Notice of Privacy Practices

Notice of Privacy Practices

This notice describes your rights regarding your medical information and informs you of how medical information about you may be used. Please review it carefully.

This notice applies to Mercy Health and to the Mercy Health facilities and clinics listed below (together referred to as “Mercy”).

Mercy's Duties Regarding Your PHI

By law, we are required to maintain privacy of your protected health information (“PHI”), to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and notify you if a breach occurs that may have compromised the privacy or security of your PHI. PHI is any information, including verbal, electronic and on paper, that is created or received by Mercy pertaining to your health care and payment for your health care. When we use or disclose your PHI, we are required to abide by the terms of this Notice. 

How We May Use and Disclose Your PHI

We may use and disclose your PHI without obtaining your authorization as described below. Below is a brief explanation of use or disclosure, but we do not list every use or disclosure in a category.

• For Treatment: We may use and disclose your PHI to provide you with health care services. We may share PHI about you with health care providers involved in your care. For example, a doctor may need to review your medical history before treating you. We may also disclose your PHI to other health care providers to provide you with various items and services, such as laboratory tests or medications and to make arrangements for home care services, rehabilitation services or other health care services you may need. We may contact you to provide appointment reminders, patient registration information, information about treatment alternatives or other health related benefits and services that may be of interest to you or to follow up on your care.
• For Payment: We may use and disclose your PHI for billing purposes. For example, we may share your PHI with your insurance company to receive payment for services Mercy provides to you, and we may share information with an ambulance company so that it may bill for services provided to bring you to Mercy for treatment. We may also tell your health insurance company about a treatment that you need to obtain prior approval or check if your insurance will pay for the treatment.
• For Health Care Operations: We may use and disclose PHI about you for our health care operations which are various activities necessary to run our business, provide quality health care services and contact you when necessary. For example, we may share your PHI to evaluate our doctors’ and nurses’ performance in caring for you and for quality improvement activities. We may disclose your PHI to medical or nursing students and other trainees for review and learning purposes.
• Family Members and Friends Involved in Your Care: We may share PHI about you with your friend, family member, personal representative, or any individual you identify who is involved in your care or is paying for some or all of your care. If you are present, we may disclose the PHI if you agree to the disclosure, we provide you with an opportunity to object to the disclosure and you do not say no, or if we reasonably infer that you do not object to the disclosure. If you are unable to tell us your preference, for example, if you are not present or are unconscious, we may share your PHI that is directly relevant to the person’s involvement with your care if we believe it is in your best interest. In addition, we may disclose your PHI to an entity legally authorized to assist in disaster relief efforts so that your family can be notified of your condition and location.
• Facility Directory: For hospital patients, unless you advise the registration representative otherwise, if we maintain a facility directory, we may use your name, location in the facility, general condition (e.g., fair, good) for directory purposes. This information may be provided to members of the clergy and to other people who ask for you by name. This helps your family, friends and clergy to visit you and learn about your general condition.
• For Research: We may use or disclose your PHI for research purposes provided that we comply with applicable laws. We may share your PHI with researchers when their research has been approved by an institutional review board (IRB) and found by the IRB not to require patient permission.
• Fundraising: We may use and disclose to a business associate or an institutionally related foundation certain limited PHI about you to contact you as part of a fundraising effort on behalf of Mercy, unless you have told us that you do not want to receive communications from us for fundraising purposes. You have the right to opt out of receiving fundraising communications and if you receive a communication for fundraising purposes, you will be provided with instructions on how to request not to be contacted for fundraising purposes in the future. In addition, if you would like to opt out from receiving any fundraising communications, you can contact our Mercy Health Foundation.
• Public Health Activities: We may disclose your PHI for public health activities to public health or other governmental authorities authorized by law to receive such information. This may include disclosing your medical information to report certain diseases, report child abuse or neglect, report information to the Food and Drug Administration if you experience an adverse reaction from a medication, to enable product recalls or disclosing PHI for public health surveillance, investigations or interventions.
• Victims of Abuse, Neglect or Domestic Violence: We may disclose your PHI to a governmental authority authorized by law to receive reports of abuse, neglect or domestic violence, if we reasonably believe that you are a victim of abuse, neglect or domestic violence, if the disclosure is required or authorized by law.
• Health Oversight Activities: We may use and disclose your PHI to a health oversight agency that oversees the health care system so they can monitor, investigate, inspect, discipline or license those who work in health care and engage in other health care oversight activities.
• Judicial and Administrative Proceedings: We may use and disclose your PHI in the course of judicial or administrative proceedings in response to a legal order, subpoena, discovery request or other lawful process, subject to applicable procedural requirements.
• Law Enforcement Officials: We may disclose your PHI to the police or other law enforcement officials to report or prevent a crime or as otherwise required or permitted by law.
• Decedents: We may disclose PHI to coroners, medical examiners and funeral directors when an individual dies so that they can carry out their duties or for identification of a deceased person or determining cause of death.
• Organ and Tissue Donation: We may disclose PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
• Health or Safety Threat: We may use or disclose your PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Workers Compensation: We may use and disclose your PHI as authorized by and to the extent necessary to comply with state law relating to workers’ compensation or other similar programs providing benefits for work-related injuries or illnesses.
• Specialized Government Functions: We may use and disclose PHI for special government functions such as military, national security and presidential protective services.
• Correctional Institutions: If you are in the custody of law enforcement or a correctional institution, we may disclose your PHI to the law enforcement official or the correctional institution as necessary for health and safety of you or others, provision of health care to you or certain operations of the correctional institution.
• Business Associates: We may disclose your PHI to third party business associates, which are vendors that perform various services for Mercy. For example, we may disclose your PHI to a vendor that provides billing or collection services for us. We require our business associates to safeguard your PHI.
• Limited Data Sets: We may use or disclose a limited data set (which is PHI from which certain identifying information has been removed) for purposes of research, public health, or health care operations. We require any recipient of such information to agree to safeguard such information.
• As Required by Law: We may disclose your PHI to the Secretary of the Department of Health and Human Services and as otherwise required by Federal or state law.

Uses and Disclosures Requiring Your Authorization

For any purpose other than the ones listed above in this Notice, we may use or share your PHI only when you give us your written authorization. Your authorization is required for most uses and disclosures of psychotherapy notes, most uses and disclosures of your PHI for marketing purposes and for sale of your PHI. In addition, certain Federal and state laws may require special protections for certain medical information, including information that pertains to HIV/AIDS, mental health, alcohol or drug abuse treatment services, genetic information or certain other information. If these laws do not permit disclosure of such information without obtaining your authorization, we will comply with those laws.

Revoking Your Authorization

If you give us written authorization to use and share your PHI, you can take back your authorization at any time, as long as you tell us in writing. If you take back your authorization , we will stop using or sharing your PHI, but we will not be able to take back any PHI that we have already shared. To revoke any previously provided authorization you must submit a written request for revocation to our Health Information Management Department.

Your Rights Regarding Your PHI

• Right to Request Restrictions: You have the right to ask us not to use or disclose your PHI for purposes of treatment, payment or health care operations or to individuals who are involved in your care. To request a restriction, you must submit your request in writing to our Health Information Management Department. In your request, you must tell us what PHI you want us not to use or disclose and to whom you want the restriction to apply (for example, disclosures to a certain family member). We are not required to agree to your request, and we will notify you if we don’t agree. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that PHI for the purpose of payment or our operations with your health insurer, and we will agree to such request unless a law requires us to share that information. If we agree to your request, we will comply with the restriction unless the information is needed to provide emergency treatment to you. Even if we agree to your request, we may still disclose your PHI to the Secretary of the Department of Health and Human Services and for certain other purposes described in this Notice for which disclosure is permitted without your authorization. We may end a restriction to which we previously agreed if we inform you that we plan to do so.
• Right to Request Confidential Communication: You have the right to request PHI in a certain form or at a specific location. For example, you can request that we only contact you at a certain phone number or only send mail to a certain address. Your request must be in writing and must be submitted to our Privacy Department. In your request, you must tell us how or where you wish to be contacted and to what address we may send bills for services provided to you. We will not ask you about the reason for your request. We will agree to reasonable requests. If we agree to your request, we will honor your request until you tell us in writing that you have changed your mind and no longer want the confidential communication.
• Right to Inspect and Receive a Copy of Your PHI: You have the right to review your PHI and to receive a paper or electronic copy of your PHI. You may request that we send a copy of your PHI to a third party. Your request must be in writing and must be submitted to our Health Information Management Department. We may charge a reasonable cost based fee for the cost of providing you with copies. We may deny your request to access and receive a copy of your PHI in certain limited circumstances. If we deny your request, we will explain the reasons to you and in most cases you may have the denial reviewed.
• Right to Request a Change to Your PHI: You have a right to request that your PHI be corrected if you believe that it contains a mistake or is missing information. Your request must be in writing and must be submitted to our Health Information Management Department. You must tell us the reasons for the change in writing using the request form you can get from your provider or from our Health Information Management Department. Mercy can deny your request if: (1) it is not in writing or does not include a reason for the change; (2) the information you want to change was not created by Mercy; (3) the information is not part of the medical record kept by Mercy; (4) the information is not part of the information that you are permitted to inspect or copy; or (5) the information contained in the record is accurate and complete. If we accept your request, we will inform you about our acceptance and make the appropriate corrections. If we deny your request, we will inform you and give you a chance to submit to us a written statement disagreeing with the denial. We will add your written statement to your record and include it whenever we disclose the part of your PHI to which your written statement relates.
• Right to Notice of a Breach: You have the right to receive notice if a breach occurs that may have compromised the privacy or security of your PHI.
• Right to an Accounting of Disclosures: You have the right to request a list of the times we have shared your PHI for six years prior to the date of your request, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures. To request this list, you must submit your request in writing to our Health Information Management Department. Your request must state a time period for which you want to receive this information. We will provide one accounting a year for free but may charge a reasonable, cost-based fee if you ask for another one within twelve months. We will notify you of the cost involved and you may choose to withdraw or modify your request before any costs are incurred.
• Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify that the person has this authority and can act for you before we take any action.
• Right to Receive a Paper Copy of this Notice: You have the right to a paper copy of this Notice. Even if you have agreed to receive this Notice electronically, you may still ask for a paper copy of this Notice at any time. Copies of the Notice will be available at our facilities. You may view and print a copy of this Notice from our website at www.mercy.net. If you want a paper copy of this Notice mailed to you, or to exercise any of your rights outlined above, please send a written request to our Privacy Department.

For Further Information; Privacy Complaints

If you have any questions about this Notice or would like more information about our privacy practices, please contact our Privacy Department at 314.364.3381 or by mail at the address specified in this Notice. If you believe your privacy rights have been violated, you may file a written complaint with our Privacy Department at the address specified in this Notice or with the U.S. Department of Health and Human Services Office for Civil Rights Secretary by sending a letter to 200 Independence Avenue, S.W., Washington, D.C., 20201, calling 1.877.696.6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html We will not retaliate against you for filing a complaint.

Changes to This Notice

We have the right to change this Notice at any time. If we change this Notice, we may apply the revised Notice to all PHI that we maintain about you. We will post a copy of the current Notice on our website at www.mercy.net. The Notice will specify the effective date of the Notice. Each time you visit our website, you will see a link to the current Notice in effect. In addition, at any time you may request a copy of the Notice currently in effect. You can also call or write our Privacy Department at the address listed in this Notice to obtain a copy of the Notice currently in effect.

Nondiscrimination Notice

Mercy complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex (consistent with the scope of sex discrimination described at 45 CFR § 92.101(a)(2). Mercy does not exclude people or treat them less favorably because of race, color, national origin, age, disability, or sex. Mercy provides people with disabilities reasonable modifications and free appropriate auxiliary aids and services to communicate effectively with us, such as qualified sign language interpreters and written information in other formats (large print, audio, accessible electronic formats, other formats). Mercy provides free language assistance services to people whose primary language is not English, which may include qualified interpreters and information written in other languages. If you need reasonable modifications, appropriate auxiliary aids and services, or language assistance services, contact your local Mercy facility. If you believe that Mercy has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, or sex, you can file a grievance with: Mercy’s Chief Compliance Officer, 15740 South Outer 40 Road, Chesterfield, MO 63017, 1-844-764-0100, [email protected]. You can file a grievance in person or by mail or email. If you need help filing a grievance, Mercy’s Chief Compliance Officer is available to help you. You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, electronically through the Office for Civil Rights Complaint Portal, available at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Room 509F, HHH Building, Washington, D.C. 20201, 1-800-368-1019, 800-537-7697 (TDD). Complaint forms are available at http://www.hhs.gov/ocr/office/file/index.html. This notice is available at Mercy’s website: www.mercy.net.

For more information, please see our full Nondescrimination Notice here.

Effective Date: (11/4/24)