Notice of Privacy Practices

This notice describes your rights regarding your medical information and informs you of how medical information about you may be used. Please review it carefully.

This notice applies to Mercy Health and to the Mercy Health facilities and clinics listed below (together referred to as “Mercy”).

Mercy's Duties

By law, Mercy must keep protected health information (“PHI”) private. PHI is any information, including verbal, electronic and on paper that is created or received by Mercy for purposes of providing health care to patients and for purposes of billing and payment for those services. PHI includes test results, notes written by doctors, nurses and other clinical staff, and general information such as your name, address and telephone number that is included in your health care records and your billing records.

Mercy is required by law to give you this notice and to follow the notice that is currently in effect.

The Health Care Providers Covered By This Notice

This notice covers Mercy and Mercy co-workers, volunteers, students and trainees. The notice also covers other health care providers that come to Mercy’s facilities and clinics to care for patients (such as physicians, physician assistants, therapists and other health care providers not employed by Mercy), unless these other health care providers give you their own notice of privacy practices. 

Use and Disclosure of PHI without your Permission

Below is a list of ways in which Mercy may use or share your PHI without your advance permission:

  • For Treatment: We may share PHI about you with people involved in your care. For example, a doctor may need to look at your medical history before treating you. 
  • For Payment: We may use and disclose your PHI for billing purposes. For example, we may share your PHI with your insurance company to receive payment for services Mercy provides to you, and we may share information with an ambulance company so that it may bill for services provided to bring you to Mercy for treatment.
  • For Health Care Operations: We may use and disclose PHI about you for our operations. For example, we may share PHI about you to evaluate our doctors’ and nurses’ performance in caring for you.
  • For Research: We may share your PHI with researchers when their research has been approved by an institutional review board (IRB) and found by the IRB not to require patient permission. Your permission is required for other types of research.

Other Uses and Disclosures of PHI without your permission

Mercy may also use or share PHI without your permission for the following purposes:

  • Public health activities such as to report the occurrence of communicable diseases.
  • To report information about victims of abuse, neglect or domestic violence.
  • Health oversight activities, such as Medicare and Medicaid program activities.
  • Legal proceedings, such as in response to a subpoena or court order.
  • Law enforcement purposes, such as with the police or other law enforcement officials who are pursuing a criminal suspect.
  • Specialized government functions such as military and veteran activities, national security and intelligence activities, protective services for the President and others, medical suitability determinations, correctional institutions, providing public benefits, etc.
  • With medical examiners, coroners, and funeral directors.
  • For organ and tissue donation purposes.
  • To avert a serious health or safety threat.
  • To comply with workers’ compensation laws.
  • With an entity legally authorized to assist in disaster relief efforts such as the American Red Cross.
  • For other purposes as required by law.

Permissive Uses or Disclosures

Mercy may use or share your PHI for any of the purposes described in this section unless you specifically request in writing that we do not. Your written request must be given to your care provider or to the Health Information Management Office listed at the end of this notice.

  • We may contact you to remind you of an appointment.
  • We may contact you to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
  • We may share hospital directory information including your name, room location, and general condition with people who ask for you by name including clergy.
  • We may contact you about Mercy-sponsored activities including fundraising programs and events. If you do not want your information to be used for fundraising purposes, you have the option to opt out by contacting Mercy Foundation office listed at the end of this notice. We will care for you regardless of your decision to participate in fundraising activities.
  • We may share PHI about you with a friend, family member, personal representative, or any individual you identify who is involved in your care or is paying for some or all of your care.
  • If you are unable to tell us your preference, for example, if you are unconscious or it could lessen a serious threat to your health and safety, we may share your information if we believe it is in your best interest.

Uses and Disclosures Requiring Your Written Permission


For any purpose other than the ones listed earlier in this notice, we may use or share your PHI only when you give us written permission.

  • Psychotherapy Notes. We must obtain your written permission for most uses and disclosures of psychotherapy notes.
  • Marketing. Before we receive financial payment for marketing activities using your PHI, we must obtain your written permission. We may, however, communicate with you about products or services related to your treatment, case management, care coordination, or alternative treatments, therapies, health care providers or care settings without your permission. Your permission is also not needed for small promotional items and face-to-face communications.
  • Sale of PHI. Your PHI will not be sold without your written permission, except that we may be paid our cost to provide PHI for certain purposes such as public health purposes and other purposes permitted by HIPAA.

Revoking Your Authorization

If you give us written permission to use and share your PHI, you can take back your permission at any time, as long as you tell us in writing. If you take back your permission, we will stop using or sharing your information, but we will not be able to take back any information that we have already shared.

You have the following rights:

  • Right to Request Confidential Communication:
    You have the right to request PHI in a certain form or at a specific location. Your request must be in writing. For example, you can request that we not contact you at work, and you can tell us how and/or where you want to receive PHI. We will agree to reasonable requests. If we agree to your request, we will honor your request until you tell us in writing that you have changed your mind and no longer want the confidential communication.
  • Right to Inspect and Receive a Copy Your PHI:
    You have the right to review your PHI and to receive a paper or electronic copy of your PHI. Your request must be in writing. We may charge a fee for the cost of providing you with copies. We may deny your request to access and receive a copy of your PHI in rare situations when doing so is determined by a licensed health care professional to pose a serious risk of harm. 
  • Right to Request a Change to Your PHI:
    You have a right to request that your PHI be corrected if you believe that it contains a mistake or is missing information. You must tell us the reasons for the change in writing using the request form you can get from your provider or from the Health Information Management Office listed at the end of this notice. Mercy can deny your request if: (1) it is not in writing or does not include a reason for the change; (2) the information you want to change was not created by Mercy; (3) the information is not part of the medical record kept by Mercy; (4) the information is not part of the information that you are permitted to inspect or copy; or (5) the information contained in the record is accurate and complete.
  • Right to Notice of a Breach:
    We are required by law to tell you if there is a breach of your PHI. A breach can occur when safeguards to protect your PHI fail. 
  • Right to an Accounting of Disclosures:
    You have the right to request an accounting of disclosures of your PHI that we have made, with some exceptions. Your request must be in writing and must state the time period for the requested information. Mercy will not provide this information for a time period greater than six (6) years from the date of your request. You have the right to receive one (1) free accounting every twelve (12) months. If you request more than one (1) accounting in any twelve (12) month period, we may charge you a reasonable fee for the costs of providing that list.
  • Right to Receive a Copy of this Notice:
    You have the right to a copy of this Notice. You may view and print a copy of this notice from our website at If you want a paper copy of this notice mailed to you, or to exercise any of your rights outlined above, please send a written request to the Director of Health Information Management for the Mercy Location where you received your health care services, listed at the end of this notice.

Privacy Complaints
If you have any questions about this Notice, or any concern about the privacy of your PHI, please contact the Privacy Manager for the Mercy provider where you obtained health care services listed at the end of this notice.

We hope you will tell us if you have a concern so we can try to fix it, but you also have the right to file a complaint with the Office for Civil Rights (OCR) and the Secretary of Health and Human Services (HHS). If you decide to report a complaint to Mercy, the OCR, or Secretary of HHS, this will not affect your ability to obtain care and treatment at Mercy. You have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights Secretary by sending a letter to 200 Independence Avenue, S.W., Washington, D.C., 20201, calling 1.877.696.6775, or visiting 

Changes to This Notice
We have the right to change this notice at any time. If we change this notice, we may make the new terms effective for all PHI that we maintain. Any changes that we make will comply with federal, state and other laws. The most recent copy of this notice will be on our website. You can also call or write the Director of Health Information Management listed at the end of this notice to obtain the most recent version of this notice.


Privacy Contacts for Concerns or Questions

Last updated 01/22/2021

Printable Notice of Privacy Practices