Notice of Privacy Practices

42 CFR PART 2 Substance Use Disorder (SUD)

Upperline Health | Effective Date: May 28, 2026

THIS NOTICE DESCRIBES:

HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOUR RIGHT TO OBTAIN A COPY OF THIS NOTICE IN PAPER OR ELECTRONIC FORM

PLEASE REVIEW THIS NOTICE CAREFULLY.

Questions about this Notice? Contact: Privacy Officer, Madison Bryant | (844)-427-4216 | compliance@upperlinehealth.com

Section 1 — Our Legal Duties

Upperline Health (“this program” or “we”) is required by federal law (42 CFR Part 2 and HIPAA) to:

Maintain the privacy and confidentiality of your substance use disorder (SUD) treatment records;
Provide you with this Notice of our legal duties and privacy practices; and
Notify you promptly if there is a breach of your unsecured records.

We are required to abide by the terms of the notice currently in effect.

We reserve the right to change the terms of this Notice and to make the revised provisions effective for all records we maintain, including records created or received before the revision. If we make a material change, we will:

Post the revised Notice conspicuously at our service delivery site(s) in a location where patients can read it without being identified as receiving SUD treatment;
Make the revised Notice available upon request on or after its effective date; and
Post the revised Notice on our website, if we maintain one that describes our services or benefits.

Section 2 — About Your Substance Use Disorder Records

This program is a Part 2 program subject to 42 CFR Part 2, which provides heightened federal confidentiality protections for SUD treatment records that are stronger than standard HIPAA protections. Your records are protected by both:

42 U.S.C. § 290dd-2 and 42 CFR Part 2 (federal SUD confidentiality law); and
The Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164.

Where state law is more stringent than federal law regarding the confidentiality of your records, this program will follow the more protective standard.

Section 3 — Uses and Disclosures Permitted Without Your Written Consent

Federal law permits or requires this program to use or disclose your records without your written consent only in the following limited circumstances. Where other applicable law further limits these disclosures, we will comply with the more stringent standard.

Medical Emergencies

We may disclose your records to medical personnel to the extent necessary to meet a bona fide medical emergency involving a risk to your life or the life of another person. We will document the emergency disclosure and, when feasible, seek your consent after the emergency has been addressed.

Research, Audit, and Program Evaluation

We may use or disclose your records for research, audit, or program evaluation purposes as permitted under 42 CFR § 2.52, including when an Institutional Review Board (IRB) or Privacy Board has determined that the need for research outweighs the risk to your privacy and has approved a waiver of the written consent requirement.

Reporting of Suspected Child Abuse or Neglect

We are required by applicable state law to report suspected child abuse or neglect to appropriate authorities. We may make such an initial report without your written consent; however, federal law prohibits us from disclosing any additional records or information beyond what is required to make that report.

Oversight Activities

Authorized federal, state, or local government agencies responsible for oversight of this program — including audits, inspections, and program evaluations — may have access to your records as required by law and as permitted under 42 CFR § 2.53.

Court Orders

We may disclose your records when a court order is entered in compliance with 42 CFR § 2.61. See Section 5 of this Notice for a full description of the legal protections that apply before your records may be used in any legal proceeding.

Deceased Patients

We may disclose information about a deceased patient to a coroner, medical examiner, or similar official for purposes of identifying the deceased, determining the cause of death, or as otherwise authorized by law.

Crimes on Program Premises or Against Program Personnel

If a patient commits or threatens to commit a crime on this program’s premises or against this program’s personnel, we may report and provide information to a law enforcement agency or seek its assistance, as permitted under 42 CFR § 2.12(c)(5).

Section 4 — Uses and Disclosures That Require Your Written Consent

Except as described in Section 3, this program will not use or disclose your records for any purpose without your specific written consent. Your written consent is required for uses and disclosures including, but not limited to:

Sharing your records with your primary care physician, specialist, or other treating provider (example: sending a summary of your treatment to a referring physician);
Disclosing your records to your health insurance company, managed care organization, or other payer for payment purposes;
Sharing your records for health care operations, such as quality improvement activities conducted by another covered entity;
Releasing your records to a family member, personal representative, or caregiver;
Disclosing your records to an employer, school, court, or other third party at your request; and
Any other use or disclosure not specifically described in this Notice.

Single Consent for Treatment, Payment, and Health Care Operations (TPO)

You may provide a single written consent authorizing all future uses and disclosures of your records for treatment, payment, and health care operations purposes. This single consent will remain in effect until you revoke it.

Your Right to Revoke Consent

You may revoke any written consent you have given at any time, except to the extent that we have already acted in reliance on that consent. Revocation must be submitted in writing to our Privacy Officer. See 42 CFR §§ 2.31 and 2.35 for the applicable requirements.

Important Notice Regarding Further Disclosures by Covered Entities and Business Associates

If we disclose your records to a covered entity (such as a hospital, health plan, or physician practice) or a business associate pursuant to your written consent for treatment, payment, or health care operations, that covered entity or business associate may be permitted to further disclose your records to others without obtaining additional written consent from you to the extent that such further disclosure is permitted under HIPAA. You should be aware of this before providing consent for TPO disclosures.

Section 5 — Legal Protections Against Use of Your Records in Proceeding

Federal law provides you with the following important protections against the use of your SUD treatment records in legal proceedings:

Your records, or any testimony relaying the content of such records, may not be used or disclosed in any civil, administrative, criminal, or legislative proceeding against you, unless such use or disclosure is based on your specific written consent or a court order issued in accordance with 42 U.S.C. § 290dd-2 and 42 CFR Part 2.
Your records may only be disclosed pursuant to a court order after you, or the holder of the record, have been provided notice and an opportunity to be heard, where required by 42 U.S.C. § 290dd-2 and 42 CFR Part 2.
Any court order authorizing the use or disclosure of your records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before your records may be released.

Section 6 — Your Rights Regarding Your Records

You have the following rights with respect to your SUD treatment records maintained by this program. To exercise any of these rights, submit a written request to our Privacy Officer using the contact information in Section 8.

Right to Request Restrictions on Disclosures [42 CFR § 2.26]

You have the right to request that we restrict uses or disclosures of your records that would otherwise be made with your written consent for treatment, payment, or health care operations purposes. We are not required to agree to every requested restriction, except that we must agree to restrict disclosures to your health plan when: (1) the disclosure is for payment or health care operations and is not required by law; and (2) the record pertains solely to a health care item or service for which you, or someone other than your health plan on your behalf, has paid us in full.

Right to an Accounting of Disclosures [42 CFR § 2.25; 45 CFR § 164.528]

You have the right to receive an accounting of disclosures of your electronic records under 42 CFR Part 2 made during the past three (3) years. For all other disclosures made with your consent, you have the right to an accounting that meets the requirements of 45 CFR §§ 164.528(a)(2) and (b) through (d). Your request must be in writing and must specify the time period (no more than three years).

Right to a List of Disclosures by an Intermediary [42 CFR § 2.24]

If you have signed a general designation consent authorizing an intermediary to disclose your records, you have the right to request a list of the persons or entities to which your records have been disclosed by that intermediary during the past three (3) years. The intermediary must respond within 30 days and must provide the name of each recipient, the date of disclosure, and a brief description of the information disclosed.

Right to a Copy of This Notice

You have the right to obtain a paper or electronic copy of this Notice at any time, upon request, even if you previously agreed to receive this Notice electronically.

Right to Discuss This Notice

You have the right to discuss this Notice with our designated Privacy Officer. Contact information is provided in Section 8.

Right to Elect Not to Receive Fundraising Communications

You have the right to elect, at any time, not to receive fundraising communications from this program. To exercise this right, contact our Privacy Officer using the information in Section 8. We will honor your election promptly.

Section 7 — How to File a Complaint

If you believe your privacy rights under 42 CFR Part 2 or HIPAA have been violated, you may file a complaint with:

This program — by contacting our Privacy Officer in writing using the information provided in Section 8; or
The Secretary of the U.S. Department of Health and Human Services (HHS) — by visiting www.hhs.gov/ocr/privacy/hipaa/complaints or by contacting the Office for Civil Rights (OCR) at 1-800-368-1019.

You will not be retaliated against, penalized, or denied services for filing a complaint with this program or with HHS.

Section 8 — Contact Information

For questions about this Notice, to request a copy of this Notice, to revoke consent, to request a restriction, to request an accounting of disclosures, to opt out of fundraising communications, or to file a complaint, please contact:

Upperline Health
ATTN: Privacy Officer, Madison Bryant
4101 Charlotte Avenue, Suite F185
Nashville, TN 37209
(844)-427-4216
compliance@upperlinehealth.com

Section 9 — How We Provide This Notice

This program will make this Notice available to any person upon request. We will provide this Notice to patients:

No later than the date of the first service delivery (including electronic service delivery); or
In an emergency treatment situation, as soon as reasonably practicable after the emergency.

We will keep this Notice available for patients to take and will post it in a clear and prominent location where patients can read it without being identified as receiving SUD treatment.

We will prominently post this Notice on our website. We may also provide this Notice by email if you agree to receive electronic notices and have not withdrawn that agreement. If an email transmission fails, we will provide a paper copy. You retain the right to obtain a paper copy of this Notice at any time upon request.