HIPAA Notice of Privacy Practices

This Notice Describes How Medical Information About You May Be Used and Disclosed and How You Can Get Access to This Information. Please Review It Carefully.

Beth Israel Lahey Health (BILH) respects your privacy. This notice explains your rights and our responsibilities regarding our medical information.

The practices in this notice apply to all BILH care locations. This includes our hospitals, clinics, and other sites listed at bilh.org/coveredentities.

This notice covers all BILH employees, staff, trainees, volunteers, and others who help provide your care.

This notice also applies to private doctors who care for you at a BILH care location. They will give you their own notice if they see you at their private office.

We are required by law to:

Keep your protected health information private;
Provide you this notice of our legal duties and privacy practices;
Notify you if there is a breach of your protected health information; and
Follow the terms of our Notice of Privacy Practices that is currently in effect.

Effective Date of This Notice:

This notice is effective as of February 16, 2026.

Our Notice of Privacy Practices is available in the following languages:

Your Rights Regarding Your Medical Information

You have the following rights regarding medical information we maintain about you:

Right To View or Get a Copy of Your Medical Records

You have the right to see or get a paper or electronic copy of your medical or billing records.

Your request must be in writing to your BILH care location. We may charge a reasonable fee for the costs of copying, mailing, or other supplies related to your request. We will complete your request in 30 days or let you know if we need more time. You can also request your records using your MyBILH Chart patient portal account.

In some cases, we can deny your request. We will explain why in writing and tell you next steps.

Right To Request Confidential Communications

You have the right to ask us to contact you about your medical matters in a certain way or at a certain place. For example, you can ask that we send mail to your PO Box or only call your home number.

You must make this request in writing at your BILH care location and tell us how you wish to be contacted. We will agree to all reasonable requests.

You can also tell us your "Communication Preferences" in your MyBILH Chart account.

Right To Ask for Restrictions

You have the right to ask us not to share — or "restrict" sharing — your medical information outside of BILH. We do not have to agree to your request, but if we do agree, we will honor your request.

You have the right to say we cannot share your medical information with your health insurer if you have paid in full for a service or healthcare item out-of-pocket. In this case, we must agree.

Right To Ask Us To Amend Your Record

You have the right to ask us to review health or billing information about you that you think is wrong or incomplete. Your request must be in writing to your BILH care location and must give the reason for your request.

We will respond within 60 days. If we agree with your request, we will update your record and ask you who else should get the corrected information.

In some cases, we can deny your request. We will explain why in writing and tell you next steps.

Right To Request for an Accounting of Disclosures

An “accounting” is a list of certain times when we shared your information with others outside of BILH without advance notice to you.

This list does not include: sharing for treatment, payment, or healthcare operations; sharing with you; or sharing with your permission.

You may request an accounting for the previous six years. Requests must be in writing to your BILH care location.

We will respond within 60 days. You may have one free accounting per year.

Right To Make a Complaint

If you believe we have violated your privacy rights, you may complain to us or the federal government.

All complaints to BILH must be made in writing to your BILH care location or call BILH Integrity & Compliance for help sending a complaint to us: 617-278-8300. You can also contact the U.S. Department of Health and Human Services Office for Civil Rights (OCR) by phone 877-696-6775, online, or by writing to: Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201.

You will not be penalized or retaliated against for filing a complaint.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this notice, even if you have agreed to get it electronically. Ask us at any BILH care location.

How We May Use and Share Your Medical Information

Below are different ways that we are allowed to use and share your medical information. For each category, we will explain what we mean and give some examples. Not every example is listed, but all of the ways we use and share your information will fall into one of these categories.

For Your Treatment

We may use your medical information to care for you. We may share your information with doctors, nurses, technicians, medical students, or other healthcare workers who are involved in caring for you.

We may share your information with people involved in your health or well-being, like your family members, friends, home health services, support agencies, clergy, or medical equipment suppliers.

For Payment

We may use your information so we can bill for the care and services you receive at BILH.

For example, we may share your information to get payment from you, an insurance company, or a third party. We may share your information for prior approval, or to see if your insurance plan will cover future treatment. We may also give information to someone who helps pay for your care, like your guarantor or the subscriber of your insurance, if that is not you.

For Our Health Care Operations

We may use and share your information to run BILH. This includes our operations to improve the quality of care we provide, to train staff and students, or provide customer service. We may also share your information with others we hire to help us provide services and programs.

To Contact You

We may contact you about your care, treatment options and experiences at BILH. For example:

Appointment Reminders: We may contact you about an appointment coming up, or to schedule or cancel an appointment.
Treatment Alternatives: We may contact you to tell you about possible treatment options or health-related benefits you may be interested in, or a health-related product or service that we provide.
Satisfaction Surveys: We may contact you to ask about your experience at one of our locations or with our providers.

Fundraising

We may use limited information about you (like your age, dates of service, or department) to contact you in an effort to raise money for BILH.

You can opt out of fundraising communications by contacting your BILH care location.

Hospital Directory

While you are an inpatient at a BILH hospital, we may include your information in our hospital directory. The directory has your name, location in the hospital, your general condition (e.g., good, fair, etc.) and your religious affiliation.

We may share your location in the hospital and general condition with people who ask for you by name. We may share your name with a member of the clergy, even if they do not ask for you by name.

If you do not want to be listed in the hospital directory, please tell your nurse or another member of your care team.

Other Uses and Disclosures That Need Your Written Permission

We will ask for your written permission or “authorization” for uses and disclosures of your medical information not covered by this notice or the laws that apply to us.

If you give us permission to use or share your information, you can take back your permission at any time. You must write to your BILH care location to cancel your permission. Starting then, we will stop using or sharing your information for the reasons covered in your authorization. We are unable to take back any information we have already shared with your permission, and we are required to keep our records of care that we provided to you.

State and federal laws require your written permission to share some types of sensitive health information, like HIV testing or HIV test results, genetic testing information, and some types of counseling notes. There may be exceptions: we do not need your permission to report abuse or neglect, for example.

We will never use or share your information for marketing purposes, unless you specifically give us permission to do so.

Uses and Disclosures That Do Not Need Your Written Permission

In some cases, we may share your information without your written permission when the law allows or requires it. Below are examples:

Disaster Relief

We may share medical information about you to an entity helping in a disaster relief effort so your family can be informed of your condition, location, and status. We may also release general information, such as: “the hospital is treating four individuals from the accident.”

Research

We can share health information about you for research that is approved by a BILH Research Committee or its designee when written permission is not required by federal or state law. This also may include preparing for research or telling you about research studies in which you might be interested.

As Required By Law

We may share your medical information when we have to under federal, state or local law, for example, in response to a court order, administrative request or subpoena.

To Prevent a Serious Threat

We may use and share your medical information to protect your health and safety or the health and safety of others. We can only share with someone able to help prevent the threatened harm.

Organ and Tissue Donation

We may share medical information with organizations involved in donation and transplantation of organs, eyes or tissues.

Military and Veterans

We may share medical information as required by law for Armed Forces or foreign military personnel.

Workers’ Compensation

We may share your medical information for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

Public Health

We may share your medical information for public health activities. For example: to prevent or control disease; to report births and deaths; to report abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls; or to warn people who may have been exposed to a disease, or may be at risk for contracting or spreading a disease.

Health Oversight

We may share your medical information with a health oversight agency for their activities like audits, certifications, investigations, inspections, and licensure. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws.

Law Enforcement

We may share your medical information with law enforcement, in some circumstances, including: to identify or find a suspect, fugitive, witness, or missing person; about a death that may involve criminal conduct; about criminal conduct at BILH; in emergency circumstances, to report a crime.

Coroners, Medical Examiners and Funeral Directors

We may share medical information with a coroner or medical examiner to help them identify a deceased person or determine the cause of death. We may also share medical information with funeral directors to carry out their duties.

National Security and Intelligence Activities

We may share your medical information with authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others

We may share medical information with authorized federal officials providing protection to the President, other authorized persons or foreign heads of state or conduct special investigations as permitted by law.

Inmates

If you are an inmate of a correctional institution or in the custody of a law enforcement, we may share medical information about you with the correctional institution or law enforcement, if permitted by law.

Notice of Privacy Practices of BILH Part 2 Programs

If you receive care from one of our substance use disorder (“SUD”) programs, an additional federal privacy law, 42 CFR Part 2 (“Part 2”), applies to records we create or maintain in our SUD programs (“Part 2 Programs”). A list of the BILH Part 2 Programs can be found at bilh.org/Part2Programs and the practices in this notice apply to all of the listed BILH Part 2 Programs.

Your consent to treatment allows us to share these records for treatment, payment, and healthcare operations — the same way we use and share your information under the Health Insurance Portability and Accountability Act (HIPAA). When we share SUD information for treatment, payment, or health care operations, the recipient is not allowed to re-share your information unless the law allows them to do so.

Generally, we may not share your SUD information except as described below. We may share information without your authorization when:

The disclosure is made to medical personnel in a medical emergency;
The disclosure is made to qualified service organizations providing services on our behalf who agree in writing to protect the information in the same way that we are required to protect the information;
The disclosure is made to law enforcement to report a crime you commit, or threaten to commit, in our facility or against our personnel;
The disclosure is made to child protective agencies to report suspected child abuse and neglect as required by state law;
The disclosure is made to qualified personnel for research subject to ethics board approval and oversight;
The disclosure is made to qualified personnel for audit or program evaluation who a) agree in writing to protect the information as required under our policies, b) represent federal, state, or local government agencies that are authorized by law to oversee our program, or c) provide financial assistance to the program or provide payment for health care.
The disclosure is allowed by a court order and that order includes a subpoena or other legal mandate requiring that we share your information. In those instances, you should also know:
- Your information, or testimony relaying the content of your medical record information, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on specific written authorization or a court order.
- Your information will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or the holder of the medical record, where required by law.
- A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

In other circumstances, we will ask for your authorization to release your information outside of our program. For example, you may provide us written authorization for us to send your information to your attorney. If you have authorized us to share your information, you can change your mind at any time and ask us not to share by letting us know in writing. If you change your mind, we will stop any future sharing of your information but will be unable to stop any information that has already been released.

You still have a right to request restrictions of disclosures of your SUD information, revoke your authorization, obtain an accounting of disclosures, file a complaint if you believe your privacy rights have been violated, and obtain a paper or electronic copy of this notice, all as provided in other parts of this notice. In addition, if your information was shared for treatment through a health information exchange, care management organization, or other intermediary, you have a right to a list of disclosures by the intermediary for the past 3 years. Your request for a list of such disclosures must be in writing to your substance use disorder Part 2 program. Also, you have a right to obtain an accounting of disclosures made with your authorization for the past 3 years.

You will be given an opportunity to opt out of fundraising communications before your records are used for such purposes.

For more information see 42 U.S.C. Section 290dd-2 and 42 C.F.R., Part 2.

Changes to This Notice

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice.

In addition, each time you register or are admitted to the hospital for treatment or healthcare services as an inpatient or outpatient, a copy of the notice currently in effect will be available at your request.

You have a right to discuss this notice and have your questions answered. If you have any questions about this notice, please contact the Beth Israel Lahey Health Integrity & Compliance Department at 617-278-8300 or NOPP@bilh.org.