Privacy Policy and Notice of Privacy Practices
Icarus Addiction Care, PLLC
Effective Date: September 12, 2026
This notice describes how medical information about patients may be used and disclosed, how Icarus Addiction Care protects that information, and how patients can obtain access to their information. Please review it carefully.
Icarus Addiction Care, PLLC (“Icarus”) is committed to protecting the privacy and confidentiality of patients, prospective patients, and website visitors. As a healthcare provider specializing in addiction medicine, Icarus protects health information in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), its implementing regulations, applicable Tennessee law, and, when applicable, the federal confidentiality requirements governing substance use disorder records under 42 CFR Part 2 (“Part 2”).
This notice applies to protected health information maintained by Icarus in connection with healthcare services and related operations, including information collected or maintained through Icarus clinics, telemedicine services, hospital consultation services, contracted clinical services, patient communications, and the Icarus website.
1. Protected Health Information
“Protected Health Information” or “PHI” generally means individually identifiable information relating to a person's past, present, or future physical or mental health; healthcare received by that person; or payment for healthcare.
Information concerning the diagnosis, treatment, or referral for treatment of a substance use disorder may receive additional federal confidentiality protections under 42 CFR Part 2. Information provided to Icarus through patient registration, appointment requests, telemedicine services, patient portals, clinical communications, treatment, billing, website forms, or other healthcare interactions may constitute PHI and will be handled in accordance with applicablefederal and state privacy laws.
General information generated from visiting the public portions of the Icarus website does notnnecessarily constitute PHI. When website information is linked to an identifiable individual seeking or receiving healthcare from Icarus, however, Icarus treats that information in accordance with applicable healthcare privacy requirements.
2. Icarus's Responsibilities
Icarus is required by law to:
Maintain the privacy and security of PHI;
Protect substance use disorder patient records as required by 42 CFR Part 2;
Provide patients with notice of Icarus's legal duties and privacy practices;
Follow the privacy practices described in the notice currently in effect;
Use appropriate administrative, technical, and physical safeguards to protect health information;
Notify affected individuals as required by law if a breach occurs that compromises the privacy or security of protected information; and
Refrain from retaliating against any person for exercising privacy rights or filing a privacy complaint.
Icarus will not use or disclose health information except as permitted or required by law, as described in this notice, or as authorized by the patient.
3. Special Protection for Substance Use Disorder Records
Because Icarus provides substance use disorder treatment, some patient records maintained by Icarus are subject to the enhanced confidentiality protections of 42 CFR Part 2.
Part 2 generally provides additional confidentiality protections for substance use disorder records beyond those applicable to ordinary medical records.
When Part 2 applies, Icarus will obtain patient consent for uses and disclosures when required by law. A valid consent may permit certain uses and disclosures for treatment, payment, and healthcare operations as allowed by Part 2 and HIPAA.
Part 2 records generally may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against a patient unless specifically authorized by the patient or permitted by a qualifying court order and subpoena or other applicable legal authority.
Icarus will not disclose Part 2 records to law enforcement, courts, attorneys, governmental agencies, employers, or other persons for use against a patient merely because those records exist within Icarus's medical record systems.
Substance use disorder treatment information will be disclosed only as permitted by applicable law.
4. How Icarus May Use and Disclose Health Information
Subject to HIPAA, Part 2, Tennessee law, and any other applicable restrictions, Icarus may use or disclose health information for purposes including the following:
Treatment
Icarus may use health information to provide, coordinate, or manage healthcare and may share information with healthcare professionals involved in a patient's treatment when legally
permitted.
For example, an Icarus clinician may communicate with another physician, pharmacy, hospital, laboratory, treatment program, counselor, or other healthcare professional involved in a patient's care.
Additional Part 2 requirements may apply to substance use disorder records.
Payment
Icarus may use or disclose health information as legally permitted to bill a patient, health plan, or other responsible party and to obtain payment for healthcare services.
Healthcare Operations
Icarus may use health information as legally permitted to operate the practice, including quality improvement, clinical supervision, credentialing, compliance, auditing, training, business administration, peer review, and other healthcare operations.
Public Health and Safety
Icarus may disclose information when permitted or required by law for certain public health or safety purposes, including reporting certain diseases, adverse events, abuse or neglect, or serious threats to health or safety.
Additional restrictions may apply to Part 2 records.
When Required by Law
Icarus may disclose information when required to do so by applicable federal or state law. Icarus will disclose only the information legally required and will continue to apply Part 2 protectionswhere applicable.
Business Associates and Service Providers
Icarus may use vendors or contractors that perform services involving PHI. When required by HIPAA, these organizations are considered “business associates” and must contractually agree to appropriately safeguard PHI.
Part 2 records provided to contractors or other lawful recipients remain subject to applicable Part 2 requirements.
5. Uses Requiring Authorization or Consent
Icarus will obtain written authorization, consent, or other permission when required by law.
This includes certain uses or disclosures involving:
Marketing;
Sale of PHI;
Psychotherapy notes;
Substance use disorder records protected by Part 2;
Certain disclosures to family members or other persons identified by the patient; and
Other uses or disclosures not otherwise permitted by law.
A patient may revoke an authorization or consent in writing, subject to legal limitations and actions already taken in reliance upon that authorization or consent.
Icarus does not sell patient PHI.
6. Patient Privacy Rights
Patients have important rights regarding health information maintained by Icarus.
Obtain Medical Records
A patient may ask to inspect or receive an electronic or paper copy of the patient's medical record and other health information maintained by Icarus, subject to limited exceptions
permitted by law.
Request a Correction
A patient may ask Icarus to correct or amend health information believed to be incorrect or incomplete.
Icarus may deny certain requests when permitted by law but will explain the reason for the denial.
Request Confidential Communications
A patient may ask Icarus to communicate in a particular manner or at a particular location, such as using a specific telephone number, mailing address, or other reasonable method.
Icarus will accommodate reasonable requests as required by law.
Request Restrictions
A patient may ask Icarus not to use or disclose certain health information.
Icarus is not required to agree to every restriction except where the law specifically requires otherwise.
If a patient pays for a healthcare service or item entirely out of pocket, the patient may ask Icarus not to disclose information about that service to a health insurer for payment or healthcare operations. Icarus will comply when required by HIPAA.
Receive an Accounting of Disclosures
A patient may request an accounting of certain disclosures Icarus has made of the patient's health information as provided by law.
Rights concerning accounting for electronic Part 2 records will be provided in accordance with applicable federal requirements.
Obtain a Copy of This Notice
A patient may request a paper or electronic copy of this notice at any time.
This notice is also made available through the Icarus website and at Icarus clinical locations as appropriate.
Choose a Personal Representative
If another person has legal authority to act on a patient's behalf, such as through a valid healthcare power of attorney, guardianship, or other legally recognized authority, that person
may exercise the patient's privacy rights when applicable. Icarus may verify the person's authority before acting on a request.
Revoke Certain Authorizations or Consents
When a patient has authorized or consented to a use or disclosure of information, the patient may generally revoke that authorization or consent in writing for future uses or disclosures, except to the extent Icarus has already acted in reliance upon it or applicable law provides otherwise.
7. Family Members and Other Persons Involved in Care
HIPAA sometimes permits healthcare providers to communicate limited information with family members, friends, or others involved in a patient's care.
Because substance use disorder information may receive additional protection under Part 2, Icarus will apply the more protective applicable standard and obtain consent when required.
A patient may tell Icarus whom Icarus may communicate with regarding the patient's healthcare.
8. Legal Proceedings and Law Enforcement
Healthcare information is not automatically available to law enforcement, attorneys, courts, employers, governmental agencies, or other third parties.
Special protections apply to substance use disorder records.
To the extent Icarus maintains records protected by 42 CFR Part 2, those records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against a patient without the patient's specific written consent or a court order and subpoena that satisfy applicable federal requirements.
9. Website Forms and Electronic Communications
The Icarus website may allow patients and prospective patients to request appointments, request information, provide contact information, submit forms, or otherwise communicate with Icarus.
Information submitted through website forms that relates to seeking or receiving healthcare may become PHI and will be handled in accordance with applicable healthcare privacy laws.
Icarus uses reasonable administrative, technical, and physical safeguards intended to protect information transmitted electronically. Sensitive or confidential information transmitted through the Icarus website is protected using appropriate secure transmission methods, including encrypted connections such as Secure Socket Layer/Transport Layer Security (“SSL/TLS”), when applicable.
No internet transmission, electronic communication method, or electronic storage system can be guaranteed to be completely secure. Patients and prospective patients should avoid sending highly sensitive medical information through ordinary email, standard text messages, or general website fields unless Icarus specifically directs use of that communication method.
10. Cookies, Analytics, Advertising, and Tracking Technologies
The Icarus website may use cookies and similar technologies for functions such as security, website performance, navigation, analytics, and understanding how visitors use the website.
Because information relating to a person's healthcare may constitute PHI in certain circumstances, Icarus does not intentionally disclose PHI to advertising platforms, analytics providers, data brokers, or other third parties except when the disclosure is permitted by applicable law and appropriate privacy protections are in place.
Icarus does not sell PHI or Part 2 patient information for advertising or marketing purposes.
Third-party technologies used on healthcare-related portions of the Icarus website are evaluated and managed with consideration for applicable HIPAA and Part 2 obligations.
11. Website Information Not Related to Patient Care
When a person visits the Icarus website without seeking or receiving healthcare, Icarus may receive ordinary internet information such as browser type, device type, referring website, pages viewed, approximate geographic region, and technical information used to maintain and improve the website.
Icarus may use this information for security, website operations, analytics, and service improvement, subject to applicable law.
Not every piece of information associated with a website visitor is PHI. Whether information constitutes PHI depends on the circumstances, the nature of the information, and its relationship to healthcare provided by Icarus.
12. Communications With Patients
If a patient or prospective patient provides Icarus with a telephone number, email address, mailing address, or other contact information, Icarus may use that information as legally permitted to communicate regarding appointments, treatment, billing, care coordination, administrative matters, or other healthcare-related purposes.
A patient may request reasonable alternative methods of confidential communication.
Marketing communications involving PHI or Part 2 records will be handled in accordance with applicable authorization and consent requirements.
13. Security of Health Information
Icarus maintains safeguards designed to protect PHI and other confidential information from unauthorized access, use, alteration, disclosure, or destruction.
These safeguards include administrative policies, workforce privacy and security practices, access controls, technical security measures, secure transmission methods, and physical safeguards appropriate to the nature of the information.
Access to patient information is limited to individuals and organizations with an appropriate clinical, operational, payment, legal, or other authorized need for the information.
14. Breach Notification
If a breach of unsecured PHI or Part 2 records occurs, Icarus will investigate the incident and provide notifications to affected individuals, the U.S. Department of Health and Human Services, and other persons or entities when required by applicable law.
15. Complaints and Questions
A patient or other individual who believes privacy rights have been violated, has questions about this notice, or wishes to exercise privacy rights may contact:
Privacy Officer
Icarus Addiction Care, PLLC
3443 Dickerson Pike, Suite 310
Nashville, Tennessee 37207
Phone: (615) 645-3013
Email: info@icarusaddictioncare.com
A complaint may also be filed with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).
Filing a complaint will not affect treatment, and Icarus will not retaliate against any person for filing a complaint or exercising privacy rights.
16. Changes to This Notice
Icarus may change this notice and its privacy practices from time to time as permitted by law.
A revised notice may apply to information Icarus already maintains as well as information received in the future.
The current version of this notice will be available upon request, at Icarus clinical locations as required, and on the Icarus website.
17. Scope of This Notice
This notice applies to protected health information maintained by Icarus Addiction Care, PLLC in connection with healthcare services and related operations, including outpatient clinical care, telemedicine services, hospital consultation services, contracted clinical services, billing and administrative functions, patient communications, and healthcare-related interactions through the Icarus website.
When Icarus clinicians provide care within another healthcare organization's facility, electronic medical record, or administrative system, that organization may also maintain its own Notice of Privacy Practices applicable to information maintained by that organization.
Effective Date: September 12, 2026
Questions regarding this notice or Icarus's privacy practices may be directed to the Icarus Privacy Officer using the contact information above.