Notice of Privacy Practices

Pillar Primary Care and Recovery Services (“Pillar,” “we”) provides primary care and addiction recovery care. We are required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, to notify you if a breach affects your unsecured health information, and to follow the terms of the notice currently in effect.

Two federal laws protect your information. All of your health information is protected by HIPAA. Information from your recovery care that would identify you as having or having had a substance use disorder (“SUD records”) has additional protection under 42 U.S.C. § 290dd-2 and 42 CFR Part 2 (“Part 2”), described in its own section below. Michigan law may give some information, such as HIV and certain mental health information, further protection; where a law is stricter, we follow the stricter law.

How we may use and share your health information

For treatment, payment and health care operations

• Treatment. We use and share your information to provide and coordinate your care, for example among your Pillar providers, with a pharmacy filling your prescription, or with a specialist we refer you to.
• Payment. We use and share your information to bill and get paid by you, your health plan or others, for example sending a claim to your insurance.
• Health care operations. We use and share your information to run our practice and improve care, for example quality reviews, training, licensing, audits, and working with business associates (such as our electronic health record, billing, and AI note-taking vendors) who must protect your information under a written agreement.

For SUD records, these uses and disclosures outside Pillar require your written consent, as explained in the Part 2 section below.

Other uses and disclosures we may make without your written authorization

We may use or share your information in these situations, as permitted or required by law and subject to the extra limits on SUD records:

• When required by federal, state or local law.
• For public health activities, such as reporting certain diseases, preventing or controlling disease, reporting adverse reactions to medications, and product recalls.
• To report suspected abuse, neglect or domestic violence to the proper authorities.
• For health oversight activities, such as audits, investigations and licensing.
• In response to a court or administrative order, subpoena, or other lawful process (SUD records require a court order meeting Part 2 requirements).
• For certain law enforcement purposes, as limited by law.
• To coroners, medical examiners and funeral directors.
• For organ, eye or tissue donation.
• For research that meets legal privacy safeguards.
• To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• For specialized government functions, such as military, national security and correctional institutions, as allowed by law.
• For workers’ compensation or similar programs.

When we share with people involved in your care

Unless you object, we may share information directly relevant to a family member’s, friend’s or other person’s involvement in your care or payment, or to notify them of your location or condition. If you are not present or cannot agree, we use our professional judgment. For SUD records we will share only with your written consent, except in a medical emergency.

Uses and disclosures that require your written authorization

• Most uses and disclosures of psychotherapy notes.
• Uses and disclosures for marketing.
• Any sale of your health information.
• Any other use or disclosure not described in this notice.

You may revoke an authorization in writing at any time, except to the extent we have already acted on it. Pillar does not sell your information or use it for fundraising.

Substance use disorder records: 42 CFR Part 2

SUD records from your recovery care receive the following additional protections:

• Consent. Except as described below, we will not disclose that you receive recovery care, or any information identifying you as having a substance use disorder, without your written consent. You may give a single consent for all future uses and disclosures for treatment, payment and health care operations. You may revoke a consent in writing at any time, except to the extent we have already acted on it.
• Redisclosure. If you consent to disclosure for treatment, payment and health care operations, a recipient that is a HIPAA covered entity or business associate may further use and disclose those records as HIPAA permits. Other recipients may not redisclose them except as Part 2 allows.
• Legal proceedings. Your SUD records, or testimony about their content, may not be used or disclosed in any civil, criminal, administrative or legislative proceeding against you unless you give specific written consent or a court issues an order that meets Part 2 requirements, after notice to you and an opportunity to be heard.
• Without consent, we may disclose SUD records only as Part 2 allows, including: to medical personnel in a bona fide medical emergency; for certain research, audits and program evaluations; to report suspected child abuse or neglect under state law; to public health authorities in de-identified form; to qualified service organizations that provide services to us under a written agreement; and under a court order meeting Part 2 requirements.
• Crimes on our premises. Part 2 does not protect information about a crime committed by a patient at Pillar or against Pillar staff, or about a threat to commit such a crime.
• Accounting and restrictions. You may ask for a list of disclosures of your SUD records made with your consent, and you may ask us to restrict disclosures of your SUD records for treatment, payment or health care operations, as described in “Your rights” below.

Violation of Part 2 is a federal crime. You may report a suspected violation to the U.S. Department of Health and Human Services, Office for Civil Rights (contact information below), and, for opioid treatment programs, to the Substance Abuse and Mental Health Services Administration (SAMHSA).

Your rights

• Get a copy of your records. You may ask to see or get a paper or electronic copy of your medical and billing records. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct your records. You may ask us to amend information you believe is incorrect or incomplete. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications. You may ask us to contact you in a specific way (for example, a cell phone or a different address). We will agree to reasonable requests.
• Ask us to limit what we use or share. You may ask us not to use or share certain information for treatment, payment or operations. We are not required to agree, except that if you pay for a service in full out of pocket, you may ask us not to share information about it with your health plan, and we will agree unless a law requires us to share it.
• Get a list of those we’ve shared information with. You may ask for an accounting of certain disclosures we made in the six years before your request, with whom and why. One list a year is free.
• Get a copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney or have a legal guardian, that person can exercise your rights. We will confirm they have this authority before we act.
• Be notified of a breach. We will notify you if a breach occurs that may have compromised the privacy or security of your information.

To exercise any of these rights, contact our Privacy Officer.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Pillar’s Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, 1-800-368-1019 (TDD 1-800-537-7697), www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, in our office, and on our website, www.pillarprimary.com.