HIPAA
Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
- Encrypted in transit (TLS 1.2+) and at rest (AES-256-GCM field-level encryption of every assessment, answer, report, crisis plan and uploaded document)
- Access controls: 12+ character passwords, 5-attempt lockout, automatic sign-out after 15 idle minutes and 12-hour session limit
- Audit logging of every record view, edit, export and share — visible to you in Settings
- Minimum necessary: AI-generated plans are built from de-identified data (no names or contact details leave the system); nothing is ever sold or used for advertising
- Breach notification: affected individuals and HHS are notified as required by the HIPAA Breach Notification Rule
Who we are
Autism Spectrum Needs Profile is operated on behalf of Tree of Life Behavioral Health ("we"), 190 Lime Quarry Rd, STE 111, Madison, AL 35758, a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). Partner organizations such as the Neuro Affirmative Autism Resource Center (NAARC) and the UAH Regional Autism Network use the platform under business-associate or data-sharing agreements.
What information we collect
Names, age, state, contact details, questionnaire answers, scores, AI-generated support plans, crisis & safety plans, caregiver check-ins, accommodation letters and documents you choose to upload. Family members and clients who receive a link may also create accounts (email, name).
How we use it
Only to produce and deliver the support-needs profile, resources and plans you request; to let you share them with the people you choose; to send the reminders and digests you turned on; and to keep the service secure. We do not sell health information or use it for advertising.
How we protect it
Protected health information is encrypted at rest with AES-256-GCM (field-level) and uploaded documents are encrypted before storage. All connections use TLS 1.2 or higher. Access requires strong passwords, accounts lock after five failed attempts, sessions end after 15 idle minutes or 12 hours. Every view, edit, export and share of a record is written to an audit log you can review in Settings. AI-generated plans are produced from de-identified data: names, contact details and exact ages never leave the system.
Who can see it
The provider or individual who created the record; anyone they invite (family portal) or send a read-only link to; staff of the covered entity for treatment, payment and operations; and vendors that host the platform, database, and email under HIPAA business-associate agreements. We disclose information to others only with written authorization or when the law requires it (for example, imminent danger to the person or others, abuse reporting, court order).
Your rights
You may request a copy of the information held about you, ask for corrections, request a list of disclosures, ask us to restrict certain uses, ask for confidential communications, and file a complaint with us or with the U.S. Department of Health & Human Services Office for Civil Rights (hhs.gov/ocr) without retaliation. Providers can delete a record at any time from the dashboard.
Breach notification
If unsecured protected health information is compromised we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, and notify HHS (and the media where required) as set out in the HIPAA Breach Notification Rule.
Not a substitute for care
The profile is support-needs guidance, not a diagnosis or emergency service. If someone is in immediate danger call 911 or 988 (call or text).
Contact
Privacy Officer, Tree of Life Behavioral Health, 190 Lime Quarry Rd, STE 111, Madison, AL 35758 — www.treeoflifebehavioral.com. Effective date: June 2026. We may update this notice; the current version is always available at this address.