Cornerstone of Recovery Notice of Privacy

This Notice describes the privacy practices of The Cornerstone of Recovery, Inc., which includes each of our facilities in Tennessee, and Ohio. When we say “Cornerstone of Recovery” we mean all the facilities, individually and collectively.

Our Privacy and Confidentiality Obligations

    • We are required by federal and state laws to maintain the privacy and confidentiality of your health, health care, and payment for services related to your health (known as “protected health information (PHI)”).


    • We are required by law to inform you of our legal duties and privacy practices with respect to your health information through this Notice of Privacy Practices. This Notice describes the ways we may share your past, present and future PHI, ensuring that we use and/or disclose this information only as we have described in this notice.


    • We do reserve the right to change our privacy practices and the terms of this Notice, and to make the new Notice provisions effective for all health information we maintain. Any changes to this Notice will be posted throughout our facilities and made available on our website. If at any time you have questions or concerns about the information in this Notice or about our organization’s privacy policies, procedures, and practices, you may contact the Cornerstone of Recovery, Inc. Privacy Office at 865-970- 7747/800-684-6614.


    • Generally, if you are applying for or receiving services for drug or alcohol abuse, we may not acknowledge to a person outside our organization that you attend our program or disclose any information identifying you as an alcohol or drug abuser except under circumstances that are listed in this notice.


    • The HIPAA Privacy Regulations (45 CFR Parts 160 and 164) also protect your health information, whether you are applying for or receiving services for drug or alcohol abuse. Generally, if you are not applying for or receiving services for drug or alcohol abuse, the way we may use and disclose information differs slightly. These differences will be listed in this notice.


Understanding Your Behavioral Health Record Information

Each time you visit a hospital, physician, or other healthcare provider, a record of your visit is made. Typically, this record contains your health history, current symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information, often referred to as your medical record, serves as a:

Basis for planning your care and treatment

Means of communication between those professionals that contribute to your care Legal document describing the care you received

Means by which you and your payer source can verify charges for services A medical education tool

A tool to assess the appropriateness and quality of care you receive

A tool to improve the quality of healthcare and achieve better patient outcomes


Uses and Disclosures WITH your Authorization

    • We may use or disclose your PHI when you give your authorization to do so on a form that specifically meets the requirements of laws and regulations that


    • There are some exceptions and special rules that allow for uses and disclosures without your authorization or consent. They are listed in section D of this Notice.


    • You may revoke your authorization at any time to any person or entity. If you are currently receiving care and wish to revoke your authorization, you will need to request this to one of your treatment team members. After you are discharged, you will need to send a written statement to the attention of Cornerstone of Recovery Information Management


    • Please know a court with appropriate jurisdiction or other authorized third party could request or compel you to sign an authorization, at any time during or after receiving treatment services from Cornerstone



Uses and Disclosures WITHOUT your Authorization

Even when you have not given your authorization, we may use and disclose information under the circumstances listed below. This list applies to all PHI, including the information we get when you are applying for or receiving services for drug or alcohol abuse.

    • Treatment: we may use or disclose your PHI for treatment purposes. Treatment includes diagnosis, treatment and other services, including discharge planning. For example, your treatment team may disclose your PHI to each other to coordinate individual and group therapy sessions for your treatment, or information about treatment alternatives or other health-related benefits and services that are necessary or may be of interest to you.


    • Health Care Operations: We may use or disclose your PHI for the purposes of health care operations that include internal administration and planning and various activities that improve the quality and effectiveness of care. For example, we may use information about your care to evaluate the quality and competence of our clinical staff. We may disclose information to qualified personnel for outcome evaluation, management audits, financial audits, or organizational evaluation; however, such personnel may not identify, directly or indirectly, any individual patient in any report of such audit or evaluation, or otherwise disclose patient identities in any manner. We may disclose your information as needed within Cornerstone of Recovery to resolve any complaints or issues arising regarding your care. We may also disclose your protected health information to an agent or agency which provides services to us under a qualified service organization agreement and/or business associate agreement, in which they agree to abide by applicable federal law and related regulations (42 CFR Part 2 and HIPAA). Health Care Operations may also include use of your PHI for programs offered by Cornerstone of Recovery, such as sending you invitations to alumni events and workshops sponsored by Cornerstone of Recovery. This list of examples is for illustration only and is not an exclusive list of all the potential uses and disclosures that may be made for health care operations.


  • Other allowable uses and disclosures without your authorization, aside from treatment and health care operations include:
      • Appointment Reminders: we may contact you to send you reminder notices of future appointments for your treatment or continuous care, recovery coach, or aftercare appointment


      • Medical Emergencies: we may disclose your PHI to medical personnel to the extent necessary to meet a bona fide medical emergencies


      • Decedents: we may disclose PHI to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.


      • Child Abuse: we may disclose your PHI for the purpose of mandatory state of Tennessee reporting of child abuse and neglect


    • Domestic and Elder Abuse: we may disclose your PHI for the purpose of mandatory state of Tennessee reporting of domestic and elder abuse.


    • Duty to Warn: In the event that a person makes threats of harm or homicidal threats towards an identified individual or entity, approved clinical staff will evaluate and if threats are probable, notification to the individuals or entity will be made as well as to the local sheriff department due to state and federal laws.



Judicial and Administrative Proceedings: we may disclose your PHI in response to a court order or subpoena that meets the requirements of federal regulations

Commission of a Crime on Premises or against Organizational Personnel: we may disclose your PHI to the police or other law enforcement officials if you commit a crime on the premises or against our organizational personnel, or threaten to commit such a crime.

Audit and Evaluation Activities: we may disclose your PHI to those who perform audit or evaluation activities for certain healthcare operations oversight, such as, state licensure or certification agencies, the Joint Commission on Accreditation of Healthcare Organizations, which oversees the health care system and ensures compliance with regulations and standards, or those providing financial assistance to Cornerstone of Recovery.

Recovery Coach and Continuous Care: we may contact you post-discharge from treatment to inquire about the status of your personal recovery from alcohol and drug abuse.

Research: we may use or disclose your PHI without your consent or authorization for research purposes, which will generally be presented in a ‘de-identified’ manner, which maintains certain levels of confidentiality and data safeguards.

Required by law: we may disclose your PHI as required by other state or federal laws not specifically mentioned in this notice

Law Enforcement activities: we may disclose your PHI to law enforcement officials in response to a valid court order or warrant or as otherwise required or permitted by law

Federal Government: we must disclose your PHI to the United States Department of Health and Human Services when requested to enforce the privacy laws and ensure organizational compliance.

Your Individual Rights

  1. Right to request restrictions: at your request, we will not disclose your PHI to your health plan if the disclosure is for payment of a health care item or service for which you have paid Cornerstone of Recovery out of pocket in full. You may request additional restrictions on our use and disclosure of your PHI for treatment, payment, and health care operations. While we will consider requests for additional restrictions, we are not required to agree to a requested restriction. If you wish to request additional restrictions and you are currently receiving treatment services, please make this request known to any member of your treatment team, who will get your signed authorization to rescind an active authorization. If you are no longer receiving services from Cornerstone of Recovery, contact the Information Management Department in writing specifying your request to rescind an authorization or restrict.


  1. Right to Inspect and Copy your PHI: you may request access to your records at Cornerstone of Recovery and billing records. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records and you are currently receiving treatment services, please ask any one of your treatment team members. Once you are no longer receiving treatment services from Cornerstone, contact the Information Management Department in writing with your request. If you request copies of your medical records at Cornerstone of Recovery, please be aware we have a right to charge for each page copied and you will be told the cost prior to the copies being made. Cornerstone of Recovery must receive payment in full before the copies of your records are given to you.  If you request electronic copies this can also be arranged.  If you are interested in electronic records, please contact the Information Management Department in writing with your request.  Please be aware that collateral or third-party records cannot be re-released either hard or electronic copies.  Record request will be honored no later than 30 days of written request.

Right to amend your Records: you have the right to request that we amend your PHI maintained within your medical record or billing records. If you desire to amend your records and you are currently receiving treatment services, please contact any one of your treatment team members. Once you are no longer receiving treatment services from Cornerstone of Recovery, contact the Cornerstone of Recovery Information Management Department. Under certain circumstances, Cornerstone of Recovery has the right to deny your request to amend your records and will notify you of this denial as provided in the HIPAA regulations. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend” a record, we may append information to the original record, as opposed to physically removing or changing the original If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical records.


Right to Receive Account of Disclosures: upon request, you may obtain a detailed list of correspondence when Cornerstone of Recovery staff has disclosed your PHI, whether you gave written authorization or did not give written authorization. The account will apply only to covered disclosures prior to the date of your request, provided such period does not exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. If you request an accounting more than once during a twelve-month period, there will be a charge. You will be informed of the cost prior to the request being.


Right to Receive Notification of Breach: you will be notified in the event we discover a breach has occurred such that your PHI or confidentiality may have been compromised. A risk analysis will be conducted to determine the probability that PHI has been Notification will be made no more than 60 days after the discovery of the breach, unless it is determined by a law enforcement agency that the notification should be delayed.


Right to Receive Copy of this Notice: upon request, you may obtain a paper copy of this Notice of Privacy


For Further Information and/or Complaints: if you require further information about your privacy and confidentiality rights, you may contact the Office of the Privacy Officer at Cornerstone of Recovery at 865-970-7747 or 800-684-6614. You may call this number if you are concerned in any way that we have violated your privacy rights, if you disagree with a decision that we made about access to your PHI, or if you wish to complain about our breach notification processes. You may also feel free to file a written complaint with the Secretary of the United States Department of Health and Human Services. Upon request, we will provide you with the correct address. We will not retaliate against in any way you if you file a complaint.


Effective Date and Duration of This Notice

Effective date: This notice is effective September 23, 2013.  Revision done January 20, 2020.

Right to change terms of this Notice: we may change the terms of this Notice at any time. If we change this Notice, we may make the new Notice terms effective to all PHI that we maintain, including any information created or received prior to issuing the new Notice. If we change this Notice, we will post the new Notice in public access areas at our locations and on our Internet site You may also obtain any new Notice by contacting the Cornerstone of Recovery Privacy Office.