HIPAA Notice of Privacy Practices

HIPAA Notice of Privacy Practices

En Español

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to Connecticut Children’s Medical Center (“Connecticut Children’s”), Connecticut Children’s Specialty Group, Inc. (“Children’s Specialty Group”) and New York Children’s Medical Provider Services, P.C. (“New York Children’s”) (referred to collectively as the “Children’s Provider(s),” “we” or “our”).

INTRODUCTION

This Notice describes the privacy practices of healthcare facilities and professionals of the Children’s Providers, including all departments and units of the Connecticut Children’s Medical Center, Children’s Specialty Group, and New York Children’s, and all employees, staff, trainees, volunteers and other personnel of Connecticut Children’s, Children’s Specialty Group, and New York Children’s, who participate in an organized health care arrangement to deliver high-quality care to you.

We respect the privacy of your health information and are committed to protecting patient confidentiality. We are required to maintain the privacy of your health information, provide you with this Notice regarding our legal duties and privacy practices with respect to information we collect and maintain about you, and abide by the terms of this Notice. This Notice describes your rights and our obligations regarding your health information, and informs you about the possible uses and disclosures of your health information. This Notice applies to all information and records related to your care that we have received or created.

The Children’s Providers will share your health information with each other, as necessary to carry out treatment, payment and health care operations, as further explained below.

UNDERSTANDING YOUR HEALTH RECORD INFORMATION

Each time you receive care at Connecticut Children’s or from a Children’s Provider healthcare professional, a record of your care is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information, often referred to as your health or medical record, serves as a:

  • Basis for planning your care and treatment;
  • Means of communication among the many healthcare professionals who contribute to your care;
  • Legal document describing the care you received;
  • Means by which you or your insurer can verify that services billed were actually provided;
  • A tool in educating healthcare professionals;
  • A source of data for medical research;
  • A source of information for public health officials charged with improving the health of the nation; and
  • A tool with which we can assess and continually work to improve the care we render and the outcomes we achieve.

Understanding what is in your health record and how your health information is used helps you to:

  • Ensure your record is accurate;
  • Better understand who, what, when, where, and why others may access your health information; and
  • Make more informed decisions when authorizing the use or sharing of your health information.
     

YOUR HEALTH INFORMATION RIGHTS

Your health record is the physical property of the Children’s Providers, but the information belongs to you. You have the right to:

Request a restriction. You have the right to request a restriction on our use or sharing of your health information for treatment, payment or healthcare operations. You have the right to request restrictions on the health information we disclose about you to a family member, friend or other person who is involved in your care or the payment of your care.

We are not required to agree to your requested restriction, unless (i) you request that information not be provided to a health plan for purposes of carrying out payment or health care operations, (ii) such restriction is allowed by law, and (iii) the information pertains solely to a health care item or service for which the Children’s Providers have been paid out of pocket in full. If we do agree to accept your requested restriction, we will comply with your request, except as needed to provide you emergency treatment. If restricted protected health information is shared with a healthcare professional for emergency treatment, we will request that such healthcare professional not further use or share the information. In addition, you and the Children’s Providers may terminate the restriction if the other party is notified in writing of the termination. Unless you agree, the termination of the restriction is only effective with respect to protected health information created or received after we have informed you of the termination.

Obtain a paper copy of this Notice. You have the right to obtain a copy of this Notice upon request at any time. In addition, you may obtain an electronic copy of this Notice at our website: www.connecticutchildrens.org.

Access, inspect and copy your health record. You have the right to access, inspect and obtain a copy of your protected health information that is used to make decisions about your care for as long as the protected health information is maintained by the Children’s Providers. To access, inspect and copy your protected health information that may be used to make decisions about you, you must submit your request in writing to the Children’s Providers using the contact information below. If you request a copy of the information, we may charge a fee for the costs of preparing, copying, mailing or other supplies associated with your request. We may deny, in whole or in part, your request to access, inspect and copy your protected health information under certain limited circumstances. If we deny your request, we will provide you with a written explanation of the reason for the denial. You may have the right to have this denial reviewed by an independent healthcare professional designated by us to act as a reviewing official. This individual will not have participated in the original decision to deny your request.

Submit a request to amend your health record. You have the right to submit a request to amend your health record maintained by the Children’s Providers for as long as the information is kept by or for the Children’s Providers. Your request must be made in writing on a specific form and must state the reason for the requested amendment.

We may deny your request for amendment if the information (a) was not created by the Children’s Providers, unless the originator of the information is no longer available to act on your request; (b) is not part of the health information maintained by or for the Children’s Providers; (c) is not part of the information to which you have a right of access; or (d) is already accurate and complete, as determined by the Children’s Providers. If we deny your request for amendment, we will give you a written denial, including the reasons for the denial, and the right to submit a written statement disagreeing with the denial.

Obtain an accounting of certain disclosures. You have the right to obtain an accounting of certain disclosures of your health information. This is a listing of disclosures made by the Entities, or others, on our behalf, but does not include disclosures for treatment, payment and healthcare operations or certain other exceptions.

To request an accounting of disclosures, you must submit a request in writing, stating a time period that is within six years from the date of your request. An accounting will include, if requested: the disclosure date; the name of the person or entity that received the information and address, if known; a brief description of the information disclosed; and a brief statement of the purpose of the disclosure or a copy of the authorization or request or certain summary information concerning multiple disclosures. The first accounting provided within a 12-month period will be free; for further requests, a reasonable fee may be charged.

Request confidential communications. You have the right to request a reasonable accommodation regarding how you receive communications of health information. You have the right to request an alternative means of communication or an alternative location where you would like to receive communications. For example, you can request that we contact you only at a certain telephone number. We will accommodate your reasonable requests.

Revoke your authorization to use or disclose. You have the right to revoke your authorization to use or share your health information, except to the extent that action has already been taken by the Children’s Providers in reliance on the authorization.

Be notified of a breach of unsecured protected health information. You have the right to be provided written notification, if your unsecured protected health information is subject to a breach (as defined by federal and/or state law) and the law requires us to provide you notification. In the event the Children’s Providers determine there is a breach, we will provide you with written notification of the breach no later than sixty (60) days following our discovery of such breach.

Have a Personal Representative. You have the right to have a parent, family member, legal guardian, or others involved in your care. A parent or legal guardian may be designated by applicable law or a court to act on your behalf. We may take steps to make sure the person has authority to act on your behalf as your personal representative.
 

HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The following categories describe the different ways that we may use or share your protected health information. Even if not specifically listed below, the Children’s Providers may use and share your protected health information as permitted or required by law or as authorized by you. We will make reasonable efforts to limit access to your records to our workforce members who need access to carry out their duties and other persons or organizations involved in your care. In addition, if required, we will make reasonable efforts to limit the protected health information to the minimum amount necessary to accomplish the intended purpose of any use or disclosure. Except as described in this Notice and as permitted by law, we will not use or disclose your health information without your authorization.

Treatment. We will use and disclose your health information in order to provide you with treatment, services and to coordinate your care. Doctors, advanced practice providers, nurses, as well as lab technicians, dieticians, physical therapists or other personnel involved in your care, may use, share or receive your health information consistent with this Notice.

For example: A Connecticut Children’s medical staff physician may discuss your treatment with your primary care physician, and may share records of your treatment with specialists to provide you with care.

Payment. We may use and share your health information so that we can bill and receive payment for the treatment and services you receive. For billing and payment purposes, we may disclose your health information to your representative, insurance or managed care company, Medicare, Medicaid or another third party payer or benefits provider.

For example: A bill may be sent to you or your insurance company for care we provide. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures, services, and items or supplies used.

Healthcare Operations. We may use and share your health information, as necessary, to run our business and for practice operations, such as for management purposes, and to monitor our quality of care and performance.

For example: Members of the medical staff, the risk or quality improvement departments, or members of committees may use information in your health record to assess the care and outcomes in your case and others similar to it.

The Children’s Providers may also share your health information for the following reasons, under certain circumstances:

  • Electronic Health Information Exchange. We participate in the electronic sharing of health information with other health care providers, health plans, other health care-related entities, and others, through a health information exchange (“HIE”), which may include, but is not limited to, Care Everywhere, EpicCare Link, CTHealthLink, and Connie. Ask us how and to what extent you can opt out of sharing your information with HIEs.

Your electronic health records, including certain sensitive health information, for example mental health information, HIV/AIDS, genetic information, some substance use disorder treatment information, communicable diseases, and developmental and intellectual disability treatment, may be accessible through the HIE to properly authorized users for purposes of treatment, payment, and health care operations, as well as other purposes permitted or required by law.  You may submit an opt-out request to restrict this sharing, as described in the RESTRICTIONS section below. Even if you opt-out of having your health information used and disclosed through the HIE, some of your information may still be available through the HIE to properly authorized individuals as necessary in an emergency, Prescription Drug Monitoring Program or to report specific information to a government agency as required by law (for example, reporting of certain communicable diseases or suspected incidents of abuse to state agencies).

  • Business Associates. We may disclose your health information to our business associates, who are contracted individuals or entities that provide certain services on our behalf. To protect your health information, we require the business associate to agree in writing to appropriately safeguard your information.
     
  • Connecticut Children’s Directory. Unless you object, we will include certain limited information about you in the Connecticut Children’s hospital directory while you are a patient at Connecticut Children’s. This information may include your name, your location in Connecticut Children’s, your general condition and your religious affiliation. The Connecticut Children’s directory does not include specific medical information about you. We may disclose directory information, except for your religious affiliation, to people who ask for you by name. We may provide the directory information, including your religious affiliation, to any member of the clergy. You have the right to restrict or prohibit some or all of the foregoing uses or disclosures.
     
  • Communication with Family or Those Responsible for Care. Healthcare professionals, using their best judgment, may disclose to a family member, other relative, close personal friend, or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care.
     
  • Reporting Victims of Abuse, Neglect or Domestic Violence. If we believe that you have been a victim of abuse, neglect or domestic violence, we may use and disclose your health information to notify a government authority, if authorized by law or if you agree to the report.
     
  • Research. We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information, if the researcher is collecting information in preparing a research proposal, if the research occurs after your death, or if you authorize the use or disclosure.
     
  • Funeral Directors, Coroners, Medical Examiners, Organ Procurement Organizations. We may disclose health information to funeral directors, coroners, medical examiners and organ procurement organizations consistent with applicable law to carry out their duties.
     
  • Communications. We may contact you to provide information about your treatment and services, appointment reminders, billing and payment for your care or information about treatment alternatives or other health-related benefits and services. This may include communications via mail, telephone, voicemail, text message (SMS), electronic mail (email), patient portal messaging, or other electronic means.

By providing your contact information, including your address, email address(es), telephone number, and other contact information, and/or by signing up to receive communications through our patient portal, you expressly consent and authorize Children’s Providers to use and share your contact information to communicate with you for purposes allowed by law, including treatment, payment, and healthcare operations, such as to send reminders regarding appointments, share test results or follow-up instructions, recommend treatment alternatives or medical education services, and for other health-related purposes, in accordance with this Notice and applicable law.  Standard message and data rates may apply for text message communications.

These communications may include information about your health. We take reasonable steps to safeguard your health information, but you should be aware that by agreeing to receive electronic communications, the messages may be sent unencrypted, and unencrypted communications can pose a risk to the privacy or security of your health information. Additionally, if we are unable to speak with you directly, in certain situations we may leave you messages (via voice or electronic mail) containing limited information about your treatment if we determine it is in your best interest and not contrary to your prior expressed preferences for communication.  You can securely message your provider through our electronic health system portal at any time, but electronic provider messages should not be used in an emergency.

You can change your communication preferences at any time by contacting us, and you have the right to request confidential communications as described further below. You can also opt out of certain non-required electronic notices by telling us, and we will never condition your receipt of care on consenting to receive communications through a specific electronic means.  However, opting out or restricting our ability to communicate with you may limit our ability to provide you with timely and convenient information regarding your care and payment for your care.

  • Food and Drug Administration (FDA). We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
     
  • Workers’ Compensation. We may disclose health information, to the extent authorized by and to the extent necessary, to comply with laws relating to workers’ compensation or other similar programs established by law.
     
  • Public Health. As required by law, we may share your health information with public health or legal authorities charged with preventing or controlling disease, injury, or disability. For example, these required disclosures may include the reporting of child abuse or neglect cases, births and deaths, or communicable disease.
     
  • Emergencies/Disaster Relief. We may use or share health information, as necessary, in emergency treatment situations. We will attempt to obtain an authorization as soon as possible. We may share your health information with an organization assisting in a disaster relief effort.
     
  • Correctional Institution/Law Enforcement. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your health information to the institution or official for certain purposes, including the health and safety of you and others, suspicious deaths, or in response to a valid subpoena, court order or warrant.
     
  • Judicial and Administrative Proceedings. We may disclose your health information in response to a court or administrative order or subpoena.
     
  • Health Oversight Agency. We may share your health information with a health oversight agency for activities authorized by law. These may include audits, investigations, inspections, licensure or other legal proceedings. These activities may include government oversight of the health care system, government payment or regulatory programs, and compliance with civil right laws.
     
  • Serious Threat to Health or Safety. To prevent a serious threat to your health or safety or the health or safety of the public or another person, we may use or share health information, limiting disclosures to someone able to help lessen or prevent the threatened harm.
     
  • Military and Veterans. If you are a member of the armed forces, we may use and share your health information, as required by military command authorities. We may also use and disclose health information about foreign military personnel, as required by the appropriate foreign military authority.
     
  • National Security and Intelligence Activities. We may disclose health information to authorized federal officials conducting national security and intelligence activities or as needed to provide protection to the President of the United States, certain other persons or foreign heads of states or to conduct certain special investigations. As Required by Law. We may disclose your health information when required by law to do so.

De-Identified Information. We may remove all data elements that could be used to identify an individual from your health information to create a “de-identified” set of data that is no longer subject to HIPAA and this Notice.

Limited Data Set. We may create a “limited data set” of your health information by removing certain identifying information, as required by HIPAA. Such limited data set will only be used or shared for certain purposes allowed under HIPAA, such as research, public health, or operational purposes.

Use of Artificial Intelligence (AI). We may use AI or machine learning programs to help us deliver care, perform administrative functions, and operate our business.  AI tools will never be used as a decision-maker.  We will not use or share your identifiable health information with any AI programs or tools that could re-use or re-disclose your information without authorization.

YOUR AUTHORIZATION IS REQUIRED FOR OTHER USES

Except as described in this Notice and permitted by law, we will use and disclose your health information only with your written authorization. All of our uses and disclosures of your information will be done in accordance with applicable law (including HIPAA and 42 C.F.R. Part 2, as discussed further below). Even if you sign an authorization, it will only apply to the health information you specify for other particular uses or disclosures that you may allow. You may revoke an authorization to use or disclose your health information for the purposes covered by that authorization at any time, but the revocation will not affect instances where we have already relied on the authorization.

You should be aware that your health information disclosed pursuant to an authorization, consent or this notice may be subject to redisclosure by the recipient and no longer protected by HIPAA or the requirements of this Notice.

USES AND SHARING OF SENSITIVE HEALTH INFORMATION

Special restrictions may apply to the use and sharing of the following types of sensitive health information afforded heightened confidentiality protections by law. We will never disclose such information without your written authorization or as otherwise required by law.

Behavioral Health. If necessary for your diagnosis or treatment in a behavioral health program, behavioral (mental) health information may be used and shared as permitted or required by law. Very limited information may be disclosed for payment purposes. Otherwise, behavioral health information, including psychotherapy notes, may not be used or shared without your authorization except as specifically permitted under federal or state law.

HIV-related Information. HIV-related information may be used or shared for purposes of treatment or payment, but your authorization will be necessary for other disclosures except as permitted under state law.

Substance Use Disorder Treatment. Records the Children’s Providers receive of your care or referral for care in a specialized substance use disorder program protected under federal law (at 42 C.F.R. Part 2) cannot be shared without your consent except in narrow circumstances. You may provide a single written consent to permit all future uses or disclosures of your substance use disorder treatment records protected under 42 C.F.R. Part 2 for treatment, payment, and/or health care operations purposes of the Children’s Providers. If you provide such a consent, we may further use or disclose your records as permitted by HIPAA and this Notice without additional consent from you.  We may not use or disclose your records of substance use disorder treatment protected by 42 C.F.R. Part 2, or any testimony relaying the content of those records, in connection with any civil, criminal, administrative, or legislative proceedings against you without your consent, except as required by a court order accompanied by a subpoena or similar legal mandate (which order may only be issued after you are given notice and an opportunity to be heard).

Ask us if you have any questions regarding whether these requirements apply to you.

Minors. We will comply with Connecticut law when using or disclosing protected health information of minors. For example, if you are an unemancipated minor consenting to a health care service related to HIV/AIDS, venereal disease, abortion, outpatient mental health treatment or alcohol/drug dependence, and you have not requested that another person be treated as a personal representative, you may have the authority to consent to the use and sharing of your health information related to that treatment.

Marketing. A signed authorization is required for the use or sharing of your protected health information for a purpose that encourages you to purchase or use a product or service, except for certain limited circumstances such as when the marketing communication is face-to-face or when marketing includes the distribution of a promotional gift of nominal value provided by the Children’s Providers. We may also communicate with you about the programs and services offered by the Children’s Providers without needing your authorization.

Sale of protected health information. A signed authorization is required for the use or disclosure of your protected health information in the event that the Children’s Providers receive remuneration for such use or disclosure, except under certain circumstances as allowed by federal or Connecticut law.

USE AND SHARING OF YOUR INFORMATION FOR FUNDRAISING

Fundraising Activities. We may use your health information in order to contact you in an effort to raise money for Connecticut Children’s, including by sharing certain health information with our affiliated charitable foundation. Such information will be limited to certain contact information such as your name, address, phone number, and email address; the dates you received treatment or services; guarantor information; information regarding the department(s) in which you received care; treating provider information; and outcome information. A description of how to opt out of receiving any further fundraising communications will be included with any fundraising materials you receive from Connecticut Children’s. If you request that your information not be used or disclosed for fundraising purposes, we will ensure that you do not receive future fundraising communications.

We will not use any substance use disorder records subject to 42 C.F.R. Part 2 to contact you for fundraising purposes without your prior consent. Your decision to opt-out of receiving these communications will have no impact on your treatment or payment for services.

CHANGES TO THIS NOTICE

We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures of health information, your individual rights, our legal duties, or other privacy practices stated in this Notice. We reserve the right to change this Notice and to make the revised or new Notice effective for all health information already received and maintained by the Entities, as well as for all health information we receive in the future. We will post a copy of the current Notice in all of our offices. In addition, we will post a copy of the revised Notice on our website: www.connecticutchildrens.org and provide a copy to all patients at their next encounter with the Entities.

NOTICE EFFECTIVE DATE

This notice went into effect on February 16, 2026.

RESTRICTIONS

If you would like to request a restriction on the use or disclosure of your health information, please contact our Health Information Management department at 860-837-5780 or send the request by mail to:

Connecticut Children’s Medical Center
Connecticut Children’s Specialty Group
Health Information Management Department
282 Washington Street
Hartford, CT 06106

COMPLAINTS

If you believe that your privacy rights have been violated, you may file a complaint in writing with us (through the Compliance/HIPAA Officer and/or committee) or with the government.

  1. To file a complaint with the government, you may contact: Office of Civil Rights, U.S. Department of Health and Human Services 200 Independence Avenue, S.W., Room 509F Washington, D.C. 20201
  2. To file a complaint with us, you should contact the Connecticut Children’s Hotline Service by dialing 877-363-3073 or 800-297-8592 (Spanish).
  3. You will not be retaliated against for filing a complaint.

FOR FURTHER INFORMATION

If you have any questions about this Notice or would like further information concerning your privacy rights, please contact the Connecticut Children’s Hotline Service by dialing 800-723-5985 or by visiting https://reportanissue.com/connecticutchildrens.