Star Behavioral Health

 

Privacy Policy

 

Effective Date: November 9, 2026 | Last Updated: November 9, 2026

3505 Brambleton Ave, Roanoke, VA 24018 | (540) 512-9754 | www.starhealthroanoke.com

 

 

1. Introduction

Star Behavioral Health ("we," "us," or "our") is committed to protecting your privacy and the confidentiality of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, including information collected through our website, patient portal, and SMS/text messaging programs.

This policy is designed to comply with applicable federal and state laws, including the Health Insurance Portability and Accountability Act (HIPAA), Virginia Code § 32.1-127.1:03 (Health Records Privacy), the Virginia Consumer Data Protection Act (VCDPA), the Telephone Consumer Protection Act (TCPA), and the 10-Digit Long Code (10-DLC) messaging standards established by mobile carriers and The Campaign Registry (TCR).

 

2. Information We Collect

We may collect the following categories of information:

 

Personal Identifiers

• Full name, date of birth, and home address

• Phone number(s) and email address

• Emergency contact information

• Government-issued identification (when required)

 

Health and Clinical Information

• Medical and behavioral health history, diagnoses, and treatment records

• Psychotherapy notes (subject to heightened protection)

• Medication information and prescription history

• Insurance and billing information

• Reproductive and sexual health information (collected only with explicit consent per the VCDPA, effective July 1, 2025)

Communication Data

• SMS/text message consent records and opt-in/opt-out history

• Call logs and voicemail records

• Patient portal messages and appointment communications

 

Technical Data

• IP address, browser type, and device identifiers

 

• Website usage data and cookies (see Section 9)

 

3. SMS and Text Messaging — 10-DLC Compliance

Star Behavioral Health uses 10-DLC registered messaging to communicate with patients and prospective patients. Text messages are sent from our registered 10-DLC number: (540) 512-9754. The following terms govern our SMS program.

3.1 Program Description

We may send text messages for the following purposes:

• Appointment reminders and scheduling confirmations

• Intake and onboarding instructions

• Billing and payment notifications

• Care coordination and follow-up reminders

• General practice announcements

 

3.2 Consent (Opt-In)

We will never send marketing or operational SMS messages without your prior express written consent. You may provide consent by:

• Completing a consent form at your intake appointment

• Submitting a web form that includes an SMS consent checkbox

• Verbally consenting during an intake call (documented in your record)

By opting in, you agree to receive text messages from Star Behavioral Health at (540) 512-9754. Message frequency varies. Message and data rates may apply.

Consent to receive SMS messages is not a condition of receiving treatment or services from Star Behavioral Health.

3.3 Opt-Out Instructions

You may opt out of SMS communications at any time by:

• Replying STOP to any text message you receive from us

• Calling our office at (540) 512-9754 and requesting removal

• Submitting an opt-out request through our patient portal at www.starhealthroanoke.com

Upon receipt of a STOP request, we will send one final confirmation message and remove your number from all active messaging campaigns within 10 business days. No further messages will be sent unless you re-enroll.

3.4 Help Instructions

Reply HELP to any SMS message to receive assistance, or contact us directly:

• Phone: (540) 512-9754

• Email: hillary@starhealthroanoke.com

• Address: 3505 Brambleton Ave, Roanoke, VA 24018

 

3.5 Message Frequency and Rates

Message frequency depends on your care plan and appointment schedule. Standard message and data rates may apply depending on your mobile carrier and plan. Star Behavioral Health is not responsible for charges imposed by your carrier.

3.6 Supported Carriers

Our 10-DLC messaging is supported by all major U.S. carriers, including AT&T, T-Mobile, and Verizon. Carrier support is not guaranteed for all MVNO (Mobile Virtual Network Operator) carriers.

3.7 No Protected Health Information in SMS

In compliance with HIPAA, we do not send protected health information (PHI) via standard SMS/text message. Messages are limited to scheduling, reminders, and general administrative communications. Clinical information is communicated through our HIPAA-compliant patient portal.

 

4. How We Use Your Information

We use your information to:

• Schedule, confirm, and manage your appointments

• Provide and coordinate behavioral health treatment

• Process billing and insurance claims

• Communicate with you via your preferred contact method (with consent)

• Comply with legal and regulatory obligations

• Improve our services and patient experience

 

5. How We Share Your Information

We do not sell your personal information. We may share your information only in the following limited circumstances:

 

Recipient

Purpose

Treatment providers and care team

Direct clinical care and coordination

Business Associates (HIPAA BAA required)

Billing, EHR, scheduling, and SMS platforms

Insurance and payers

Claims processing and reimbursement

Legal and regulatory authorities

Court orders, subpoenas, and mandatory reporting

Emergency responders

Imminent safety situations

 

All third-party vendors who process your information on our behalf are required to sign a Business Associate Agreement (BAA) or equivalent data protection agreement, including our SMS platform provider.

 

6. HIPAA Patient Rights

As a patient, you have the following rights under HIPAA regarding your Protected Health Information (PHI):

• Right to Access — Request a copy of your health records

• Right to Amend — Request corrections to inaccurate or incomplete records

• Right to an Accounting of Disclosures — Request a list of how your PHI has been shared

• Right to Request Restrictions — Ask us to limit how we use or share your PHI

• Right to Confidential Communications — Request we contact you in a specific way or at a specific location

• Right to a Notice of Privacy Practices — Receive this document in writing upon request To exercise any of these rights, contact our Privacy Officer:

Hillary Marshall

Email: hillary@starhealthroanoke.com Phone: (540) 512-9754

 

7. Virginia-Specific Patient Rights

 

7.1 Virginia Code § 32.1-127.1:03 — Health Records Privacy

In addition to your federal HIPAA rights, Virginia law independently recognizes your right to privacy in your health records. We comply with Virginia Code § 32.1-127.1:03, which governs the use and disclosure of health records, including mental and behavioral health records, and prohibits disclosure except where authorized by you or required by law.

7.2 Virginia Consumer Data Protection Act (VCDPA)

The VCDPA classifies mental health information as sensitive data, requiring your opt-in consent before we process it for purposes beyond your direct treatment and care. Under the VCDPA, you have the right to:

• Access your personal data we hold

• Correct inaccurate personal data

• Delete your personal data (subject to legal retention requirements)

• Obtain a portable copy of your personal data

• Opt out of any sale of your personal data (we do not sell personal data)

• Appeal a denied rights request through our internal review process

Effective July 1, 2025, the VCDPA also requires explicit consent before we collect, disclose, or process your reproductive or sexual health information. We will always request separate, explicit consent before handling such information.

7.3 Minor Patients — Virginia Code § 20-124.6

Under Virginia law, parents and legal guardians generally have the right to access a minor child's health records. However, Virginia law also permits minors to independently consent to certain outpatient mental health, substance use, and family planning services. In such cases, the minor's records from those services may be

 

kept confidential from parents or guardians, consistent with the minor's right to consent.

 

7.4 Substance Use Disorder Records — 42 CFR Part 2

Star Behavioral Health does not currently provide substance use disorder (SUD) treatment services. However, should such services be offered in the future, those records would be subject to the heightened confidentiality protections of 42 CFR Part 2. These federal regulations restrict disclosure beyond what HIPAA permits and generally require a patient's specific written consent for any release of SUD treatment records. We include this notice proactively so patients are aware of these additional protections if such services are offered.

 

8. Data Retention

We retain patient records in accordance with Virginia law and applicable federal requirements. SMS consent records and opt-in/opt-out logs are retained for a minimum of 5 years to satisfy TCPA and 10-DLC compliance requirements. Clinical records are retained for a minimum of 6 years from the date of service or from the date the patient was last seen, and for minors, until the patient reaches age 21, whichever is later.

 

9. Data Security

We implement administrative, physical, and technical safeguards to protect your information, including:

• Encrypted data storage and transmission (TLS/SSL)

• Role-based access controls for staff

• Regular staff HIPAA and privacy training

• Annual security risk assessments

• HIPAA-compliant SMS, telehealth, and EHR platforms

Despite these measures, no system is completely secure. If you have concerns about the security of your information, please contact us at hillary@starhealthroanoke.com.

 

10. Cookies and Website Tracking

Our website (www.starhealthroanoke.com) may use cookies and similar tracking technologies to improve user experience and analyze site traffic. You may disable cookies in your browser settings; however, some website features may not function properly as a result. We do not use website tracking data for targeted advertising or the sale of personal data.

 

11. Minors

Our services may include the treatment of minors. We handle information about individuals under the age of 18 in accordance with HIPAA, the VCDPA (which requires parental or guardian consent before processing the personal data of children under 13 for certain purposes, effective January 1, 2025), and Virginia Code §

20-124.6. SMS consent for minors must be provided by a parent or legal guardian unless the minor has independently consented to treatment under Virginia law.

 

12. Changes to This Policy

 

We may update this Privacy Policy periodically. Changes will be posted on our website at www.starhealthroanoke.com and communicated to patients at their next visit or via written notice. The "Last Updated" date at the top of this document reflects the most recent revision.

 

13. Contact Us

Privacy Officer — Star Behavioral Health

Hillary Marshall

3505 Brambleton Ave, Roanoke, VA 24018

Phone: (540) 512-9754

Email: hillary@starhealthroanoke.com Website: www.starhealthroanoke.com

 

To file a complaint regarding our privacy practices, you may also contact the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr or 1-800-368-1019. Filing a complaint will not result in any retaliation against you.

​