Creative Partner
NewLeaf Recovery · Compliance Attorney Fulfillment Distribution Packet · v02 · May 2026
White-label optional Legal · 7 footer pages Drafts · 14 business days
02 · At a glance

Engagement snapshot

The shape of the engagement in eight numbers and one timeline. Outpatient SUD framing matters more than the page count — the federal frame is HIPAA plus 42 CFR Part 2, which is materially stricter.

Entity
NewLeaf Recovery Services
Sole owner: Tamesha Porter. New entity.
State
Michigan
Governing law & state Medicaid bill-of-rights framework.
Service
Outpatient Suboxone / MAT
Counseling + case management + recovery support.
Patient ages
12–80includes minors
Triggers COPPA + minor-consent considerations.
Payor mix
Medicaid + commercial + self-pay
Medicaid primary — ~$200–$300/visit MI Medicaid.
EHR
Behave Health
Likely; contract pending. May supply own NPP template.
CRM
GoHighLevel
HIPAA tier. BAA in place. Form intake routes through it.
Federal frame
HIPAA + 42 CFR Part 2
Both apply. Part 2 is the stricter floor for SUD treatment.

Timeline

The 14-business-day primary deliverable governs everything else. Two short reviews follow in mid-June.

Milestone
Date
Engagement confirmedReply to confirm
Send + 5 bus. days
7 footer pages deliveredPrimary deliverable
Send + 14 bus. days
GHL SMS copy review~30 min · Track E drafts
~June 15, 2026
Hero / positioning review~15 min · Track B copy
~June 17, 2026
Final approval + publishSite live for bus campaign
June 30, 2026
03 · Locked vs flexible

What's fixed, what's yours

Two columns. Everything on the left is set by the engagement shape and Tamesha's launch deadline. Everything on the right is your professional call.

Locked

Set

Don't quote differently — these are decided.

  • 7-page deliverable list — must include all 7 (NPP, 42 CFR Part 2, ADA, Good Faith Estimate, Patient Bill of Rights, Terms of Use, Privacy Policy).
  • July 1, 2026 hard deadline — driven by Tamesha's bus campaign launch. Drafts due [send + 14 business days].
  • HIPAA + 42 CFR Part 2 framing — both apply; SUD-specific 42 CFR Part 2 is more restrictive than HIPAA and must be respected.
  • Invoicing to Tamesha directly — Creative Partner coordinates but does not pay for legal services.
  • White-label arrangement — NewLeaf doesn't see contractor identity unless you prefer to be introduced; default is Chad coordinates everything.

Flexible

Your call

Use your professional judgment.

  • Draft from scratch vs. review-and-customize a standard template (HHS / SAMHSA / Michigan Medicaid).
  • Hourly vs. fixed-fee quote model.
  • Recommended review/update cadence per page (annual? biennial?).
  • Any additional disclaimers/notices you spot we haven't flagged (especially Michigan-specific).
  • Privacy Policy + Terms of Use — one combined page or two separate pages.
04 · The work · 7 footer pages

Scope detail — 7 pages

Each page below: framework citation, expected length, source/strategy, and required content elements. Word-count ranges are typical — quote what you'd actually deliver.

Page 1 — Notice of Privacy Practices (HIPAA NPP)

Required by HIPAA Privacy Rule § 164.520

Length: typically 2,500–4,000 words. Source: either (a) Behave Health template if their EHR provides one (Tamesha to confirm at contract close), or (b) HHS OCR model NPP form, or (c) draft from scratch.

Entity ID
NewLeaf Recovery Services
Record Set
Designated Record Set definition
Privacy Officer
TBD (Tamesha or designated staff once hired)
Patient rights
Access, amendment, accounting of disclosures, restrictions, confidential communications, complaints
Permitted uses
Treatment, payment, healthcare operations
Required disclosures
Statutorily required disclosures
Authorization
Authorization requirements for non-routine disclosures
Effective date
Target: site launch ~July 1, 2026
Update process
Process for updating the NPP

Page 2 — 42 CFR Part 2 Confidentiality Disclosure

Required by federal SUD-specific confidentiality regulation

Length: typically 800–1,500 words. Why it's distinct from the HIPAA NPP: 42 CFR Part 2 is MORE PROTECTIVE than HIPAA. Patients receiving SUD treatment have stronger confidentiality rights, including a higher consent threshold for disclosures, “re-disclosure prohibition” (recipients of patient info cannot further disclose without additional consent), and restricted disclosures even within the same healthcare entity.

Part 2 status
Statement that NewLeaf is a “Part 2 program” (or specific applicability statement based on Tamesha's licensure)
Consent form
Patient consent form requirements (referencing 42 CFR Part 2 § 2.31 consent form structure)
Re-disclosure
Re-disclosure prohibition language
Permitted w/o consent
Medical emergencies, crimes on premises, child abuse reporting, audit/evaluation, research
Patient restrictions
Patient right to request restrictions
Revoke consent
How patients revoke consent
Outpatient scope
Specific to outpatient setting (NOT residential)

Page 3 — Accessibility Statement

Required by ADA Title III

Length: typically 400–600 words. We have a baseline structure (WCAG 2.1 A baseline being implemented in the build). Tamesha may opt into Add-On 1 (full WCAG 2.1 AA certification) — if so, we update the statement to reflect AA compliance. This page can launch with us-drafted language; we need your review to confirm liability framing is sufficient.

Commitments
Standard accessibility commitments
WCAG level
WCAG 2.1 level we're committing to (baseline A or full AA depending on Add-On 1 inclusion)
Complaints contact
Contact info for accessibility complaints (Tamesha + Creative Partner)
Last review
Last review date
Known limits
Known limitations (if any)

Page 4 — Good Faith Estimate Notice

Required by No Surprises Act

Length: typically 300–500 words. Required because NewLeaf accepts uninsured/self-pay patients. The No Surprises Act requires healthcare providers to give a Good Faith Estimate to uninsured patients before treatment.

Right statement
Statement of right to receive Good Faith Estimate
Request process
How to request one (intake process)
Pricing
Pricing transparency commitment
Dispute resolution
Federal arbitration option
Effective date
Effective date

Page 5 — Patient Bill of Rights

Required by Michigan state + CMS Medicaid

Length: typically 600–1,000 words. Source: Michigan Medicaid Bill of Rights as starting template; Behave Health may have a template.

Dignity
Right to dignified, respectful treatment
Participation
Right to participate in treatment decisions
Refuse treatment
Right to refuse treatment (with relevant SUD context)
Privacy
Right to privacy (cross-reference to HIPAA NPP + 42 CFR Part 2)
Records access
Right to access medical records
Complaints
Right to file complaints (NewLeaf grievance process + external authorities)
Non-discrimination
Right to non-discrimination
Interpretation
Right to language interpretation (if applicable)
Family involvement
Right to family involvement (with consent)

Page 6 — Terms of Use

Standard website liability framing

Length: typically 800–1,200 words. Distinct from Patient Bill of Rights: this is the website user agreement for ANYONE visiting the marketing site, not just patients. Covers liability of the marketing site itself.

Acceptance
Acceptance of terms
Informational only
Marketing site is for informational purposes only; not medical advice
No relationship
No doctor-patient relationship established by site visit
IP
Intellectual property (NewLeaf brand, content)
User conduct
No automated scraping, no unauthorized use
Liability
Liability disclaimers
Termination
Termination / right to modify terms
Governing law
Governing law (Michigan)
Contact
Contact info

Page 7 — Privacy Policy (website tracking)

State + federal website-tracking framework

Length: typically 1,000–1,800 words. Distinct from HIPAA NPP: this covers WEBSITE cookie/analytics/marketing tracking, NOT clinical PHI. The site uses Google Analytics 4, Google Tag Manager, Microsoft Clarity. Visitors are tracked anonymously for marketing/analytics purposes.

Info collected
Information collected via website (analytics, cookies, form submissions)
Form data flow
How form data flows (Wix → GoHighLevel BAA-protected → Behave Health EHR for intake)
Tracking tech
Cookie/tracking technology disclosures (GA4, GTM, Clarity)
Opt-out
User opt-out mechanisms (browser settings, GA opt-out)
Marketing consent
Intake form gathers SMS/email opt-in
Third-party processors
GoHighLevel BAA, Behave Health BAA, Google Analytics
Children < 13
Likely COPPA considerations given 12–17 age segment
State rights
California/CCPA-style rights if applicable
Retention
Data retention policies
Privacy contact
Contact info for privacy questions
04 · Secondary scope

Two short reviews after the 7 pages ship

Two follow-up reviews scheduled for mid-June. Quote separately or roll into the base engagement — your preference.

Review
Sent · Time · Compliance focus
GHL SMS automation copy
Sent: ~June 15, 2026 · Time est.: ~30 min
Compliance focus: 42 CFR Part 2 + HIPAA — does any SMS inappropriately acknowledge a patient as receiving SUD treatment without verified consent context?
Website hero / positioning copy
Sent: ~June 17, 2026 · Time est.: ~15 min
Compliance focus: Any misleading-claims risk or undisclosed limitations in Suboxone/MAT homepage language
04 · Out of scope

What's NOT in scope

Boundary line. These items are real legal work but are handled outside this engagement.

Clinical compliance

Tamesha + Behave

Clinical-side framework lives in the EHR, not the website.

  • Tamesha's clinical staff and Behave Health EHR handle clinical-side HIPAA + 42 CFR Part 2 protocols. The website is the marketing layer, not the clinical layer.

EHR contract review

Separate engagement

Direct Tamesha-to-attorney engagement, outside this packet.

  • Tamesha's Behave Health contract is separate (her direct engagement with you, if relevant).

Insurance contract review

Separate engagement

Medicaid managed care + commercial payer contracts.

  • Medicaid managed care and commercial payer contracts are separate from this scope.

Liability insurance review

Separate engagement

Professional liability + general liability policies.

  • Separate.
04 · What we provide

Reference materials available on request

Anything below speeds your work — ask Chad and we'll send it.

HHS HIPAA NPP
Standard HIPAA NPP template (HHS model)
SAMHSA 42 CFR Part 2
Standard 42 CFR Part 2 template (SAMHSA-aligned)
WCAG accessibility
Standard Accessibility Statement template (WCAG 2.1 baseline)
Good Faith Estimate
Standard Good Faith Estimate template
NewLeaf entity
Full NewLeaf entity details (this packet)
Tamesha access
Direct contact with Tamesha for clinical-side context (treatment modality details, intake protocols, etc.)
04 · Deliverable format

How each page should land

Plain text we can paste into the Wix Studio build. Implementation notes welcome. We'll handle the typography, the layout, and the publish — you handle the legal language.

Final language
Final approved language (text format — we integrate into Wix Studio)
Implementation notes
Implementation notes if any (e.g., “include logo here,” “link to grievance form”)
Effective date
Effective date stamp
Cadence
Review/update cadence recommendation (annual? biennial?)
05 · Handoffs

What you receive, what you deliver back

You coordinate primarily with Chad (Creative Partner) and Tamesha. Other fulfillment tracks send copy/automation drafts to you for review when their work product is ready. You deliver primarily to Chad, who integrates the language into the Wix Studio website and shares back to Tamesha for clinical-team sign-off. Tamesha is the final approver on language; you can mark up “needs Tamesha-confirmation” items in your drafts.

From
You receive
You deliver back
Tamesha Porter
Owner, NewLeaf
On engagement confirm: entity details + EHR contract status + any clinical-side template (Behave Health NPP if available).
Drafts of the 7 footer pages; clinical-side flagged items marked “needs Tamesha-confirmation.”
Track B · Content
Writer, via Chad
~June 17, 2026: homepage hero copy + Suboxone/MAT positioning for ~15-min liability review.
Markup on misleading-claims risk or undisclosed limitations.
Track E · GHL/Automation
via Chad
~June 15, 2026: 6 workflows of SMS/email patient-facing copy for ~30-min 42 CFR Part 2 + HIPAA review.
Markup on any SMS that inappropriately acknowledges SUD-treatment status without verified consent.
Track A · Web team
via Chad
On engagement confirm: WCAG 2.1 level we're committing to (baseline A or full AA — depends on whether Tamesha opts into Add-On 1).
Accessibility Statement language reflecting the committed WCAG level.
06 · Risks we already see

Flagged upfront

Already known. None of these block engagement — they're flagged so your quote can accommodate them honestly.

42 CFR Part 2 is stricter than HIPAA

Many attorneys without dedicated SUD-program experience default to HIPAA-framing on the NPP and forget the Part 2 layer. We want both pages drafted and the relationship between them stated clearly so patient-facing language doesn't accidentally re-disclose what Part 2 prohibits.

Medicaid is the primary payor

NewLeaf is Medicaid-primary (~$200–$300/visit Michigan Medicaid). State Medicaid Bill of Rights language is non-optional; commercial-payor-only templates leave gaps.

Patients aged 12–80 — COPPA + minor-consent rules apply

The age range includes minors. Privacy Policy must address COPPA. Patient Bill of Rights should address minor-consent (Michigan law on SUD treatment for minors is more permissive than for general healthcare — worth a specific call-out).

EHR (Behave Health) contract not yet signed

Drafts may need to be revised if Behave Health's own NPP language is materially different from what you draft. Build a revision pass into your quote (or note it as a pass-through cost).

07 · Quote Request

What we need from you

Five items + sign-off. Engagement confirmation first; line items second; anything you'd add, third.

Engagement confirmation

CONFIRM

Proceed

Reply yes to chad@creativepartnersolutions.com (cc Tamesha at info@newleafrecoveryservices.com) and proceed to the quote items below.

DECLINE

Respected

Reply with any reason — conflict, capacity, scope concern — and we'll respect it. No follow-up required.

Quote line items

Fill in your fees / hours. Word-count ranges are typical — what you'd actually deliver is your call.

Line item
Detail  ·  Hours / fee
Engagement confirmation
Reply Y/N within 5 business days  ·  —
Page 1 — HIPAA NPP
Draft or review-and-customize (typically 2,500–4,000 words)  ·  $ / hrs
Page 2 — 42 CFR Part 2
Draft from scratch most likely (typically 800–1,500 words)  ·  $ / hrs
Page 3 — Accessibility Statement
Review our draft for liability framing (typically 400–600 words)  ·  $ / hrs
Page 4 — Good Faith Estimate
Draft from template (typically 300–500 words)  ·  $ / hrs
Page 5 — Patient Bill of Rights
Customize MI Medicaid template (typically 600–1,000 words)  ·  $ / hrs
Page 6 — Terms of Use
Draft from scratch (typically 800–1,200 words)  ·  $ / hrs
Page 7 — Privacy Policy
Draft from scratch — site-tracking, NOT clinical PHI (typically 1,000–1,800 words)  ·  $ / hrs
Secondary review #1 — GHL SMS
~30 min, ~June 15, 2026  ·  $ / hrs
Secondary review #2 — Hero
~15 min, ~June 17, 2026  ·  $ / hrs
Rate model
Hourly / fixed-fee / blended — your call  ·  —
Estimated completion
Target: [send + 14 business days]  ·  —
Recommended review cadence
Annual / biennial / other — your call per page  ·  —
TOTAL
  ·   $

Anything we haven't flagged

Free-form. Notices, disclaimers, Michigan-specific requirements, COPPA considerations, anything you spot that we'd be exposed on. We default to your judgment. If you see something we should add or remove from the 7-page list, flag it in your reply.

08 · Sign-Off

Confirm engagement & quote

Please respond to chad@creativepartnersolutions.com (cc info@newleafrecoveryservices.com) with the 5 items below. We'll countersign and you're engaged.

Engagement sign-off

5 items + signature
1. Engagement (Y/N)
 
2. Estimated hours
7 pages + 2 reviews
 
3. Rate model
Hourly / fixed-fee
 
4. Estimated completion
[target: send + 14 business days]
5. Invoicing
To NewLeaf directly
Tamesha Porter, NewLeaf Recovery Services
Attorney signature
 
Date