Notice from the Chief Privacy Officer

Dear Patients and Visitors,

Protecting the privacy of your health information is important. We are pleased to provide the information below to inform you about a federal law that is designed to help protect the privacy of that health information. This law is known as the HIPAA Privacy Rule.

The Privacy Rule requires us to give you a copy of our Notice of Privacy Practices ("the Notice"). This Notice explains our use of your medical or health information. The Rule also requires us to ask you to sign a form called the Acknowledgment. By signing this form you are confirming that you received a copy of the Notice.

We hope that the UChicago Medicine and Ingalls Notice of Privacy Practices both help you to understand the ways we use and protect your health information. If you have any questions about this Notice or our privacy practices, please feel free to contact the HIPAA Program Office at 773-834-9716.

Karen Habercoss
Chief Privacy Officer




I. Our Organization

This Notice describes the privacy practices of the University of Chicago Medicine Organized Health Care Arrangement (“OHCA”). The UCM OHCA includes the:

  1. The University of Chicago Medical Center (UCMC), including its nurses, residents, volunteers, and other staff;
  2. Portions of the University of Chicago that participate in or support the activities of health care, including its physicians, nurses, students, volunteers, and other staff;
  3. UCM Community Physicians;
  4. UCM Care Network Medical Group;
  5. Primary Healthcare Associates, SC

A list of our care sites is provided at the end of this Notice and on our website. Collectively, these entities will be referred to as “we” or “us” in this Notice. We will share your medical information with each other to treat you, obtain payment for our services and operate our hospitals and clinics as permitted by HIPAA.

II. Your Representatives

If you are under 18 years of age, usually your parent(s) or guardian(s) handle your privacy and your medical information for you, although there are a few exceptions.
If you are an adult with others who make decisions for you, such as your health care surrogate, they may make decisions about your privacy and your medical information.

III. Our Responsibility Regarding Your Medical Information

We respect the privacy of your medical information. Each time you visit us, we record information about the care you receive, including external information we receive about your health care and information to seek payment for our services (your “medical information”). This medical information is also called your “Protected Health Information” (“PHI”). These records may be kept on paper, electronically on a computer, or stored by other media.

UCMC is required by law to:

  • Maintain the privacy and security of your PHI;
  • Notify you following a breach of your unsecured PHI, if required by law;
  • Provide this Notice to you and describe the ways we may use and share your PHI;
  • Notify you of your rights regarding your PHI;
  • Follow the terms of this Notice.

We reserve the right to make changes to this Notice at any time and to apply new privacy or security practices to medical information we maintain. Our website will contain the most current version of our Notice. You can access the Notice that is current at any time at You can also request a paper copy of this notice from our Privacy Program.

IV. How We May Use and Share Your Medical Information

This Notice explains how we may use and share medical information about you in order to provide health care, obtain payment for that health care, and operate our business. This Section also describes several other circumstances in which we may use and share your medical information. We do not need your authorization (permission) to use your medical information in the following circumstances:

1. Treatment
We keep records of the care and services we provide to you. We may use and share your information with doctors, nurses, technicians, medical or nursing students, or anyone else who needs the information to take care of you.

Example 1: A doctor treating a patient for a broken leg may need to ask another doctor if the patient has diabetes, because diabetes may slow the leg’s healing process. This may involve talking to doctors and others not employed by us. If they are involved in the patient’s health care, we may disclose the patient’s medical information to them for purposes of the patient’s treatment.

Example 2: We use medical information to notify you about products or services we provide that are related to your health, recommend treatment alternatives and to provide information about health-related benefits or services that may be of interest to you.

2. Payment
We may use and share information about you so that we and other health care providers that have provided services to you, such as an ambulance company, may bill and collect payment for those services. Your information may be used to obtain payment from you, your insurance company, or another person you identify.

Example: We submit claims for services rendered using medical information about the services provided to obtain payment from insurance companies, including Medicare, and family members or others who are responsible for paying the patient’s bill.

3. Health Care Operations
We may use and share information about you for business tasks necessary for our operations, including, for example, to improve the quality of care, train staff and students, provide customer services, or conduct any required business duties to better serve our patients and community. Also, we may share your medical information with others we hire to help us provide services and programs.

Example 1: The University of Chicago Medicine is an academic medical institution and we provide education and training across many health care disciplines, such as medical students, nursing students, and other professional student disciplines. Your medical information may be used for training purposes.

Example 2: We may use your information to improve the quality of our own health care services provided, to improve the process or outcome of your care, or to improve your satisfaction with the care we provide.

Example 3: UCM may share your information with outside entities we use to assist us in carrying out our operational activities such as benefit management or data analysis.

4. Relatives, Close Friends, and Caregivers
We may share your medical information with your family member or relative, a close personal friend, or another person you identify if you do not object to the disclosure or you agree to share your information with them. If, for some reason such as medical emergency, you are not able to agree or disagree, we may use our professional judgment to decide whether sharing your information is in your best interest. This includes information about your location and general condition.

5. Contacting You
We may use and share your medical information to contact you about appointments and other matters by mail, telephone, or email. When calling or emailing you with the contact information you give us to remind you of your appointment, we may include your name, the clinic, the location, and the physician or other health care provider you have the appointment within any message left on voice mail, with an individual who answers the phone or within an email. We will honor any reasonable request you make to receive an appointment reminder in a different way. We may also contact you to follow up regarding test results, care received, or to notify you about treatment options or health-related products or services that may interest you.

6. Patient Directory
We may automatically include your name, location in the hospital, general health condition and religious affiliation in a directory of patients in our hospital unless you tell us you do not want your information in the directory. Information in the directory may be shared in emergency situations and to members of the clergy. Directory information other than religious affiliation may also be shared with anyone who asks for you by name.

7. Fundraising
We may use limited information about you (e.g., your name, address, phone number, date of birth, gender, dates on which we provided health care to you, your treating physician, outcome information, and health insurance status) to contact you to raise money for our programs and services. You can opt out of these communications at any time by contacting our Development Office by phone at (773) 834-9166 or by e-mail at

8. Research
We perform research at UCM to support learning of new knowledge and treatments that may benefit all patients. We will inform you and obtain your authorization for any research that involves identifiable information about you as required by law. All human subject research is reviewed by our Institutional Review Board. UCM researchers may look at your medical information to explore whether future studies are possible or to identify and contact you about whether you want to take part in research. We may also gather information to publish an educational article, but we will not identify you in this way without your written authorization. Our researchers may use or share your information without your authorization (a) if the group that oversees research gives them permission to do so, (b) if the patient data is being used to prepare for a research study, or (c) under certain circumstances if the research is limited to data of deceased patients.

9. Permitted and Required by Law
We are required and permitted by federal, state and local laws to share medical information to certain government agencies and others. For example, we may share your medical information to:

  • report information to public health authorities for the purpose of preventing or controlling disease, injury, or disability;
  • report abuse and neglect to government authorities, including social service or protective service agencies;
  • report information about products and services to the FDA;
  • alert a person who may have been exposed to a communicable disease or may otherwise be at risk of developing or spreading a disease or condition;
  • report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance;
  • prevent or lessen a serious and imminent threat to a person for the public’s health or safety, or to certain government agencies with special functions; and
  • report proof of student immunization to your schools.

We may also share your medical information:

  • with a government oversight agency that oversees the health care system and ensures the rules of government health programs and other rules that apply to us, are being followed;
  • as a part of a judicial or administrative proceeding in response to a legal order or other lawful process;
  • with the police or other law enforcement officials for example, reporting about certain physical injuries, crimes, victims or unidentified patients; and
  • for special government programs, for example programs related to veterans or the military.

10. Organ and Tissue Donation
We may release your medical information to organizations that manage organ, tissue, and eye donation and transplantation.

11. Deceased Patients
We may share medical information about deceased patients to the coroner, medical examiner or funeral director.

V. Other Uses of Your Medical Information

We will not use or share your medical information for any reason other than those described in this Notice without a written authorization signed by you or your personal representative. An authorization is a document that you sign that directs us to use or disclose specific information for a specific purpose. For example, if you want your medical information sent to a family member, we will ask you to sign an authorization.

We will obtain your written permission:

  • Before we share your Highly Confidential Information for a purpose other than those permitted by law, including information about:
    • Abuse or neglect of a child, an elderly person, or an adult with a disability;
    • Genetic testing;
    • HIV/AIDS testing, diagnosis or treatment;
    • Invitro Fertilization (IVF);
    • Mental health and developmental disabilities;
    • Sexually transmitted diseases; and
    • Sexual assault.
  • To use or disclose your medical information to contact you to market others’ products or services.
  • For the sale of your medical information.

Psychotherapy notes (your mental health provider’s written notes) will only be disclosed with your written permission and the consent of your mental health provider.
You may change your mind about your authorization at any time by sending a written “revocation statement” to the Privacy Program. The revocation will not apply if we have already taken action for which we relied on your permission.

VI. Your Rights Regarding Your Medical Information

1. Inspect and Receive a Copy Your Medical Information
You may access and receive a copy your medical record file, billing records, and other similar records used to make decisions about your treatment and obtain payment for our services. We may deny access to a portion of your records under limited circumstances. If you want to see your records or receive a copy, call Health Information Management (Medical Records) at (773) 702-1637. We will expect you to complete, sign, and return a Record Request form. We will charge you for the reasonable cost of the copy and postage costs to the extent that the law allows it.

2. Receive Confidential Communications
You may ask us to send papers that contain your PHI to a different location than the address that you gave us, or in a special way. You will need to ask us in writing. We will try to grant any reasonable request. For example, you may ask us to send a copy of your medical records to a different address than your home address.

3. Amend Certain Records
You have the right to request an amendment (correct or add to) to your medical information that we maintain. If you believe that the information is either inaccurate or incomplete and you would like to amend your information, you may obtain an Amendment Request Form from the Privacy Program. We will decide if we will grant your request or, under limited circumstances, deny your request.

4. Receive an Accounting of Disclosures
You may request a list (accounting) of people or organizations, outside of UCM, with whom we have shared (disclosed) your medical information. This list will not include disclosures:

  • To you
  • For your treatment
  • To obtain payment for your treatment
  • Permitted by your authorization, or
  • As described in this Notice.

We will not go back more than six (6) years before the date of your request.

5. Request Restrictions
You have the right to ask us to restrict or limit the medical information we use or disclose about you for treatment, payment, or health care operations. We are not required to agree to your request with one exception specified below. If we do agree, we will comply unless the information is needed to provide emergency treatment. Your request for restrictions must be made in writing and submitted to the Privacy Program. By law, we must agree to your request to restrict disclosure of your medical information to a health plan if the disclosure is a) for the purpose of carrying out payment or health care operations, b) is not otherwise required by law, and c) for an item or service you have paid for in full, out-of-pocket.

6. Breach Notification
You may have the right to be notified in the event of unpermitted access or use of unsecured medical information. If the law requires us to notify you of this type of access or use, then we will notify you promptly with the following information:

  • A brief description of what happened,
  • A description of the medical information involved,
  • Recommended steps you can take to protect yourself from harm,
  • What steps were taken in response to the breach, and
  • Contact procedures so you can obtain further information.

Effective Date

Our original Notice was effective in April 2003. It was revised in May 2012, September 2013, January 2017. This version is effective February 2020.

University of Chicago Medicine Locations

All UCM health care providers providing health care to the public at all of their delivery sites, including on-campus and off-site locations in and around Chicago and Northwest Indiana follow this Notice. A current list of all locations can be found on the University of Chicago Medicine website.

  • The University of Chicago Medicine Main Campus; All Adult and Pediatric Sites, including Emergency Departments, Chicago
  • The University of Chicago Medicine Center for Advanced Care; All Ambulatory Offsite Clinics, Greater Chicagoland Locations
  • The University of Chicago Medicine Physician Offices; All Primary Care and Specialty Care Clinics, Greater Chicagoland Locations

Further Information and Complaints

If you would like more information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact the Privacy Program. You may also file written complaints with the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services. When you ask, the Privacy Program will provide you with the correct address for the OCR. We will not take any action against you if you file a complaint with us or with the OCR.

You may contact the Privacy Program at:

The University of Chicago Medicine
Privacy Program
5841 South Maryland Avenue, MC1000
Chicago, IL 60637
Telephone Number: (773) 834-9716
Anonymous Report Line: 1-877-440-5480, Option 2

Download Privacy Practices PDFs

The University of Chicago Medicine Notice of Privacy Practices

Ingalls Memorial Notice of Privacy Practices

Why Choose UChicago Medicine

We are advancing the forefront of health every day by bringing research to reality and advanced care closer to our patients. Welcome to the forefront.

Two UChicago Medicine nurses celebrate Magnet recognition
Thomas Kelly and patient at OP
Two UChicago Medicine Day of Service and Reflection (DOSAR) volunteers performing gardening tasks
Vivek Prachand, MD, in surgery
South Loop family medicine physician, Cindy Iglesias, MD, smiling at her new patient, a baby
Male and female researchers working in a lab at the Comprehensive Cancer Center
Close Dialog