CenterWell ACE
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR PROTECTED HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY
CONTACT PERSON
If you have any questions about this Notice of Privacy Practices (“Notice”), please contact us through one of the methods listed at the end of this Notice.
ENTITIES SUBJECT TO THIS NOTICE OF PRIVACY PRACTICES.
This Notice of Privacy Practices applies to all entities that are part of CenterWell ACE, an Affiliated Covered Entity under HIPAA. The ACE is a group of legally separate covered entities that are affiliated and have designated themselves as a single covered entity for purposes of HIPAA.
EFFECTIVE DATE OF THIS NOTICE.
The original effective date of this Notice was April 26, 2003. The most recent revision date is at the end.
WE HAVE A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI).
We are required by law to maintain the privacy of your personal information. This medical information is called protected health information or “PHI” for short. PHI includes information that can be used to identify you that we have created or received about your past, present, or future health or medical condition, the provision of health care to you, or the payment of this health care. We need access to your medical records to provide you with health care and to comply with certain legal requirements. This Notice applies to all of the records of the care and services you receive from us, whether made by our employees or your physician. This Notice will tell you about the ways in which we may use and disclose PHI about you and describes your rights and certain obligations we have regarding the use and disclosure of your PHI.
However, we reserve the right to change the terms of this Notice and our Privacy Policies and Procedures at any time. Any changes will apply to the PHI we already have. When we make a material change in our privacy practices, we will modify this Notice and make it available to you by posting it on our website displaying it in a prominent location in the physical service delivery site, if applicable, deliver by e-mail with your approval, or otherwise make the revised Notice available to you. You can also request a copy of this Notice from us at any time by contacting us using any of the methods described on the last page of this Notice. When you first become a patient, you will be asked to sign an acknowledgement indicating that you have been given the opportunity to review and/or obtain a paper copy of the Notice.
OUR DUTIES.
We are required by law to:
- make sure that PHI that identifies you is kept private;
- give you this Notice of our privacy practices with respect to your PHI;
- disclose information on HIV, mental health, and/or communicable diseases only as permitted under federal and state law; and follow the terms of this Notice as long as it is currently in effect. If we revise this Notice, we will follow the terms of the revised Notice.
HOW WE MAY USE AND DISCLOSE YOUR PHI.
The following categories (listed in bold-face print) describe different ways that we use and disclose your PHI. Disclosures of PHI may be provided in various media, including electronically. For each category of uses or disclosures we will explain what we mean and give you some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information about you will fall within one of the bold-face print categories. Also, not all of the categories may apply to the health care service you are seeking.
For Treatment.
We may disclose your PHI to physicians, nurses, case managers, and other health care personnel who provide you with health care services or are involved in your care. We may use and disclose your PHI to provide and coordinate the treatment, medications and services you receive including dispensing of prescription medications when applicable. For example, if you’re being treated for a knee injury, we may disclose your PHI regarding this injury to a physical therapist or radiologist, or to medical equipment suppliers or case managers.
To Obtain Payment for Treatment.
We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your PHI to our billing department and your health plan to get paid for the health care services we provided to you. We may also provide your PHI to our Business Associates, such as billing companies and others that process our health care claims.
For Health Care Operations.
We may disclose your PHI in order to operate our facilities. For example, we may use your PHI to evaluate the quality of health care services that you received, for utilization management activities, or to evaluate the performance of the health care professionals who provided the health care services to you. We may also provide your PHI to our accountants, attorneys, consultants, and others in order to make sure we are complying with the laws that affect us.
To Business Associates for Treatment, Payment, and Health Care Operations.
We may disclose PHI about you to one of our Business Associates in order to carry out treatment, payment, or health care operations. For example, we may disclose PHI about you to a company who bills insurance companies on our behalf so that company can help us obtain payment for the health care services we provide.
Individuals Involved in Your Care or Payment for Your Care.
We may release PHI about you to a family member, other relative, or
- preventing or controlling disease, injury or disability;
- reporting child abuse or neglect;
- reporting reactions to medications or problems with products;
- notifying people of recalls of products;
- notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease;
- notifying the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
- reporting births and deaths;
Health Oversight Activities.
We may disclose PHI to a health oversight agency for activities authorized by law such as audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Lawsuits and Disputes.
If you are involved in a lawsuit or a dispute, we may disclose PHI about you under a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else in the dispute.
Law Enforcement.
We may release PHI if asked to do so by a law enforcement official:
- in response to a court order, subpoena, warrant, summons or similar process;
- to identify or locate a suspect, fugitive, material witness, or missing person, but only if limited information (e.g., name and address, date and place of birth, social security number, blood type, RH factor, injury, date and time of treatment, and details of death) is disclosed;
- about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
- about a death we believe may be the result of criminal conduct;
- about criminal conduct we believed occurred at our facility; and
- in emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
Coroners, Medical Examiners and Funeral Directors.
We may release PHI about patients to a coroner or medical examiner to identify a deceased person or to determine the cause of death or to funeral directors to carry out their duties.
Organ and Tissue Donation.
We may release PHI to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank to facilitate organ or tissue donation.
Research.
Under certain circumstances, we may use and disclose PHI about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another for the same condition. All research projects are subject to a special approval process which requires an evaluation of the proposed research project and its use of PHI, and balances these research needs with our patients' need for privacy. Before we use or disclose PHI for research, the project generally will have been approved through this special approval process. However, this approval process is not required when we allow PHI about you to be reviewed by people who are preparing a research project and who want to look at information about patients with specific medical needs, so long as the PHI does not leave our facility.
To Avert a Serious Threat to Health or Safety.
We may use and disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone who is able to help prevent the threat.
Armed Forces and Foreign Military Personnel.
If you are a member of the Armed Forces, we may release PHI as required by military command authorities or about foreign military personnel to the appropriate foreign military authority.
National Security and Intelligence Activities.
We may release PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Protective Services for the President and Others.
We may disclose PHI about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state, or to conduct special investigations.
Inmates.
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. This release would be necessary, for example, for the institution to provide you with health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.
Food and Drug Administration (FDA)
We may use and disclose to the Food and Drug Administration (FDA), or person under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products, and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
Incidental Uses and Disclosures.
Uses and disclosures that occur incidentally with a use or disclosure described in this Notice are acceptable provided there are reasonable safeguards in place to limit such incidental uses and disclosures.
WHAT DO WE DO WITH YOUR INFORMATION WHEN YOU ARE NO LONGER A PATIENT OR YOU DO NOT OBTAIN SERVICES THROUGH US.
Your information may continue to be used for purposes described in this Notice if you no longer obtain services through us. After the required legal retention period, we destroy the information following strict procedures to maintain the confidentiality.
YOUR RIGHTS REGARDING YOUR PHI.
The Right to Request Limits on Uses and Disclosures of Your PHI.
You have the right to ask that we limit how we use and disclose your PHI. We will consider your request but are not legally required to approve it. If we approve your request, we will put any limits in writing and follow them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.
The Right to Choose How We Send PHI to You.
You have the right to ask that we send information to you to an alternate address or via an alternate method. We must agree to your request so long as we can easily provide it in the format you requested.
The Right to See and Get Copies of Your PHI.
In most cases, you have the right to look at or get copies of your PHI that we have, but you must make the request in writing. If we do not have your PHI, but we know who does, we will tell you how to get it. In certain situations, we may deny your request. If we do, we will tell you in writing our reasons for the denial and explain your right to have the denial reviewed. If you request copies of your PHI, there may be a per page charge. Instead of providing the PHI you requested, we may provide you with a summary or explanation of the PHI as long as you agree to that and to any additional costs in advance.
The Right to Get a List of the Disclosures We Have Made.
You have the right to get a list of instances in which we have disclosed your PHI in the past six (6) years. The list will include the date of the disclosure(s), to whom PHI was disclosed, a description of the information disclosed, and the reason for the disclosure. The list will not include uses or disclosures that were made for the purposes of treatment, payment or health care operations, uses or disclosures that you authorized, or disclosures made directly to you or to your family. The list also will not include uses and disclosures made for national security purposes, or to corrections or law enforcement personnel. Your request must state a time period that may not be longer than six (6) years prior, but may certainly be less than six (6) years.
The Right to Correct or Update Your PHI.
If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment of the existing information or to add the missing information. You must provide the request and your reason for the request in writing. If we approve your request, we will make the change to your PHI, tell you that we have done it, and tell others that need to know about the change to your PHI. We may deny your request if the PHI is: (i) correct and complete, (ii) not created by us, (iii) not allowed to be disclosed, or (iv) not part of our records. Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you do not file a statement of disagreement, you have the right to request that your request and our denial be attached to all future disclosures of your PHI.
The Right to Get This Notice.
You have the right to get a copy of this Notice in paper and by e-mail.
The Right to File a Complaint.
If you believe your privacy rights have been violated or if you disagree with a decision we make about your rights, such as accessing or amending your records, you may file a complaint with us by phone, fax, or mail. All complaints to us must be submitted using the contact information listed below.
You may also submit a written complaint to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will give you the appropriate OCR regional address on request. You also have the option to e-mail your complaint to
We will respond to all privacy requests and complaints. It has always been our goal to ensure the protection and integrity of your personal and health information. Therefore, we will notify you of any potential situation where your information would be used for reasons other than what is listed above.
WHAT WILL HAPPEN IF MY PRIVATE INFORMATION IS USED OF DISCLOSED INAPPROPRIATELY.
You have the right to receive a notice following a breach of your unsecured PHI. We will notify you in a timely manner if such a breach occurs.
HOW WILL MY INFORMATION BE USED FOR PURPOSES NOT DESCRIBED IN THIS NOTICE.
In all situations other than described in this Notice, we will request your written permission before using or disclosing your information. You may revoke your permission at any time by notifying us in writing. We will not disclose your information for any reason not described in this notice without your permission. The following uses and disclosures will require authorization.
- Most uses and disclosures of psychotherapy notes.
Psychotherapy notes are notes recorded by your health care provider who is a mental health professional documenting or analyzing the contents of a conversation that are separate from the rest of the patient’s medical record. Exceptions exist for disclosures required by other law, such as for mandatory reporting of abuse, and mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient.
- Marketing purposes.
With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing. So as not to interfere with core health care functions, HIPAA distinguishes marketing communications from those communications about goods and services that are essential for quality health care.
- Sale of protected health form information.
Sale of PHI is a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information. Some activities are not considered a “sale” of PHI, such as disclosures related to public health purposes, required by law, research purposes, for treatment and payment purposes, for the sale, transfer, merger or consolidations of the entity.
What type of communications can I opt out of receiving from you?
You can opt out at the address below regarding the following communications:
- Appointment reminders.
- Treatment alternatives or other health-related benefits and services.
- Fundraising activities.
HOW TO REQUEST YOUR PRIVACY RIGHTS.
If you believe your privacy has been violated in any way, you may file a complaint by contacting us as described below. We are committed to responding to your rights request in a timely manner. To request any of your privacy rights, please contact us at:
Centerwell Primary Care
Mailing Address:
Primary Care Privacy
500 West Main Street
Louisville, KY 40202
Email:
Centerwell Pharmacy and Home Health
Mailing Address:
Centerwell Pharmacy and Home Health
Privacy Office 003/10911
101 E. Main Street Louisville, KY 40202
Email:
Date of Last Revision: 5/01/2023