Privacy Policy

HOMETOWN HEALTH SYSTEM

Correctional Care Services

‍

_{Effective Date: May 19, 2026 | Last Updated: May 19, 2026}

‍

IMPORTANT NOTICE REGARDING YOUR HEALTH INFORMATION

This Privacy Policy describes how Hometown Health System and its Correctional Care Services division ("we," "us," or "our") collect, use, and protect information about individuals who visit our website, contact us, or receive our services. If you are a patient or prospective patient, your health information is also protected by federal and Kentucky state law, including HIPAA, 42 CFR Part 2, and applicable Kentucky privacy statutes. Please read this policy carefully.

‍

1. Who We Are

Hometown Health System operates Correctional Care Services to provide healthcare to incarcerated individuals and justice-involved populations throughout Kentucky. Our services include primary care, psychiatry, medication-assisted treatment (MAT), specialty pharmacy, telehealth, and reentry health planning.

‍

Website: www.hometowncorrectionalcare.com

‍

Contact: corrections@hometownhealthsystem.com | Phone: 2709379008

‍

Mailing Address: 3200 New Columbia Rd, Kentucky 42718

‍

2. Information We Collect

2a. Information You Provide Directly

When you contact us or submit a form on our website, we may collect:

Full name and contact information (phone number, email address, mailing address)
Facility name and inmate identification number (where applicable)
Nature of inquiry or request (e.g., service referral, MAT enrollment, reentry planning)
Insurance or Medicaid/Medicare information
Any health-related information you choose to share in a message or intake form

2b. Information Collected Automatically

When you visit our website, we may automatically collect:

IP address and browser type
Pages visited and time spent on the site
Referring website or search terms
Device type and operating system

This data is collected through standard web analytics tools (such as Google Analytics) and is used solely to improve our website and user experience. It is not linked to your identity without your consent.

‍

2c. Sensitive Health Information

Special Notice: If you submit any information related to substance use disorder treatment, mental health treatment, or HIV/AIDS status, this information is subject to heightened protections under 42 CFR Part 2 and applicable Kentucky law in addition to HIPAA. We treat all health-related form submissions as Protected Health Information (PHI) and handle them accordingly.

‍

3. How We Use Your Information

We use the information we collect for the following purposes:

To respond to your inquiry or service request
To coordinate care, referrals, or enrollment in our correctional health programs
To process intake and provide treatment services
To communicate with correctional facility partners for care coordination
To comply with our legal and regulatory obligations
To improve our website, services, and outreach efforts
To send administrative communications (appointment reminders, policy updates) — never marketing without your consent

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

‍

4. HIPAA and Your Health Privacy Rights

As a covered healthcare entity, Hometown Health System is fully subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. A full Notice of Privacy Practices (NPP) is provided at the time of treatment and is available upon request.

Under HIPAA, you have the right to:

Access and receive a copy of your health records
Request corrections to your health information
Receive an accounting of disclosures of your PHI
Request restrictions on how we use or disclose your PHI
Receive communications through alternate means or locations
File a complaint if you believe your privacy rights have been violated

To exercise any of these rights, contact our Privacy Officer at privacy@hometownhealthsystem.com.

‍

5. 42 CFR Part 2 — Substance Use Disorder Records

This section applies specifically to records related to MAT and substance use disorder (SUD) treatment. Federal law (42 CFR Part 2) imposes strict confidentiality requirements on records of patients treated in any program that provides SUD treatment and receives federal funding.

Under 42 CFR Part 2:

We cannot disclose that a patient attends our MAT or SUD program without specific written patient consent
We cannot disclose the content of SUD treatment records without written patient consent, except in very narrow circumstances (medical emergencies, court orders, audits)
A general consent to release medical records does NOT satisfy 42 CFR Part 2 — a specific, separate authorization is required
Law enforcement does not have automatic access to SUD treatment records under Part 2, even in correctional settings, without the required legal process

Patients receiving MAT or SUD services will receive a separate disclosure explaining their Part 2 rights at the time of enrollment.

‍

6. Kentucky State Privacy Law

In addition to federal law, we comply with applicable Kentucky privacy statutes including:

KRS Chapter 422A — Kentucky Health Care Records Act, governing patient access to and confidentiality of health records
KRS 210.235 — Mental health information confidentiality
KRS 218A — Provisions relating to the confidentiality of substance abuse treatment information under Kentucky law
KRS 61.870–61.884 — Kentucky Open Records Act (applicable to certain public entities with which we contract)

Where Kentucky law provides stronger privacy protections than federal law, we comply with the more protective standard.

‍

7. Information Sharing and Disclosures

We may share your information only in the following circumstances:

Care coordination: With correctional facility medical staff, parole/probation officers, or reentry case managers, as permitted by law and your consent
Treatment providers: With other healthcare providers involved in your treatment, as permitted under HIPAA and 42 CFR Part 2
Business associates: With vendors and contractors (e.g., electronic health record systems, IT providers) under HIPAA-compliant Business Associate Agreements
Legal requirements: When required by a valid court order, warrant, or applicable law — and only to the extent required
Public health: As permitted by HIPAA for authorized public health activities
Emergency: To prevent serious and imminent harm to you or another person, as narrowly defined under HIPAA

We do not disclose information to correctional facilities beyond what is clinically necessary and legally permitted. We do not share SUD treatment information with law enforcement without a Part 2-compliant court order and patient notice.

‍

8. Correctional Setting — Special Considerations

We recognize that healthcare privacy in correctional settings involves unique considerations. As an independent healthcare provider contracting with correctional facilities, we maintain our obligation to patient privacy distinct from the facility's security interests.

Specifically:

Your clinical records are maintained separately from custody records
Facility staff do not have automatic access to your medical or mental health records
Your participation in MAT treatment is protected under 42 CFR Part 2 and will not be disclosed to custody staff without a lawful basis
You have the right to receive healthcare without fear that treatment information will be used adversely in your custody proceedings, except as required by law

If you believe your health information has been improperly disclosed to correctional staff or others, you have the right to file a complaint with us and with the U.S. Department of Health and Human Services Office for Civil Rights (OCR).

‍

9. Data Security

We implement administrative, technical, and physical safeguards to protect your information consistent with HIPAA Security Rule requirements, including:

Encrypted transmission of data submitted through online forms (SSL/TLS)
Access controls limiting PHI access to authorized personnel only
Audit logging of electronic health record access
Staff training on HIPAA and 42 CFR Part 2 compliance
Secure disposal of physical and electronic records

No method of internet transmission is 100% secure. If you have concerns about submitting sensitive health information online, please contact us directly by phone.

‍

10. Online Forms and Phone Contacts

When you submit a contact or intake form on our website, your submission is transmitted securely and routed to our care coordination team. Do not submit emergency medical information through the website — if you or someone else faces a medical emergency, call 911 immediately.

Phone calls to our office may be recorded for quality assurance purposes. You will be informed at the start of any recorded call. Phone communications with patients are subject to the same HIPAA and Part 2 protections as all other protected health information.

‍

11. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to:

Maintain website functionality and session state
Analyze web traffic through anonymized analytics tools
Remember your preferences for future visits

You may disable cookies in your browser settings. Disabling cookies may affect some website functionality but will not prevent you from accessing our services or contacting us.

We do not use advertising trackers, third-party behavioral tracking pixels, or retargeting cookies on our correctional care website.

‍

12. Third-Party Links

Our website may contain links to third-party websites (e.g., Kentucky Department of Corrections, SAMHSA, Medicaid resources). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external sites you visit.

‍

13. Children's Privacy

Our correctional care services are not directed to individuals under the age of 18, and we do not knowingly collect information from minors through this website. If a minor is receiving services through a juvenile justice program we operate, applicable federal and state laws governing minors' health information will apply.

‍

14. How to File a Privacy Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

Hometown Health System Privacy Officer

Email: privacy@hometownhealthsystem.com

Phone: 2709379008

Mailing Address: 3200 New Columbia Rd, Campbellsville, Ky 42718

U.S. Department of Health and Human Services — Office for Civil Rights

Website: www.hhs.gov/ocr

Phone: 1-800-368-1019

You will not be retaliated against for filing a complaint.

‍

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. When we make material changes, we will update the effective date at the top of this document and post the revised policy on our website. Continued use of our website following notice of changes constitutes acceptance of the updated policy.

We recommend reviewing this policy periodically.

‍

16. Contact Us

Questions about this Privacy Policy or your privacy rights? Contact us:

Hometown Health System — Correctional Care Services

Website: www.hometowncorrectionalcare.com

Email: corrections@hometownhealthsystem.com