Notice of Health Information Practices

Note: The following information is available for download in PDF format »

UAB St. Vincent’s Joint Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

Our Commitment

We are committed to maintaining the privacy and confidentiality of your health information. This Notice describes your rights concerning your health information and how we may use and disclose (share) your information.

Who Follows This Notice

This Notice is followed by all employees (associates), medical staff, trainees, students, volunteers, contractors, vendors, agents, and workforce members of UAB St. Vincent’s hospitals, ambulatory care centers, pharmacies, laboratories, physician practices, and other UAB  health care providers. Some locations may act as an Affiliated Covered Entity (ACE) for purposes of complying with the HIPAA Rules. UAB St. Vincent’s also participates in an Organized Healthcare Arrangement with other UAB locations and may use and share your information between each other for treatment, payment, and health care operations relating to these arrangements and as permitted by the HIPAA Rules. For a complete list of locations, please contact the UAB St. Vincent’s Privacy Officer (“Privacy Officer”) as described in this Notice.

How We May Use and Share Your Information

This Notice describes the different ways we may use and disclose (share) your health information and when we need your authorization to do so. We may contact you by phone, email, or text message at the number or address you give us. Usually we will use encrypted methods to communicate electronically with you, but some communications may be sent unencrypted, such as text messages, and by providing us with your mobile number or email you are agreeing to receive messages in that manner. 

Most often we use and share your information for treatment, payment, and health care operations purposes. This means we may use and share your information, for example:

• with other health care providers who are treating you or with a pharmacy for filling your prescription.
• with your insurance plan or other payor to collect payment for health care services or to get prior approval for services or medications.
• to support our business, improve your care, educate our professionals, and evaluate provider performance.
• with our business associates, who provide services for or on our behalf, such as a billing service, who help us with our business operations. All of our business associates are required to protect the privacy and security of your health information just as we do. 

We may also use or share your health information to contact you for the following reasons:

• to notify you about possible alternative treatment options, new services, opportunities to participate in research, opportunities to provide us feedback on our services, and other health-related benefits or services. 
• to notify you about your care and upcoming services including appointments, refill reminders, or similar care related notifications.
• for UAB St. Vincent’s fundraising purposes. You have the right to opt out of receiving fundraising communications by replying as noted in the communication or by contacting the Privacy Officer.  

We are also allowed, and sometimes required by law, to use or share your information with certain recipients for the reasons listed below. We may have to meet certain requirements before we can use or share your information for these purposes. Some examples of each include: 

• Public health and safety: reporting communicable diseases, births, or deaths; reporting abuse, neglect, or domestic violence; reporting adverse reactions to medications; avoiding a serious threat to health or safety
• Law enforcement: to identify or find a suspect, fugitive, or missing person; to report a crime at the facility
• Judicial and administrative proceedings: responding to a court or administrative order, such as a subpoena
• Workers’ compensation and other government requests: workers’ compensation claims or hearings; health oversight agencies for activities authorized by law; special government functions (military, national security)
• Disaster relief: sharing your location and general condition for the purpose of notifying your family or friends and agencies chartered by law to assist in emergency situations
• Comply with the law: to the Department of Health and Human Services to see if we are complying with the federal privacy law
• Research: preparing for a research study; analyzing records as part of a project approved by an Institutional Review Board (IRB) and are low risk to your privacy; studies involving only decedents’ information
• Incidental to a permitted use or disclosure: calling your name in a waiting area for an appointment and others may hear your name called. We make reasonable efforts to limit these incidental uses or disclosures.
• To a funeral director, coroner, or medical examiner as needed to do their jobs
• To organizations that handle organ, tissue, or eye donations and transplantations as needed to do their jobs

We also participate in various health information exchanges, or HIEs, for the sharing of your information electronically for your care and other purposes allowed by the HIPAA Rules or required by law. Other participants of a HIE are also required to protect your information. You have the right to opt-out of your information being accessible in a HIE for all non-required by law purposes by contacting the Privacy Officer as described in this Notice. 

In the following cases, we may use or share your information unless you object or if you specifically give us permission. If you are not able to give us your permission, for example if you are unconscious, we may share your information if we believe it is in your best interest.

• With your family, friends, or others involved in your care or payment for your care. For example, we may provide an update to your family on your status when you are recovering from surgery. 
• For a facility directory and chaplaincy services. 

In the following situations, we will only use or share your health information if you give us written permission. You can take back this permission at any time (except to the extent that we have relied on it) by contacting the Privacy Officer.

• for marketing purposes (as defined by the HIPAA Rules).
• for the sale of your information or for payments from third parties.
• certain sharing of psychotherapy notes.
• any other reasons not described in this Notice.

Our use and disclosure of certain sensitive information may also be further restricted by other federal or state laws. This includes information related to alcohol and substance abuse, genetics, mental health, and HIV/AIDS.

Your Rights

When it comes to your health information, you have certain rights. You may:

• Access, inspect, and copy information that we use to make decisions about your care. You have the right to inspect and obtain a paper or electronic copy. If you request a copy of the information, we may charge you a reasonable fee. We will provide a copy or a summary within 30 days (or sooner in accordance with state law) and let you know about any delay.
• Request confidential communications. You can ask us to communicate with you in a certain way. We will say “yes” to all reasonable requests. 
• Request a restriction. You can ask us to limit what we use or share for treatment, payment, and healthcare operations. We are not required to agree to your request and we may say “no”. When you pay for services out-of-pocket, in full, and ask us not to share the information with your insurance plan, we will say “yes” unless a law requires us to disclose that information.
• Request an amendment. You can ask us to amend (make changes) to your health information if it is inaccurate or incomplete. We may say “no” to your request, but we will tell you why in writing within 60 days. 
• Get a list of who we have shared your information with. You can ask for a list (accounting) of the times we shared your information and why up to the six years prior to your request. Not all disclosures (sharing) will be included in this list, such as those made for treatment, payment, or health care operations. We will provide one accounting free of charge, but may charge a reasonable, cost-based fee if you ask for another one within 12 months. 
• Get a copy of this Notice. You can ask us to give you a copy (paper or electronic) of this Notice at any time or view a copy on our website.
• Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. In some circumstances, a minor child may be able to make decisions or exercise their rights themselves.
• File a complaint. You can file a complaint if you feel your rights have been violated. You can contact the Privacy Officer or the U. S. Department of Health and Human Services Office for Civil Rights. You will not be penalized, discriminated against, retaliated against, or intimidated for filing a complaint.

Our Responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We will notify you if a breach occurs that may have compromised the privacy or security of your identifiable health information.
• We must follow the practices described in this Notice and provide you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind. 
• We reserve the right to change the terms of this Notice and the changes will apply to all information we have about you. 

Questions or Complaints

If you have a question or wish to exercise your rights described in this Notice, please contact the UAB St. Vincent’s Privacy Officer at 1130 22nd Street South, Suite 1000, Birmingham, AL 35205, by phone at 866-742-4922, or by email at uabmedicinecompliance@uabmc.edu.  Most requests to exercise your rights must be made in writing. To file a complaint with the Office for Civil Rights, write to 200 Independence Avenue, S.W., Washington, D.C. 20201, call 877-696-6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints/.

This Notice is effective as of 11/1/2024.