Privacy

Notice of Privacy Practice

Effective Date: April 2003; Revised: September 24, 2013; September 4, 2025; August 5, 2016; January 2, 2017; August 10, 2017; August 10, 2024; February 6, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice explains how we fulfill our commitment to respect the privacy and confidentiality of your Protected Health Information. This Notice explains how we may use and share your Protected Health Information, as well as the legal obligations we have regarding your Protected Health Information and about your rights under federal and state laws. The Notice applies to all records held by St. Mary’s Healthcare System for Children entities listed on this Notice, regardless of whether the record is written, computerized or in any other form. We are required by law to make sure the information that identifies you is kept private and make this Notice available to you. In this Notice, the term “Protected Health Information” refers to individually identifiable information about you, which may include:

  • Information about your health (such as medication conditions and test results you may have)
  • Information about healthcare services you have received or may receive in the future (such as operation)
  • Information about your healthcare benefits under an insurance plan (such as whether a prescription is covered
  • Geographical information (such as where you live or work)
  • Demographic information (such as your race, gender, ethnicity, or marital status
  • Unique numbers that may identify you (such as social security number, phone number, or driver’s license number)

Other types of information that may identify who you are

Generally, when this noticed uses the words, “you” or “your,” it is referring to the patient, employee, or beneficiary (covered under St. Mary’s Healthcare System’s benefits plans) which is the subject of patient information. However, when this Notice discusses rights regarding patient information, including rights to access or authorize the disclosure of patient information, “you” and ‘your” may refer to a minor-patient’s parent(s), legal guardian or other personal representative, or, as applicable, an adult patient’s personal representative.

If you have any questions about this notice or would like further information, please contact Christine Hutton, Privacy Officer, at (718) 281-8587.

OVERVIEW

 The following is a summary of the key provisions in our Notice. This summary is not a complete list of how we use and disclose your Protected Health Information. If you have any questions about any of the information contained in this summary, please read this full Notice of Privacy Practices or contact St. Mary’s Privacy Officer for more information.

St. Mary’s Healthcare System for Children may use and disclose your protected health information without your consent to:

  • Provide you with medical treatment and other services
  • Carry out certain operations necessary to the operation of our programs, such as quality improvement studies, medical education, and verifying qualifications of doctors
  • Coordinate your care, which may include such things as giving your appointment reminders with affiliated healthcare providers
  • Talk to family or friends involved in your care, unless otherwise indicated by you
  • Ensure that we follow the rules of regulatory agencies regarding the quality of care that we provide
  • Comply with all legal requirements, subpoenas and court orders
  • Engage in certain preapproved research activities
  • Request payments from you, your insurance company, or some other third-party payer
  • May include information in our hospital directory, such as name and room number, for the benefit of visitors or members of the clergy
  • Contact you for fundraising activities unless otherwise indicated by you
  • Meet special situations as described in this Notice, such as public health and safety

YOU HAVE THE RIGHT TO

  • See and obtain a copy of your medical record in the format of your choosing, with certain restrictions
  • Ask us to amend the protected health information we have about you if you feel the information we have is wrong or incomplete
  • Ask us to restrict or limit the protected health information we use and share about you
  • Ask us to communicate with you about medical matters in a certain way or at a specific location
  • Obtain a list of individuals or entities that have received your protected health information from St. Mary’s, subject to limited permitted by law
  • Be notified if your protected health information is improperly disclosed or accessed
  • Obtain a paper copy of this Notice
  • Submit a complaint (No one will retaliate or take action against you for filing a complaint)

How we may use and share your protected health information with others:

St. Mary’s staff and other health care professionals in the St. Mary’s Healthcare System may use your health information or share it with others for the purposes of your treatment or care, obtaining payment for treatment or care, and conducting St. Mary’s normal business operations.  Your health information may also be shared with affiliated health care facilities and providers so that they may jointly perform certain payment activities and business operations along with St. Mary’s.  Below are further examples of how your information may be used with your consent.

Treatment: We may share your health information with health care providers at St. Mary’s who are involved in taking care of you, and they may in turn use that information to diagnose or treat you.  A health care provider at St. Mary’s may share your health information with another health care provider inside St. Mary’s, or at another health care facility, to determine how to diagnose or treat you.  A health care provider may also share your health information with another health care provider to whom you have been referred to for further health care.

Payment: We may use your health information or share it with others so that we obtain payment for your health care services.  For example, we may share information about you with your health insurance company in order to obtain reimbursement for treatment or care we have provided to you.  In some cases, we may share information about you with your health insurance company to determine whether it will cover your future treatment or care.

Business Operations: We may use your health information or share it with others in order to conduct our normal business operations.  For example, we may use your health information to evaluate the performance of our staff in caring for you, or to educate our staff on how to improve the care they provide for you.  We may also share your health information with another company that provides business services for us, such as a billing company.  If so, we will have a written contract to ensure that this company also protects the privacy of your health information.

Appointment Reminders: We may use and share your protected health information to remind you of your appointment for treatment or medical care with affiliated healthcare provider(s).

Hospital Directory: If you are admitted to St. Mary’s Hospital, your name and room location may be listed in the hospital’s patient directory. This is so your family, friends, and outside clergy can visit you in the hospital and generally know how you are doing. Unless you object to being included in the hospital directory, we will not disclose your information to anyone who asks for you unless required by law. If you do not want your information listed in the hospital directory, you must notify personnel during admissions.

Business Associates: We may share your protected health information with a business associate that we engage with to help us, such as a billing or computer company. Business associates will have assured us in writing they will safeguard your protected health information as required by law.

Treatment Alternatives, Benefits and Services: We may use your health information when we contact you in order to recommend possible treatment alternatives or health-related benefits and services that may be of interest to you.

Fundraising: We may use your information when deciding whether to contact you or your personal representative to raise money to help us operate.  We may also share this information with a charitable foundation that will contact you or your personal representative to raise money on our behalf.  If you do not want to be contacted about these fundraising efforts, please contact Christine Hutton, Privacy Officer, at (718) 281-8587 and we will no longer reach out to you. Please give your name and address so that we may suppress your name from all future fundraising.

Friends and Family: Unless you decline, we may release protected health information to people such as family members, relatives, or close personal friends who are helping to care for you or payment for that care. Additionally, we may disclose information to a patient representative. If a person has the authority under the law to make health care decisions for you, we will treat that patient representative the same way we would treat you with respect to your protected health information. Parents and legal guardians are generally patient representatives for minors unless the minors are permitted by law to act on their own behalf and make their own medical decisions in certain circumstances. If you do not want protected health information about you released to those involved in your care, please notify us.

Disaster Relief Efforts: We may disclose your protected health information to an organization such as American Red Cross so that your family can be notified about your condition, status and location in the event of a disaster. If we can reasonably do so while trying to respond to the emergency, we will try to obtain your permission to share this information first.

Research: All research projects conducted by St. Mary must be approved through a special review process to protect patient safety, welfare and confidentiality. Your protected health information may be important to research efforts and may be used for research purposes in accordance with state and federal law.

Researchers may contact you regarding your interest in participating in certain research studies after receiving your authorization or approval from a special review board called an Institutional Review Board (IRB). An IRB is a special committee that protects the rights and welfare of people who participate in research studies. These studies will not affect your treatment or welfare, and your private health information will continue to be protected. Federal law also allows researchers to look at your protected health information when preparing future research studies, so long as any information identifying you does not leave St. Mary’s. If you have any questions about how your medical record information could be used in a research protocol, please call the Chief Medical Officer at (718) 281-8863.

As required by law: We will share your protected health information when federal, state or local law requires us to do so. This includes to the Secretary of the U.S. Department of Health and Human Services for HIPAA rules compliance and enforcement purposes.

SPECIAL SITUATIONS

Legal proceedings, lawsuits and other legal actions: We may share your protected health information with courts, attorneys and court employees when we get a court order, subpoena, discovery request, warrant, summons, or other lawful instructions from those courts or public bodies, and in the course of certain other lawful, judicial or administrative proceedings, or to defend ourselves against a lawsuit brought against us.

Law enforcement: If asked to do so by law enforcement, and as authorized or required by law, we may release protected health information:

  • To identify or locate a suspect, fugitive, material witness or missing person
  • About a suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement
  • About a death suspected to be result of a criminal conduct
  • About criminal conduct at St. Mary’s Healthcare System for Children, Inc.

To avert a serious threat to health and safety: We may use and disclose your protected health information when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would be to help stop or reduce the threat. We may also disclose your  health information to law enforcement officers if you  tell us that you participated in a violent crime that may have caused serious physical harm to another person (unless you admitted that fact while in counseling), or if we determine that you escaped from lawful custody (such as a prison or mental health institution).

Public health risks: As required by law, we may disclose your protected health information to public health authorities for purposes related to: preventing or controlling disease, injuries or disability; reporting vital events, such as deaths; reporting child abuse or neglect; reporting domestic violence; reporting reactions to medications or problems with products; notifying people of recalls; repairs or replacements of products they may be using; notifying a person who many have been exposed to a disease or may be at risk for contracting or spreading a disease and reporting to your employer findings concerning work-related illness or injury so that your workplace may be monitored for safety.

Workers’ compensation: We may share your protected health information for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

Specialized government functions: If you are a member of the armed forces (of either the United States or of a foreign government), we may share your protected health information with military authorities so they may carry out their duties under the law. We may also disclose your protected health information if it relates to national security and intelligence activities, or to providing protective services for the President or for other important officials, such as foreign heads of state.

Health oversight activities: We may disclose your protected health information to local, state or federal governmental authorities responsible for the oversight of medical matters as authorized by law. This includes licensing, auditing and accrediting agencies and agencies that administer public health programs such as Medicare and Medicaid.

Coroners, medical examiners and funeral directors: We may release your protected health information to a coroner or medical examiner as necessary to identify a deceased person or to determine the cause of death. We also may release protected health information to funeral directors so they can carry out their duties.

Organ, eye and tissue donation: If you are an organ donor, we may release your protected health information to organizations that obtain organs or handle organ, eye or tissue transplantation. We also may release your information to an organ donation bank as necessary to facilitate organ, eye or tissue donation and transplantation.

Inmates: If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your protected health information to the correctional institution or law officer as authorized or required by law. This includes sharing information that is necessary to protect the health and safety of other inmates or people involved in supervising or transporting inmates.

Incidental disclosures: While we will take reasonable steps to safeguard the privacy of your protected health information, certain disclosures of your information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your information. For example, during the course of a treatment session, other patients in the treatment area may see or overhear discussion of your information. These “incidental disclosures” are permissible.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

Uses and disclosures not covered in this Notice: Other uses and disclosures of your protected health information not described above in this Notice or permitted by law will be made only with your written authorization. In addition, we will obtain your authorization for most uses and disclosures of psychotherapy notes. When consent for disclosure is required by law, your consent will be obtained prior to the disclosure. If you give us authorization to use or share protected health information about you, you may revoke the authorization in writing at any time. Please understand that we are unable to retract any disclosures already made with your authorization.

Under the regulations known as Part 2, certain substance use disorder patient records have greater privacy protections. If we have any of these patient records, we cannot use them to investigate or prosecute a patient without your written or pursuant to a court order after you are presented with notice and an opportunity to be heard. You can provide a single consent for all future uses and disclosures of such records for purposes of treatment, payment and health care operations that does not permit use for civil, criminal, administrative or legislative proceedings.

Special privacy protections apply to HIV-related information, alcohol and substance abuse information, mental health information, and genetic information.  Some parts of this general Notice of Privacy Practices may not apply to these types of information.  If your treatment involves this information, you will be provided with separate notices explaining how the information will be protected.

YOUR RIGHTS CONCERNING YOUR PROTECTED HEALTH INFORMATION

Right to ask to see and obtain a copy: You have the right to inspect and obtain a copy of any of your health information that may be used to make decisions about your treatment for as long as we maintain this information in our records.  This includes medical and billing records.  To inspect or obtain a copy of your health information, please submit your request to Christine Hutton, Privacy Officer (718) 281-8587. Upon your request, we will provide you with a copy of your record in the format you request, if it is available. This includes a paper copy or electronic copy of your record, if it is available.  If you request a copy of your record, we may charge a fee for the cost of copying, mailing or other supplies we use to fulfill your request.  The standard fee is $0.75 per page for paper and $10.00 for an electronic copy.  The fee must generally be paid before or at the time we give the copies to you.  For St. Mary’s Hospital for Children residents, we will respond to your request for inspection of records within twenty-four hours and we ordinarily will respond to requests for copies within two working days.  For patients and clients of all other St. Mary’s programs, access to your records will be made within ten days of your request.

Under certain very limited circumstances, we may deny your request to inspect or obtain a copy of your information.  If we do, we will provide you with a summary of the information instead.  We will also provide a written notice that explains our reasons for providing only a summary, and a complete description of your rights to have that decision reviewed and how you can exercise those rights.  The notice will also include information on how to file a complaint about these issues with us or with the Secretary of the Department of Health and Human Services.  If we have reason to deny only part of your request, we will provide complete access to the remaining parts after excluding the information we cannot let you inspect or copy. You may be charged a fee for the cost of preparing the summary of your record.

Right to ask for an accounting of disclosures: You have the right to ask us for a listing of those individuals or entities who have received your protected health information from St. Mary’s in the six years prior to your request. This list will not cover disclosures made:

  • To you or your personal representative
  • To provide or arrange for your care
  • To carry out treatment, payment or healthcare operations
  • Incident to a permitted use or disclosure
  • To parties you authorize to receive your protected health information
  • To those who request your information through the hospital directory
  • To your family member, relatives, or friends who are involved in your care
  • For national security or intelligence services
  • To correctional institutions or law enforcement officials
  • As part of a limited data set for research purposes

To request this list, please contact Christine Hutton, Privacy Officer at (718) 281-8587.  Your request must state a period for the disclosures you want us to include.  For example, you may request a list of the disclosures that we made between January 1, 2004, and January 1, 2005.  You have the right to one list within every twelve-month period for free.  However, we may charge you for the cost of providing any additional lists in that same twelve-month period.  We will always notify you of any cost involved so that you may choose to withdraw or modify your request before any costs are incurred.

Ordinarily we will respond to your request for an accounting list within 60 days.  If we need additional time to prepare the accounting list you have requested, we will notify you in writing about the reason for the delay and the date when you can expect to receive the accounting list.  In rare cases, we may have to delay providing you with the accounting list without notifying you because a law enforcement official or government agency has asked us to do so.

Right to request restrictions: You have the right to ask us to restrict or limit the protected health information we use or disclose about you for treatment, payment or healthcare operations. In most cases, we must consider your request, but we are not required to agree to it. However, we must agree to limit disclosures made to your health insurer or other third-party payer about services we provided to you if, prior to receiving the medical services, you pay for the services in full, unless the disclosure of that information is required by law.

To request restrictions, please contact Christine Hutton, Privacy Officer at (718) 281-8587.  Your request should include (1) what information you want to limit; (2) whether you want to limit how we use the information, how we share it with others, or both; and (3) to whom you want the limits to apply. 

We are not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law.  However, if we do agree, we will be bound by our agreement unless the information is needed to provide you with emergency treatment or comply with the law.  Once we have agreed to a restriction, you have the right to revoke the restriction at any time.  Under some circumstances, we will also have the right to revoke the restriction as long as we notify you before doing so; in other cases, we will need your permission before we can revoke the restriction.

Right to request confidential communication: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask when we contact you only at home, only by mail/email or by text. If you want us to communicate with you in a special way, you will need to give us details about how to contact you, including a valid alternate address. You will also need to give us information about where your bills may be sent. However, if we are unable to contact you using the requested means or location, we may contact you using whatever information we have

You have the right to request that we communicate with you or your personal representative about your medical matters in a more confidential way.  To request more confidential communications, we will not ask you the reason for your request, and we will try to accommodate all reasonable requests.  Please specify in your request how you or your personal representative wishes to be contacted, and how payment for your health care will be handled if we communicate with your personal representative through this alternative method or location. As indicated in this Notice, this request must be sent to Christine Hutton, Privacy Officer at St. Mary’s Healthcare System for Children, Inc 333 Earle Ovington Blvd, Suite 600, Uniondale, NY 11552.

Right to receive notice of a breach: You have the right to be notified in the event of a breach of a privacy of your unsecured protected health information by St. Mary’s or its business associates. The notice will provide you with the date we discovered the breach, a brief description of the type of information that was involved and the steps we are taking to investigate and mitigate the situation, as well as contact information for you to ask questions and obtain additional information.

Right to a paper copy of this Notice: Upon request, you may at any time obtain a paper copy of this Notice, even if you previously agreed to receive this Notice electronically. To request a copy, please contact Christine Hutton, Privacy Officer, at (718) 281-8587 or ask admissions for one at the time of your next visit.

How to file a privacy complaint: If you believe that your privacy rights have not been followed as directed by federal regulations and state law or as explained in this Notice, you may contact us by telephone, submit a written complaint through our web-based reporting, or file a written complaint with us at: Christine Hutton, Privacy Officer at St. Mary’s Healthcare System for Children, Inc 333 Earle Ovington Blvd, Suite 600, Uniondale, NY 11552.

Compliance Hotline: (888) 343-2581 or web-based reporting: https://www.integrity-helpline.com/stmaryskids.jsp

You will not be retaliated against or denied any health services if you file a complaint: If you are not satisfied with our response to your privacy complaint or wish to file a complaint, you may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. The complaint must be in writing; it must describe the subject matter of the complaint and the individuals or organization that you believe violated your privacy and it must be filed within 180 days of when you knew or should have known that the violation occurred. The complaint should then be sent to: Long Island Region Office at info.longisland@dhr.ny.gov or Telephone: (516) 539-6848 or U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Ave, S.W., Washington, D.C 20201, calling 1-877-696-6775 or visiting https://www.hhs.gov/ocr/complaints/index.html

Future changes to St. Mary’s Healthcare System for Children, Inc’s privacy practices and this Notice: We reserve the right to change this Notice and the privacy practices of the organizations covered by this Notice without first notifying you. We reserve the right to make the revised or changed Notice effective for protected health information we already have about you as well as any information we receive in the future. To request a copy of the most recent Notice, please contact Christine Hutton, Privacy Officer, at (718) 281-8587 or ask admissions for one at the time of your next visit.

The current Notice will also be posted to the St. Mary’s website, www.stmaryskids.org. At any time, you may request a copy of the Notice currently in effect.

For Further Information, Please Contact:

Christine Hutton, Audit & Compliance Manager
333 Earle Ovington Blvd. –  Suite 600 
Uniondale, NY 115533
(718) 281-8587