NOTICE OF PRIVACY PRACTICES
YOUR PRIVACY IS OUR PRIORITY. THIS NOTICE DESCRIBES HOW MEDICAL
INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
THIS NOTICE ALSO DESCRIBES YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION AND HOW TO FILE A COMPLAINT
CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY.
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM)
AND TO DISCUSS IT WITH ONEIDA HEALTH’S PRIVACY OFFICER AT (315)-361-2117
OR Privacy@Oneidahealth.org
IF YOU HAVE ANY QUESTIONS.
Oneida Health-Hospital and its affiliated entities listed on Appendix A (collectively referred to herein as “Oneida Health”
or “OH”) take the privacy of your health information seriously. We are required by Federal and State law to maintain the privacy of your health information and to provide you with this Notice of Privacy Practices (“Notice”) outlining your rights
and our legal obligations regarding the use and disclosure of your health information.
Oneida Health’s Legal Obligations
OH is required by law to (1) maintain the privacy and security of your health information; (2) provide you with a copy of this Notice which describes our privacy practices and legal obligations regarding your health information; (3) abide by the terms and conditions of the Notice currently in effect; and (4) notify you of any breach of your unsecured protected health information.
Who This Notice Applies To
This Notice describes the privacy practices of Oneida Health. This Notice applies to the delivery of health care services at Oneida Health and all protected health information (PHI) and records that we generate. The entities covered by this Notice may share your health information with each other as necessary to carry out the treatment, payment, or health care operations purposes detailed in this Notice.
In addition to OH affiliated entities, the following personnel will follow the privacy practices described in this Notice:
➢ All medical staff providers and other health care professionals authorized to enter information into your medical record
maintained by OH;
➢ All OH employees, staff members, and other personnel in every department, unit, or facility with access to your health
information or involved in your care, including students and any volunteers we allow to help you while you receive
services from OH as a patient/resident; and
➢ OH contractors involved in your care.
Understanding Your Health Record and Information
Each time you visit Oneida Health, a record of your visit is made. Typically, this record contains your health information
and is stored in an electronic format. This is your legal medical record. This information, referred to as your health or
medical record, serves as a:
Page 1 of 8
• Basis for planning your care and treatment
• Means of communication among the many health professionals who contribute to your care
• Legal document describing the care you received
• Means by which you or a third-party payer may verify that services billed were actually provided
• Tool in educating health professionals and with which we can assess and continually work to improve the care we render
and the outcomes we achieve
• Source of data for medical research or for facility planning and marketing
• Source of information for public health officials charged with improving the health of the nation
Understanding what is in your medical record and how your health information is used helps you to ensure its accuracy;
better understand who, what, when, where, and why others may access your health information; and make informed
decisions when authorizing use and disclosure of your health information to others.
Your Health Information Rights
Although your medical record is the physical property of OH, the information belongs to you. Any requests concerning these rights may be submitted, in writing, to Oneida Health’s Health Information Management (HIM) Department, Oneida Health-Hospital, 7840 Oxbow Road, Canastota, NY 13032, except as may otherwise be indicated. With regard
to the health information we maintain about you, you have the right to:
• Request a Restriction on Certain Uses and Disclosures of Your Information. You have the right to request a restriction on certain uses and disclosures of your information. You have the right to request in writing a restriction or limitation on the medical information we use or disclose about you for treatment, payment, and health care operations. You also have the right to request in writing that we limit how we disclose medical information about you to family or friends involved in your care or the payment of your care. Generally, we are not required to agree to your request to restrict how we use and disclose your medical information. Except however, if you request we restrict the disclosure of
your health information to a health plan (your health insurer) related to services or items we provide to you and you pay us for such services or items out-of-pocket in full, we must agree to your request, unless we are required by law to
disclose the information (such as in an emergency treatment situation). Please note: This restriction will apply only when requested and services are paid in full. Future services without a restriction request and for which no out-of-pocket
payment is received will be billed per provider and health plan policy, which may include current provider notes that reference prior treatments or services previously restricted. If we do agree to a restriction, our agreement will be in
writing and we will follow your request unless the information is needed to provide you emergency treatment or we terminate the agreement. To request a restriction, you must make your request in writing.
• Obtain a Copy of the Notice of Privacy Practices Upon Request: You have the right to a paper or electronic copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this
Notice electronically, you are still entitled to a paper copy of this Notice. Copies of this Notice shall be available throughout OH, or you may obtain a copy from our website: https://www.oneidahealth.org/our-organization/corporate
compliance-privacy/patient-privacy/
• Inspect and Copy Records: With certain exceptions, you have the right to inspect and/or receive a copy of your health information maintained by OH. To inspect and/or receive a copy of your medical record, you must submit your request in writing to the address noted above, or via facsimile at 315-361-2227. There may be a fee associated with the production of copies per your request. If you are denied access to your health information, you may request an appeal
of such denial through the New York State Department of Health. Contact us to obtain a special Department of Health form to request such an appeal, or access the form here: https://www.health.ny.gov/forms/doh-1989.pdf. If your health
information is maintained in an electronic health record (EHR), you also have the right to request that an electronic copy of your record be sent to you or to another individual or entity. We may charge you a reasonable cost-based fee limited to the costs of labor and supplies associated with transmitting the electronic health record we strongly encourage the use of our available Patient Portals to access and inspect your electronic health record.
• Request an Amendment: If you believe that the health information OH has about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is
maintained by or for OH. To request an amendment, you must submit your request in writing. In addition, you must provide us with a reason that supports your request. We may deny your request to amend your information under certain
circumstances.
• Request an Accounting of Disclosures. You have the right to receive a list of the disclosures we have made of your health information unless the disclosure was for treatment, payment, health care operations, or if you authorized in writing
the disclosure of your health information. Certain other disclosures are not included in the list, including disclosures you authorized us to make; disclosures made to you, or to your family and friends involved in your care; disclosures made to federal officials for national security purposes; and disclosures made to correctional facilities or law enforcement officials. To request this accounting of disclosures, you must submit your request in writing. Your request must state a
time period that may not be longer than the six (6) years prior to the date of your request. OH will provide you with one accounting within any 12-month period at no cost, but may charge a reasonable, cost-based fee if you ask for another accounting within 12 months.
• Request Confidential Communications. You have the right to request that we communicate with you about your healthcare in a certain way or at a certain location. For example, you may ask that we contact you only at home or only
by mail. To request confidential communications, you must make your request in writing. We will accommodate all reasonable requests.
• Request Information Sharing through Application Programming Interfaces (“APIs”). You have the right to request or authorize that your electronic PHI in your legal medical record be transmitted to you or another person or organization through an API. APIs are computer coding mechanisms that permit two or more electronic computer applications or software programs to communicate with each other and share information. We are required by law to
comply with requests regarding API transmissions, subject to certain exceptions. You understand that PHI transmitted through an API at your request will no longer be under our protection and control; will no longer be subject to the
protections and rights outlined in this Notice; and may no longer be subject to the same laws, regulations, policies or procedures regarding its confidentiality, security, privacy, use, or disclosure. You understand and agree that you make
any request to us to transmit your PHI through an API at your own risk and you assume all liability for the consequences of such action taken by us at your direction. We caution you to confirm any confidentiality, security, or
privacy protections with respect to your transmitted PHI with the recipient of the PHI prior to submitting a request to us to transmit your PHI through an API.
• Receive a Notice of a Breach: OH is required to notify you by first class mail or by email (if you have indicated a preference to receive information by email), of any breaches of Unsecured Protected Health Information as soon as possible, but in any event, no later than 60 days following the discovery of the breach.
Examples of Disclosures for Treatment, Payment and Health Care Operations
We are permitted to use and disclose your health information for treatment, payment and healthcare operations purposes. The following is intended to provide examples of such uses and disclosures and is not meant to be a complete list, but the ways in which we use or disclose your health information will be under one of these purposes.
We will use your health information for treatment: We may use health information about you to provide you with medical treatment or services. We may disclose health information about you to nurses, physicians, or other providers and personnel involved in your care. For example, we may share health information about you with other OH personnel or non OH providers, agencies or facilities in order to provide or coordinate the different types of care you need, such as prescriptions and lab work. We also may disclose health information about you to people outside OH who may be involved in your continuing medical care, such as other health care providers, transport companies, community agencies, and family members.
We will use your health information for payment: We may use and disclose your health information so that the treatment and services you receive at OH may be billed and payment may be collected from you or an insurance company. For example, the information contained on the bill may include information that identifies you, as well as your diagnoses, procedures and supplies used. In addition, we may also tell your insurer about a treatment that you are going to undergo in order to obtain prior approval or to determine if your insurer will cover the treatment.
We will use your health information for health care operations: We may use your health information in our general business activities. For example, we may use and disclose information to physicians, nurses, and other personnel for performance improvement and educational purposes. This information will then be used in an effort to continually improve the quality and effectiveness of the healthcare and services we provide. We may also utilize health information to assist us in deciding which services to offer, which services to discontinue, or to determine the effectiveness of new treatments and services.
Other Permitted Uses and Disclosures
We may make the following uses and disclosures of your health information without your consent to the extent such uses and disclosures comply with federal and state law:
• Appointment Reminders/Sign In Sheets: We may contact you to remind you that you have an appointment at OH. However, you may request that we provide such reminders only in a certain way or only at a certain place. We will
make every effort to accommodate all reasonable requests. In addition, we may use sign-in sheets to enhance patient
flow processes.
• Treatment Alternatives/Health-Related Benefits and Services: We may contact you to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.
• Business Associate: Some of our services are provided through contracts with a vendor called a “business associate” that needs access to your medical information. We require all of our business associates to appropriately safeguard
your information with the same diligence that we would. For example, we may contract with a vendor to provide billing services that needs access to your medical information in order to bill your insurance company.
• Communication with Family, Friends, and Others Directly Involved in your care: Using their best judgment, health professionals may disclose your health information to a family member or friend, who is involved in your care or
payment related to your care. We may also use your health information for the purpose of notification or assisting in the notification of a family member, personal representative or another person responsible for your care. We may
disclose the health information of minor children to their parents or guardians unless such disclosure is otherwise
prohibited by law.
• Health Information Exchange (HIE); Data Exchange Technologies. OH may access, share, store and/or transmit your health information, including sensitive information related to HIV, sexually transmitted diseases, mental health,
drug and alcohol treatment, genetic testing, and reproductive health, electronically through the “SHIN-NY”, a statewide health information network, and with other health information exchanges (HIEs) for treatment, payment and health care operations purposes. OH also uses data exchange technologies (such as record locator services, direct messaging services, APIs and provider portals) with its EHR to exchange your health records for permitted purposes. HIEs and
data exchange technology providers function as our business associates, enabling the sharing of your health records for continuity of care and to improve the quality of health care services provided to you (i.e., avoiding unnecessary duplicate
testing). These entities must implement administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and security of your health information. Applicable law may provide
you with rights to restrict, opt-in, or opt-out of HIE(s). For more information please contact OH’s Privacy Officer using the contact information provided below.
• De-identified Data: We may use your PHI to create data that cannot be linked to you by removing certain elements from your PHI, such as your name, address, telephone number, and medical record number. We may use such de identified information for certain business purposes, or disclose your PHI to a business associate for the purpose of creating de-identified information. For example, we may use de-identified information to create statistical and/or benchmarking data to monitor trends in order to help us improve the quality of services we deliver.
• Facility Directory: Unless you object, we may use your name, location in the facility, your general condition and your religious affiliation for directory purposes. This information, except your religious affiliation, may be released to people who ask for you by name. Your religious affiliation may be given to members of the clergy even if they don’t ask for you by name.
• Communication with Family, Friends, and Others Directly Involved in your care: Unless you object, we may disclose your health information to anyone involved in your medical care (e.g., a friend, family member, personal
representative, or any individual you identify). We may also give your health information to someone who helps pay for your care. We may also tell your family or friends about your general condition and that you are in the hospital. We
also may disclose the health information of minor children to their parents or guardians unless such disclosure is otherwise prohibited by law.
• Care Transitions. We may disclose your health information to other health care providers and organizations who may potentially help coordinate and improve the services you receive. These communications help us manage your care and ensure you get necessary follow-up services to stay healthy. For example, in order to develop your discharge plan, we may talk to a home health provider to see what services are available to help you manage your health at home.
• News Gathering Activities: We may contact you or a family member when a news reporter has requested an interview with you. News reporters often seek interviews with patients injured in accidents or experiencing particular medical
conditions or procedures. For example, a reporter working on a story about a new cancer therapy may ask whether any of the patients undergoing that therapy might be willing to be interviewed. In such cases, a member of our staff would
contact you to discuss whether you want to participate in the story. If you choose to participate in the interview, the staff member will obtain your written authorization to do so, and a copy of this authorization will be kept in your medical record.
• Research: We may disclose your health information for research purposes if the research organization has satisfied certain conditions protecting the privacy of the health information.
• Coroners/Funeral Directors/Medical Examiners: In most circumstances, we may disclose your health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine cause
of death. We may also disclose your health information to funeral directors as necessary to carry out their duties.
• Organ and Tissue Donation: Consistent with applicable law, we may disclose your health information to organizations engaged in the procurement, banking, or transplantation of organs, eyes and tissues.
• Fundraising: We may use certain limited identifying information to contact you as part of our fundraising efforts. We may also provide your name to the Oneida Health Foundation for the same purpose. You have the right to opt-out of
receiving fundraising communications and any materials you receive will describe the opt-out process. Your decision will have no impact on your treatment or payment for services at OH.
• Face-to-Face Communications and Promotional Gifts of Nominal Value: We may use your health information to engage in face-to-face communications with you regarding our products and services or to provide you with promotional gifts of nominal value.
• Law Enforcement: We may disclose your health information to respond to a court order, subpoena, warrant, summons or similar process to the extent authorized or required by law. Other disclosures may include reporting certain crimes or alleged criminal conduct at OH.
• Workers’ Compensation/Disability: We may use or disclose health information about you to the extent authorized or required by law for workers’ compensation or other similar programs. These programs provide benefits for work related injuries or illnesses.
• Public Health & Safety: As required or authorized by law, we may disclose your health information for public health purposes. These purposes generally include: preventing or controlling disease, injury or disability; reporting of vital
events such as births and deaths; reporting adverse events or surveillance related to food, medications or defects or
problems with products; notifying persons of recalls, repairs or replacements of products they may be using; notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition;
and notifying the appropriate government authority if we suspect a patient has been the victim of abuse, neglect or domestic violence and make this disclosure as authorized or required by law.
• Cancer Registry: If you have a newly diagnosed cancer, we will release your medical information to the New York State Cancer Registry.
• Inmates /Correctional Institutions: Should you be an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose to the correctional institution health information about you as authorized or required by law.
• Health Oversight Activities/Agencies: We may use or disclose your medical information to governmental, licensing, auditing, and accrediting agencies as authorized or required by law. These oversight activities include, for example,
audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• Specialized Government Functions: As authorized or required by law, OH may disclose health information about you to authorized federal officials for intelligence, counterintelligence, the secret service and other national security
activities authorized or required by law. If you are or were a member of the Armed Forces, we may release health information about you to military command authorities as authorized or required by law. We may also release health
information about foreign military personnel to the appropriate military authority as authorized or required by law.
• Employers under OSHA standards: We may release your health information to an employer when that information is related to the medical surveillance of the workplace, work-related illnesses and injuries, and when the employer requests health care to be provided to the employee by OHC.
• Judicial or Administrative Proceedings: In connection with lawsuits or other legal proceedings, we may, as authorized or required by law, disclose health information about you in response to a court or administrative order, or
in response to a subpoena, discovery request, warrant, summons or other lawful process.
• As Required By Law: We will disclose health information about you when required to do so by federal or state law. For example, state law requires us to report gunshot wounds and other injuries to the police and to report known or
suspected child abuse or neglect to the Department of Social Services. We will comply with those state laws and with all other applicable laws.
• To Avert a Serious Threat to Health or Safety: We may use and disclose health information about you when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or
another person. Any disclosure would only be to someone able to help stop or reduce the threat.
• Incidental Uses / Disclosures: In order to ensure that communications essential to providing quality healthcare are not hindered, incidental disclosures may occur. For example, after surgery the nurse or physician may need to use your
name to identify family members that may be waiting for you in a waiting area and other individuals waiting in the same area may hear your name called. We will make reasonable efforts to limit these incidental disclosures.
Uses and Disclosures That Will Only Be Made With Your Written Authorization:
We will only make the following uses and disclosures of your health information with your written authorization:
• Uses and disclosures for marketing purposes;
• Uses and disclosures that constitute a sale of protected health information; and
• Most uses and disclosures of psychotherapy notes, if we maintain psychotherapy notes.
Special Considerations
We will follow restrictions under state and federal law that provide additional protection on the use and disclosure of certain information, such as HIV/AIDS-related information, mental health information, genetic information, and certain
information related to minors. In addition, we will comply with the additional protections for Substance Use Disorder (SUD) treatment information under 42 CFR Part 2 (“Part 2”) to the extent that we receive such information from a chemical dependency program covered by 42 CFR Part 2. Where use and disclosure is more limited by 42 CFR Part 2, we will abide by such restrictions. The following additional restrictions apply to SUD information:
• Single Consent for Treatment, Payment and Health Care Operations: You may provide a single consent to your SUD provider for all future uses or disclosures of your SUD information for treatment, payment and health care
operations purposes. Records that are disclosed for such purposes by your SUD provider to a HIPAA covered entity like OH, may be re-disclosed by OH without your written consent to the extent the HIPAA regulations permit such
disclosure, except for uses and disclosures for civil, criminal, administrative, or legislative proceedings against you.
• For Judicial Proceedings: We may disclose information or records about you in response to a court order and subpoena (or other similar legal mandate) that complies with the requirements of Part 2, or based on your specific written consent. Records (or testimony based on such records) shall not be used in civil, criminal, administrative, or legislative proceedings without specific written consent or a court order, which court order must be accompanied by a subpoena
or other legal mandate compelling disclosure. Where required by law, notice and an opportunity to be heard will be provided to you or OH prior to such use and disclosure
Other Uses of Medical Information
Other uses and disclosures of health information not covered by this Notice, or the laws that apply to us, will only be made with your written authorization. You may revoke your authorization at any time by submitting a written request to OH’s
Privacy Officer at the address listed below. This revocation will not be applicable to uses and disclosures that we may have acted upon prior to the revocation of your previously provided authorization.
Notice Revisions
We reserve the right to change our privacy practices and this Notice and to make the new Notice effective for all health information that we already have, as well as any health information we receive in the future. The effective date of the Notice
can be found on the last page of the Notice. We will post the revised Notice at multiple locations in our facilities. The current Notice in effect will also be available on our website at: https://www.oneidahealth.org/our-organization/corporatecompliance-privacy/patient-privacy/ or you may obtain a copy during your next visit to Oneida Health.
For More Information or to Report a Concern
If you have questions or would like additional information about this Notice, please contact the OH Privacy Officer as
follows:
Privacy Officer
Oneida Health
321 Genesee Street
Oneida, NY 13421
Phone: (315) 361-2117
Fax: (315)361-2317
Email: Privacy@OneidaHealth.org
If you believe that your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services (DHHS) as follows:
To file a complaint with OH, contact the Privacy Officer at the address or phone number listed above.
To file a complaint with the DHHS, use the following contact information:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Building
Washington, DC 20201
Website: https://www.hhs.gov/civil-rights/filing-a-complaint/index.html
Email: OCRComplaint@hhs.gov
Violations of Part 2 is a crime. You may report suspected violations of Part 2 in the same manner as HIPAA violations are reported as described above. You will not be retaliated against in any way for filing a complaint.
Current Effective Date: September 3, 2026
Original Effective Date: April 1, 2003; Revision Date(s): February, 2006; May, 2012, September, 2013; September 2026
Revision No.: #5; HIPAA Policy: 1-4