Privacy Information

How we my use and disclose information about you:

The following describes different ways that we may use and disclose medical information about you. Not every use or disclosure in a category will be listed. However, all the ways we are permitted to use and disclose information will fall within one of the following categories.

For Treatment:
We may use medical information about you to provide, coordinate, or manage your health care and related services. This includes sharing information with doctors, nurses, technicians, medical students, volunteers, and other System personnel involved in your care.

We may also disclose your medical information to health care providers outside of the System who are involved in your care, such as hospitals, nursing facilities, or other providers if you are transferred or admitted for care. In addition, we may disclose information to family members, friends, or other individuals you identify, to the extent permitted by law and consistent with your preferences.

For Payment:
We may use and disclose medical information about you so that the treatment and services provided by the System may be billed and payment collected from you, your health plan, or a third party. This may include disclosures to another health care provider or health plan for payment activities related to services you received.

You have the right to request that we not disclose medical information to your health plan only if the disclosure is for payment or health care operations and the applicable item or service has been paid for in full out‑of‑pocket.

For Health Care Operations:
We and our business associates may use and disclose medical information about you for health care operations. These activities are necessary to operate the System and ensure that all patients receive quality care.

Examples include quality assessment and improvement activities, training and education, credentialing, licensing, compliance activities, audits, legal services, business planning and development, patient safety activities, and operational improvement efforts.

We may also disclose medical information to other health care providers, health plans, or health care clearinghouses for certain health care operation purposes as permitted by law.

Use of Artificial Intelligence and Advanced Technologies

The System may use artificial intelligence (AI), machine learning, or similar advanced technologies to support the delivery of care and the efficient operation of our health system.

These tools may be used to:

• Assist clinicians with clinical documentation, such as drafting or summarizing notes
• Support administrative and operational tasks, including scheduling, billing, coding, quality improvement, and compliance activities
• Improve care coordination, patient safety, and operational efficiency

AI-supported tools are intended to support – not replace – clinical judgment or decision-making. Health care professionals remain responsible for reviewing, verifying, and finalizing all clinical documentation and care decisions.

Patient Choice Regarding AI Use:
If you prefer that AI-assisted tools not be used during your visit or in connection with your care, you may inform your health care provider. We will make reasonable efforts to honor your preference when feasible and consistent with safe, effective care and operational requirements. Your decision will not affect your access to care.

Affiliated Covered Entities (ACE)

The System participates in an Affiliated Covered Entity (ACE) as permitted by federal law. An ACE is a group of legally separate entities under common ownership or control that designate themselves as a single covered entity for purposes of compliance with the HIPAA Privacy and Security Rules.

Entities that may participate in the System’s ACE include, but are not limited to:

• Hospitals and inpatient facilities
• Outpatient clinics and ambulatory care sites
• Employed physician practices and provider groups
• Behavioral health and specialty care programs
• Diagnostic, laboratory, imaging, and ancillary service providers
• Administrative, management, and support entities that perform covered functions

As part of the ACE, participating entities may use and disclose medical information among themselves for treatment, payment, and health care operations, as permitted by HIPAA and other applicable laws. All ACE participants share a joint Notice of Privacy Practices and have agreed to protect the privacy and security of your medical information in accordance with federal and state law.

Organized Health Care Arrangements (OHCA)

Certain entities within the System may also participate in Organized Health Care Arrangements (OHCAs). An OHCA is an arrangement in which multiple health care providers participate jointly in certain health care operations, such as quality improvement, utilization review, care coordination, and operational efficiency initiatives.

Participants in an OHCA may share medical information with one another for purposes of treatment, payment, and health care operations related to the OHCA, as permitted by HIPAA and other applicable laws. Each participant in an OHCA may use or disclose medical information in accordance with its own Notice of Privacy Practices and applicable legal requirements.

Health-Related Benefits and Services:
We may use and disclose medical information to inform you of health-related benefits, services, treatment alternatives, or care coordination services that may be of interest to you. You may opt out of receiving these communications by contacting the System’s Privacy Office.

Fundraising Activities:
We may use limited medical information to contact you about fundraising efforts to support the System. You have the right to opt out of receiving fundraising communications at any time by contacting the System’s Privacy Office or informing the individual who contacts you. Opting out will not affect your treatment or payment for services.

Hospital Directory:
While you are a patient, we may include limited information about you in the hospital directory, such as your name, location, general condition, and religious affiliation, unless you request otherwise.

Special Situations:
We may disclose medical information as permitted or required by law for:

• Public health activities
  We may share health information about you for certain situations such as preventing disease, helping with product recalls, preventing or reducing a serious threat to anyone’s health or safety, reporting suspected abuse, neglect, or domestic violence. Health oversight activities – We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
• Lawsuits and legal proceedings
  We may disclose your health information in response to a court order or lawful process related to a lawsuit or dispute, but only after efforts have been made to notify you of the request or to obtain a protective order. Law enforcement purposes – We may disclose information in response to legal process or for certain law enforcement purposes, including reporting deaths or suspected criminal activity on our premises or identified during emergency care.
• Coroners and medical examiners
  We may disclose information for certain purposes related to death investigations, including to help identify a deceased person or determine the cause of death. Organ and Tissue Donations –We may disclose information for certain purposes related to organ, eye, or tissue donation and transplantation, including sharing information with organizations that handle organ procurement or donation.
• Military and Veterans
  We may disclose information for certain military‑related purposes, including sharing information with military command authorities if you are a member of the armed forces, or with appropriate foreign military authorities when required.
• Workers’ Compensation
  We may disclose information for certain purposes related to workers’ compensation or similar programs that provide benefits for work‑related injuries or illnesses.
• National security and protective services
  We may disclose information for certain national security or protective service purposes, including sharing information with authorized federal officials as required by law.
• Protective Services for the President and Others
  We may disclose information for certain protective service purposes, including sharing information with authorized federal officials as required by law to provide protection for authorized persons or conduct special investigations.
• Inmates and correctional institutions
  We may disclose information to correctional institutions or law enforcement if you are in custody, as needed for your health care, safety, the safety of others, or institutional security.

Research
We may use or disclose your health information for research purposes, including records research and clinical research. Records research involves reviewing information in medical records, while clinical research may involve drugs, devices, procedures, or other interventions. For example, a records research study may review medical records to compare outcomes for patients who received different treatments for the same condition. A clinical research study may involve a patient participating in a study to test whether a new drug is safe and effective in treating a disease.

Some types of research are covered by HIPAA and other types are not. For research that uses or discloses identifiable health information from your medical records and is covered by HIPAA, we will generally obtain your written authorization. However, as permitted by law, we may use or disclose medical information without your authorization for research activities, including when an Institutional Review Board approves the research or waives authorization, when the information is reviewed solely to prepare a research protocol, when the use or disclosure is solely for research on the PHI of deceased individuals, or when a researcher receives a limited data set with nonspecific geographic information (such as ZIP code) and agrees to safeguard the information.

If you would like more information on the privacy policies regarding the use or disclosure of your health information for research that is covered by HIPAA, you may contact the NGHS Privacy Office at Privacy.Officer@nghs.com or at 1-844-917-1115.

Psychotherapy Notes:
Psychotherapy notes receive special protection under federal law and will not be disclosed except with your written authorization, pursuant to a court order, or as otherwise required by law. Psychotherapy notes may be used internally only by the mental health professional who created them, except to defend against a legal action.

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

Federal law (42 CFR Part 2) provides special privacy protections for your substance use disorder (SUD) treatment records. These records cannot be disclosed without your written permission except in very limited situations: medical emergencies, scientific research conducted in compliance with federal regulations, audits, a court order that meets the requirements of 42 CFR Part 2, and reporting regarding crimes committed on premises or against personnel.

You have the option to give a single broad consent that allows us to share your SUD treatment information for treatment, payment, and healthcare operations now and in the future without needing to ask you each time. This helps your healthcare providers coordinate your care more easily.

You may choose whether to provide this broad consent, and you can change or revoke your permission at any time by contacting the System’s Privacy Office in writing. Revocation applies only to disclosures made after the revocation.

If your SUD treatment information is shared with a HIPAA-covered entity or business associate, they may share it again as allowed under HIPAA for purposes like treatment, payment, or healthcare operations. However, any further sharing must still follow the law and any limits you have placed in your written permission.

Even if you give written consent for your SUD treatment information to be shared, it is still protected by federal law. The person or organization that receives this information cannot use it to investigate you, arrest you, charge you, or take other legal or administrative action against you unless you give specific written permission for that purpose or a court order meeting strict federal requirements allows it. A general medical release form is not enough to allow your SUD information to be used in these ways.

Your rights regarding your medical information

You have the right to::

• Inspect and receive a copy of your medical record
• Request amendments to your medical information
• Request an accounting of certain disclosures
• Request restrictions on certain uses or disclosures
• Request confidential communications
• Receive a paper copy of this Notice

You have the right to request restrictions on certain uses and disclosures of your medical information. We are not required to agree to your request. However, we must agree if you pay for a service or item in full out of pocket and ask us not to share that information with your health plan for payment or health care operations.

Changes to this Notice

We reserve the right to change this Notice of Privacy Practices. Any revised notice will apply to medical information we already have about you as well as information created or received in the future. The current notice will include an effective date and will be available upon request.

Investigation of Breaches

If we determine that the privacy or security of your unsecured protected health information has been breached, we will notify you, describe mitigation steps, and advise you on actions you may take to protect yourself.

Additional Information & Complaints

If you have questions or would like more information, contact the System’s Privacy Office at 844-917-1115 or Privacy.Officer@nghs.com.

If you believe your privacy rights have been violated, you may file a complaint with the System or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Other Uses of Medical Information

Other uses and disclosures not described in this Notice will be made only with your written authorization or as otherwise permitted or required by law. You may revoke an authorization at any time by submitting a written request to the System’s Privacy Office.