Notice of Privacy Practices

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION, HOW YOU CAN GET ACCESS TO YOUR HEALTH INFORMATION, AND HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION. YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH PRIVACY DEPARTMENT AT (314) 364-3381 AND [email protected] IF YOU HAVE ANY QUESTIONS. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") describes the privacy practices of Mercy Health ("Mercy"), a "covered entity" under the Health Insurance Portability and Accountability Act ("HIPAA") and its organizational affiliates that are covered entities and under common ownership and control that have designated themselves as a single affiliated covered entity (“ACE”) for the purposes of compliance with HIPAA (collectively, “Mercy”). We will share your medical and health information that is subject to HIPAA ("Protected Health Information" or "PHI") as necessary to carry out treatment, payment and health care operations and as permitted by HIPAA and this Notice. This Notice does not apply to health information that is not subject to HIPAA or similar state health information privacy laws, or information used or shared in a manner that cannot identify you. This Notice does not apply to any Mercy health plan or to Mercy as an employer. Any Mercy health plan is considered a separate covered entity for the purpose of HIPAA and has its own notice of privacy practices. Mercy also participates in certain “organized health care arrangements” (“OHCAs”) such as with the members of its medical staffs and with other health care organizations that are clinically integrated or participate in joint payment, quality assessment and improvement, or utilization review activities and share PHI for such purposes.

This Notice only applies to those parts of Mercy's websites and mobile device applications where you can access your PHI or interact with a clinician regarding your specific care, such as Mercy's patient portal with respect to your PHI. However, these websites and applications may contain additional terms associated with your use. You should review those terms as well as the website terms contained on the Mercy website that you visit.

You may have additional rights under other applicable state or federal law. Applicable state or federal laws that provide greater privacy protection or broader privacy rights will continue to apply and we will comply with such laws to the extent they are applicable.

USES AND DISCLOSURES OF YOUR PHI

We may use and disclose your PHI in the following situations; however, applicable laws governing sensitive information (including behavioral health information, drug and alcohol treatment information, reproductive health information, and information related to HIV/AIDS or other communicable diseases) may further limit these uses and disclosures.

• Treatment: We may use or disclose your PHI to provide medical treatment and/or services in order to manage and coordinate your medical care. For example, we may share your PHI with other providers to ensure that the medical provider has the necessary PHI to diagnose and provide treatment to you.
• Payment: Your PHI may be used or disclosed to obtain payment for your health care services. For example, we will provide your health care plan with the PHI it requires prior to paying us for the services we have provided to you. This use and disclosure may also include certain activities that your health plan requires prior to approving a service, such as determining benefits eligibility and prior authorization.
• Health Care Operations: We may use and disclose your PHI to manage, operate, and support the business activities of our Mercy. These activities include, but are not limited to, quality assessment, employee review, licensing, and conducting other business activities. We may use or disclose your PHI, as necessary, to contact you to remind you of your appointment or for important services such as annual checkups and inform you about treatment alternatives or other health-related benefits and services that may be of interest to you. For example, we may call, text, or e-mail you to remind you of a scheduled appointment. We may also share your PHI for case management and care coordination purposes. We may share PHI with our students, trainees, and staff for review and learning purposes. We may also use and share your PHI to confirm the time, place, and attendance of your appointment for treatment with third-party transportation services.
• Minors: PHI of minors will be disclosed to their parents or legal guardians acting as personal representatives, unless prohibited by law or in circumstances where the law permits us to withhold PHI, such as to prevent harm to the minor or another person or in cases of suspected child abuse or neglect.
• Required by Law; Judicial and Administrative Proceedings: We will use or disclose your PHI when required to do so by local, state, federal, and international law. For example, we may share your PHI as required to report a suspicious death or suspected child abuse or neglect. We may use and disclose your PHI in conjunction with judicial or administrative proceedings or for purposes of litigation as permitted by law. We may also share your PHI in response to an administrative or court order, or in response to a subpoena, a discovery request, or other legal process if we are advised that you have been made aware of the request or that efforts were made to secure a qualified protective order.
• Abuse, Neglect, and Domestic Violence or Other Threats to Safety: Your PHI will be disclosed to the appropriate government agency if we believe that a patient has been or is currently the victim of abuse, neglect, or domestic violence and the patient agrees to the disclosure or we are otherwise permitted or required by law to do so. In addition, your PHI may also be disclosed when necessary to prevent a serious threat to your health or safety or the health and safety of others to someone who may be able to help prevent the threat. State laws may require such disclosure when an individual or group has been specifically identified as the target or potential victim.
• Law Enforcement: We will disclose your PHI for law enforcement purposes when all applicable legal requirements have been met. This includes, but is not limited to, law enforcement due to identifying or locating a suspect, fugitive, material witness or missing person; complying with a court order or warrant, and grand jury subpoena; reporting information about a victim of a crime, reporting a death we believe resulted from criminal conduct, reporting criminal conduct occurring on our premises, or reporting crime in an emergency, such as the location of the crime or victims or the identity, description or location of the person who committed the crime.
• Public Health: Your PHI may be disclosed and may be required by law to be disclosed for public health purposes. This includes: to prevent or control disease; report births and deaths; reporting of reactions to medications or problems with health products; reporting a person who may have been exposed to a disease or may be at risk of contracting and/or spreading a disease or condition. We may share your PHI with public health authorities for public health purposes to prevent or control disease, injury, or disability and for conducting public health monitoring, investigations, or activities.
• Health Oversight Activities: We may disclose your PHI to a health oversight agency for audits, investigations, inspections, licensures, and other activities as authorized by law. The relevant agencies include governmental units that oversee or monitor the health care system, government benefit and regulatory programs, and compliance with civil rights laws.
• Military, National Security, and other Specialized Government Functions: We may disclose your PHI, if you are in the Armed Forces, for activities deemed necessary by appropriate military command authorities for determination of benefit eligibility by the Department of Veterans Affairs or to foreign military authorities if you are a member of that foreign military service. We may disclose your PHI to authorized federal officials for conducting national security and intelligence activities or special investigations (including for the provision of protective services to the President of the United States, other authorized persons, or foreign heads of state) or to the Department of State to make medical suitability determinations.
• Inmates and Correctional Institutions: If you are an inmate at a correctional institution, then under certain circumstances we may disclose your PHI to the correctional institution or law enforcement official. This may be necessary 1) for the institution to provide you with health care; 2) to protect your health and safety or the health and safety of others; or 3) for the safety and security of the correctional institution and its staff.
• Worker's Compensation: We will disclose only the PHI necessary for Worker's Compensation in compliance with Worker's Compensation laws. This PHI may be reported to your employer and/or your employer's representative regarding an occupational injury or illness.
• Ownership Change: If all or a portion of our business is sold, acquired, or merged with another entity, your PHI may become the property of the new owner. However, you will still have the right to request copies of your records and have copies transferred to another provider.
• Breach Notification Purposes: If for any reason there is an unsecured breach of your PHI, we will utilize the contact information you have provided us with to notify you of the breach, as required by law. In addition, your PHI may be disclosed as a part of the breach notification and reporting process.
• Research: Your PHI may be used by or disclosed to researchers for the purpose of conducting research when an Institutional Review or Privacy Board has approved the research and in compliance with law governing research, or where you have provided your authorization. You may choose to participate in a research study that requires you to obtain related health care services. In this case, we may share your PHI 1) with the researchers involved in the study who ordered the hospital or other health care services; and 2) with your insurance company in order to receive payment for those services that your insurance agrees to pay for. We may use and share your PHI with a researcher if certain parts of your PHI that would identify you are removed before we share it with the researcher. This will only be done if the researcher agrees in writing not to share the information, will not try to contact you, and will obey other requirements that the law provides.
• Business Associates: We may disclose your PHI to our business associates who provide us with services necessary to operate and function as a health care provider. We will only provide the minimum information necessary for the associate(s) to perform their functions as it relates to our business operations. For example, we may use a separate company to process our billing or transcription services that require access to a limited amount of your PHI. Please know and understand that all of our business associates are obligated to comply with the same HIPAA privacy and security rules in which we are obligated. Additionally, all of our business associates are under contract with us and committed to protect the privacy and security of your PHI. We may also share your PHI with a Business Associate who will remove information that identifies you so that the remaining information can be used or disclosed for purposes outside of this Notice.
• Decedents. We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary for them to perform their duties.
• Organ and Tissue Donation. If you are an organ donor, we may disclose your PHI to organizations that handle organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

USES AND DISCLOSURES IN WHICH YOU HAVE THE RIGHT TO OBJECT AND OPT OUT

• Facility Directory: We may include limited information about you in a facility directory while you are a patient at Mercy. The information may include your name, location in the building, general condition, and your religious affiliation. Except for your religious affiliation, the directory information may be released to people who ask for you by name. We may give your religious affiliation to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. You have the right to ask that all or part of your information not be given out.
• Communication with family and/or individuals involved in your care or payment of your care: Unless you object, disclosure of your PHI may be made to a family member, friend, or other individual , whom you have identified that is involved in your care or payment for your care. We may share your PHI with these persons if you are present or available before we share your PHI with them and you do not object to our sharing your PHI with them, or we reasonably believe that you would not object to this. If you are not present and certain circumstances indicate to us that it would be in your best interests to do so, we will share information with a friend or family member or someone else identified by you, to the extent necessary. This could include sharing information with your family or friend so that they could pick up a prescription or a medical supply.
• Disaster: In the event of a disaster, your PHI may be disclosed to disaster relief organizations to coordinate your care and/or to notify family members or friends of your location and condition. Whenever possible, we will provide you with an opportunity to agree or object.
• Fundraising: As necessary, we may disclose your PHI to contact you regarding fundraising events and efforts. For example, you may receive a letter from Mercy asking for a donation to support enhanced patient care, treatment, education, or research at Mercy. You have the right to object or opt out of these types of communications. Please let our office know if you would NOT like to receive such communications.
• Health Information Networks and Exchanges. We may participate in certain health information networks or exchanges ("HIEs") that permit health care providers or other health care entities, such as your health plan or health insurer, to share your PHI for treatment, payment and other purposes permitted by law, including those described in this Notice. You are automatically opted in to such HIEs. If you wish to opt out, please submit a written request to us, which we will comply with unless disclosure is required by law. If you opt out of participating in these HIEs, your PHI will no longer be provided to other health care entities through the HIE. However, your decision does not affect the PHI that was exchanged prior to the time you opted out of participation.

USE AND DISCLOSURE OF SUBSTANCE USE DISORDER (“SUD”) RECORDS SUBJECT TO PART 2

Federal law protects the confidentiality of SUD patient records and places additional restrictions on the use or disclosure of such health information. A SUD is a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance (such as drugs or alcohol but not including tobacco or caffeine) despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. If you receive services from Mercy covered by such laws, Mercy complies with the federal Confidentiality of SUD Patient Records laws and regulations that protect information regarding SUD diagnosis, treatment, and referral for treatment. See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations (collectively, "Part 2").

Please note that Part 2 does not protect all SUD information that Mercy may have. Part 2 applies to certain programs (which could be limited to certain programs, persons, or departments of Mercy) that are federally funded and hold themselves out as and/or have the primary purpose of providing SUD treatment, diagnosis, or referral for treatment. Additionally, if Mercy receives records regarding your SUD from another Part 2 program pursuant to your specific consent, Part 2 generally will continue to protect such records. Where Part 2 is applicable, Mercy will not disclose your SUD records, that you are enrolled in a Part 2 program, or any other information that would identify you as having or having had a SUD (collectively, "Part 2 Records") except in compliance with this Section. If Part 2 Records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations or are disclosed by you or another person involved in your care to a non-Part 2 provider at Mercy, we or our business associates may use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

We will obtain your written consent to use and disclose your Part 2 Records unless we are permitted to use and disclose Part 2 Records without your written consent consistent with Part 2.

USES AND DISCLOSURES OF YOUR SUD RECORDS WITHOUT WRITTEN CONSENT

• Medical Emergencies. We may disclose your Part 2 Records to medical personnel to the extent necessary to meet a bona fide medical emergency in which the your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. Mercy will obtain your authorization prior to disclosing your information for non-emergency treatment. Mercy may also disclose your Part 2 Records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your Part 2 Records will be used for the exclusive purpose of notifying you or your physicians of potential danger.
• Research. Under certain circumstances, Mercy may use and disclose your Part 2 Records without your consent for research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your Part 2 Records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.
• Management and Financial Audits and Program Evaluation. Under certain circumstances we may use or disclose your Part 2 Records for purposes of the performance of certain program financial and management audits and evaluations. For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program. We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.
• Fundraising. Consistent with provisions elsewhere in this Notice, we may also use or disclose your Part 2 Records for fundraising purposes.
• Public Health. We may use or disclose to a public health authority your Part 2 Records for public health purposes. However, the contents of the information from the Part 2 Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.
• Designated person or entities. We may use and disclose your Part 2 Records in accordance with the consent to any person or category of persons identified or generally designated in the consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.
• Single Consent for Treatment, Payment, or Healthcare Operations. We may also use and disclose your Part 2 Records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.
• Central Registry or Withdrawal Management Program. We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For instance, if you consent to participating in in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.
• Criminal Justice System. We may disclose information from your Part 2 Records to those persons within the criminal justice system who have made your participation in the Part 2 program a condition of the disposition of any criminal proceeding against you. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.
• PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law. We will first obtain your consent to a disclosure of Part 2 Records to a prescription drug monitoring program prior to reporting of such information.

Any Part 2 Record, or testimony relaying the content of such Part 2 Records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent) or a court issues an appropriate order. Your Part 2 Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, Mercy or other holder of the Part 2 Record in accordance with Part 2. A court order authorizing use or disclosure of Part 2 Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Records may be used or disclosed.

Part 2 does not protect health information about a crime committed on Mercy's premises or against any Mercy personnel or about any threat to commit such crime. Part 2 also does not prohibit the disclosure of health information by Mercy to report suspected child abuse or neglect under state law to appropriate state or local authorities. The restrictions on use and disclosure in Part 2 do not apply to communications of Part 2 Records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with SUDs if the communications are within the program (or with an entity that has direct administrative control over the program the communications between a part 2 program) and to communications of Part 2 Records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of Mercy (similar to provisions herein regarding Business Associates). To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.

USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION/CONSENT

We will not disclose or use your PHI in the situations listed below without first obtaining written authorization to do so. In addition to the uses and disclosures listed below, other uses and disclosures of your PHI or Part 2 Records not covered in this Notice will be made only with your written authorization/consent. If you provide us with an authorization/consent, you may revoke it at any time by submitting a request in writing. Revocation does not apply to PHI or Part 2 Records that have already been used or disclosed with your permission. You can obtain an authorization/consent form from us upon request.

• Disclosure of Psychotherapy Notes: Unless we obtain your written authorization, in most circumstances we will not disclose your psychotherapy notes. Some circumstances in which we will disclose your psychotherapy notes include the following: for your continued treatment; training of medical students and staff; to defend ourselves during litigation; if the law requires; health oversight activities regarding your psychotherapist; to avert a serious or imminent threat to yourself or others; and to the coroner or medical examiner upon your death.
• Marketing: Disclosures for marketing purposes which result in our receiving financial payment from a third party whose product or services is being marketed will require your written authorization. This does not include compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you. However, we may use or disclose your PHI without your authorization to send you information about alternative medical treatments, our own programs or about health-related products and services that may be of interest to you, provided that we do not receive financial remuneration for making such communications. For example, if you suffer from a chronic illness or condition, we may use your PHI to assess your eligibility and propose newly available treatments. When we see you face-to-face, we may also use your PHI without your authorization to encourage you to maintain a healthy lifestyle and get recommended tests, suggest that you participate in a disease management program, provide you with promotional gifts of nominal value, or tell you about government sponsored health programs.
• Sale of PHI: Any activity constituting a sale of your PHI will require your prior written authorization.

PHI AND YOUR RIGHTS

The following are statements of your rights, subject to certain limitations, with respect to your PHI and apply equally with respect to Part 2 Records:

• You have the right to inspect and copy your PHI: Pursuant to your written request, you have the right to inspect and copy your PHI contained in a Designated Record Set (as defined by HIPAA) in paper or electronic format. Under federal law, you may not inspect or copy the following types of records: psychotherapy notes, information compiled as it relates to civil, criminal, or administrative action or proceeding; information restricted by law; information related to medical research in which you have agreed to participate; information obtained under a promise of confidentiality; and information whose disclosure may result in harm or injury to yourself or others. To inspect, copy or otherwise electronically access your PHI in the designated record set, you must submit your request in writing. Where permitted by law, we may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request, including where you designate a third-party recipient. We will discuss any fees with you before processing your request. We may deny your request to inspect and copy in certain very limited circumstances. If we deny you access to your PHI for certain reasons, we will provide you with an opportunity to request that the denial be reviewed. A licensed health care professional chosen by us will perform such a review. This person will not be the same person who refused your request.
• You have a right to a summary or explanation of your PHI: You have the right to request only a summary of your PHI if you do not desire to obtain a copy of your entire record. You also have the option to request an explanation of the PHI to which you were provided access when you request your entire record.
• You have the right to obtain an electronic copy of medical records/PHI in the designated record set: You have the right to request an electronic copy of your medical record/PHI in the designated record set for yourself or to be sent to another individual or organization when your PHI is maintained in an electronic format. We will make every attempt to provide the records in the format you request; however, in the case that the information is not readily accessible or producible in the format you request, we will provide the record in a standard electronic format or a legible hard copy form. We provide the Mercy patient portal as one option for patients to electronically access their PHI. You may set up access to the Mercy patient portal by requesting information from your health care provider. There is no fee for you to access information through the Mercy patient portal.
• You have the right to receive a notice of breach: In the event of a breach of your unsecured PHI, you have the right to be notified of such breach. We will notify you of a breach of your unsecured PHI experienced by us or one of our Business Associates in accordance with applicable law.
• You have the right to request amendments: At any time if you believe the PHI that we have on file for you is inaccurate or incomplete, you may request that we amend the information. Your request for an amendment must be submitted in writing and detail what PHI is inaccurate and why. Please note that submitting a request for an amendment does not necessarily mean the PHI will be amended. If we approve your request, we will include the amendment in any future disclosures of the relevant PHI. If we deny your request for an amendment, you may file a written statement of disagreement, which we may rebut in writing. The denial, statement of disagreement, and rebuttal will be included in any future disclosures of the relevant PHI. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend PHI that: is not part of the PHI maintained by us; was not created by us, unless the person or entity that created the information is no longer available to make the amendment; is not part of the information which you would be permitted to inspect and copy; or is accurate and complete. All denials will be made in writing.
• You have a right to receive an accounting of certain disclosures: You have the right to receive an accounting of certain disclosures of your PHI. An "accounting" being a list of the certain disclosures that we have made of your PHI. The request can be made for paper and/or electronic disclosures. Certain disclosures are exempt from the accounting requirement, such as (but not limited to) disclosures made for the purposes of treatment, payment, and health care operations; notification and communication with family and/or friends; and those required by law. Your request must be in writing. Your request must include the time frame that you would like us to cover, which may be no longer than 6 years prior to the date of your request. We will provide the first requested accounting in any 12-month period without charge. However, we may charge you for the cost of providing the accounting for any subsequent accounting requested in a 12-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. If you are requesting an accounting of disclosures of Part 2 Records made pursuant to your written consent in the 3 years prior to the date of the request (or a shorter time period chosen by you), we will provide such accounting consistent with these HIPAA requirements and Part 2. When regulations are effective requiring such accountings pursuant to HIPAA and Part 2, we will provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record and during only the 3 years prior to the date on which the accounting is requested.
• You have the right to request restrictions of your PHI: You have a right to request to restrict and/or limit the PHI we disclose to others, such as family members, friends, and individuals involved in your care or payment for your care. You also have the right to request to limit or restrict the PHI we use or disclose for treatment, payment, and/or health care operations. Your request must be submitted in writing and include 1) what PHI you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosure to your spouse. Please note that we are not required to agree to your request for restriction with the exception of a restriction requested to not disclose PHI for purposes of payment or health care operations to your health plan for care and services in which you have paid us in full out-of-pocket. If we do agree to any request, we still may provide PHI, as necessary, to give you emergency treatment.
• You have a right to request to receive confidential communications: You have a right to request confidential communications from us by alternative means or at an alternative location. For example, you may request that we send mail only to an address specified by you which may or may not be your home address. You may request that we should only call you on your work phone or specify which telephone numbers we are allowed or not allowed to leave messages on. You do not have to disclose the reason for your request; however, you must submit a request with specific instructions in writing. We will make reasonable efforts to accommodate your request.
• You have the right to appoint a personal representative, such as a medical power of attorney or if you have legal guardian. Your personal representative may be authorized to exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action based on their request.
• You have a right to receive a paper copy of this Notice: Even if you have agreed to receive an electronic copy of this Notice, you have the right to request we provide it in paper form. You may make such a request at any time. You can also get a copy of this Notice at our website.

CHANGES TO THIS NOTICE

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided the change is permitted by law. We reserve the right to have such a change apply to all PHI we maintain, including PHI we received or created before the change. If we make changes to this Notice, we will post an updated form in our office and on our website. We will also make copies available of our new notice if you wish to obtain one.

ELECTRONIC MEDICAL INFORMATION SHARING THROUGH APPLICATION PROGRAMMING INTERFACES

You have the right to request or authorize that your electronic PHI in your designated record set be transmitted to you or another person or organization through an application programming interface (API). APIs are computer coding mechanisms that permit two or more electronic computer applications or software programs to communicate with each other and share information. Mercy is required by law to comply with requests regarding API transmissions, subject to certain exceptions. You understand that PHI transmitted through an API at your request will no longer be under Mercy's protection and control, will no longer be subject to the protections and rights outlined in this Notice, and may no longer be subject to the same laws, regulations, policies or procedures regarding its confidentiality, security, privacy, use, or disclosure. You understand and agree that you make any request to Mercy to transmit your PHI through an API at your own risk and you assume all liability for the consequences of such action taken by Mercy at your direction. Mercy cautions you to confirm any confidentiality, security, or privacy protections with respect to your transmitted PHI with the recipient of the PHI prior to submitting a request to Mercy to transmit your PHI through an API.

NOTICE OF REDISCLOSURE

PHI that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Law applicable to the recipient may limit their ability to use and disclose the PHI received, such as if they are another covered entity subject to HIPAA or a program or entity subject to Part 2.

COMPLAINTS

If at any time you believe your privacy rights have been violated and you would like to register a complaint, you may do so with us or with the federal government. If you file a complaint, we will not retaliate against you or change our treatment of you in any way.

If you wish to file a complaint with us, please submit it in writing to our Privacy Officer at the address or email provided in the Contact section below.

If you wish to file a HIPAA complaint with the Secretary of the United States Department of Health and Human Services, please go to the website of the Office for Civil Rights (www.hhs.gov/ocr/hipaa/), call 202-619-0257 (toll free 877-696-6775), or mail to:

Secretary of the US – Department of Health and Human Services
200 Independence Ave S.W.
Washington, D.C. 20201

To file a complaint with the Secretary, you must 1) name Mercy as the place or person that you believe violated your privacy rights and describe how that place or person violated your privacy rights; and 2) file the complaint within 180 days of when you knew or should have known that the violation occurred.

Violation of Part 2 is a crime. You may report suspected violations of Part 2 to the Secretary of the United States Department of Health and Human Services in the same manner as HIPAA violations are reported.

CONTACT

Mercy Health
ATTN: HIPAA PRIVACY OFFICER
1350 Elbridge Payne Road, 2nd Floor Chesterfield, MO 63017
PHONE: (314) 364-3381
EMAIL: [email protected]

We are required by law to provide individuals with this Notice of our legal responsibilities and privacy practices with respect to PHI. We are also required to implement safeguards to maintain the privacy of PHI and abide by the terms of the Notice currently in effect. If you have any questions in reference to this Notice, please our Privacy Officer by email or by phone at the number listed above.

Nondiscrimination Notice

Mercy complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex (consistent with the scope of sex discrimination described at 45 CFR § 92.101(a)(2). Mercy does not exclude people or treat them less favorably because of race, color, national origin, age, disability, or sex. Mercy provides people with disabilities reasonable modifications and free appropriate auxiliary aids and services to communicate effectively with us, such as qualified sign language interpreters and written information in other formats (large print, audio, accessible electronic formats, other formats). Mercy provides free language assistance services to people whose primary language is not English, which may include qualified interpreters and information written in other languages. If you need reasonable modifications, appropriate auxiliary aids and services, or language assistance services, contact your local Mercy facility. If you believe that Mercy has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, or sex, you can file a grievance with: Mercy’s Chief Compliance Officer, 15740 South Outer 40 Road, Chesterfield, MO 63017, 1-844-764-0100, [email protected]. You can file a grievance by mail or email. If you need help filing a grievance, Mercy’s Chief Compliance Officer is available to help you. You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, electronically through the Office for Civil Rights Complaint Portal, available at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Room 509F, HHH Building, Washington, D.C. 20201, 1-800-368-1019, 800-537-7697 (TDD). Complaint forms are available at http://www.hhs.gov/ocr/office/file/index.html. This notice is available at Mercy’s website: www.mercy.net.

For more information, please see our full Nondescrimination Notice and Notice of Language Availability here.

Effective Date: (2/16/26)