NOTICE OF PRIVACY PRACTICES
HIPAA Privacy and Security Plan
If you have any questions about this Notice, please contact:
Union Health Privacy Officer
1606 N 7th Street
Terre Haute, IN 47804
Phone: 812-238-7533
Email: privacy@union.health
NOTICE OF PRIVACY PRACTICES
This Notice of Privacy Practices (“Notice”) is intended for patients of Union Hospital, Inc., Union Associated Physicians Clinic, LLC, and Center for Occupational Health, Inc. (hereafter, collectively, “Union Health” or “we”).
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE UNION HEALTH HIPAA COMPLIANCE & PRIVACY OFFICER (“PRIVACY OFFICER”) AT (812) 238-7533 OR PRIVACY@UNION.HEALTH IF YOU HAVE ANY QUESTIONS.
If you are an inmate of a correctional institution, you do not have the right to receive this Notice of Privacy Practices, and the Notice requirements do not apply to the correctional institution.
THIS NOTICE DESCRIBES:
- HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
- YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
- HOW YOU CAN GET ACCESS TO THIS INFORMATION
- HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
PLEASE REVIEW THIS NOTICE CAREFULLY.
How We May Use and Disclose Your Health Information
The following categories describe different ways that we use and disclose health information. Health information may be disclosed in writing, orally, or electronically. Not every use or disclosure in each category will be listed; however, all the ways we are permitted to use and disclose health information fall within one of the categories. Any other uses or disclosures will only be made with your written authorization, unless otherwise permitted or required by law.
If there are different laws covering your health care information, we will follow the law that offers the greatest privacy protection to you.
Our Privacy Commitment and Legal Duties
We understand that health information about you is personal, and we are committed to protecting your privacy. We create and maintain records of the care and services you receive to provide you with quality care and comply with legal and regulatory requirements. This Notice applies to all records of your care maintained by our organization, whether in paper or electronic form.
We are required by law to:
- Safeguard the health information that identifies you;
- Provide you with this Notice of our legal duties and privacy practices;
- Follow the terms of this Notice currently in effect; and
- Notify you in the event of a breach of your unsecured health information.
Access to and Safeguards for Your Information
We limit access to your health information to workforce members and business partners who have a legitimate need to know the information to perform their duties. We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of your information in compliance with state and federal law.
We collect and use only the information necessary to provide care, manage our operations, and fulfill billing and legal obligations. Except as described in this Notice or otherwise permitted by law, we will not use or disclose your PHI without your authorization.
How We May Use and Disclose Your Health Information for Treatment, Payment, or Health Care Operations (“TPO”)
The following categories describe the ways that Union Health may use and disclose your health information. For each type of use and disclosure, we will explain what each category means and provide examples.
For Treatment:
We may use or disclose your health information in the provision, coordination, or management of your health care. Our communications to you may be by telehealth, telephone, cell phone, email, patient portal, mail, or text. Additionally, your information may be accessed by various people who are involved in your care (for example, doctors, nurses, technicians, students, clerks, laboratory personnel, etc.). Different departments may share health information about you to coordinate your care. For example, a doctor may share your health information with another physician when you are referred for specialized care.
We participate in certain Health Information Exchanges or Organizations (“HIEs” or “HIOs”). Specifically, we participate in the Indiana Health Information Exchange (“IHIE”) and Indiana Network for Patient Care (“INPC”), which help make your PHI available to other health care providers who may need access to it to provide care or treatment to you.
For Payment:
We may use and disclose your health information to obtain payment for your health care services. For example, we may use your information to send a bill for your health care services to your insurance plan. We may also share your health information with other affiliated or contracted entities who performed a service for you during your visit to our facility (examples include other physicians, technicians, labs, and diagnostic services such as x-ray, CT, or MRI).
For Health Care Operations:
We may use and disclose your health information for activities relating to the evaluation of patient care, evaluating the performance of health care providers, business planning, and compliance with the law. These uses and disclosures are necessary to run our facilities and make sure that all our patients receive quality care. For example, we may use your information to determine the quality of care you received when you had your surgery.
Substance Use Disorder (SUD) Records (42 C.F.R. Part 2)
Certain substance use disorder (“SUD”) treatment information may be subject to additional protections under 42 CFR Part 2 (“Part 2”), a federal law that provides heightened confidentiality protections for records related to federally assisted substance use disorder treatment programs.
When applicable, SUD records that are protected by Part 2 will not be used or disclosed without your consent or as otherwise permitted by Part 2. For SUD records, you may provide a single written consent that permits future uses and disclosures for treatment, payment, and health care operations as permitted by Part 2 and the Health Insurance Portability and Accountability Act (HIPAA) Rule. If you provide written consent for the use and disclosure of your SUD records for treatment, payment, and health care operations, federal law permits recipients to further use and disclose those records in accordance with HIPAA, except as otherwise restricted by Part 2. However, federal law continues to prohibit the use or disclosure of SUD records in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a court order that complies with Part 2 Subpart E. SUD records that are disclosed to us may become part of your health record and will then be protected thereafter in accordance with applicable federal and state law, including HIPAA.
Federal law prohibits discrimination against you based on information contained in SUD records. Recipients of SUD records may not use or disclose that information to investigate or prosecute you, or to deny you access to health care, employment, housing, courts, child custody, social services, or other benefits, except as permitted by law.
You have a right to request restrictions of disclosures under this single consent. If you give us written permission to share your SUD treatment information, you may revoke that permission at any time by sending a written request to the Privacy Officer. When you revoke your permission, we will stop sharing your SUD records based on that permission. However, we cannot undo anything that was already shared before you revoked it.
After your revocation takes effect, we will only share your SUD information if you sign a new authorization or if the law allows or requires us to do so. Any recipient of SUD information protected by Part 2 is prohibited from redisclosing the information except as permitted by federal law. Not all health information is subject to Part 2. The applicability of Part 2 depends on the nature of the services provided and the source of the information.
For Treatment:
We may use and share SUD information in order to:
- Provide you with treatment and services; and/or
- Coordinate your care with other health care providers involved in your treatment.
We only share this information when you give written permission or when federal law allows it. For example, a patient is receiving substance use treatment and is also seeing a primary care provider. With the patient’s written consent, the SUD provider discloses information about current medications so the primary care provider can avoid any drug interactions.
For Payment:
We may use and share SUD information in order to:
- Bill your health plan.
- Receive payment for services.
- Answer questions from your health plan about coverage.
This information is shared only as allowed by federal law and only the minimum necessary. For example, a substance use treatment program submits a claim to the health plan. The claim includes a diagnosis and service codes needed to process payment, but nothing extra.
For Health Care Operations:
We may use SUD information in order to:
- Improve the quality of care.
- Review and improve our services.
- Train staff.
- Meet legal and accreditation requirements.
For example, a SUD treatment program reviews patient outcomes to see which services work best. Data may be used internally to improve care, without sharing patient identities when possible.
How We May Use and Disclose Your Health Information Without Your Written Authorization
The law allows us to use or disclose your health information without your authorization in certain situations, including but not limited to:
When required by law: We may disclose your health information when a law requires or allows us to do so. For example, we may report information about suspected abuse and/or neglect or in response to a court order.
Judicial and Administrative Proceedings: We may disclose your health information in the course of an administrative or judicial proceeding in response to a court order. Under most circumstances when the request is made through a subpoena, a discovery request, or another type of administrative order which must meet conditions for disclosure, we may disclose your health information as permitted by law.
SUD records protected by Part 2 are subject to stricter requirements. We will not disclose SUD records or their contents in any civil, criminal, administrative, or legislative proceeding against you unless you have provided your specific written consent or the disclosure is authorized by a court order that complies with Part 2 Subpart E. We do not disclose SUD records in response to subpoenas, discovery requests, or other routine legal process unless permitted under Part 2.
For public health activities: We may disclose your health information to local, state, or federal public health agencies subject to the provisions of applicable state and federal law for reporting communicable disease, aiding in the prevention or control of certain diseases and reporting problems with products or reactions to medications to the Food and Drug Administration (FDA).
SUD records protected by Part 2 may be disclosed for public health purposes only as permitted by Part 2 and applicable law. When required, such disclosures may be limited to de-identified information or made pursuant to your written consent or other lawful authorization.
For health oversight activities: We may disclose your health information to government agencies or organizations authorized by law to conduct audits, investigations, inspections, licensure, or other oversight activities necessary for the government to monitor the health care system, government programs, or compliance with civil rights laws.
SUD records protected by Part 2 may be disclosed for oversight activities only as permitted by Part 2 and other applicable laws.
To a Business Associate: Certain services are provided to us through contracts with third party entities known as “business associates” that require access to your health information in order to provide such services. Examples include transcription agencies, copying services and cloud service providers. We require these business associates to agree to protect your health information in compliance with all laws.
Relating to decedents: We may disclose your health information relating to an individual's death to coroners, medical examiners, funeral directors, and organ procurement organizations.
For research purposes: We may disclose your information for approved research studies that help improve treatment. When we do this:
- The research must be reviewed and approved, and
- Researchers are not allowed to identify you or share your information with others.
To avert a threat to health or safety: To avoid a serious and imminent threat to the health or safety of an individual or the public, we may disclose your health information to law enforcement or other persons who can reasonably prevent or lessen the threat of harm.
Law enforcement: We may disclose your health information to a law enforcement official in circumstances permitted by law, such as in response to a court order; to identify or locate a suspect, fugitive, material witness, or missing person; about the victim of a crime; or about a death that may have resulted from a crime. If a crime occurs at our facility or against our staff, we may report limited information to law enforcement. SUD records protected under Part 2 will be disclosed to law enforcement only as permitted by Part 2, including with your written consent or pursuant to a court order that complies with Part 2 Subpart E.
Victims of Abuse, Neglect, or Violence: We may disclose your information to a government authority authorized by law to receive reports of abuse, neglect, or violence relating to children or the elderly.
For specific government functions: We may disclose health information of military personnel and veterans in certain situations; to correctional facilities in certain situations; and for national security and intelligence reasons.
Workers’ Compensation: We may disclose your health information to your employer or your employer’s insurance carrier for Workers’ Compensation or similar programs that provide benefits for work-related illness or injuries.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your health information in order for them to provide you with health care, to protect your health and safety or the health and safety of others, or to ensure the safety and security of the correctional institution.
De-Identified Information: We may de-identify your health information as permitted by law. We may use or disclose to others the de-identified information for any purpose, without your further authorization or consent, including but not limited to, research studies, development of artificial intelligence tools, and health care/health operations improvement activities.
Medical Emergencies: If you have a medical emergency and cannot provide prior written consent to treatment, or if we are closed or operating during a declared state or federal emergency and are unable to obtain your consent, we may share limited information about you, including SUD records, with emergency medical staff to help keep you safe. We only share what information is needed to treat you at that time.
When We Are Required to Provide You with an Opportunity to Object
In the following situations, we may use or disclose your health information if we tell you about the use or disclosure in advance and you have the opportunity to agree to, prohibit, or restrict the use or disclosure, and you do not object. However, if there is an emergency situation and you cannot be given the opportunity to agree or object, we may use or disclose your health information if it is consistent with any prior expressed wishes and the use or disclosure is determined to be in your best interests; provided that you must be informed and given an opportunity to object to further uses or disclosures for patient directory purposes as soon as you are able to do so.
Facility Directories: If you are hospitalized, your name, location, general condition, and religious affiliation may be put into our facility directory for use by clergy or by callers or visitors who ask for you by name. If you choose for your visit to be made private, volunteers, caregivers, and telephone operators will not tell anyone you are in the facility and flowers, mail, phone calls, and visitors will be turned away and not accepted.
To families, friends or others involved in your care: We may share with your family, your friends or others involved in your care information directly related to their involvement in your care or payment for your care. We may also share your health information with these people to notify them about your location, general condition, or your death.
Disaster relief: In the event of a disaster, we may release your health information to a public or private relief agency to assist in disaster relief efforts.
When We Are Required to Obtain an Authorization to Use or Disclose Your Health Information
Other uses and disclosures of health information not covered by this Notice or law will be made only with your written permission. If you provide us with permission to use or disclose your health information, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. Please understand that we are unable to take back any disclosures we may have already made while we had your permission, and that we are required by law to retain our records of the care we provided to you.
Your written authorization will be required for certain uses and disclosures of your health information, including most psychotherapy notes as defined by HIPAA, and SUD treatment records that are protected under Part 2, except as otherwise permitted or required by law. Your authorization is also required for most uses and disclosures of health information for marketing purposes or sale of health information. If we intend to contact you for fundraising purposes, you have the right to opt out of receiving such communications. To opt out of fundraising communications, contact the Privacy Officer.
Your Rights Regarding Your Health Information
Right to Inspect and Copy: You may read your information or request a copy of your records. This includes medical and billing records but does not include psychotherapy notes or certain SUD treatment records. If you request a copy of the records, we will respond to your request within thirty (30) days. If we deny your request, we will give you written reasons for the denial and explain any right to have the denial reviewed. If you want copies of your health information, we may charge a reasonable, cost-based fee. If you request a digital copy of health information that we maintain in a digital format, we will provide it in the requested format, provided it is readily producible. You have a right to choose what portions of your information you want copied and to have information on the cost of copying in advance. To review or request a copy of your record, contact the Union Health Medical Records Department at 812.238.7648 or by going to our website at https://www.union.health/patients-and-visitors/for-patients/request-medical-records.
Right to Amend: If you believe that health information in your records is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept. A representative will give you the appropriate form to request an amendment (which must include the reason for your request). We will respond within sixty (60) days of receiving your request. We will deny your request for an amendment if it is not in writing or does not include a reason for the request. In addition, we may deny your request if we determine that our information is accurate and complete, that it was not created by us, or not permitted to be disclosed. To request an amendment, you must make your request in writing to the Privacy Officer.
Right to Accounting of Disclosures: You have the right to request an accounting of disclosures, that is, a list of the persons to whom we sent some or all of your health information during the past six (6) years (three (3) years for SUD records), except for disclosures:
- For treatment, payment, and health care operations (for SUD records, this includes disclosures for treatment, payment, and health care operations made pursuant to your written consent);
- To you;
- That are incidental in nature;
- Pursuant to an authorization;
- For our directory or to persons involved in care;
- For national security or intelligence purposes;
- To corrections institutions or law enforcement officials; or
- As part of a limited data set.
We will charge you for the cost of providing more than one accounting during a 12-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any charges are incurred. To request an accounting of disclosures, contact the Privacy Officer.
Right to Request Restrictions: You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or other health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about this visit. In most cases, we are not required to agree to your request. If we do agree, we will comply with your request, unless the information is needed to provide your emergency treatment. If you have paid in full for a service and have requested that we not share information related to that service with a health plan, we must agree to such request. To request restrictions, contact the Privacy Officer. You will be given the appropriate form to complete your request, which requires:
- A description of information you want to limit;
- Whether you want to limit our use, disclosure, or both; and
- To whom you want the limits to apply, for example, disclosures to your spouse.
Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may wish to receive information about your health status in a special, private room or through a written letter sent to a private address. We must accommodate reasonable requests. To request confidential communications, you must submit your request in writing to the Privacy Officer.
Right to Obtain a Paper Copy of this Notice: Upon your request, you may at any time receive a paper copy of this notice, even if you earlier agreed to receive this notice electronically. To obtain a paper copy of this Notice, send your written request to the Privacy Officer. Union Health maintains a website and posts its current Notice of Privacy Practices on the website, where it is available electronically at https://www.union.health/about-us/notice-of-privacy-practices.
Right to be Notified of a Breach: We are required by law to maintain the privacy of health information and provide you with notice of its legal duties and privacy practices with respect to health information and to notify you following a breach of unsecured health information that qualifies under the federal health care privacy rules. This breach notification requirement applies to substance use disorder records protected by Part 2 to the extent required by federal law.
Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with the Union Health Privacy Officer who will provide you with any needed assistance. We request that you file your complaint in writing so that we may better assist in the investigation of your complaint. You may file a complaint with the Secretary of the Department of Health and Human Services (DHHS) regarding alleged violations of HIPAA or Part 2, including concerns about the use or disclosure of substance use disorder records. There will be no retaliation against you in any way for filing a complaint.
If you have questions or would like further information about this Notice, please contact:
Union Health Privacy Officer
1606 N 7th Street
Terre Haute, IN 47804
Phone: 812-238-7533
Email: privacy@union.health
Use of unsecure electronic communications: If you choose to contact us through unsecure methods, such as regular email or text message, we may reply using the same method and to the same email address or number you provided. We may use these email addresses or numbers to send appointment reminders, surveys, or other general information. For your convenience, these messages may be sent unencrypted.
Please be aware that unsecure communications carry risks, including interception, mis-delivery, shared accounts, forwarding, or storage on unsecured devices. By using these methods, you acknowledge and accept these risks.
Changes to this Notice: We reserve the right to change our practices and this Notice and to make the revised or changed notice effective for health information we already have about you, as well as any information we receive in the future. We will post a copy of the current Notice on the Union Health website and will follow the current version in effect, https://www.union.health/about-us/notice-of-privacy-practices.
Effective Date of this Notice: February 16, 2026