How protected health information may be used and disclosed.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. This Notice is required by HIPAA, the Health Insurance Portability and Accountability Act, and by 42 CFR Part 2 for substance use disorder records.

Who this notice applies to

Vanguard Labs LLC d/b/a Shift Support Network.

This Notice applies to all care delivered by Shift Support Network clinicians, all records we create or maintain, and all communications about your care.

Our duties

What we are required to do.

Keep protected health information (PHI) private under HIPAA.
Apply the additional protections required by 42 CFR Part 2 for substance use disorder records, which are stricter than HIPAA.
Provide you with this Notice and follow the practices it describes.
Notify you if a breach of unsecured PHI affects your records.
Honor a request you make to communicate with you confidentially or to restrict certain disclosures, to the extent allowed by law.

How we use and disclose PHI

The categories where we may use your information without separate written authorization.

For treatment

To provide, coordinate, or manage your healthcare. For example, sharing relevant information with another clinician on our team. Substance use disorder treatment information, under 42 CFR Part 2, generally requires your separate written consent before disclosure even within the treatment context.

For payment

To bill your insurance plan for services rendered. Under 42 CFR Part 2, disclosure to your insurance plan for payment of substance use treatment requires your written consent.

For healthcare operations

For quality assessment, accreditation, audit, and similar operational activities. We do not use PHI to send marketing communications without your authorization.

As required by law

Court orders, subpoenas, mandated reporting (child abuse, elder abuse, dependent adult abuse, certain communicable disease reporting), and other legal obligations. For substance use treatment records, 42 CFR Part 2 generally requires a special court order before records can be released to law enforcement, even with a subpoena. We will follow those rules.

Uses and disclosures that require your written authorization

Where you control the decision.

Disclosure to your employer, union, or trust fund. We do not disclose your treatment to your employer or union without your written authorization. Substance use disorder records under 42 CFR Part 2 are particularly protected.
Disclosure to family members beyond what is necessary for involvement in your care.
Marketing communications that are not directly related to your treatment with us.
Sale of your information (we do not do this, ever).
Most disclosures of psychotherapy notes.

An authorization you give can be revoked in writing at any time, except to the extent we have already acted on it.

42 CFR Part 2 in plain English

The substance use treatment record is more protected than the general medical record.

Federal regulation 42 CFR Part 2 protects identifiable information about a patient who has sought or received substance use treatment. The protection is stricter than HIPAA. Under Part 2:

We cannot confirm that you are a patient to anyone without your written consent.
We cannot disclose information about your treatment to your employer, your insurance plan beyond what is needed for payment, your family, your union, or law enforcement, without your written consent or a Part 2-specific court order.
Each disclosure requires a specific, time-limited, purpose-bound written consent. Blanket releases are not allowed.
If you authorize a disclosure, the recipient is generally prohibited from re-disclosing the information except with your further consent.

Exceptions to Part 2 are narrow. They include medical emergencies, certain audits and evaluations, mandated reports of child or elder abuse, and crimes committed on the premises or against program staff.

Your rights as a patient

What you can ask us to do.

Inspect and copy your records, with limited exceptions defined by law.
Request an amendment to records you believe are inaccurate.
Request restrictions on certain uses or disclosures (we will accommodate where required, and will consider all reasonable requests).
Request confidential communications (for example, requesting that we call your cell rather than your home).
Receive an accounting of certain disclosures we have made.
Receive a paper copy of this Notice on request.
File a complaint without retaliation. Complaints can be made to our Privacy Officer (admin@shiftsupportnetwork.com), to the U.S. Department of Health and Human Services Office for Civil Rights, or to the California Department of Health Care Services.

How to reach our Privacy Officer

Questions or complaints.

By email: admin@shiftsupportnetwork.com

By phone: (805) 815-6777

By mail: Privacy Officer, Vanguard Labs LLC, 28310 Roadside Dr, Suite 218, Agoura Hills, CA 91301

Federal complaints can be filed with the HHS Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. State complaints can be filed with the California Department of Health Care Services.

Last updated: 2026-05-14. Effective: 2026-05-14.