UChicago Medicine Notice of Privacy Practices

Notice from the Chief Privacy Officer

Dear Patients and Visitors,

Protecting the privacy of your health information is important. We are pleased to provide the information below to inform you about a federal law that is designed to help protect the privacy of that health information. This law is known as the HIPAA Privacy Rule.

The Privacy Rule requires us to give you a copy of our Notice of Privacy Practices ("the Notice"). This Notice explains our use of your medical or health information. The Rule also requires us to ask you to sign a form called the Acknowledgment. By signing this form you are confirming that you received a copy of the Notice.

We hope that the UChicago Medicine Notice of Privacy Practices helps you to understand the ways we use and protect your health information. If you have any questions about this Notice or our privacy practices, please feel free to contact the HIPAA Program Office at 773-834-9716.

Sincerely,
Karen Habercoss
Chief Privacy Officer

Notice of Privacy Practices

University of Chicago Medicine Notice of Privacy Practices

UChicago Medicine (UCM) has hospitals, outpatient clinics and doctors’ offices across Chicago, its suburbs and Northwest Indiana. This notice applies to all records about your care at UChicago Medicine entities. These include the University of Chicago Medical Center covered entities, the University of Chicago Health Care covered components as designated, its affiliated UChicago Medicine Network entities, and its group health plans (as further described below).

Each time you visit a hospital, doctor or other health care provider in our system, a record of your visit is made. The record typically has information about your symptoms, diagnosis, exam, test results, treatment plan, and bill-related information.

This notice also applies to the following health plans: The University of Chicago Medical Center Health Plan, The University of Chicago Group Health Plan, and Ingalls Memorial Hospital Group Health Plan. The health plans maintain enrollment, claims adjudication and other records about health plan members who are employees and their dependents.

UChicago Medicine has hospitals, outpatient clinics and doctors’ offices through Chicago, its suburbs and Northwest Indiana. This notice applies to all records regarding your care at UChicago Medicine entities, including the University of Chicago Medical Center covered entities and the University of Chicago Health Care covered components as designated, and its affiliated UCM Care Network entities, Ingalls Memorial covered entities, the Northwest Indiana covered entities, and its group health plans. Each time you visit a hospital, doctor or other health care provider in our system, a record of your visit is made. The record typically has information about your symptoms, diagnosis, examination, test results, treatment plan and bill-related information. This notice also applies to the following health plans: The University of Chicago Medical Center Health Plan, The University of Chicago Group Health Plan and Ingalls Memorial Hospital Group Health Plan. The health plans maintain enrollment, claims adjudication and other records about health plan members who are employees and their dependents.

This notice describes:
• How medical/health information about you may be used and disclosed and how you can get access to this information
• Your rights with respect to your health information
• How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information

You have the right to a copy of this notice (in paper or electronic form) and to discuss it with the Chief Privacy Office or designee at 773-834-9716 or privacy@uchicagomedicine.org if you have any questions.

Please review it carefully.

Your Rights

You have the right to:

Look at and get a copy of your health information in the way you choose and we are able to provide
Get confidential (private) communications
Ask for changes to your medical records or health plan records
Know who your information has been shared with
Ask us to not share your medical information
Be told if there was unlawful access or use of your medical information
Get more information about your privacy rights or to make a complaint

Your Choices

You have some choices in the way we use and share information as we:

Share your medical information with relatives, friends and caregivers
Contact you by mail, phone, text message or email about appointments and other things
Include your information in our patient directory
Contact you to raise money for our programs and services

Our Uses and Disclosures

We may use and share your information as we:

Treat you
Bill for your services
Resolve claims for the health plans
Run our organizations
Do research
Comply with the law
Help with public health and safety issues
Address workers’ compensation or requests from the government
Respond to organ and tissue donation requests
Work with a medical examiner or funeral director
Participate in organized health care arrangements

Your Rights About Your Medical Information

Looking at and Getting a Copy of Your Medical Information

You may look at and get a copy your medical records, billing and payment records, and other health information used to make decisions about your treatment in the format you want. There may be times when we may not allow access to some records, or we may not be able to provide them in the way you want. We will tell you if this is the case.

If you want to see your records or get a copy, call UCM Health Information Management (Medical Records) at 773-702-1637. We may ask you to fill out, sign, and return a Record Request form. We may charge you for the cost to copy your medical record and postage, but only what the law allows us to charge and will tell you in advance. You can find information here: https://www.uchicagomedicine.org/patients-visitors/patient-information/request-medical-records.

Getting Confidential (Private) Communications

You may ask us to send papers that have your Protected Health Information (PHI) to an address different from the one you gave us, or to send the information in another way.

We may ask you to put this in writing, and we will try to grant any reasonable request. For example, you may ask us to send a copy of your medical records to a different address than your home address or send an electronic copy by email, fax, or in an electronic portal or other electronic way.

Making Changes to Your Medical Records

You have the right to ask us to make changes by correcting or adding information in the medical record we keep about you. If you believe information is not correct or not complete and you want to ask us to change your information, you may get an Amendment Request Form from the Privacy Program. There may be times when we may deny your request.

Knowing Who Your Information Has Been Shared With

You may ask for a list (accounting) of people or organizations that we have shared your medical information with outside the University of Chicago Medicine.

We will not go back more than 6 years before the date of your request. This list will not include when we have shared information:

With you
For your treatment
To get payment for your treatment
With your permission
As described in this Notice

Asking Us to Not Share Your Medical Information

You have the right to ask us to not share or to limit the medical information we use or share to treat you, get payment for our services to you, and to run our hospitals and clinics. Your request must be made in writing and given to the Privacy Program.

By law, we must agree to not share or limit your medical information if:

It is for making payment or health care operations
We are not required by law to not share or limit the information
It is for an item or service you have paid for in full, out-of-pocket

We are not required to agree to your request except as noted above. If we do agree, we will follow your request unless the information is needed for an emergency.

Unlawful Access or Use of Your Information

You may have the right to be told if your medical information was accessed (looked at) or used in a way that was not allowed or not secure. If the law requires us to tell you of this kind of access, use, or disclosure (sharing of information), then we will tell you as soon as possible giving you the following information:

A description of what happened
The types of medical information that were accessed, used or disclosed
Things you can do to protect yourself from harm
What we did about this
How and who to contact for more information

For More Information or to Make Complaints

You may contact the UChicago Medicine Privacy Program for more information about:

Your privacy rights
If you believe we have violated your privacy rights
If you do not agree with a decision we made about access to your Protected Health Information (PHI)

You may also make complaints in writing to the Office for Civil Rights (OCR) of the United States Department of Health and Human Services. The UChicago Medicine Privacy Program will provide you with the address for the OCR.

We will not take any action against you if you file a complaint with us or with the OCR, and we will not ask you to not file a complaint as a condition of treatment or payment.

You may contact the Chief Privacy Officer in the Privacy Program at:

The University of Chicago Medicine: Privacy Program

5841 South Maryland Avenue, MC 1000

Chicago, IL 60637

Phone: 773-834-9716 Email: privacy@uchicagomedicine.org

Anonymous Report Phone Line (you do not have to say or give information that shows who you are): 877-440-5480, option 2

Language interpreter services for patients and caregivers are free of charge. Please contact us at: 773-702-6330 or InterpreterServices2@uchicagomedicine.org

You Can Chose How We Use and Share Your Medical Information

Your Relatives, Friends, and Caregivers

If you want us to and agree, we will share your medical information with your family member, relative, close personal friend, or another person you chose.

If, for some reason such as medical emergency, you are not able to agree or do not agree, we may use our professional judgment to decide if sharing your information is in your best interest. This includes information about your location and general condition.

To Contact You

We may use and share your medical information to contact you by mail, phone, text message or email about appointments and other health care related things. We will use the contact information you gave us when we mail, call, text or email you.

Any message left on voice mail, with a person who answers the phone, text or in an email may include:

Your name
The clinic and location
The doctor or other health care provider you have the appointment with

We will follow reasonable requests to send an appointment reminder in a different way.

We may contact you to:

Follow up about test results, care given or treatment options
Tell you about health-related products or services that may interest you offered by the University of Chicago Medicine
Tell you about possible research you may be interested in taking part in

In Our Patient Directory

If you are an inpatient in our hospital, we may include information about you in our patient directory. Anyone who asks for you by name can be given your location in the hospital and your general health condition. We may share directory information in emergency situations. Members of the clergy can also see the religion listed in your medical record.

You must tell us if you do not want information about you shared in our patient directory.

For Fundraising

To raise money for our programs and services, we may use some information about you including your name, address, phone number, date of birth, gender, dates that we provided health care to you, the doctor who treated you, outcome information, and health insurance status.

You can choose not to get these communications at any time by contacting our:

University of Chicago Medical Center Development Office by phone at 773-834-9166 or by e-mail at givetomedicine@bsd.uchicago.edu
Ingalls Hospital Development Office by phone at 708-915-6115 or by email at foundation@ingalls.org.

How We Use and Share Your Medical Information

Who Will Follow this Notice?

This notice of privacy practices will be followed by:

UCMC Covered Entities

The University of Chicago Medical Center (UCMC), including its nurses, residents, other staff, and volunteers
Parts of the University of Chicago that take part in or support the activities of health care, including its doctors, nurses, students, volunteers, and other staff

UChicago Medicine Network Covered Entities

UCM Community Physicians, LLC
UCM Medical Group, Inc.
UCM Medical Group Sub, LLC
UCM Home Care
Ingalls Memorial Hospital
Ingalls Same Day Surgery, LP
UChicago Medicine Northwest Indiana, Inc.

Group Health Plans

The University of Chicago Group Health Plan
The UCMC Group Health Plan
Ingalls Group Health Plan

The UCMC Covered Entities and the UChicago Medicine Network Covered Entities have designated themselves as an affiliated covered entity for purposes of complying with HIPAA. In addition, UCM has established an organized health care arrangement with all of the organizations listed above.

This means we may share your health information among the organizations for our activities as a health system. This includes information for treating you, getting payment for services, handling claims for our health plan, and running our hospitals, clinics and health plans. It can include utilization review, education, patient safety and risk management and joint quality assessment and improvement.

The affiliated covered entity and organized health care arrangement allow the above UCM organizations to use and share your medical information. This must be in compliance with HIPAA and provide this joint notice to you, but do not create any legal relationships between or among any of the organizations.

The organizations are not agents or joint venturers of each other. They are independent entities responsible for their own activities.

We will share your medical information as permitted by the Health Insurance Portability and Accountability Act (HIPAA) with one another to:

Treat you
Get payment for our services
Run our hospitals and clinics and health plans

Your Representatives

If you are under 18 years old, a parent or guardian is often responsible for your privacy and your medical information. There are a few exceptions.

One example is if you are an adult who has other people making decisions for you. This may be your health care surrogate or health care agent (your medical decision maker). They may make decisions about your privacy and your medical information.

Our Responsibility for Your Medical Information

We respect the privacy of your medical information. Information we keep about you includes:

A record of the care you are given each time you visit
Outside information we are given about you
Information to get payment for our services

This medical information is also called your Protected Health Information (PHI).

These records may be kept on paper, electronically on a computer, or kept by other media. You can ask for and we will provide you access to the medical information we keep. We will work with you to provide this in the way you want and in the way we are able to provide this.

By law, UCM must keep your PHI private and secure and we must:

Tell you if there has been a breach of your unsecured PHI, if required by law
Give this Notice to you and tell you the ways we may use and share your PHI

Tell you of your rights about your PHI
Follow the terms of this Notice

Substance Use Records:

We follow the HIPAA standard for sharing Substance Use Disorder (SUD) Records.
Federal law (42 CFR Part 2) protects the confidentiality (privacy) of SUD records.
Most times, we will not disclose (share) SUD records without written permission.
- You may revoke (take back) this written permission.
- You have the right to ask for restrictions of disclosures made with prior consent for the purposes of treatment, payment, and health care operations. (You can ask to limit information shared even when you agreed to share it in a past consent form)
- For example, we require your written permission to share SUD records with your employer.
You have the right to provide one consent to tell us how your SUD records can be used and shared for future treatment, payment, and health care operations.
We may share SUD records without your written permission in the following cases:
- We will only share with public health authorities if the records do not identify you (show who you are) and follow the Health Insurance Portability and Accountability Act (HIPAA).
- We may share for research, audit, or evaluation under certain conditions.
- Records will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on specific written consent or court order and only after notice and an opportunity to be heard is provided to you. We will share SUD records in response to a court order with a subpoena or similar legal mandate.
Records disclosed (shared) to others not part of UCM who are HIPAA covered entities, other programs that must comply with 42 CFR Part 2, and business associates, may re-share your information without your consent to the extent allowable under HIPAA.

Sharing Your Medical Information Without Permission

We have the right to make changes to this document at any time and to apply new privacy or security practices to medical information we keep. You can also ask for a paper copy of this notice from our Privacy Program.

The following notice is about how and when we may use and share medical information about you in order to provide health care, get payment for that health care, and run our business.

We do not need your authorization (permission) to use your medical information during the following times.

To Treat You: We keep records of the care and services we provide to you. We may use and share your information with doctors, nurses, technicians, medical, professional health care students, or anyone else who needs the information to take care of you.

Example 1: A doctor treating a patient for a broken leg may need to ask another doctor if the patient has diabetes or other conditions that may slow the leg’s healing process. To treat a patient, we may need to share medical information and talk with doctors and others involved in the patient’s health care who are not employed by us. This includes for care collaboration (care team members working together), referrals, or care management.

Example 2: We use medical information to tell you about products or services we offer that are related to your health or may be of interest to you and to or recommend other kinds of treatment.

To Bill and Pay for Services: We may use and share information about you so that we and other health care providers that have provided services to you, such as an ambulance company, may bill and collect payment for those services. Your information may be used to get payment from you, your insurance company, or another person you identify. Our health plans use and share information to process claims for payment for services provided to you.

Example: When we submit claims to get payment for services we provided, we use medical information about the services. We may share this information with insurance companies including Medicare, family members or others responsible for paying a patient’s bill.

To Run Our Organization: We may use and share information about you to run our business and operations. This may be to improve the quality of care, train staff and students, provide customer service, or other things to help us better serve our patients and community. We may also share your medical information with individuals or organizations we hire to help us provide services and programs on our behalf.

Example 1: The University of Chicago Medicine is an academic medical center. We provide education and training for many kinds of health care professionals including medical students, nursing students, and other kinds of health care professions. Your medical information may be used for training purposes.

Example 2: We may use your information to jointly assess and to improve the quality of the health care services we provide, to improve the process or outcome of your care, or to improve how happy you are with the care we provide.

Example 3: We may share your information with outside groups we use to help us in carrying out our operational activities such as benefit management or data analysis.

Research: We perform research at UCM to support learning of new knowledge and treatments that may help patients and the community. As required by law, we will tell you about and get your permission for research that involves information that may show who you are.

All human subject research is looked over by an Institutional Review Board (IRB). Protected health information that is approved by the IRB and used for research is then considered research information and is not part of the health record.

UCM researchers may look at your medical information to know if future studies are possible or to find and contact you to see if you want to take part in research.

We may also gather information to publish an educational article. However, we will not share who you are without your written permission.

Our researchers may use or share your information without your authorization:

If the group that oversees research (IRB) gives them permission to do so
If the patient data is being used to prepare for a research study
At times when the research is limited to information of patients who have died

Permitted and Required by Law: We are required and permitted by federal, state and local laws to share medical information to some government agencies and others including to:

Report information to public health authorities for the purpose of preventing or controlling disease, injury, or disability
Report about a child abuse, neglect, or domestic violence
Report information about products and services to the FDA
Tell a person who may have been exposed to an infectious disease or may be at risk of developing or spreading a disease or condition
Report information to your employer as required under laws about work-related illnesses and injuries or workplace medical surveillance
Prevent or lessen a serious and imminent threat to a person for the public’s health or safety, or to some government agencies with special functions
Report proof of student immunization to your schools

We may also share your medical information with:

A government agency that oversees the health care system and makes sure the rules of government health programs and other rules that apply to us, are being followed
A court or administrative proceeding about a legal order or other lawful process
The police or other law enforcement officials. For example, reporting about some physical injury, crimes, victims or unknown patients
A special government program. For example, programs related to veterans or the military
Sharing Your Medical Information Without Permission

Organ and Tissue Donation: We may share your medical information with an organization that manages organ, tissue, and eye donation and transplantation.

Deceased Patients: We may share medical information about patients who have died with the coroner, medical examiner, or funeral director.

Other: We will not use or share your medical information other than as described in this notice without written permission signed by you or your personal representative. A written authorization (or permission) is a document you sign allowing us to use or share some information for a particular purpose.

You may change your mind at any time about giving permission to share this information.
You can remove your permission by sending a written statement to the Privacy Program.
Your statement to remove your permission will not apply if we have already taken action on something that you have already given us your permission to do.

Unless we are allowed by law, we will get your written permission:

Before we share your Highly Confidential (private) Information for a purpose other than those permitted by law, including information about:

Abuse or neglect of a child, an elderly person, or an adult with a disability
Genetic testing
HIV and AIDS testing, diagnosis or treatment
In vitro fertilization (IVF)
Mental health and developmental disabilities
Sexually transmitted diseases
Sexual assault

To use or share your medical information to contact you to sell others products or services.
For the sale of your medical information.
Sharing of psychotherapy notes (your mental health provider’s written notes) will only be done with your written permission and the agreement of your mental health provider.

University of Chicago Medicine Locations and Effective Date

All UCM health care providers providing health care to the public at all hospitals, doctor offices, and other UCM delivery sites, including on-campus and off-site locations in and around Chicago and Northwest Indiana follow this Notice. A complete list of all locations is on the University of Chicago Medicine external website.

This notice does not imply any other special association or legal relationship between UCM organizations and its independent doctors. This notice is an administrative tool required by federal law to allow UCM and its doctors to tell you about our common privacy practices.

Independent doctors are responsible for their own acts, and UCM hospitals are not responsible for the clinical services provided by independent doctors to you at a UCM location. A list of our care sites is also available on our website. All these care sites are called “we” or “us” in this document.

This notice of privacy practices is being provided to you as required by the Health Insurance Portability and Accountability Act (HIPAA) and 42 CFR (Code of Federal Regulations) Part 2. If you want a paper copy of this notice, contact the Privacy Program. UCM is required by law to maintain the privacy of health records and provide this notice of its legal duties with respect to these records. UCM is required to abide by the terms of the notice currently in effect. UCM reserves the right to change the terms of this notice and make the new notice provisions effective for the records it maintains. Revisions to this notice are available to patients in electronic form on the UCM website, in paper form upon request, and posted.

Effective Date: Our original Notice took effect in April 2003. It was revised in May 2012, September 2013, January 2017, November 2019, February 2020, December 2021, November 2023. This version takes effect August 2025.

This notice of privacy practices is being provided to you as required by the Health Insurance Portability and Accountability Act (HIPAA) and 42 CFR (Code of Federal Regulations) Part 2.

If you want a paper copy of this notice, contact the Privacy Program.
UCM is required by law to maintain the privacy of health records and provide this notice of its legal duties with respect to these records.
UCM is required to abide by the terms of the notice currently in effect.
UCM reserves the right to change the terms of this notice and make the new notice provisions effective for the records it maintains.
Revisions to this notice are available to patients in electronic form on the UCM website, in paper form upon request, and posted.

Download Privacy Practices PDFs

The University of Chicago Medicine Notice of Privacy Practices

The University of Chicago Medicine Notice of Privacy Practices- Arabic

The University of Chicago Medicine Notice of Privacy Practices- Chinese

The University of Chicago Medicine Notice of Privacy Practices- Spanish