Pyramid Healthcare, Inc. – Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice also describes your rights with respect to your health information and how to file a complaint concerning a violation of the privacy or security of your health information.

You have a right to a copy of this Notice, in paper or electronic form.

Pyramid Healthcare, Inc.
271 Lakemont Park Boulevard
Altoona, PA 16602

Effective date of this revised Notice: October 1, 2026
Revised: September 23, 2026

Kimberly Cerretta, Privacy Officer
(908) 363-1023 ext. 8942
Email: [email protected]

Our Duties

Pyramid Healthcare, Inc., and its facilities and subsidiaries, respect your privacy. We are also legally required to maintain the privacy of your protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) and other federal and state laws. We follow state privacy laws when they are stricter or more protective of your PHI than federal law.

As part of our commitment and legal compliance, we are providing you with this Notice of Privacy Practices (Notice). This Notice describes:

• Our legal duties and privacy practices regarding your PHI, including our duty to notify you following a data breach of your unsecured PHI.
• Our permitted uses and disclosures of your PHI.
• Your rights regarding your PHI.

Confidentiality of Substance Use Disorder Records

The confidentiality of substance use disorder (SUD) records is protected by federal law and regulations, including 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records).

Generally, we may not tell a person outside the facility that you attend or are a client of the facility, or disclose any information identifying you as having a substance use disorder, unless:

• You consent in writing (as discussed below in “Authorization to Use or Disclose PHI”);
• The disclosure is allowed by a court order (as discussed below in “Other Uses and Disclosures”); or
• The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation (as discussed below in “Other Uses and Disclosures”).

Violation of the federal law and regulations by the facility is a crime. Suspected violations may be reported to appropriate authorities in accordance with federal regulations. Federal law and regulations do not protect any information about a crime committed by you either at the facility or against any person who works for the facility or about any threat to commit such a crime (as discussed below in “Uses and Disclosures”).

Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities (as discussed below in “Uses and Disclosures”).

Your SUD records, and any testimony that relays their content, may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you give specific written consent or a court order is entered in accordance with 42 CFR Part 2. Any such court order must be accompanied by a subpoena or other legal mandate compelling disclosure, and, where required, may be issued only after you (or the holder of the record) are given notice and an opportunity to be heard.

You may provide a single written consent authorizing all future uses and disclosures of your SUD records for treatment, payment, and health care operations. When you provide such consent, we, and any covered entity or business associate that receives your records for these purposes, may use and disclose them for treatment, payment, and health care operations as permitted by HIPAA until you revoke your consent in writing.

When your SUD records are disclosed to a Part 2 program, covered entity, or business associate with your consent for treatment, payment, or health care operations, that recipient may further disclose them, without your written consent, to the extent HIPAA permits. Other recipients are generally prohibited by 42 CFR Part 2 from re-disclosing your SUD records without your written consent, except as permitted by 42 CFR Part 2.

For your SUD records, you also have the right to receive an accounting of disclosures of electronic records made during the past three years, and a list of disclosures made through an intermediary, as provided by 42 CFR Part 2. This is in addition to the accounting rights described below under “Your Rights.”

Contact

If you have any questions about this Notice, please contact Kimberly Cerretta, Privacy Officer.

PHI Defined

Your PHI:

• Is health information about you:
  • which someone may use to identify you; and
  • which we keep or transmit in electronic, oral, or written form.
• Includes information such as your:
  • name;
  • contact information;
  • past, present, or future physical or mental health or medical conditions;
  • payment for health care products or services; or
  • prescriptions.

Scope

We create a record of the care and health services you receive, to provide your care, and to comply with certain legal requirements. This Notice applies to all the PHI that we generate.

We follow and our employees and other workforce members follow the duties and privacy practices that this Notice describes and any changes once they take effect.

Changes to this Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available on request, in our office, and on our website.

Data Breach Notification

We will promptly notify you if a data breach occurs that may have compromised the privacy or security of your PHI. We will notify you within the legally required time frame after we discover the breach.

Most of the time, we will notify you in writing, by first-class mail, or we may email you if you have provided us with your current email address and you have previously agreed to receive notices electronically.

In some circumstances, our business associates, which are described in more detail below, may provide the notification. In limited circumstances when we have insufficient or out-of-date contact information, we may provide notice in a legally acceptable alternative form.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

You have the right to:

Get a Copy of Your PHI

You can ask to see or obtain an electronic or paper copy of the PHI that we maintain about you (right to request access). Some clarifications about your access rights:

• We may require you to make access requests in writing/by submitting an electronically signed form.
• We may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies associated with your request. This fee complies with state/federal laws.
• You may request that we provide a copy of your PHI to a family member, another person, or a designated entity. We require that you submit these requests in writing with your signature, and submit an electronically signed form, and clearly identify the designated person and where to send the PHI.
• You may request that we direct a copy of your PHI to a third party of your choice on a standing, regular basis. We require that you submit these requests in writing and/or electronically.
• If you request a copy of your PHI, we will generally decide to provide or deny access within 30 days, however, if we cannot act within 30 days, we will give you a reason for the delay in writing and when you can expect us to act on your request.
• We may deny your request for access in certain limited circumstances, however, if we deny your access request, we will provide a written denial with the basis for our decision and explain your rights to appeal or file a complaint.

Ask Us to Correct Your Medical Record

You may ask us to correct or amend PHI that we maintain about you that you think is incorrect or inaccurate. For these requests:

• You must submit requests in writing/electronically, specify the inaccurate or incorrect PHI, and provide a reason that supports your request.
• We will generally decide to grant or deny your request within 60 days. If we cannot act within 60 days, we will give you a reason for the delay in writing and include when you can expect us to complete our decision, which will be no longer than an additional 30 days. We will only ask for an extension once in response to a request.
• We may deny your request for an amendment if you ask us to amend PHI that is not part of our record, that we did not create, that is not part of a designated record set, or that is accurate and complete.
• If we deny your request, we will tell you why in writing. You will have the right to submit a written statement disagreeing with the denial and, if you opt not to submit this statement, you may request that we provide your original request for amendment and the denial with any future disclosures of PHI subject to the amendment. However, we may prepare a written rebuttal to any individual’s statement of disagreement.
• We will append the material created or submitted in accordance with this paragraph to your designated record.

Ask Us to Limit What We Use or Share

You have the right to ask us to limit what we use or share about your PHI (right to request restrictions). You can contact us and request us not to use or share certain PHI for treatment, payment, or operations or with certain persons involved in your care. We may require that you submit this request in writing.

For these requests:

• We are not required to agree.
• We may say “no” if it would affect your care.
• We will agree not to disclose information to a health plan for purposes of payment or health care operations if the requested restriction concerns a health care item or service for which you or another person, other than the health plan, paid in full out-of-pocket, unless it is otherwise required by law.

Get a List of Those With Whom We’ve Shared Your PHI

You have the right to request an accounting of certain PHI disclosures that we have made. For these requests:

• We will respond no later than 60 days after receiving the request. We may ask for an additional 30 days during this 60-day period, but if we do, we will only do it once, provide a written statement of why, and indicate the date by which we intend to send the response.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures, such as any you asked us to make.
• We will provide one accounting a year for free, but may charge a reasonable, cost-based fee if you ask for another one within 12 months. We will notify you about the costs in advance and you may choose to withdraw or modify your request at that time.

Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action.

Request Confidential Communications

You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or at a specific address.

For these requests:

• We will not ask for the reason.
• You must specify how or where you wish to be contacted.
• We will accommodate reasonable requests.

Make a Complaint

You have the right to complain if you feel we have violated your rights related this notice. We will not retaliate against you for filing a complaint.

You may either file a complaint:

• By submitting a written complaint to Kimberly Cerretta, Privacy Officer, at [email protected]; or
• With the Office for Civil Rights at the US Department of Health and Human Services at www.hhs.gov/ocr/privacy/hipaa/complaints/.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact us and we will make reasonable efforts to follow your instructions.

In these cases, you have both the right and choice to tell us whether to:

• Share information, such as your PHI, general condition, or location, with your family, close friends, or others involved in your care.
• Share information in a disaster relief situation, such as to a relief organization to assist with locating or notifying your family, close friends, or others involved in your care.

If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, according to our best judgment. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we will not share your information unless you give us your written permission:

• Most sharing of a mental health care professional’s notes (psychotherapy notes).
• Marketing purposes.
• Selling or otherwise receiving compensation for disclosing your PHI.
• Fundraising. If we use your Part 2 records for fundraising communications, we will give you clear notice in advance and a choice about whether to receive them. You may opt out of fundraising communications by contacting our Privacy Officer.
• Certain research activities.
• Other uses and disclosures not described in this Notice.

You may revoke your authorization at any time, but it will not affect information that we already used and disclosed.

Uses and Disclosures of Your PHI

The law permits or requires us to use or disclose your PHI for various reasons, which we explain in this Notice. We have included some examples, but we have not listed every permissible use or disclosure.

When using or disclosing PHI or requesting your PHI from another source, we will make reasonable efforts to limit our use, disclosure, or request about your PHI to the minimum we need to accomplish our intended purpose.

Treatment

We may use or disclose your PHI and share it with other professionals who are treating you, including doctors, nurses, technicians, medical students, or hospital personnel involved in your care for the purpose of providing, coordinating, or managing your healthcare and related services.

For example, we might disclose information about your overall health condition to physicians who are treating you for a specific injury or condition.

Among Pyramid Healthcare Personnel

We may use or disclose your PHI between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse, provided such communication is: (i) within the facility; or (ii) between the facility and Pyramid Healthcare, Inc.

Billing and Payment

We may use and disclose your PHI to bill and get payment from health plans or others other third parties. For example, we share your PHI with your health insurance plan so it will pay for the services you receive.

Running Our Organization (Healthcare Operations)

We may use and disclose your PHI to run our practice, improve your care, and contact you when necessary. For example, we may use your PHI to manage the services and treatment you receive or to monitor the quality of our health care services.

Other Uses and Disclosures

We may share your information in other ways, usually for public health or research purposes or to contribute to the public good.

For more information on permitted uses and disclosures, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

For example, these other uses and disclosures may involve:

Our Business Associates

We may use and disclose your PHI to outside persons or entities that perform services on our behalf, such as auditing, legal, or transcription (Business Associates). The law requires our business associates and their subcontractors to protect your PHI in the same way we do.

We also contractually require these parties to use and disclose your PHI only as permitted and to appropriately safeguard your PHI.

Health Information Exchanges

We participate in health information exchanges (HIEs) which support electronic information sharing among members for treatment, payment, and health care operations purposes.

Individuals may opt-out of HIEs. We will use reasonable efforts to limit the sharing of PHI in these electronic sharing activities for individuals who have opted out. If you would like to opt out, please contact Kimberly Cerretta, Privacy Officer.

Complying With the Law

For example, we will share your PHI if the Department of Health and Human Services requires it when investigating our compliance with privacy laws.

Helping With Public Health and Safety Issues

For example, we may share your PHI to:

• Prevent disease.
• Report adverse reactions to medications or medical device product defects.
• Report suspected child neglect or abuse, or domestic violence.
• Avert a serious threat to public health or safety.

Responding to Legal Actions

For example, we may share your PHI to respond to:

• A court or administrative order or subpoena.
• Discovery request.
• Another lawful process.

Research

For example, we may share your PHI for some types of health research that do not require your authorization, such as if an institutional review board (IRB) has waived the written authorization requirement because the disclosure only involves minimal privacy risks.

Audit and Evaluation Activities

We may disclose your PHI to persons conducting certain audit and evaluation activities, provided the person agrees to certain restrictions on disclosure of information.

Working With Medical Examiners or Funeral Directors

For example, we may share PHI with coroners, medical examiners, or funeral directors when an individual dies.

Addressing Workers’ Compensation, Law Enforcement, or Other Government Requests

For example, we may use and disclose your PHI for:

• Workers’ compensation claims.
• Health oversight activities by federal or state agencies.
• Law enforcement purposes or with a law enforcement official.
• Specialized government functions, such as military and veterans’ activities, national security and intelligence, presidential protective services, or medical suitability.

Crimes on Premises

We may disclose to law enforcement officers PHI that is directly related to the commission of a crime on the premises or against our personnel or to a threat to commit such a crime.

Reports of Suspected Child Abuse and Neglect

We may disclose PHI required to report under state law incidents of suspected child abuse and neglect to the appropriate state or local authorities.

However, we may not disclose the original patient records, including for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect, without consent.

Emergency Situations

We may disclose PHI to medical personnel for the purpose of treating you in an emergency.

Technology and Artificial Intelligence

Pyramid Healthcare, Inc. uses approved, secure AI tools to support care and operations, including treatment, payment, and preparing and organizing clinical documentation. AI assists staff but does not make care decisions; counselor remains responsible and reviews AI-assisted documentation.

We protect your health information under this Notice and applicable law. Vendors must safeguard it and limit its use. We use encryption, access controls, and limited retention.

We do not sell your information or use identifiable health information to train AI without your written authorization, unless it is de-identified.

Before technology listens to, records, or transcribes a session, we will notify you and obtain required consent. You may decline without affecting your care.

When we use technology that listens to, records, or transcribes a particular session, we will tell you and obtain any required consent before using it. You may decline the use of these tools for a session without affecting your access to care.

Disclosures to Entities Not Regulated by HIPAA Privacy Rule

Information disclosed by us to an individual or entity not regulated by the HIPAA privacy rule may be subject to redisclosure and no longer protected as the recipient is not required to comply with the confidentiality obligations applicable to us and described in this notice.

Part 2 Protections

The uses and disclosures described above may be subject to the additional protections for Part 2 records. For treatment, payment, and health care operations involving Part 2 records, we obtain your written consent unless Part 2 permits the particular use or disclosure without it.

A general HIPAA permission listed above does not, by itself, authorize disclosure of a Part 2 record.

In particular, we will not use or disclose Part 2 records or testimony about them in investigations or proceedings against you without your specific written consent or a Part 2 court order accompanied by a subpoena or other legal mandate.