UChicago Medicine Notice of Privacy Practices

Notice from the Chief Privacy Officer

Dear Patients and Visitors,

Protecting the privacy of your health information is important. We are pleased to provide the information below to inform you about a federal law that is designed to help protect the privacy of that health information. This law is known as the HIPAA Privacy Rule.

The Privacy Rule requires us to give you a copy of our Notice of Privacy Practices ("the Notice"). This Notice explains our use of your medical or health information. The Rule also requires us to ask you to sign a form called the Acknowledgment. By signing this form you are confirming that you received a copy of the Notice.

We hope that the UChicago Medicine Notice of Privacy Practices helps you to understand the ways we use and protect your health information. If you have any questions about this Notice or our privacy practices, please feel free to contact the HIPAA Program Office at 773-834-9716.

Sincerely,
Karen Habercoss
Chief Privacy Officer

University of Chicago Medicine Notice of Privacy Practices

UChicago Medicine has hospitals, outpatient clinics and doctors’ offices through Chicago, its suburbs and Northwest Indiana. This notice applies to all records regarding your care at UChicago Medicine entities, including the University of Chicago Medical Center covered entities and the University of Chicago Health Care covered components as designated, and its affiliated UCM Care Network entities, Ingalls Memorial covered entities, the Northwest Indiana covered entities, and its group health plans. Each time you visit a hospital, doctor or other health care provider in our system, a record of your visit is made. The record typically has information about your symptoms, diagnosis, examination, test results, treatment plan and bill-related information. This notice also applies to the following health plans: The University of Chicago Medical Center Health Plan, The University of Chicago Group Health Plan and Ingalls Memorial Hospital Group Health Plan. The health plans maintain enrollment, claims adjudication and other records about health plan members who are employees and their dependents.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Rights

You have the right to:

Look at and get a copy of your health information in the way you choose and we are able to provide
Get confidential (private) communications
Ask for changes to your medical records or health plan records
Know who your information has been shared with
Ask us to not share your medical information
Be told if there was unlawful access or use of your medical information
Get more information about your privacy rights or to make a complaint

Your Choices

You have some choices in the way we use and share information as we:

Share your medical information with relatives, friends and caregivers
Contact you by mail, phone, text message or email about appointments and other things
Include your information in our patient directory
Contact you to raise money for our programs and services

Our Uses and Disclosures

We may use and share your information as we:

Treat you
Bill for your services
Resolve claims for the health plans
Run our organizations
Do research
Comply with the law
Help with public health and safety issues
Address workers’ compensation or requests from the government
Respond to organ and tissue donation requests
Work with a medical examiner or funeral director
Participate in organized health care arrangements

Your Rights About Your Medical Information

Looking at and Getting a Copy of Your Medical Information

You may look at and get a copy your medical records, billing and payment records, and other health information used to make decisions about your treatment in the format you want. There may be times when we may not allow access to some records, or we may not be able to provide them in the way you want. We will tell you if this is the case.

If you want to see your records or get a copy, call UCM Health Information Management (Medical Records) at 773-702-1637. We may ask you to fill out, sign, and return a Record Request form. We may charge you for the cost to copy your medical record and postage, but only what the law allows us to charge and will tell you in advance. You can find information here: https://www.uchicagomedicine.org/patients-visitors/patient-information/request-medical-records.

Getting Confidential (Private) Communications

You may ask us to send papers that have your Protected Health Information (PHI) to an address different from the one you gave us, or to send the information in another way.
We may ask you to put this in writing, and we will try to grant any reasonable request. For example, you may ask us to send a copy of your medical records to a different address than your home address or send an electronic copy by email, fax, or in an electronic portal or other electronic application.

Making Changes to Your Medical Records

You have the right to ask us to make changes by correcting or adding information in the medical record we keep about you. If you believe information is not correct or not complete and you want to ask us to change your information, you may get an Amendment Request Form from the Privacy Program. There may be times when we may deny your request.

Knowing Who Your Information Has Been Shared With

You may ask for a list (accounting) of people or organizations that we have shared your medical information with outside the University of Chicago Medicine.

We will not go back more than 6 years before the date of your request. This list will not include when we have shared information:

With you
For your treatment
To get payment for your treatment
Allowed with your permission
As described in this Notice

Asking Us to Not Share Your Medical Information

You have the right to ask us to not share or to limit the medical information we use or share to treat you, get payment for our services to you, and to run our hospitals and clinics. Your request must be made in writing and given to the Privacy Program.

By law, we must agree to not share or limit your medical information if:

It is for making payment or health care operations
We are not required by law to not share or limit the information
It is for an item or service you have paid for in full, out-of-pocket

We are not required to agree to your request except as noted above. If we do agree, we will follow your request unless the information is needed for an emergency.

Unlawful Access or Use of Your Information

You may have the right to be told if your medical information was accessed or used in a way that was not allowed or not secure. If the law requires us to tell you of this kind of access, use, or disclosure then we will tell you as soon as possible giving you the following information:

A description of what happened
The types of medical information that was accessed, used or disclosed
Things you can do to protect yourself from harm
What we did about this
How and who to contact for more information

For More Information or to Make Complaints

You may contact the UChicago Medicine Privacy Program for more information about:

Your privacy rights
If you believe we have violated your privacy rights
If you do not agree with a decision we made about access to your Protected Health Information (PHI)

You may also make complaints in writing to the Office for Civil Rights (OCR) of the United States Department of Health and Human Services. The UChicago Medicine Privacy Program will provide you with the address for the OCR. We will not take any action against you if you file a complaint with us or with the OCR, and we will not ask you to not file a complaint as a condition of treatment or payment.

You may contact the Privacy Program at:
The University of Chicago Medicine: Privacy Program
5841 South Maryland Avenue, MC 1000
Chicago, IL 60637

Phone: 773-834-9716 or Email: privacy@uchicagomedicine.org
Anonymous Report Phone Line (you do not have to identify who you are): 1-877-440-5480, option 2

You Can Choose How We Use and Share Your Medical Information

Your Relatives, Friends, and Caregivers

If you want us to and agree, we will share your medical information with your family member, relative, close personal friend, or another person you chose. If, for some reason such as medical emergency, you are not able to agree or do not agree, we may use our professional judgment to decide if sharing your information is in your best interest. This includes information about your location and general condition.

To Contact You

We may use and share your medical information to contact you by mail, phone, text message or email about appointments and other health care related things. We will use the contact information you gave us when we mail, call, text or email you.

Any message left on voice mail, with a person who answers the phone, text or in an email may include:

Your name
The clinic and location
The doctor or other health care provider you have the appointment with

We will follow anything reasonable you ask of us in sending an appointment reminder in a different way.

We may contact you to:

Follow up about test results, care given or treatment options
Tell you about health-related products or services that may interest you offered by the University of Chicago Medicine
Tell you are about possible research you may be interested in participating in

In Our Patient Directory

If you are an inpatient in our hospital, we may include information about you in our patient directory. Anyone who asks for you by name can be given your location in the hospital and your general health condition. We may share directory information in emergency situations. Members of the clergy can also see the religion listed in your medical record.

You must tell us if you do not want information about you shared in our patient directory.

For Fundraising

To raise money for our programs and services, we may use some information about you including your name, address, phone number, date of birth, gender, dates that we provided health care to you, the doctor who treated you, outcome information, and health insurance status.

You can chose not to get these communications at any time by contacting our University of Chicago Medical Center Development Office by phone at (773) 834-9166 or by e-mail at supportUCMC@bsd.uchicago.edu or our Ingalls Hospital Development Office by phone at (708) 915-6115 or by email at foundation@ingalls.org.

How We Use and Share Your Medical Information

Who Will Follow this Notice?

This notice of privacy practices will be followed by:

UCMC-Covered Entities

1. The University of Chicago Medical Center (UCMC), including its nurses, residents, other staff, and volunteers
2. Parts of the University of Chicago that take part in or support the activities of health care, including its doctors, nurses, students, volunteers, and other staff

UCM-Care Network Covered Entities

3. UCM Community Physicians, LLC
4. UCM Care Network Medical Group, Inc.
5. Primary Healthcare Associates, SC

UCM-Ingalls Covered Entities

6. Ingalls Memorial Hospital, including its doctors and other health care professionals on its medical staff, nurses, residents, other staff, and volunteers.
7. Ingalls Home Care
8. Ingalls Same Day Surgery, LP
9. Ingalls Health Ventures

UCM-Northwest Indiana Covered Entities

Group Health Plans

10. The University of Chicago Group Health Plan
11. The UCMC Group Health Plan
12. Ingalls Group Health Plan

The UCMC-Covered Entities, the UCM-Care Network Covered Entities, the UCM-Ingalls Covered Entities, and the UCM-Northwest Indiana Covered Entities have designated themselves as an affiliated covered entity for purposes of complying with HIPAA. In addition, UCM has established an organized health care arrangement with all of the organizations listed above. This means we may share your health information among the organizations for our activities as a health system, including treating you, getting payment for services, handling claims for our health plan, and running our hospitals, clinics and health plans, which may include utilization review, education, patient safety and risk management and joint quality assessment and improvement.

The UCM affiliated covered entity and organized health care arrangement allow the UCM organizations to use and disclose your medical information in compliance with HIPAA and provide this joint notice to you, but do not create any legal relationships between or among any of the organizations. The organizations are not agents or joint venturers of each other. They are independent entities responsible for their own activities. We will share your medical information as permitted by the Health Insurance Portability and Accountability Act (HIPAA) with one another to:

Treat you
Get payment for our services
Run our hospitals and clinics and health plans

Your Representatives

If you are under 18 years old, a parent or guardian is often responsible for your privacy and your medical information. There are a few exceptions.

If you are an adult who has other people such as your health care surrogate making decisions for you, they may make decisions about your privacy and your medical information.

Our Responsibility for Your Medical Information

We respect the privacy of your medical information. Information we keep about you includes:

A record of the care you are given each time you visit
Outside information we are given about you
Information to get payment for our services.

This medical information is also called your Protected Health Information (PHI). These records may be kept on paper, electronically on a computer, or kept by other media. You can request and we will provide you access to the medical information we keep. We will work with you to provide this in the way you would like it and in the way we are able to provide this.

By law, UCM must keep your PHI private and secure and we must:

Tell you if there has been a breach of your unsecured PHI, if required by law
Give this Notice to you and tell you the ways we may use and share your PHI
Tell you of your rights about your PHI
Follow the terms of this Notice

We have the right to make changes to this document at any time and to apply new privacy or security practices to medical information we keep. Our website will have the most current Notice. Go online to https://www.uchicagomedicine.org/about-us/privacy-practices for more information. You can also ask for a paper copy of this notice from our Privacy Program.

Sharing Your Medical Information Without Permission

The following notice is about how and when we may use and share medical information about you in order to provide health care, get payment for that health care, and run our business.

We do not need your authorization (permission) to use your medical information during the following times.

To Treat You: We keep records of the care and services we provide to you. We may use and share your information with doctors, nurses, technicians, medical, professional health care students, or anyone else who needs the information to take care of you.

Example 1: A doctor treating a patient for a broken leg may need to ask another doctor if the patient has diabetes or other conditions that may slow the leg’s healing process. To treat a patient, we may need to share medical information and talk with doctors and others involved in the patient’s health care who are not employed by us for care collaboration, referrals or care management.

Example 2: We use medical information to tell you about products or services we offer that are related to your health or may be of interest to you and to or recommend other kinds of treatment.

To Bill and Pay for Services: We may use and share information about you so that we and other health care providers that have provided services to you, such as an ambulance company, may bill and collect payment for those services. Your information may be used to get payment from you, your insurance company, or another person you identify. Our health plans use and share information to process claims for payment for services provided to you.

Example: When we submit claims to get payment for services we provided, we use medical information about the services. We may share this information with insurance companies including Medicare, family members or others responsible for paying a patient’s bill.

To Run Our Organization: We may use and share information about you to run our business and operations. This may be to improve the quality of care, train staff and students, provide customer service, or other things to help us better serve our patients and community. We may also share your medical information with individuals or organizations we hire to help us provide services and programs on our behalf.

Example 1: The University of Chicago Medicine is an academic medical center. We provide education and training for many kinds of health care professionals including medical students, nursing students, and other kinds of health care professions or health care business students. Your medical information may be used for training purposes.

Example 2: We may use your information to jointly assess and to improve the quality of the health care services we provide, to improve the process or outcome of your care, or to improve how happy you are with the care we provide.

Example 3: We may share your information with outside groups we use to help us in carrying out our operational activities such as benefit management or data analysis.

Sharing Your Medical Information Without Permission

Research: We perform research at UCM to support learning of new knowledge and treatments that may help all patients and the community. As required by law, we will tell you about and get your permission for any research that involves information that may show who you are. All human subject research is looked over by an Institutional Review Board (IRB). Protected health information that is approved by the IRB and used for research is then considered research information and is not part of the health record. UCM researchers may look at your medical information to know if future studies are possible or to find and contact you to see if you want to take part in research.

We may also gather information to publish an educational article. However, we will not share who you are without your written permission. Our researchers may use or share your information without your authorization:

If the group that oversees research (IRB) gives them permission to do so
If the patient data is being used to prepare for a research study
At times when the research is limited to information of patients who have died

Permitted and Required by Law: We are required and permitted by federal, state and local laws to share medical information to some government agencies and others including to:

Report information to public health authorities for the purpose of preventing or controlling disease, injury, or disability
Report abuse and neglect to government authorities, including social service or protective service agencies
Report information about products and services to the FDA
Tell a person who may have been exposed to an infectious disease or may be at risk of developing or spreading a disease or condition
Report information to your employer as required under laws about work-related illnesses and injuries or workplace medical surveillance
Prevent or lessen a serious and imminent threat to a person for the public’s health or safety, or to some government agencies with special functions
Report proof of student immunization to your schools

We may also share your medical information with:

A government agency that oversees the health care system and makes sure the rules of government health programs and other rules that apply to us, are being followed
A court or administrative proceeding about a legal order or other lawful process
The police or other law enforcement officials. For example, reporting about some physical injury, crimes, victims or unknown patients
A special government program. For example, programs related to veterans or the military

Organ and Tissue Donation: We may share your medical information with an organization that manages organ, tissue, and eye donation and transplantation.

Deceased Patients: We may share medical information about patients who have died to the coroner, medical examiner or funeral director.

Other:

Organized Health Care Arrangements: We may participate in organized health care arrangements with other covered entities that are not agents of each other for purposes of joint utilization review, quality assessment and improvement activities, or payment activities. Each are independent entities responsible for their own activities. You may find out more information about this on our website: https://www.uchicagomedicine.org/about-us/privacy-practices/organized-health-care-arrangements. We will share your medical information as permitted by HIPAA.

We will not use or share your medical information other than those talked about in this notice without written permission signed by you or your personal representative. A written authorization (or permission) is a document you sign allowing us to use or share some information for a particular purpose.

You may change your mind at any time about giving permission to share this information.
You can remove your permission by sending a written statement to the Privacy Program.
Your statement to remove your permission will not apply if we have already taken action on something that you have already given us your permission for.

Unless we are allowed by law, we will get your written permission:

1. Before we share your Highly Confidential (private) Information for a purpose other than those permitted by law, including information about:

Abuse or neglect of a child, an elderly person, or an adult with a disability
Genetic testing
HIV and AIDS testing, diagnosis or treatment
In vitro fertilization (IVF)
Mental health and developmental disabilities
Sexually transmitted diseases
Sexual assault

2. To use or share your medical information to contact you to sell others products or services.

3. For the sale of your medical information.

4. Sharing of psychotherapy notes (your mental health provider’s written notes) will only be done with your written permission and the agreement of your mental health provider.

University of Chicago Medicine Locations and Effective Date

All UCM health care providers providing health care to the public at all of their delivery sites, including on-campus and off-site locations in and around Chicago and Northwest Indiana follow this Notice. A complete list of all locations is available on the University of Chicago Medicine external website.

The University of Chicago Medicine Main Campus: All Adult and Pediatric Sites, including Emergency Departments, Chicago
The University of Chicago Medicine Center for Advanced Care: All Ambulatory Offsite Clinics, Chicago, Greater Chicagoland and Northwest Indiana Locations
The University of Chicago Medicine Physician Offices: All Primary Care and Specialty Care Clinics, Greater Chicagoland and Northwest Indiana Locations
The UCM Care Network Medical Group Office locations, Greater Chicagoland and Northwest Indiana
Ingalls Memorial Main Campus; All Adult and Pediatric Sites, including Emergency Departments, Harvey
Ingalls Memorial Ambulatory and Emergency Offsite Clinics, Greater Chicagoland Locations
Ingalls Home Care; Greater Chicagoland and Northwest Indiana Locations
Ingalls Same Day Surgery; Greater Chicagoland Locations
Ingalls Health Ventures; Greater Chicagoland and Northwest Indiana Locations
Northwest Indiana Entities; Northwest Indiana Locations

This notice does not imply any other special association or legal relationship between UCM organizations and its independent doctors. This notice is an administrative tool required by federal law to allow UCM and its doctors to tell you about our common privacy practices. Independent doctors are responsible for their own acts, and UCM hospitals are not responsible for the clinical services provided by independent doctors to you at a UCM location. A list of our care sites is also available on our website. All these care sites are called we or us in this document.

Effective Date: Our original Notice took effect in April, 2003. It was revised in May 2012, September 2013, January 2017, November 2019, February 2020, December 2021. This version takes effect November 2023.

Download Privacy Practices PDFs

The University of Chicago Medicine Notice of Privacy Practices

The University of Chicago Medicine Notice of Privacy Practices- Arabic

The University of Chicago Medicine Notice of Privacy Practices- Chinese

The University of Chicago Medicine Notice of Privacy Practices- Spanish