How We Protect Your Health Information

Who We Are

Baxter Cobb Shared Services, LLC (BCSS) provides administrative services — billing, scheduling, and reception — to behavioral health practices. Under HIPAA we are a business associate: we handle health information only on behalf of your healthcare provider, under a written Business Associate Agreement with that provider.

Your healthcare provider (the practice where you receive care) is the covered entity. Your provider decides how your information is used and shared, gives you its Notice of Privacy Practices, and answers your requests about your records.

What We Must Do

As a business associate, BCSS must:

• Keep your health information private and use or share it only as our agreement with your provider and HIPAA allow — for your treatment, for payment such as billing your insurance, and for your provider's healthcare operations
• Protect it with the administrative, physical, and technical safeguards the HIPAA Security Rule requires
• Report any breach of your health information to your provider
• Help your provider respond when you exercise your HIPAA rights
• Never sell your health information or use it for marketing

If There Is a Breach

If we discover that your health information was accessed, used, or shared in a way that was not allowed, we will notify your healthcare provider without unreasonable delay and within the deadline our agreement with your provider sets, and in no case later than 60 calendar days after discovery (45 CFR 164.410). Your provider then notifies you and, where the law requires it, the Department of Health and Human Services and the media.

Your Rights

HIPAA gives you the right to see and get a copy of your health information, to ask for corrections, to get a list of certain disclosures, to ask for limits on how your information is used or shared, and to choose how your provider contacts you. These rights are exercised through your healthcare provider, who must respond to an access request within 30 days and may extend that once by up to 30 days. BCSS assists your provider with these requests.

If you believe your privacy rights were violated, you may complain to your provider or to the U.S. Department of Health and Human Services (see below). You may also tell us. No one may penalize you for filing a complaint.

Substance Use Disorder Records

If your provider treats substance use disorders, those records receive extra protection under federal law (42 CFR Part 2).

Under the 2024 updates to this law, once you give a single consent for sharing your substance use disorder records, they may be used and shared for treatment, payment, and healthcare operations under standard HIPAA rules until you revoke that consent in writing. Your provider can explain what this means for your situation.

These records still cannot be used against you in a criminal, civil, administrative, or legislative proceeding without your consent or a specific court order. Federal law also prohibits using them to discriminate against you in employment, housing, and similar areas.

New York Mental Hygiene Law

If your provider is licensed or operated by the New York State Office of Mental Health, or provides services under contract with, with funding from, or with the approval of that office or a county mental health agency, New York Mental Hygiene Law Section 33.13 adds protections to your clinical record. Ask your provider whether it applies to you.

Changes to This Page

We may update this page from time to time. When we do, we will post the revised version here with a new effective date.

Last updated: October 18, 2026

Contact Our Privacy Officer

For questions about this page or our privacy practices: