Notice of Privacy Practices

Effective February 16, 2026

This notice explains how your health information may be used, disclosed, your rights with respect to your health information, how you can access it, and how you can file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information. You have a right to a copy of this notice (in paper or electronic form) and to discuss it with the Privacy team at [email protected], or call 1.833.793.0588 if you have any questions. Please read it carefully.

How We Typically Use and Share Your Health Information

We understand your health information is personal and you may be concerned with how that information may be used. We are allowed to use or share your health information in the following ways:

To Treat You: For example, we may provide your health information to a specialist as part of a referral or notify your provider primarily responsible for your care that you have had an emergency department visit or hospital admission, discharge, or transfer.

We participate in Health Information Exchange (HIE) networks. These networks provide a way to securely and electronically share health information with other health care providers participating in the network to avoid duplicate testing, reduce medication errors, improve diagnostics and ultimately provide safer and better care. If you do not wish for your information to be included, please contact your care site and ask for the medical records department.

To Bill for Services: Such as sending billing information to your health insurance plan or the person who holds your insurance policy.

To Support our Healthcare Operations: For example, activities to improve your care, staff training, communicating with business associates assisting with business and administrative functions.

Artificial Intelligence (AI): Your healthcare provider might use AI to assist with treatment (including making diagnoses), payment, and healthcare operations. They can do this as long as it’s within their license, certification, or authorization, and as long as it is not prohibited by federal or state law.

Other Ways We May Use and Share Your Health Information

We are allowed, and sometimes required, to share your health information in other ways for purposes including:

Public health purposes
Coroners, medical examiners, and funeral directors
Organ, eye, or tissue donation
Research studies
Judicial and administrative orders
Health oversight audits or inspections
Workers’ compensation purposes
Serious and imminent threat to a person or the public
Abuse, neglect, certain injuries, or domestic violence reporting
Law enforcement, in certain circumstances (e.g., crime on premises)
Essential government functions (e.g., national security and intelligence, health and safety of inmates)

Your Choices

For certain health information, you can tell us your choices about what we share.

Facility Patient Directory: We keep a list of admitted patients to assist family and other visitors. Unless you tell us otherwise, we may list your name, your location in the facility, your general condition, and your religious affiliation. If you list a religious affiliation, that may be shared with clergy. If you don’t want to be listed in the directory, please tell the registration staff.

Family, Friends, and Others Helping with Your Care: Unless you tell us not to, we may share your health information with a friend or family member who is involved in your care.

Fundraising Activities: We may use limited information about you to reach out for fundraising purposes and share it with our fundraising foundation. If you are contacted for fundraising and do not wish to be, please notify us according to the instructions contained in the fundraising materials you may receive.

Substance Use Disorder Treatment (SUD) Program: Records regarding treatment received from a SUD program, as defined by 42 CFR Part 2, have additional protections and require your written consent for most disclosures, including for treatment, payment, and healthcare operations. These records should not be re-disclosed by the person or entity we share it with without them obtaining your separate written consent. We will not release your SUD records in response to a civil, criminal, administrative, or legislative proceeding without your consent, unless a limited exception applies (e.g., medical emergency, court order, crime on premises, abuse or neglect).

Special Circumstances: Most uses and disclosures of your health information related to psychotherapy notes, for marketing purposes, or constituting a sale of your health information require your authorization. In any other situation not covered by this notice, we will ask for your written authorization before using or disclosing your health information. You can later revoke your authorization, unless we have already acted on it, by notifying us in writing.

Your Individual Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get a Copy of Your Medical Record: You can ask to see, or get a copy of, your paper or electronic medical record that is used to make decisions about your care. You have the ability to access your medical information through CommonSpirit’s patient portal free of charge. We may charge a reasonable, cost-based fee for copies of the medical record.

Ask Us to Correct Your Medical Record: You can ask us to correct (amend) your record if you believe it is wrong or if important information is missing by submitting a request in writing along with your reason for requesting. We may deny your request if the information was not created by us; if it is not part of the medical information we maintained; if it is not part of the information you have the right to access; or if we determine the record is accurate. If your request is denied, you can submit a written statement of disagreement.

Obtain a Log of Certain Disclosures: You can request a log of instances where we have shared your health information, other than for treatment, payment, or healthcare operations or where you authorized us to share. You can request this log for the six years prior to the request. The log will include the date shared, name of the entity to which the information was shared (not specific individual names), and a brief description of the purpose. The first request within a 12-month period is free.

Confidential Communications: You can ask that your health information be communicated to you in a confidential manner. For example, a specific phone number, address, or in a specific way. We will attempt to honor all reasonable requests.

Ask Us to Limit What We Use or Share: You can ask us to limit how we use or share your health information for treatment, payment, and healthcare operations. We will consider your written request and inform you of our decision in writing, but are not required to agree to it, except for certain requests to not share with your health insurance plan when you pay out-of-pocket in full.

Concerns and Complaints: If you are concerned your privacy rights may have been violated, you may contact our Privacy team at [email protected], or call 1.833.793.0588. You may also send a written complaint to the U.S. Department of Health and Human Services, Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1.877.696.6775, or visiting hhs.gov/hipaa. We will not retaliate against you for filing a complaint.

Changes to the Terms of this Notice

We may update this notice. These changes will apply to all information we have about you, past and future. If we make changes, the new notice will be available on our website, in our facilities, and made available to you each time you register.

Joint Notice

CommonSpirit Health providers are part of an Organized Health Care Arrangement (OHCA), a collaboration between multiple healthcare providers who share health information and coordinate care to improve patient outcomes. This arrangement allows health information to be shared among CommonSpirit Health OHCA participants for treatment, payment and joint healthcare operations. A list of OHCA members is available at commonspirit.org.

Our Commitment to You

We understand your health information is personal. We are required by law to maintain the privacy and security of your health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We will follow the privacy practices described in this notice and make a copy available to you. Additionally, you may view or print a copy of this notice from our website, commonspirit.org.

Additional Notice of Privacy Practices for Substance Use Disorder Programs

Applies only to substance use disorder programs as defined by 42 CFR Part 2

There are additional confidentiality protections that apply only to records created or maintained by our Substance Use Disorder (SUD) Programs, as defined by 42 CFR Part 2. These protections apply in addition to HIPAA and supplement our Notice of Privacy Practices. When the two laws conflict, the stricter rule applies.

Your Choices

For SUD treatment information, you can tell us your choices about what we share.

Consent: We cannot reveal that you are receiving SUD treatment, have a substance use disorder, or were ever a patient of our SUD program unless you sign a written consent, or a limited exception applies. You may sign a single written consent for all future uses and disclosures. You can later revoke your consent, unless we have already acted on it, by notifying us in writing.

Any disclosure of your SUD treatment information will include the following statement:

“This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure unless permitted by 42 CFR Part 2.”

Other Parties: Other parties receiving your SUD treatment information from us generally may not redisclose it. However, if you provide them a written consent, or it’s permitted by HIPAA and Part 2, your information may be redisclosed.

Legal Proceedings: Your SUD treatment information will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you without your written consent or a court order. If we receive a court order, your SUD treatment information will not be disclosed without you being notified or having an opportunity to be heard. Court orders concerning your SUD treatment information must be accompanied by a subpoena.

Other Ways We May Use and Share Your SUD Treatment Information

We are allowed to share your SUD treatment information without your written consent in other ways for purposes including:

Medical emergencies
Scientific research, audits, or program evaluation
Court order
Crimes on program premises or against program personnel
Child abuse or neglect reporting
To a Qualified Service Organization (QSO) providing services under contract (e.g., billing, lab services)

Your Individual Rights

When it comes to your SUD treatment information, you have certain rights in addition to HIPAA. This section explains your rights.

Obtain a Log of Intermediary Disclosures: You can request a log of disclosures by an intermediary for the past three years by submitting a written request directly to the intermediary.