HIPAA Notice of Privacy Practices

Effective April 14, 2003. Revised: February 16, 2026. Effective Date: February 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION AND SUBSTANCE USE DISORDER INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Organized Health Care Arrangement

St. Elizabeth Healthcare participates in a clinically integrated care setting in which patients typically receive health care from more than one health care provider. This arrangement is called an Organized Health Care Arrangement (or OHCA) under the federal laws governing the privacy of patient health information. This means that when you receive services at St. Elizabeth Healthcare, you may receive certain professional services from physicians on our Medical Staff, residents, and/or medical students who are independent practitioners and not employees or agents of St. Elizabeth Healthcare. These independent practitioners have agreed to abide by the terms of this Notice when providing services at St. Elizabeth Healthcare. Therefore, this Notice applies to all of your health information that is created or received as a result of being a patient at St. Elizabeth Healthcare. However, this Notice does not apply to the independent practitioners in their private offices.

Who will follow this notice?

The privacy practices in this notice will be followed by any health care professional that treats you at any of our locations, by all departments and units of our organization (including all off-campus units or departments), and by all employed associates, staff and volunteers of our organization.

Our pledge to you

We understand that your medical information, including your protected health information (PHI) and any Substance Use Disorder (SUD) treatment records, as defined by 42 CFR Part 2 (Part 2), is personal. We are committed to protecting your medical information. We create a record of the care and services you receive to provide quality care and to comply with legal requirements. This notice applies to all of your care records that we maintain, whether created by facility staff or your personal doctor. Your personal doctor may have different policies or notices regarding the doctor’s use and disclosure of your medical information created in the doctor’s office.

Purpose

We are required by law to keep your PHI and SUD treatment records private, to give you this notice of our legal duties and privacy practices with respect to your medical information, and to follow the terms of the notice that is currently in effect.

Changes to this Notice

We may change our policies from time to time, and those changes will apply to information we already hold, as well as information after the change occurs. If we make a material change in our policies that affects this notice, we will change our notice and post the new notice in our facilities and on our Web site at www.stelizabeth.com. You may request a copy of the current notice at any time. You will be offered a copy of the current notice each time you register. You will also be asked to acknowledge that you were offered the notice.

Confidentiality of Substance Use Disorder Patient Records

The confidentiality of SUD treatment records (records related to alcohol or drug use, diagnosis, prognosis, or treatment that are created or maintained by a program covered under 42 CFR Part 2) maintained by us places additional restrictions on use and disclosures of such health information. Part 2 applies to certain programs that are federally funded and have the primary purpose of providing SUD treatment, diagnosis or referral for treatment. To the extent applicable law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent law.

How we may use and disclose medical information about you

Under certain circumstances, we are entitled to use or disclose your medical information (but not SUD treatment records) without obtaining your written authorization. Some examples of when we are permitted to do this are presented below:

• Treatment We will use or disclose medical information about you for treatment purposes to doctors, nurses, technicians, and other caregivers in accordance with the Medical Authorization and Release that you signed and provided to us. We will make health information about you available through an electronic medical record system to healthcare providers who treat you. For example, a physician treating you for a broken leg in our facility may need to know whether you are a diabetic because diabetes slows the healing process. A nurse or diabetic counselor may discuss your medical condition with your physician.
• Payment We will use or disclose medical information about you for treatment purposes to doctors, nurses, technicians, and other caregivers in accordance with the Medical Authorization and Release that you signed and provided to us. We will make health information about you available through an electronic medical record system to healthcare providers who treat you. For example, a physician treating you for a broken leg in our facility may need to know whether you are a diabetic because diabetes slows the healing process. A nurse or diabetic counselor may discuss your medical condition with your physician.
• Healthcare Operations We may use and disclose medical information about you to support our health care operations. For example, we may use or disclose your medical information in order for us to review our services and to evaluate our staff’s performance. We may also use or disclose your medical information to obtain a medical consultation regarding your care or treatment.

Except in medical emergencies or other special situations, use and disclosure of your SUD treatment records for Treatment, Payment and Healthcare Operations requires your written consent. The written consent may be a single consent for all future uses and disclosures for treatment, payment, and health care operations, and it will be valid until the consent is revoked by you. SUD treatment records can be shared among staff within the same Part 2 program or with an administratively connected entity when needed to carry out diagnosis, treatment, or referral duties.

While you are a patient in our facility, unless you tell us otherwise, we will list in the patient directory your name, your location in the hospital, and your general condition (in terms such as “fair” or “good”). We will release this information to anyone who asks about you by name. Your religious affiliation may be disclosed only to clergy members, even if they do not ask for you by name. If you do not want us to release such information, please inform the person assisting you during registration and/or admission.

Unless you tell us otherwise, we may disclose your medical information (but not SUD treatment information) to a family member, friend, and others whom you have identified as being involved with your care. If family members or friends are present while care is being provided, we will assume you are comfortable with your companions hearing the discussion, unless you state otherwise. In a disaster situation, we also may disclose relevant protected health information to disaster relief organizations to help locate your family members or friends or to inform them of your location, condition or death.

We may use or disclose medical information about you for fundraising efforts in support of our facility, unless you tell us otherwise. We may only use or disclose SUD treatment records for fundraising if you are first provided with a clear and conspicuous opportunity to elect not to receive fundraising communications. We also may contact you for appointment reminders or to tell you about or recommend possible treatment options and other health-related benefits or services that may be of interest to you.

Subject to certain requirements, we are permitted or required by law to make certain other uses and disclosures of your medical information without your authorization.

For instance, we will release your medical information (including SUD treatment records) if we suspect child abuse or neglect, if we believe you to be a victim of abuse, neglect, or domestic violence, and as required by law to report wounds, injuries and crimes. We may disclose your medical information (including SUD treatment information) for public health purposes such as reporting births and deaths, and reporting information to prevent and control disease; however, any SUD treatment records disclosed for public health purposes will be de-identified, such that there will be no reasonable basis to believe that the information can be used to identify you. We may disclose your medical information (including SUD treatment information) to a health oversight agency such as the Department of Health and Human Services for health oversight activities including, but not limited to, conducting an audit or inspection of our facility. We may also disclose your medical information to coroners and funeral directors, as well as to organ donation agencies (to facilitate organ and tissue donation and transplantation).

We may disclose medical information about you (but not SUD treatment records) for workers’ compensation purposes if you are injured on the job. We may also disclose medical information when permitted or required by law, such as in response to a request from law enforcement officials in specific circumstances, and in response to valid judicial, administrative, or court orders. SUD treatment records cannot be used or disclosed in any legal proceeding against you unless you give separate written consent or a court issues an order. Even with a court order, you must be given notice and a chance to object, and the order must be accompanied by a subpoena or similar legal requirement before the records can be released. We may also disclose information about you (including SUD treatment records) in certain emergencies or to avert or lessen a serious threat to the health and safety of a person or the public. We may release your medical information if you are a member of the military as required by armed forces services, or if necessary for national security or intelligence activities. We may also disclose medical information (including SUD treatment information) for purposes of medical research studies when such use has been approved by an Institutional Review Board.

For Health Information Exchange

We may participate in one or more health information exchanges (HIEs) and may electronically share your health information for treatment, payment and healthcare operations purposes with other participants in the HIEs. HIEs allow your health care providers to efficiently access and use your pertinent medical information necessary for treatment and other lawful purposes. If you do not opt-out of this exchange of information, we may provide your health information to the HIEs in which we participate in accordance with applicable law.

Other uses of medical information

Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of protected health information require your written authorization. In any other situation not covered by this notice, we must receive your written authorization before using or disclosing your medical information. If you choose to authorize use or disclosure, you have the right to later revoke that authorization by notifying us in writing of your decision.

Other uses of SUD Treatment information.

Generally, where Part 2 applies in our organization, we may not disclose to a person outside of the SUD program that you are a patient in the program or disclose any information identifying you as an SUD patient unless allowed as provided in Part 2. However, we may use and disclose your SUD treatment records in accordance with your consent to any person or category of persons identified or generally designated by you in the consent. For example, if you provide a written consent naming your spouse or health care provider, we will share your information with them as provided in your consent. We may disclose your SUD treatment records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. We may disclose information from your SUD treatment records to those persons within the criminal justice system who have made your participation in a Part 2 program a condition of disposition of any criminal proceedings against you. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of a legal agreement or sentencing conditions. We may use or disclose your SUD treatment information when performing certain financial, management, or program audits and evaluations. This can include sharing identifying information with government agencies that fund or regulate the Part 2 program. Qualified personnel working for funders, health plans, quality improvement organizations, or entities with administrative oversight may also access this information for audit or evaluation purposes. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by state law, with your consent. You may revoke your written consent in writing, except to the extent that a lawful holder of the information has already acted in reliance on your consent, and subject to limitations described below for disclosures to the criminal justice systems. You may revoke the consent by contacting St. Elizabeth Healthcare’s Health Information Management Department, 1 Medical Village Dr., Edgewood, KY 41017.

Your rights regarding your medical information

In most cases, you have the right to receive a copy and/or inspect the medical information we retain about you, upon written request. After the first request for copies, we may charge a fee for the cost of copying, mailing or other related supplies. If we deny your request, you may submit a written request for a review of that decision. In some circumstances, another licensed health care professional chosen by St. Elizabeth Healthcare may review your request. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review. However, in some circumstances, our denial of a request by you to inspect and/or receive copies of your information is not subject to review.

You have the right to request that we amend your medical information, , by submitting a request in writing that provides your reason for requesting the amendment. We have the right to deny your request if the information was not created by us, if it is not part of the medical information maintained by us, if it is not part of the information which you would be permitted to inspect and copy, or if in our opinion that record is accurate. If we deny your request, we will provide you with a written statement of the basis for the denial and a description of how you may file a written statement of disagreement. If you do not file a written statement of disagreement, you may request that your request for amendment and our written denial be provided with any future disclosures of your medical information.

You have the right to a list of those instances where we have disclosed your medical information when you submit a written request. This list will not include: disclosures made for treatment, payment or health care operations; disclosures made directly to you; disclosures you authorized pursuant to a signed authorization; disclosures for facility directory purposes or to persons involved in your care; and disclosures made to correctional institutions and for other law enforcement purposes. The request must state the time period desired for the accounting, which must be less than a 6-year period and start after April 14, 2003. You may receive the list in paper or electronic form. The first disclosure list request in a 12-month period is free. Additional requests may be provided for a fee. We will inform you of the fees before you incur any costs.

You also have the right to be notified if there is a breach of your unsecured protected health information.

If this notice was sent to you electronically, you have the right to a paper copy of this notice.

You have the right to request that medical information about you be communicated to you in a confidential manner, such as sending mail to a P.O. Box instead of your home address, by notifying us in writing of the specific way or location for us to use to communicate with you. We will not ask you the reason for your request. We will accommodate all reasonable requests, but we may not be able to agree to your request.

You may request, in writing, that we not use or disclose medical information about you for treatment, payment or healthcare operations or to persons involved in your care except when specifically authorized by you, when required by law, or in an emergency. You are entitled to a restriction to not disclose information to your health plan for health care services that we provided for which you paid us directly in full when the purpose of the disclosure is for the health plan’s payment or health care operations. We are not required to agree to other types of requests. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.

Notice of Redisclosure

Medical information that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Laws applicable to the recipient may limit their ability to use and disclose the medical information received – for example, if the recipient is another entity subject to HIPAA or Part 2.

Notice of Nondiscrimination

St. Elizabeth Healthcare does not discriminate on the basis of race, creed, national origin, religion, sex, ethnicity, age, handicap, language, or socioeconomic status.

Complaints

If you are concerned that your privacy rights may have been violated, that you may have been discriminated against, or if you disagree with a decision we made about access to your records, you may lodge a written complaint with our Privacy Office (listed below). Finally, you may send a written complaint to the U.S. Department of Health and Human Services Office for Civil Rights. Our Privacy Office can provide you with the address. Under no circumstance will you be penalized or retaliated against for filing a complaint.

HIPAA Privacy Office

If you have questions or need further assistance regarding this Notice, please contact the HIPAA Privacy Office at St. Elizabeth Healthcare, 1 Medical Village Dr., Edgewood, KY 41017, (859) 301-6266.