THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Erlanger Health Notice of Privacy Practices

Effective January 10, 2024

The practices described here apply to Erlanger Health, Inc. (Erlanger), other third party physician practices that provide care to you as an Erlanger patient, and the Federally Qualified Health Centers (FQHC) affiliated with Erlanger. Erlanger Health includes all departments and units of its hospitals, facilities, and medical practices. Erlanger Health is part of an Organized Health Care Arrangement (OHCA) that includes the practices of providers who perform services at Erlanger and will be putting information into your medical record. These include but may not be limited to University Surgical Associates; Anesthesiology Consultants Exchange; Tennessee Interventional and Imaging Associates; Pediatric Emergency Medicine Associates; LabCorp; Tennessee Oncology; Pathology Group; and Tennessee River Physicians. The FQHC is also part of the OHCA. Notice serves as a joint notice for all parties in the OHCA.

How to Ask a Question or Report a Complaint

If you have questions about this Notice or want to talk about a problem without filing a formal complaint, please contact the Office of Compliance and Privacy Services using the contact information listed below. If you believe your privacy rights have been violated, you may file a formal complaint with us in writing by sending it to the Erlanger Office of Compliance and Privacy Services at the address listed below or by filing a complaint with the Erlanger Integrity Line at the number listed below. You may also file a complaint with the United States Department of Health and Human Services Office for Civil Rights.

You will not be treated differently for filing a complaint.

How to Contact Us

Office of Compliance and Privacy Services
Erlanger Health, Inc.
975 E. 3rd Street
Chattanooga, TN 37403

423-778-7703
privacy@erlanger.org

Erlanger Integrity Line: 877-849-8338

Health Information Management Office
Erlanger Health, Inc.
975 E. 3rd Street
Chattanooga, TN 37403

423-778-7267

THIS NOTICE CONTAINS DETAILED INFORMATION ABOUT:

Your Rights

You have the right to:

• Review and/or get a copy of your paper or electronic medical record
• Ask for an amendment of your paper or electronic medical record
• Request a list of some of the parties with whom we’ve shared your medical information
• Receive notification in case of a breach of your information
• Request limits on who we share information with for certain purposes
• Request confidential communication
• Get a copy of this Notice

Our Uses and Disclosures

We may use and share your information as we:

• Treat you
• Request confidential communication
• Run our organization
• Request confidential communication
• Bill for services provided to you
• Request confidential communication
• Help with public health and safety issues
• Request confidential communication
• Do research
• Request confidential communication
• Comply with the law
• Request confidential communication
• Respond to organ and tissue donation requests
• Request confidential communication
• Work with a medical examiner or funeral director
• Request confidential communication
• Address law enforcement and other government requests
• Respond to lawsuits and legal actions

Why We Keep Information about You

We keep medical information about you to help care for you and because the law requires us to. The law also says we must:

• Protect your medical information;
• Provide this Notice and describe our practices; and
• Follow what this Notice says.

What the Words We Use Mean

• “Notice” means this Notice of Privacy Practices.
• “Erlanger” means Erlanger Health, its staff, and any affiliated organizations covered by the Notice.
• “We,” “our,” or “us” means one or more Erlanger organizations, providers, or staff and the other parties under the OHCA.
• “You” means the patient whose medical information this concerns.
• “Medical information” means all of the paper and electronic records related to a patient’s physical and mental health care – past, present, or future. These records tell who the patient is and include information about billing and payment (also known as “Protected Health Information” or “PHI”).
• “Use” means sharing or using medical information within Erlanger.
• “Share” and/or “disclose” means giving medical information or access to information to someone outside Erlanger Health, including other members of the OHCA.
• “OHCA” means Organized Health Care Arrangement. The members of such an arrangement are healthcare providers that are operationally or clinically integrated with Erlanger and may participate jointly with Erlanger in utilization review, quality assessment and improvement, or payment activities.

Your Rights Regarding Your Medical Information

The records we create and maintain using your medical information belong to Erlanger, but you have certain rights and responsibilities related to that information.

Right to Review and Get a Copy of Your Medical Information: You have the right to look at and get an electronic or paper copy of your medical information, including billing records, as long as the information is kept by or for Erlanger. You must make a written or electronic request to the Erlanger Health Information Management Department. A reasonable, cost-based fee may be charged for a copy or for a summary of your record, if one is requested. In rare cases, we may deny your request for certain information. If we deny your request, we will give you the reason why in writing.

Right to Ask for an Amendment to Your Medical Information: If you think our information about you is not correct or complete, you may ask us to correct your record by writing to the Erlanger Health Information Management Department at the address listed on the front of this brochure. You have the right to request an amendment for as long as the information is kept by Erlanger. If we agree, we will notify you and correct your record. If we deny your request, we will tell you why in writing and will include instructions as to how you can appeal the denial or file a complaint.

Right to Request a List of Some of the Parties With Whom Erlanger Has Shared Your Medical Information: You have the right to ask for a list of the times when we’ve shared your health information in the prior six years, who we’ve shared it with, and why. This is called an accounting of disclosures. This list will NOT include instances in which we used or shared your information:

• For treatment, payment, or business operations;
• With you or your legal representative;
• With anyone who has asked for your information as listed in a facility directory;
• With family members or friends involved in your care or payment for your care;
• As part of a limited data set with direct identifiers removed; and/or
• If we had your permission to share the information.

You must request this list in writing from the Health Information Management Department. Your request must specify the time period for which you want the list, which may not be longer than six (6) years prior to the date of your request. The first list you ask for within a 12-month period will be free. You may be charged a fee if you ask for another list in that same 12-month period.

Right to Notice in Case of a Breach: You have the right to know if your protected health information has been breached. We will follow what federal and state laws require, including notifying you in writing of any impact that breach may have had on you and/or your family member(s) and actions we have taken in response.

Right to Request Limits on the Use and Sharing of Your Medical Information: You have the right to ask us to limit or refrain from using or sharing information about you for treatment, payment, or business operation reasons. You also have the right to ask us to limit the medical information we share about you with someone involved in your care or paying for your care, such as a family member or friend. We are not required to agree to your request and generally we will not grant requests related to limits for treatment, payment, or business reasons. If you pay for a service in full at the time it is received, you can ask us not to share it with your health insurer, and we will grant that request unless we are legally required to share it.

Right to Ask for Confidential Communications: You have the right to ask us to communicate with you in a certain way or at a certain place. For example, you can ask that we contact you only at work or only using a post office box. You must make your request in writing to the Health Information Management Department. We will grant your request if it is reasonable to do so. However, if we are unable to contact you using the ways or locations you have requested, we may contact you using any information we have.

Right to Get a Paper Copy of this Notice: You have the right to get a paper copy of this Notice, even if you have agreed to receive it electronically. You may obtain a copy:

• at any of our facilities;
• by contacting the Erlanger Office of Compliance and Privacy Services at the number listed on the front of this brochure; and/or
• at https://www.erlanger.org/patient-and-family-resources/policies

Right to File a Complaint if You Feel Your Rights Are Violated: You have the right to file a formal complaint if you feel Erlanger has violated your rights by contacting us using the information on the front of this brochure. You can also file a complaint with the US Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Our Uses and Disclosures of Your Health Information

We use electronic record systems to manage your care. These systems have safeguards to protect the information in them. We also have policies and training that limit the use of information to those who need it to do their job. Doctors and other people who are not employed by Erlanger may share information they have about you with our employees in order to care for you. Hospitals, clinics, doctors, and other caregivers, programs, and services may also share medical information about you without requiring your permission. Here are some examples of how we may use and/or share information:

For Treatment: We may use and share medical information to treat you. For example, a doctor treating you for a broken leg will need to know if you have diabetes because diabetes can slow healing. The doctor may need to tell food services that you have diabetes so the right meals can be prepared for you.

For Billing and Payment: We may use and share your information so that we and any others who have provided services to you can bill and collect payment for these services. For example, we may share your medical information with your health plan:

• So your health plan will pay for care you received at Erlanger;
• To get approval before doing a procedure; and/or
• So your health plan can make sure they paid the right amount to Erlanger.

For Business Reasons (Operations): We may use and share information about you that is necessary to run our organization, including but not limited to:

• Training and educating our staff;
• Credentialing, licensure, certification, and accreditation;
• Improving our care and services;
• Budgeting and planning;
• Maintaining our compliance program;
• Maintaining computer systems;
• Evaluating our staff; and/or
• Finding out how satisfied our patients are.

To Contact You about Appointments, Insurance and Other Matters: We may contact you by mail, phone, text, or email for many reasons, including but not limited to:

• Reminding you about an appointment;
• Registering you for a procedure;
• Giving you test results;
• Asking about insurance, billing or payment;
• Following up on your care; and/or
• Asking you how well we cared for you.

To Inform Family Members and Friends Involved in Your Care: We may share information about you with family members and friends who are involved in your care or paying for your care. Whenever possible, we will allow you to tell us who you would like us to share information with. However, in emergencies or other situations, we will use our best judgment and share the information necessary to help us care for you. We may also share information about you with a public or private agency during a disaster so that the agency can help contact your family or friends to tell them where you are and how you are doing.

For the Hospital Facility Directory: If you are admitted to the hospital, your name, your location in the hospital, your general condition (such as “fair” or “stable”), and your religion is included in a patient directory. This helps family, friends, and clergy visit and/or contact you. Except for your religion, this information may be shared with visitors or callers who ask for you by name. Unless you tell us not to, your religion may be shared with a member of the clergy. If you ask us not to share your name and information from the directory we will not share your information even if you are asked for by name, nor will we confirm your presence at Erlanger.

To Tell You about Treatment Options or Health-Related Products and Services: We may use or share your information to let you know about treatment options or health-related products or services that may interest you.

For Worker’s Compensation: We may share medical information about you with those who need it in order to provide benefits for work-related injuries or illness, to the extent allowable by law.

For Health Oversight and Public Health Reporting: We may share information for audits, investigations, inspections, and licensing with agencies that oversee health organizations. We may also share your medical information in reports to public health agencies. Some reasons for this include:

• Preventing or controlling disease and injuries;
• Reporting certain kinds of events, such as births and deaths;
• Reporting adverse reactions to medicines;
• Notifying people about recalls of medical products they may be using

For Reporting Victims of Abuse, Neglect, or Domestic Violence: We may share information if there is a suspicion a patient has been the victim of abuse, neglect, or domestic violence.

For Organ, Eye, and Tissue Donation: We share medical information about organ, eye, and tissue donors and potential recipients with organ and tissue procurement organizations.

For Research: We may use and share medical information about you for the research we do to improve public health and develop new knowledge. We use and share your information for research only as allowed by federal and state rules. When required to by law, we will first explain to you how your information will be used and ask your permission before using and sharing your information for research.

For Fundraising: We rely on fundraising to support advances in patient care, research, and education and to provide relevant services and programs to our patients and the community. We may use limited information about you, such as your contact information and the general Erlanger departments where you have received services, to contact you to try to raise money for Erlanger. We may also share this information with our institutionally related foundation for the same purpose. You may ask us not to contact you about fundraising—contact the Office of Compliance and Privacy Services or email your request to foundation@erlanger.org.

For Lawsuits and Legal Actions: We will share your medical information as directed by a court order, subpoena, discovery request, warrant, summons, or other lawful instruction from a court or public body.

To Respond to Requests From Law Enforcement and Other Officials: We may share your information with a law enforcement or other public official as authorized or required by law, including:

• Identifying or finding a suspect, fugitive, material witness, or missing person;
• Reporting a death that may have been caused by a crime;
• In an emergency: reporting a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime;
• In order to prevent a serious and urgent threat to the health and safety of you or someone else; and/or
• If you are under the custody of the police or other law enforcement official.

To Comply with the Law: We will share information about you if state or federal laws require it, such as reporting certain types of injuries to the authorities. We will also share information with the Department of Health and Human Services, if requested, to evaluate how well we are complying with federal privacy law.

For Health Information Exchanges (HIEs): We will share your health information with the Health Information Exchanges (HIEs) in which Erlanger participates. You can view a list of these HIEs on our website at www.erlanger.org. Information about your past medical care and current medical conditions and medicines is available not only to us but also to non-Erlanger health care providers who participate in the HIE. You have the right to opt out of the HIE, but some of your health information may remain available to certain health care entities as permitted or required by law. If you have questions or would like to opt out of any of the HIEs, contact the Health Information Management department.

We May Also Share Your Medical Information with:

• Coroners, medical examiners, and funeral directors, so they can carry out their duties;
• Federal officials, for national security and intelligence activities;
• Federal officials who provide protective services for the President and others, such as foreign heads of state, or to conduct special investigations;
• Military authorities, if you are a member or a veteran of the armed forces, as authorized by law.
• A correctional institution, if you are an inmate;
• A school, to confirm that you have been immunized; and/or
• A business associate with whom Erlanger has contracted to perform an agreed-upon service.

Other Uses of Your Medical Information: We will not use or share your medical information for reasons other than those described in this Notice unless you agree to this in writing. Likewise, unless otherwise specifically authorized by you or required by law, we will not use your information for marketing; sell your information; or, for records in Tennessee, share information related to substance abuse treatment, HIV status, or psychotherapy notes.

Changes to this Notice

We have the right to change this Notice at any time. Any change could apply to medical information we already have about you, as well as information we receive in the future. A copy of the current Notice is posted throughout Erlanger and at https://www.erlanger.org/patient-and-family-resources/patient-tools/patients-rights. Each time you register at or are admitted to Erlanger for treatment or healthcare services, you may request a copy of the current Notice in effect.

Notice of Privacy Practices Past Version Effective Dates:

• 4/14/2003 - Version #1
• 6/25/2007 - Version #2
• 11/27/2007 - Version #3
• 3/18/2013 - Version #4
• 3/1/2018 - Version #5
• 1/10/24 - Version #6