-323-0060. This includes:

All records are kept confidential and are not available for inspection by unauthorized persons
No identifying information about individuals may be released to unauthorized parties without consent
Records are maintained securely and retained for the period required by Oregon law
Access to individual records is limited to authorized staff, the individual, their legal representative, and authorized ODDS/CDDP personnel
Staff receive training on confidentiality requirements and are bound by confidentiality obligations

Oregon law provides heightened protection for certain categories of records including mental health treatment records, substance use disorder records, and HIV/AIDS-related information. We apply the most protective standard applicable in all cases.

Contact & Privacy Complaints

Questions, requests, or complaints about this Privacy Policy or our Notice of Privacy Practices should be directed to:

Vitalia Care Services Privacy Contact
Meleshew Agegnehu, Executive Director
Beaverton, OR · Washington County (mailing address provided on request)
(971) 284-6950
info@vitaliacareservices.com

You may also file a HIPAA complaint with the:

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue SW, Washington, D.C. 20201
1-800-368-1019 (TTY: 1-866-788-4989)
hhs.gov/ocr/privacy/hipaa/complaints

No Retaliation

Vitalia Care Services will not retaliate against any individual for exercising their rights under HIPAA, filing a complaint with us or with HHS, or for any other exercise of rights described in this Privacy Policy or our Notice of Privacy Practices.

This Privacy Policy and Notice of Privacy Practices was last reviewed and updated in July 2026, incorporating required updates under the HHS Final Rule effective February 16, 2026 (42 CFR Part 2 NPP provisions). We reserve the right to change this notice. Any changes will be posted on this page with the updated effective date. A paper copy is available upon request at no charge.