Bluestone Enterprise Privacy Policy

Original Effective Date: January 1, 2025
Last Updated: January 1, 2026

This Privacy Policy applies to the Bluestone entities and services identified below. It does not replace any applicable HIPAA Notice of Privacy Practices or other service-specific notice.

1. Scope and Entities Covered by This Policy

This Privacy Policy explains how the Bluestone entities listed below collect, use, disclose, retain, and protect personal information. References to “Bluestone,” “we,” “us,” or “our” mean the particular Bluestone entity responsible for the applicable service and, where relevant, other listed Bluestone entities with which information is lawfully shared.

Legal entity	Trade name	Primary role
PPS Health LLC	Bluestone Health	Clinical, concierge-care, care-management, navigation, eligibility, quality, reporting, technology, and member-support services.
Bluestone Medical Group PC	Bluestone Medical Group	Professional clinical services and related patient care.
Pierce Health Solutions LLC	Bluestone Benefits	Licensed health-benefits brokerage services, including medical, stop-loss, voluntary, ancillary, and other employee benefits.
Bluestone Benefits LLC	Bluestone Benefits	Third-party administration, claims administration, eligibility, benefit administration, and related services.
Pierce Benefits Management LLC	Bluestone Rx	Pharmacy-benefit, pharmacy-management, prior-authorization, alternative-sourcing, specialty-pharmacy, and related services.

Bluestone Insurance LLC is not covered by this Policy. Any privacy notice applicable to Bluestone Insurance LLC or its captive insurance activities will be provided separately.

This Policy applies to information collected through http://www.bluestonehealth.com, Bluestone portals, applications, communications, care and benefit services, pharmacy services, brokerage and administration services, and offline interactions. It also applies to information about patients, members, dependents, website visitors, client and vendor contacts, healthcare providers, job applicants, employees, contractors, former workforce members, and other individuals whose information Bluestone processes.

If a HIPAA Notice of Privacy Practices, plan notice, client notice, service-specific notice, consent, or authorization applies to particular information, that notice or authorization governs within its scope. If there is a conflict, the more specific notice or applicable law controls.

Bluestone may provide additional notices at or before the point of collection, including service-specific, workforce, state-specific, cookie, telehealth, recording, or consumer health data notices. Those notices supplement this Policy and control for the information and processing activities within their stated scope.

2. HIPAA and Other Health-Privacy Laws

Depending on the service and transaction, one or more Bluestone entities may act as a HIPAA covered entity, healthcare provider, health plan, business associate, subcontractor, service provider, third-party administrator, pharmacy-benefit administrator, broker, or other regulated organization. Bluestone enters into business associate agreements and other privacy and security agreements when required.

Protected health information is used and disclosed only as permitted by HIPAA, applicable state health-privacy laws, applicable Notices of Privacy Practices, valid authorizations, and governing agreements. This general Policy is not a substitute for any HIPAA Notice of Privacy Practices.

Where legally required, Bluestone applies additional protections to specially protected information, including substance-use-disorder records, reproductive-health information, psychotherapy notes, genetic information, HIV-related information, mental-health records, and other categories subject to heightened protection.

3. Personal Information We Collect

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual or household. It includes sensitive personal information and protected health information where applicable.

3.1 Categories of information

Identifiers and contact information, including name, postal address, email address, telephone number, date of birth, member or employee identifier, account credentials, online identifiers, and similar identifiers.
Eligibility, enrollment, and benefit information, including employer or plan affiliation, coverage elections, dependent information, relationship codes, effective and termination dates, plan options, COBRA status, and benefit-plan information.
Health and healthcare information, including medical and pharmacy claims, diagnoses, procedures, medications, allergies, test results, laboratory data, prior authorizations, referrals, care plans, provider information, appointments, risk information, clinical notes, treatment communications, and care-management information.
Remote Patient Monitoring and connected-device information, including blood pressure, blood glucose, weight, heart rate, pulse oximetry, symptom reports, device identifiers, timestamps, alerts, connectivity information, adherence information, and clinician responses.
Pharmacy information, including prescriptions, medication history, fill and refill data, days supply, dispensing pharmacy, prescriber, formulary information, specialty-drug data, manufacturer-assistance information, and medication-adherence information.
Financial and transaction information, including client billing information, payment status, claims-funding information, bank-account and routing information used for authorized business-to-business ACH transactions, and related reconciliation information. Bluestone does not accept payments from members or consumers and does not directly collect consumer credit-card or debit-card information.
Professional and employment information, including employer, job title, work contact information, professional license, NPI, taxonomy, board-certification information, provider affiliations, contracting information, referral and prescribing information, and other professional records.
Workforce and applicant information, including application materials, resume, employment history, references, background-screening information where permitted, payroll and tax information, benefits enrollment, performance information, training records, system-access records, and workplace communications.
Communications and sensory information, including emails, text messages, calls, voicemails, secure messages, portal messages, forms, surveys, support requests, audio recordings, transcripts, and telehealth or other electronic communications when recording is disclosed and permitted.
Device, website, and usage information, including IP address, browser and device type, operating system, referring pages, pages viewed, access times, authentication events, security logs, cookies required for operation, and similar technical information.
Inferences and analytics, including risk stratification, service opportunities, care gaps, fraud or security indicators, utilization patterns, and operational insights derived from information Bluestone is authorized to process.
Other information that an individual or an authorized organization chooses to provide and that is reasonably necessary to provide the services.

3.2 Sensitive personal information

Depending on the service, Bluestone may process sensitive personal information such as health information, account credentials, bank-account information, Social Security numbers or other government identifiers received through authorized eligibility or administrative files, precise geolocation if expressly enabled in an application, racial or ethnic information, tribal affiliation, genetic information, biometric information if used for authentication, and the contents of private communications. Bluestone limits the collection, use, and disclosure of sensitive personal information to purposes reasonably necessary and proportionate to provide the services, comply with law, protect security, and fulfill authorized business functions.

Bluestone applies data-minimization principles appropriate to its role and seeks to collect, use, retain, and disclose personal information that is reasonably necessary and proportionate for the disclosed and authorized purposes.

4. Sources of Personal Information

Directly from individuals when they enroll, create an account, apply for employment, receive care, use a service, communicate with Bluestone, or provide information.
From employers, plan sponsors, health plans, benefit administrators, brokers, authorized representatives, and eligibility vendors.
From healthcare providers, pharmacies, pharmacy-benefit administrators, laboratories, claims administrators, hospitals, clinics, health-information exchanges, and other healthcare organizations.
From government agencies, public records, professional registries, credentialing sources, and other lawful sources.
From service providers and business partners that support Bluestone operations, subject to legal and contractual restrictions.
Automatically from websites, portals, applications, devices, security tools, and electronic communications.
From prior interactions and records maintained by Bluestone, as permitted by law.
As otherwise permitted or required by law.

5. How We Use Personal Information

Provide, administer, coordinate, personalize, and improve Bluestone services.
Determine eligibility, enroll members, administer benefits, process and adjudicate claims, manage prior authorizations, coordinate COBRA, FSA, HRA, HSA, dental, vision, disability, and other benefits, support billing and payment, and communicate about coverage or services.
Provide clinical care, concierge care, telehealth, pharmacy services, care management, navigation, scheduling, Remote Patient Monitoring, referrals, follow-up, and member support.
Coordinate medical, pharmacy, behavioral-health, benefit, and administrative activities among authorized parties.
Authenticate users, maintain accounts, provide customer support, respond to requests, and manage identity and access.
Communicate service, benefits, care, security, operational, legal, and administrative information.
Maintain accurate records, reconcile data, conduct audits, and support quality, safety, accreditation, and compliance activities.
Secure systems, prevent and investigate fraud, waste, abuse, misuse, and security incidents, and enforce agreements.
Perform analytics, reporting, risk stratification, care-gap identification, cost and utilization analysis, outcomes analysis, and service improvement as permitted by law and contract.
Recruit, employ, manage, compensate, train, support, and protect Bluestone workforce members and applicants.
Meet legal, regulatory, professional, tax, contractual, recordkeeping, and reporting obligations.
Establish, exercise, or defend legal claims and protect the rights, safety, and property of Bluestone, clients, members, patients, workforce members, and others.
Carry out another purpose disclosed at collection or authorized by the individual or an authorized organization.

6. Artificial Intelligence and Automated Tools

Bluestone may use artificial intelligence, machine learning, and other automated tools for claims analysis, clinical-risk identification, care-gap detection, operational analytics, fraud and security review, call or communication transcription, drafting or summarization support, member outreach support, and similar authorized purposes.

Bluestone uses de-identified information when reasonably feasible. When identifiable health information is processed, Bluestone uses systems and vendors that are intended to support HIPAA and other applicable privacy and security requirements, including appropriate contractual protections.

Automated tools generally support, rather than replace, human judgment. Clinical decisions remain subject to review by qualified healthcare professionals, and material benefit, employment, or administrative decisions are subject to appropriate human oversight where required by law or Bluestone policy.

Bluestone does not authorize vendors to use Bluestone personal information or protected health information to train general-purpose artificial-intelligence models for the vendors’ independent purposes. Vendors may process information only for authorized services and subject to applicable contracts, privacy restrictions, and security requirements.

7. How We Disclose Personal Information

Bluestone may disclose personal information only as permitted by law, applicable notices, authorizations, and contracts, and as reasonably necessary for the following purposes:

To provide services to individuals, employers, plan sponsors, health plans, clients, or authorized representatives. Employment alone does not authorize an employer to receive an individual’s protected health information.
To healthcare providers, pharmacies, claims administrators, pharmacy-benefit administrators, insurers, stop-loss carriers, laboratories, benefit vendors, brokers, and other authorized healthcare or benefit partners.
To service providers that support hosting, communications, transcription, analytics, artificial intelligence, security, payment, claims, eligibility, document management, customer support, credentialing, professional services, and other business functions. These providers are contractually restricted from using information for unauthorized purposes.
To government agencies, regulators, auditors, accreditation organizations, courts, law-enforcement authorities, public-health authorities, or other parties when required or permitted by law.
To prevent, detect, or investigate fraud, security incidents, unlawful activity, or threats to health or safety.
To complete a merger, financing, acquisition, reorganization, sale, or transfer of all or part of a Bluestone business, subject to applicable confidentiality, privacy, and legal requirements.
To protect legal rights, enforce agreements, and resolve disputes.
For another purpose disclosed at collection or authorized by the individual or an authorized organization.

Bluestone does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under applicable law. Bluestone does not disclose personal information to third parties for their independent direct-marketing purposes. Bluestone does not use protected health information for advertising or marketing except as expressly permitted by law and, where required, with authorization.

Telephone numbers and related consent are not shared with third parties for their own marketing purposes. Bluestone may provide telephone numbers to service providers acting on Bluestone’s behalf to deliver authorized communications, subject to contractual restrictions.

8. De-Identified and Aggregated Information

Bluestone may create, use, and disclose de-identified or aggregated information in accordance with applicable law. Where required, Bluestone maintains de-identified information in de-identified form and does not attempt to reidentify it except as permitted by law to test or validate de-identification processes or for another authorized purpose.

9. Cookies, Website Technologies, and Tracking

Bluestone’s public website uses only technologies reasonably necessary for site operation, security, authentication, user preferences, and basic performance measurement. Bluestone does not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, advertising cookies, session-replay tools, or similar advertising or behavioral-tracking technologies on http://www.bluestonehealth.com as of the Last Updated date.

Bluestone does not place advertising pixels on authenticated portals or health-related pages and does not knowingly permit website technologies to receive protected health information for advertising purposes. Bluestone reviews website technologies and service providers based on the information they receive and the purposes for which they use it.

Browser settings may allow users to block or delete cookies, although some functions may not operate correctly if required cookies are disabled. Bluestone does not currently respond to “Do Not Track” signals because there is no uniform standard governing them. Where required by applicable law, Bluestone honors legally recognized browser-based opt-out preference signals, such as Global Privacy Control, as requests to opt out of sale or sharing. Because Bluestone does not sell or share personal information for cross-context behavioral advertising, such signals ordinarily confirm the user’s existing preference status.

10. Communications, Recording, and Choices

Bluestone may send administrative, care-related, benefit-related, security, and service communications as permitted by law. These communications may be necessary to provide services and may not be subject to a marketing opt-out.

Some calls, text messages, portal messages, telehealth sessions, or other communications may be recorded, monitored, or transcribed for quality assurance, training, documentation, security, care coordination, legal compliance, and other disclosed purposes. Bluestone provides notice and obtains consent where required before recording or transcription begins. Not all communications are recorded or transcribed.

Individuals may unsubscribe from marketing emails by using the unsubscribe link in the message. Reply STOP to stop text messages from the sending number. Bluestone may send one confirmation message and may communicate through another lawful channel when necessary to provide care, administer benefits, protect an account, or comply with law.

11. Data Security and Incident Response

Bluestone maintains administrative, technical, and physical safeguards designed to protect personal information based on its sensitivity and the nature of the services. Safeguards may include access controls, authentication, encryption, workforce training, vendor oversight, security monitoring, incident-response procedures, backups, secure development and configuration practices, and secure transmission methods.

Bluestone uses secure transmission methods appropriate to the sensitivity and volume of the information, which may include secure file transfer, encrypted email, secure portals, encrypted application connections, and authorized payment platforms.

No system or transmission method is completely secure. Individuals should use the secure channel designated by Bluestone or the applicable client whenever available.

If a privacy or security incident requires notification, Bluestone will provide notice to affected individuals, clients, regulators, or other parties as required by applicable law and contract.

12. Data Location

Bluestone collects, stores, and processes client, member, patient, workforce, and other personal information in the United States. Bluestone requires its authorized service providers to maintain applicable client and member data, backups, support access, and system processing within the United States unless a specific exception is approved in writing and implemented with appropriate legal, contractual, privacy, and security safeguards. As of the Last Updated date, Bluestone does not intentionally process client or member information outside the United States.

13. Retention and Disposal

Bluestone retains personal information only for as long as reasonably necessary and proportionate to provide services, maintain required business and healthcare records, meet contractual obligations, resolve disputes, enforce agreements, and comply with legal, regulatory, professional, tax, claims-administration, litigation-hold, backup, and record-retention requirements.

Information category	General retention criteria
Clinical and medical records	Healthcare-record laws, professional obligations, patient-care needs, dispute periods, and applicable Notices of Privacy Practices.
Claims, eligibility, pharmacy, and benefit records	Claims runout, audit, regulatory, contractual, recovery, appeal, and dispute requirements.
Account, security, and technical logs	Security, fraud prevention, system integrity, operational, and legal requirements.
Recorded communications and transcripts	Quality, documentation, care, dispute, training, legal, and compliance needs.
Workforce and applicant records	Employment, tax, benefits, safety, legal, and regulatory requirements.
Marketing preferences and suppression records	Until withdrawal and thereafter as needed to honor the preference and demonstrate compliance.
Business, contract, and financial records	Tax, accounting, contract, audit, litigation, and regulatory requirements.

When information is no longer required, Bluestone deletes, destroys, de-identifies, or otherwise disposes of it using methods appropriate to its sensitivity and the systems in which it is maintained. Deletion may be limited where retention is required or permitted by law or contract. Where deletion is not permitted, Bluestone continues to protect the retained information and limits its use.

14. Individual Privacy Rights and National Request Process

Bluestone provides a national process for privacy requests, even when a particular state law does not require every listed right. Depending on applicable law and Bluestone’s role, individuals may request:

Confirmation of whether Bluestone processes personal information about them.
Access to or a copy of certain personal information.
Correction of inaccurate personal information.
Deletion of certain personal information.
Information about categories of information, sources, purposes, and recipients.
Restriction of, objection to, or withdrawal of consent for certain processing, where applicable.
An accounting or information about certain disclosures, where applicable.
Data portability in a usable format, where applicable.
Opt-out of sale, sharing, targeted advertising, or qualifying profiling, where applicable. Bluestone does not sell or share personal information for cross-context behavioral advertising.
Limitation of certain uses or disclosures of sensitive personal information, where applicable.
Appeal of a denied request where applicable law provides an appeal right.

Privacy requests may be submitted by email to info@bluestonehealth.com with the subject line “Privacy Request” or by calling (818) 330-5501. Requests involving protected health information may be governed by an applicable Notice of Privacy Practices and may be redirected to the process described in that notice.

Bluestone may verify identity and authority before completing a request. Verification may include matching information already maintained by Bluestone, confirming control of an email address or telephone number, requesting a signed declaration, or using another reasonable method. Bluestone will request only information reasonably necessary for verification.

An authorized agent may submit a request where permitted by law. Bluestone may require evidence of the agent’s authority and may separately verify the individual’s identity or confirm that the individual authorized the request.

Rights are not absolute. Bluestone may deny or limit a request where information must be retained or processed to provide healthcare, administer benefits, maintain claims or medical records, comply with law, protect security, exercise legal rights, or fulfill obligations to a client. If Bluestone processes information on behalf of another organization, Bluestone may direct the request to that organization or assist it in responding.

Bluestone will not discriminate or retaliate against an individual for exercising an applicable privacy right. Where an appeal right applies, send the appeal to info@bluestonehealth.com with the subject line “Privacy Appeal.”

15. California Privacy Notice

This section supplements the rest of this Policy for California residents and applies to personal information subject to the California Consumer Privacy Act, as amended. Certain information, including protected health information and other information governed by HIPAA or California medical-privacy laws, may be exempt or subject to different requirements.

15.1 Categories collected and disclosed

During the preceding 12 months, Bluestone may have collected and disclosed for business purposes the following categories of personal information, depending on the individual’s relationship with Bluestone. Bluestone has not sold these categories and has not shared them for cross-context behavioral advertising.

California category	Examples	Primary sources	Business purposes	Recipient categories
Identifiers	Name, address, email, phone, date of birth, member ID, employee ID, account credentials, government identifiers when received.	Individuals, clients, plans, providers, vendors.	Services, eligibility, claims, care, security, compliance.	Clients, plans, providers, pharmacies, vendors, regulators.
Customer records information	Contact, financial, benefit, medical, insurance, and employment information.	Individuals, clients, plans, providers.	Services, billing, benefits, care, administration.	Authorized service and benefit partners.
Protected classifications	Age, sex, disability, race or ethnicity, tribal affiliation, marital or family status when lawfully received.	Individuals, employers, plans, providers.	Eligibility, benefits, care, compliance, analytics.	Authorized clients, providers, vendors, regulators.
Commercial information	Services received, transactions, benefit elections, claims and pharmacy activity.	Individuals, clients, plans, claims and pharmacy systems.	Administration, care, reporting, reconciliation.	Authorized clients, vendors, healthcare partners.
Internet or network activity	IP address, device and browser data, portal activity, security and access logs.	Devices, websites, portals, security tools.	Operation, authentication, security, troubleshooting.	Hosting, security, and IT service providers.
Geolocation data	Approximate location from IP address; precise location only if expressly enabled.	Devices and applications.	Security, service delivery, location-enabled functions.	Authorized technology providers.
Audio, electronic, or sensory information	Call recordings, transcripts, voicemail, telehealth or portal communications when recorded.	Individuals and communication systems.	Quality, training, documentation, care, security.	Authorized communication, transcription, and service providers.
Professional or employment information	Job title, employer, license, NPI, provider affiliation, application and workforce records.	Individuals, employers, public registries, vendors.	Credentialing, contracting, employment, services.	Clients, vendors, regulators, professional advisers.
Education information	Education and training records for applicants, workforce, or providers.	Individuals, schools, credentialing sources.	Employment, credentialing, compliance.	Authorized vendors and regulators.
Inferences	Risk, care gaps, utilization, fraud or security indicators, operational insights.	Information described in this Policy.	Care, analytics, security, service improvement.	Authorized clients, care teams, vendors.
Sensitive personal information	Health, credentials, bank account, government identifiers, precise location if enabled, racial or ethnic information, tribal affiliation, private communications.	Individuals and authorized sources.	Services, care, benefits, security, compliance.	Authorized recipients under law and contract.

15.2 California rights

Right to know the categories and specific pieces of personal information collected, used, disclosed, sold, or shared, subject to exceptions.
Right to delete personal information, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. Bluestone does not sell or share personal information for cross-context behavioral advertising.
Right to limit certain uses or disclosures of sensitive personal information where the information is used beyond permitted purposes. Bluestone uses sensitive personal information only for purposes reasonably necessary to provide services, maintain security, comply with law, and perform other permitted functions.
Right to non-discrimination for exercising California privacy rights.
Right to use an authorized agent, subject to verification and proof of authority.

California requests may be submitted by email to info@bluestonehealth.com with the subject line “California Privacy Request” or by calling (818) 330-5501. Bluestone will confirm, verify, and respond within the time required by applicable law. Where the CCPA requires an additional designated submission method, including a toll-free telephone number or website request mechanism, the applicable method will be made available through http://www.bluestonehealth.com. Bluestone recognizes qualifying opt-out preference signals where required.

Bluestone may offer an internal review of a privacy-request determination even when California law does not require a formal appeal process. Requests for internal review may be submitted to info@bluestonehealth.com with the subject line “Privacy Request Review.”

The retention criteria in Section 13 apply to the California categories described above. Actual retention varies by category, legal role, service, record type, contractual obligation, and applicable healthcare, employment, tax, claims, audit, and litigation requirements.

California Shine the Light: Bluestone does not disclose personal information to third parties for their independent direct-marketing purposes.

15.3 Other State and Consumer Health Data Rights

Residents of other states may have additional rights concerning personal information, sensitive data, biometric data, or consumer health data. Depending on the law and Bluestone’s role, these may include rights to access, correct, delete, obtain a copy, opt out of targeted advertising, sale, qualifying profiling, or certain disclosures, restrict certain uses, withdraw consent, or appeal a decision. Requests may be submitted through the national process in Section 14.

Certain state consumer health data laws may require a separate consumer health data privacy notice, consent, or authorization for information outside HIPAA or other statutory exemptions. Where such a requirement applies to a Bluestone service, the applicable supplemental notice will be provided and will control within its scope.

16. Children, Minors, and Dependents

Bluestone’s general public website is not directed to children under 13, and Bluestone does not knowingly collect personal information directly from a child under 13 through the public website without appropriate authorization. Bluestone may process information about minors and dependents when necessary to provide healthcare, coverage, benefits, pharmacy, or related services and when provided or authorized by a parent, guardian, employer, health plan, healthcare provider, or other authorized party.

Bluestone does not knowingly sell or share the personal information of consumers under 16. Rights regarding minors’ medical records may depend on applicable law, the minor’s legal authority to consent to care, and the rights of parents or guardians.

17. Workforce and Applicant Information

This Policy applies to Bluestone job applicants, employees, contractors, former personnel, and other workforce members. Bluestone may collect and use workforce information for recruitment, background screening where permitted, onboarding, payroll, tax, benefits, scheduling, credentialing, training, performance management, safety, security, investigations, legal compliance, and workforce administration.

Workforce members may submit privacy requests through the national process in Section 14. Certain requests may be limited by employment, tax, benefit, healthcare, security, litigation, or other legal and operational requirements.

18. Third-Party Services and Links

Bluestone services may link to or interoperate with third-party websites, applications, portals, pharmacies, healthcare providers, benefit vendors, or other services. Their privacy practices are governed by their own notices except where they process information on Bluestone’s behalf under contract. Individuals should review the privacy terms of third-party services before providing information directly to them.

19. Accessibility and Language Assistance

Individuals who need this Policy or assistance with a privacy request in an alternative format may contact Bluestone using the information below. Language assistance may be available for privacy requests and notices. Bluestone will provide reasonable assistance consistent with applicable law and operational capability.

20. Changes to This Policy

Bluestone may update this Policy to reflect changes in services, business practices, technology, entities, or legal obligations. Bluestone will post the updated Policy with a revised Last Updated date. If a change materially affects how personal information is used or disclosed, Bluestone will provide additional notice when required by law.

21. Contact Us

Questions, concerns, complaints, and privacy requests may be directed to:

Privacy Officer
Bluestone Health
15477 Ventura Blvd., Suite 101
Sherman Oaks, CA 91403

Email: privacy@bluestonehealth.com

Phone: +1 (760) 835-4213

For medical emergencies, call 911. Do not use a privacy-request channel for urgent medical needs.

Appendix A. Entity and Service Responsibility Matrix

Entity	Primary services	Typical privacy role	Additional notice that may apply
PPS Health LLC dba Bluestone Health	Concierge care, navigation, care management, eligibility, quality, reporting, technology, support.	Covered entity, business associate, service provider, or contractor depending on service.	HIPAA Notice of Privacy Practices, telehealth or service-specific consent.
Bluestone Medical Group PC	Professional medical and clinical services.	Healthcare provider and HIPAA covered entity.	Healthcare-provider Notice of Privacy Practices and clinical consents.
Pierce Health Solutions LLC dba Bluestone Benefits	Licensed brokerage for medical, stop-loss, voluntary, ancillary, and other benefits.	Broker, service provider, covered entity or business associate where applicable.	Client or plan notices and brokerage disclosures.
Bluestone Benefits LLC	Third-party administration, claims, eligibility, COBRA, FSA, HRA, HSA, dental, vision, disability, and benefit administration.	TPA, covered entity, business associate, or service provider depending on arrangement.	Health-plan Notice of Privacy Practices and plan-specific notices.
Pierce Benefits Management LLC dba Bluestone Rx	PBM, pharmacy management, prior authorization, specialty pharmacy, alternative sourcing, and medication support.	Covered entity, business associate, pharmacy-benefit administrator, or service provider depending on arrangement.	Health-plan or pharmacy Notice of Privacy Practices and program-specific notices.