MENU

Privacy Statement

 

Kaleida Health Logo ECMC Logo UBMD Physicians Group Logo
Southtowns Surgery Center A Kaleida Health Affiliate Brooks Memorial Hospital Logo Cuba Memorial Hospital Logo

 

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION.

Original Notice Effective Date: April 14, 2003
Revised Notice Effective Date: May 30, 2026

Your treating provider is required by law to protect the privacy of health information that may reveal your identity, to provide you with a Notice of Privacy Practices, and to notify you if they become aware of a breach of your health information. This includes obligations under the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), applicable New York State Public Health Law, Mental Hygiene Law, and the Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2).

A copy of the current Notice of Privacy Practice is posted in your treating providers’ location(s). You may also obtain your own copies by visiting your treating provider’s website or by contacting your treating provider’s Privacy Official. Contact information for your treating provider’s Privacy Official is listed at the end of this Notice.

WHO DOES THIS NOTICE APPLY TO?

All the below individuals, entities, sites and locations follow the terms of this Notice, including but not limited to for purposes of telehealth visits. In addition, these individuals, entities, sites and locations may share medical information with each other for treatment, payment or operations as described in this Notice.

  • All entities who participate in the Community Connect Network, including: Kaleida Health, Erie County Medical Center and the ECMC outpatient clinics, Terrace View Long-Term Care Facility, UBMD Physicians’ Group (UBMD), Preferred Physician Care, P.C., d/b/a Premier Health Partners, General Physician, PC, Olean General Hospital, Bradford Regional Medical Center, Millard Fillmore Surgery Center, Southtowns Surgery Center, Harlem Road Ambulatory Surgery Center, Brooks-TLC Hospital System, Visiting Nursing Association of Western New York, and Cuba Memorial Hospital.
  • All employees, staff and other personnel within these entities and any member of a volunteer group we allow to help you while you are within the organization.
  • Any health care professional authorized to enter information into your medical record.
  • Other persons permitted by law to access your medical record.

OUR RESPONSIBILITY TO YOU REGARDING YOUR MEDICAL INFORMATION

We understand that medical information about you is personal, and we are committed to protecting the privacy of your medical information. In order to comply with certain legal requirements, we are required to:

  • Keep your medical information private.
  • Provide you with a copy of this Notice.
  • Follow the terms of this Notice.
  • Notify you if we are unable to agree to a restriction that you have requested.
  • Accommodate your reasonable requests to communicate your medical information by alternative means or at alternative locations.
  • Provide an accounting for certain disclosures as required by HIPAA and New York State law.
  • Notify you following a breach of your unsecured medical information, as required by law.

YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU

You have the following rights regarding medical information we maintain about you:

  • To request in writing a restriction on certain uses or disclosures of your medical information for treatment, payment or health care operations (e.g., a restriction on who may access your medical information). Although we will consider your request, we are not legally required to agree to a requested restriction, except we must agree to your written request that we restrict a disclosure of information to a health plan if the information relates solely to an item or service for which you have paid out of pocket in full. In that limited instance, we are required to abide by your request, unless we are required by law to make the disclosure. It is your responsibility to notify any other providers about any restrictions you request.
  • To request communications by alternative means or at alternative locations (for example: only by mail, never by phone, or only at work). We will accommodate all reasonable requests.
  • To obtain a paper copy of this Notice upon request, even if you have agreed to receive this Notice electronically, by contacting the privacy officer of your treating provider as listed below.
  • To inspect and obtain a copy of your medical information, in most cases. If you request a paper copy, we may charge you a reasonable, cost-based fee. However, New York State law (PHL §18) places limits on copying fees, and you will not be charged more than the amount permitted by law. You will not be charged for access to electronic records delivered electronically.
  • To request in writing an amendment to your records if you believe the information in your record is incorrect or important information is missing. We may deny your request to amend a record if the information was not created by us, is not maintained by us, or if we determine the record is accurate. Even if we deny your request for amendment, you have the right to submit a written addendum with respect to any item or statement in your record you believe is incomplete or incorrect.
  • To obtain an accounting of disclosures stating who and where your medical information has been disclosed for purposes other than treatment, payment, health care operations or where you specifically authorized a use or disclosure in the past six (6) years. The request must be in writing and state the time period desired for the accounting. After the first request, there may be a charge for additional requests made within a twelve (12) month period.
  • To request that medical information about you be communicated to you in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Such requests must be submitted in writing.

All written requests or appeals should be submitted to the Privacy Department of your treating provider.

HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION ABOUT YOU

You may initiate the transfer of your records to another person or entity by completing a written authorization form. If you provide us with written authorization, you may revoke that written authorization at any time, except to the extent that we have already relied upon it. Also, for Substance Use Disorder patients, if you were mandated to treatment through the criminal legal system and you sign a consent authorizing disclosures to elements of the criminal legal system such as the court, probation officers, parole officers, prosecutors or other law enforcement, your right to revoke consent may be more limited.

To revoke a written authorization, please write to your treating provider’s Privacy Officer.

There are some situations when we do not need your written authorization before using your health information or sharing it with others. They are:

  • Treatment: We may use and disclose medical information about you for your treatment. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. We may also disclose medical information about you to people, places and entities beyond our care partners who may be involved in your medical care after you leave our facility. For example, we may give your primary care physician access to your medical information to assist your physician in treating you.
  • Payment: We may use and disclose medical information about you for payment purposes. For example, we may give your health plan information about a surgery you received so your health plan will pay us or reimburse you for that surgery.
  • Health Care Operations: We may use and disclose medical information about you to support our health care operations. For example, we may use medical information to review our treatment and services and evaluate the performance of our staff in caring for you.

HOW INFORMATION MAY BE USED OR DISCLOSED TO YOU

We may communicate to you in a number of ways. We may utilize SMS texting, email, US mail, smart phone apps, phone calls and/or voicemail messages regarding but not limited to the following:

  • Appointment Reminders: We may use your medical information to contact you to remind you of scheduled appointments.
  • Treatment Alternatives: We may use and disclose medical information about you to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
  • Health-Related Products or Services: We may use and disclose your medical information to tell you about our health-related products or services that may be of interest to you.
  • Fundraising Activities: We may use your medical information to contact you to solicit support for certain fundraising activities related to our operations. You will have an opportunity to opt-out using the opt-out method included in each fundraising communication, as required by HIPAA (45 CFR 164.514(f)(2)).

HOW YOUR INFORMATION WILL BE USED OR DISCLOSED TO FAMILY AND FRIENDS

We may use your health information in, and disclose it from, the patient directories of facilities where you are being treated when applicable, or share it with family and friends involved in your care, without your written authorization. We will always give you an opportunity to object unless there is insufficient time because of a medical emergency (in which case we will discuss your preferences with you as soon as the emergency is over). We will follow your wishes unless we are required by law to do otherwise.

  • Hospital Directory: Unless you tell us otherwise, we will list your name, location in the facility, general condition, and religious affiliation in a hospital directory, if applicable. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name, including members of the media. If you would like to opt-out of being in the hospital directory, please notify the admission staff. Please note inpatient Substance Use Disorder patients will not be included in the hospital directory per 42 CFR §2.22(b)(ii)(B).
  • Family and Friends: We may release medical information about you to a family member, friend, or any other person involved in your medical care. We may also give information to those you identify as responsible for payment of your care.

HOW YOUR INFORMATION WILL BE USED OR DISCLOSED WITHOUT YOUR AUTHORIZATION OUTSIDE TREATMENT, PAYMENT AND OPERATIONS

We may use or disclose medical information about you without your prior authorization for several other reasons. Subject to certain requirements, we may give out medical information about you without your prior authorization for the following purposes:

  • Research: We may use and disclose medical information about you for research purposes.
    • All research projects are subject to a special approval process through an appropriate committee. Even without special approval, we may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of any health information.
    • Your treating provider is prohibited from using or disclosing genetic information of an individual for underwriting purposes (45 CFR 164.520(b)(1)(iii)(C)).
  • Required by Law: We may disclose medical information when required by law, such as in response to a request from law enforcement in specific circumstances or in response to valid judicial or administrative orders.
    • Records, or testimony relaying the content of Substance Use Disorder records will NOT be used or disclosed in any civil, administrative, criminal or legislative proceedings against you unless based on your specific written consent or a court order. Records shall only be used or disclosed based on a court order after notice and an opportunity to hear is provided to you and/or the holder of the record, where required by 42 USC 290dd-2 and 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.
  • Public Health: We must comply with all New York State reporting requirements, which may require we disclose certain information about you, including but not limited to: communicable diseases (10 NYCRR 2.10); cancer registry reporting; HIV/AIDS-related information (Public Health Law Article 27-F); immunization reporting requirements; and other public health activities. These disclosures generally may include the following:
    • to public health authorities to prevent or control disease, injury, or disability;
    • to public health agencies, or other authorized entities, as permitted by state law, that maintain registries of certain information, such as immunization registries, for purposes of conducting public health surveillance, public health investigations, and public health interventions;
    • to report births and deaths;
    • to report the abuse or neglect of children, elders, and dependent adults;
    • to notify you of recalls of products you may be using;
    • to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
    • to notify the appropriate government authority if we believe a competent adult patient has been the victim of abuse, neglect, or domestic violence (we will only make this disclosure if you agree or when required by law).
  • To Avert a Serious Threat to Health or Safety: We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
  • Law Enforcement: We may disclose medical information about you to law enforcement officials upon their request:
    • in response to a court order, subpoena, warrant, investigative demand, or other similar process; however, Substance Use Disorder records shall only be used or disclosed based on a court order after notice and opportunity to hear is provided to you and/or the holder of the record, where required by 42 USC 290dd-2 and 42 CFR Part 2;
    • to help identify or locate a suspect, fugitive, material witness, or missing person;
    • about the victim of a crime if, under certain limited circumstances, we are unable to obtain the victim’s agreement;
    • about a death we believe may be the result of criminal conduct;
    • about criminal conduct occurring on our premises;
    • in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
  • Health Oversight: We may disclose your medical information to health oversight agencies for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.
  • Business Associates: We may disclose health information to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. For example, we may use another company to perform billing services on our behalf. All of our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
  • Notification: We may use or disclose your information to notify or assist in notifying a family member, personal representative, or another person responsible for your care, of your location and general condition.
  • Funeral Directors, Medical Examiners, and Coroners: We may disclose medical information to funeral directors, coroners or medical examiners consistent with applicable law in order for them to carry out their duties.
  • Lawsuits and Disputes: If you are involved in a lawsuit or dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request (which may include written notice to you) or to obtain an order protecting the information requested.
  • Organ and Tissue Donation: Consistent with applicable law, we may disclose medical information to organ procurement organizations or other entities for the purpose of tissue donation and transplant.
  • Health Information Exchange: We participate in a health information exchange (“HIE”) and may electronically share your medical information for treatment, payment and health care operations purposes with other participants in the HIE. HIEs allow your health care providers to efficiently access and use medical information necessary for your treatment and other lawful purposes. The inclusion of your medical information in an HIE is subject to your prior consent, except in limited circumstances permitted by law.
  • Military and Veterans: If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.
  • National Security: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
  • Multidisciplinary Personnel Teams: We may disclose medical information to a multidisciplinary personnel team relevant to the protection, identification, management or treatment of (i) an abused child and the child’s parents, or (ii) elder abuse and neglect.
  • Food and Drug Administration (FDA): We may disclose certain medical information to the FDA relative to reporting adverse events.
  • Workers’ Compensation: We may disclose medical information necessary to comply with laws relating to workers’ compensation or other similar programs established by law.
  • Correctional Institutions: Should you be an inmate of a correctional institution, we may disclose medical information necessary for your health and the health and safety of other individuals to the institution or its agents.
  • Department of Health and Human Services: Your health information may also be disclosed to the Secretary of the Department of Health and Human Services for the purpose of investigating or determining compliance with HIPAA.

ADDITIONAL PRIVACY FOR CERTAIN INFORMATION

In some circumstances, your medical information may be subject to restrictions that may limit or preclude some uses or disclosures described in this Notice. For example, there are special restrictions on the use or disclosure of certain types of medical information (e.g., HIV test results, mental health records, and alcohol and substance abuse treatment records, as described further below). Government health benefit programs may also limit the disclosure.

ADDITIONAL PRIVACY FOR SUBSTANCE USE DISORDER (SUD) TREATMENT

Some of your treating providers may be/are referred to as a “Part 2 provider”, which means they are subject to the federal privacy regulations outlined in 42 CFR Part 2 (Title 42, Code of Federal Regulations, Part 2). 42 CFR Part 2 is a federal regulation that provides additional privacy protections to patients who seek treatment for substance use disorders. Many of these protections have been outlined elsewhere in this Notice. However, if you're a patient interacting with a treating provider’s substance use treatment services, please be aware that federal regulation:

  • Allows a single consent for all future uses and disclosures for treatment, payment, and health care operations.
  • Allows HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with the HIPAA regulations.
  • Permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.
  • Restricts the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients, absent patient consent or a court order.

Federal law prohibits discrimination based on information shared from your SUD records. This means your treatment history cannot be used to deny you access to employment, housing, healthcare, or legal benefits.

You have the right to revoke your consent at any time, except to the extent that action has already been taken based on your prior consent.

Once disclosed, your information may be redisclosed under HIPAA and will no longer be protected by 42 CFR Part 2.

OTHER USES OR DISCLOSURES OF MEDICAL INFORMATION

Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us your authorization to use or disclose medical information about you, you may revoke that permission, in writing, at any time. However, we are unable to take back any disclosures we have already made with your permission.

We will not use or disclose your information for marketing without your written authorization, unless the communication is permitted by law.

We will not sell your medical information without your written authorization.

If you have any concerns about the uses of your medical information, please feel free to discuss the issues with your treating provider. If you have questions about this Notice, please call the Privacy Officer of your treating provider.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice at any time. We have the right to make the revised Notice effective for any medical information we already have as well as any information we receive in the future. If we make a material change to this Notice, we will post the revised Notice at our location where you receive services and on our website and make the revised Notice available upon request.

COMPLAINTS

You may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, without fear of retaliation.

If you have any questions or would like additional information, or if you believe your privacy rights have been violated, you can contact the Privacy Officer of your treating provider. All complaints to the Department of Health and Human Services must be submitted in writing. You may do so by contacting the HHS Office of Civil Rights or accessing https://www.hhs.gov/hipaa/filing-a-complaint/index.html. A patient is not required to report an alleged violation either to the OCR or us but may report to either or both. We will not retaliate against you for filing a complaint.

Privacy Official Information

Kaleida Health, including General Physician, PC, Olean General Hospital, Millard Fillmore Surgery Center, Harlem Road Ambulatory Surgery Center, Visiting Nursing Association of Western New York
Kaleida Health Privacy Official, privacy@kaleidahealth.org, 716-859-8633

ECMCC
ECMCC Privacy Official, privacy@ecmc.edu, 716-898-6439

UBMD Physicians’ Group (UBMD)
UBMD Privacy Official, UBMDCompliance@buffalo.edu, 716-888-4752

Southtowns Surgery Center
Privacy Official, 716-859-7263

Brooks-TLC Hospital System, including Lake Erie Medical Services, PC
Julie Hover, COO, CNO, JDHover@brookshospital.org, 716-363-7333

Cuba Memorial Hospital
William Robinson, Corporate Compliance Officer, wxrobinson@cubamemorialhospital.org, 585-968-6773