The laws we follow
Two federal laws protect health information about treatment at Driftwood. The platform is built to meet both.
HIPAA
The federal law that protects health information. It controls who can see your information, requires strong security, and gives you rights over your own records.
42 CFR Part 2
A stricter federal rule for substance use treatment records. In most cases your information cannot be shared outside your care team without your specific written consent.
How the platform protects information
Eight safeguards work together, so no single step is the only thing standing between your information and the wrong person.
Secure, personal logins
Everyone has their own login. No shared accounts. Two-step verification adds a second check, like a code, so a stolen password alone is not enough.
You only see what you need
Each person sees only the information their role requires. A family member never sees another family's information, and staff only see what their job calls for.
Every access is recorded
The platform keeps a permanent record of who viewed or changed information, and when. These records are reviewed and cannot be edited.
Encrypted at all times
Information is scrambled while it travels over the internet and while it is stored, so it cannot be read if intercepted.
Signed agreements with every vendor
Every technology company that stores or handles information for us has signed a Business Associate Agreement. That legally binds them to HIPAA's protections too.
Only what is necessary
We collect and share the minimum information needed for each purpose, and nothing more.
Automatic logout
Inactive sessions sign out on their own. When a staff member leaves Driftwood, their access ends the same day.
Backups and a response plan
Information is backed up securely. If anything ever went wrong, we have a written plan to respond quickly and notify anyone affected, as the law requires.
What we never do
- Sell your information, or use it for advertising.
- Share it outside your care team without your consent, except where the law requires it.
- Put health details in text messages or email notifications. We send a simple note that something is waiting for you, and you log in to see it.
For clients
This is your information, and you stay in control of it.
What you can do
- See your own information. You can request a copy of your records, and we respond within the time the law sets.
- Ask for a correction if something looks wrong.
- Decide who else can see it. Family members and referring professionals only see your information if you sign a written consent, and only what that consent covers.
- Change your mind. You can withdraw a consent at any time, in writing.
- Ask who has seen your information outside of your treatment, payment and day-to-day operations.
- Ask us to limit how your information is used or shared.
For families
We know you want to stay close to your loved one's care. Here is how that works.
- Your access depends on your loved one's consent. Federal law requires a signed release from the client before we can share anything with family, including whether they are in treatment.
- You see only what the release covers. That might be schedules and family program details, but not clinical notes, unless the client agrees.
- Consents can change. Clients sometimes sign later in treatment, and can withdraw a consent. Your access updates to match.
- Payers are handled privately. When a parent, trust or family office pays for care, they see the financial details they need, not the client's private health information.
For referring professionals
Your relationship with your client matters to us, and so does their privacy.
- Updates follow the client's consent. You receive information about a client only when they have signed a release naming you, and only what it covers.
- Your preferences are respected. Whether you want updates by email, through the platform, or only at discharge, we record it and follow it.
- Records shared with you stay protected. Information you receive is still covered by federal confidentiality rules.
For Driftwood staff
Every team member plays a part in protecting the people we serve.
How your access works
- Sign in with your Driftwood Google account and two-step verification.
- You see what your role needs. If you need more, ask your manager.
- Every view and change is logged under your name.
- Your access ends automatically if you leave Driftwood.
Everyday habits that matter most
- Keep client details in the platform or Ritten, not in texts, Slack, personal email or personal spreadsheets.
- Never share your login, and lock your screen when you step away.
- Check for a signed release before sharing anything with family or a referent.
- If something looks wrong, report it right away. Reporting in good faith is always the right call.
Common questions
Is Driftwood "HIPAA certified"?
There is no official HIPAA certification for any organization. HIPAA compliance is an ongoing practice: the right safeguards, signed agreements with every vendor, staff training, and regular reviews. That is the standard the platform is built to.
Where is my information stored?
On secure, HIPAA-covered cloud infrastructure in the United States, operated by vendors who have signed Business Associate Agreements with Driftwood. Clinical records continue to live in Driftwood's electronic health record.
Can my employer, insurer or anyone else find out I was in treatment?
Not from us without your written consent, except in the limited situations the law requires, such as a medical emergency.
Why did I get a text or email without any details?
On purpose. Messages only tell you that something is waiting. The details stay inside the secure platform, behind your login.
What if I think my information was shared improperly?
Contact us using the details below and we will look into it promptly. You also have the right to file a complaint with the U.S. Department of Health and Human Services, and you will never be penalized for doing so.
Privacy questions or concerns
Contact Driftwood Recovery's privacy team at integrations@driftwoodrecovery.com.
Driftwood Recovery, 1905 Elder Hill Road, Driftwood, Texas 78619.
To file a complaint with the federal government, visit the HHS Office for Civil Rights.