Notice of Privacy Practices

Effective October 1, 2026

Our Legal Duty

We are required by law to maintain the privacy and security of your protected health information, to give you this notice of our legal duties and privacy practices, and to notify you if a breach of unsecured protected health information occurs that requires notification. We must follow the terms of the notice currently in effect.

We may change the terms of this notice and our privacy practices as permitted by law. A revised notice may apply to all protected health information we maintain, including information created or received before the revision. When we make a material change, we will make the revised notice available upon request, post it where required at our facilities and on our website, and provide it as required by law.

You may request a copy of our notice at any time, and it is available on our website. For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Who Will Follow This Notice

This notice describes the privacy practices of Riverside Healthcare, which is the umbrella term for all individual Riverside entities, and the health care professionals that participate in this joint notice. It applies to their workforce members and to members of the medical staff when they provide services at Riverside facilities and participate in our organized health care arrangement. Participants may share protected health information with one another as permitted by law for treatment, payment, and the health care operations of the arrangement. An independent provider may also give you a separate notice describing that provider’s practices.

Riverside may share protected health information with business associates that perform services for us under agreements requiring them to safeguard the information. A business associate’s work for Riverside does not, by itself, make that business associate a participant in this joint notice.

Participants in Our Organized Health Care Arrangement

• Riverside Healthcare and its individual entities, divisions, departments, units, facilities, and service locations
• Riverside Healthcare workforce members, including employees, trainees, volunteers, and employed health care professionals
• Members of the medical staff and their workforce members when they provide services at Riverside facilities and participate in Riverside Healthcare’s organized health care arrangement
• Riverside Healthcare employed physicians and their office staff

Uses and Disclosures of Medical Information

We use and disclose medical information about you for treatment, payment, and health care operations. Please note that the following are examples and not an exhaustive listing:

Treatment: We may use or disclose your medical information to a physician or other health care provider in order to provide treatment or health-related services to you or to arrange the next level of care on your behalf.

Payment: We may use and disclose your medical information to obtain payment for services we provide to you, including but not limited to disclosing your information to a billing company in connection with collections and billing activities. We may need to give your insurance company your medical information in order to pre-authorize planned services or receive payment for services provided. We may disclose your medical information to another health care provider or entity subject to the federal and state Privacy Rules so they can obtain payment.

Health Care Operations: We may use your PHI for various administrative tasks, to contact you when necessary, and to help improve your care. For example, we may use your PHI to contact you to remind you about an upcoming appointment.

People Involved in Your Care or Payment for Your Care: We may share information relevant to your care or payment with a family member, friend, or other person you identify. When you are available and able to make health care decisions, we generally will give you an opportunity to agree or object, or we may reasonably infer from the circumstances that you do not object. If you are unavailable or unable to decide, we may use professional judgment to share information that is directly relevant to the person’s involvement in your care or payment. We may also disclose information needed to notify or help notify a person responsible for your care about your location, general condition, or death, and may share information with organizations assisting in disaster relief as permitted by law.

Required by Law; Public Health and Oversight: We will disclose health information when federal or state law requires us to do so. We may also disclose information when the law permits us to do so for specified purposes, such as public health reporting, reports of certain injuries or suspected abuse or neglect, health oversight, and compliance reviews. We will apply any conditions and limits that govern a particular disclosure, including protections under laws that are more restrictive than HIPAA.

Coroners, Medical Examiners, and Funeral Directors: We may also share information with coroners, medical examiners, or funeral directors when a patient dies.

Workers’ Compensation: We may share PHI in response to a request related to workers’ compensation claims that a patient makes.

Legal Proceedings and Law Enforcement: We may disclose health information in response to a court or administrative order, subpoena, or other lawful process, or for a law-enforcement purpose, only when the applicable legal requirements are met. Additional restrictions may apply to particular records.

Hospital Directory: Unless you object or another law limits disclosure, we may include limited information about you in our facility directory and provide appropriate directory information to people who ask for you by name. You may tell us not to include your information.

Organ and Tissue Donation: We may share health information with organizations involved in organ, eye, or tissue donation as permitted by law.

Specialized Government Functions and Correctional Facilities: We may disclose PHI for specific government security needs. Medical details of inmates can be disclosed to correctional institutions or law enforcement agencies to provide necessary health care, protect the well-being of the inmate and others, and support the security and functioning of the facility. Such disclosures are allowed under certain conditions to ensure safety and order within the institution.

Research: We may use or disclose health information for research when you authorize it or when another legal basis permits it, such as an appropriate waiver or approval by an institutional review board or privacy board. We will meet the applicable conditions before using or sharing information for research.

Future Communications: We may use your medical information to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you. We may provide you information by a general newsletter, in person or by way of products or services of nominal value. We may disclose your medical information to a business associate to assist us in these activities.

We may contact you by email or text messaging for appointment reminders, patient surveys, or other general communications if you provide us with your email address and/or mobile telephone number. You expressly permit this type of contact unless you notify us that you do not want to receive email or text messages.

Fundraising: We may use your medical information to contact you for our fundraising purposes. We will limit our use and disclosure to your demographic information (e.g., name, address, other contact information, age, gender, and date of birth), the dates that health care or other service was provided to you, department or location of service information, treating provider, outcome information, and health insurance status. We may disclose this information to a business associate or an affiliated foundation to assist us in our fund-raising activities. We will provide you, in any fundraising materials, a description of how you may opt out of receiving future fundraising communications. Riverside does not use or disclose records protected by 42 CFR Part 2 for fundraising.

Organized Health Care Arrangements: Riverside Healthcare participates in certain health care arrangements with other health care providers, including independent physicians on our medical staff and other organization such as Rush Health. As a participant in these organized health care arrangements, we share information with other participants for certain joint activities, including utilization review, quality assessment, contracting, and payment.

Uses and Disclosures Requiring Your Written Authorization: We will obtain your written authorization for uses or disclosures that require it under applicable law, including most uses or disclosures of psychotherapy notes, uses or disclosures for marketing that require authorization, and sales of protected health information. We will also obtain your authorization for other uses or disclosures that are not described in this notice and are not otherwise permitted or required by law.

You may revoke an authorization in writing at any time. Revocation will not affect actions we already took in reliance on the authorization. If you ask us to send copies of records to you or another person, any fee will be determined under the law applicable to that request.

Information Protected by Additional Laws: Some health information receives additional protection under federal or Illinois law. Depending on the information and the circumstances, this may include records concerning substance use disorder treatment, mental health or developmental disabilities, HIV testing, and other specially protected information. We will follow the applicable law when it provides greater protection or imposes additional conditions on a use or disclosure.

Records Protected by 42 CFR Part 2: Riverside Healthcare offers a program that is subject to 42 CFR Part 2. Part 2 protects certain records from federally assisted substance use disorder treatment programs; it does not apply to every reference to substance use in a medical record. To the extent we create, maintain, or receive records protected by Part 2, we will use or disclose them as permitted by Part 2 and other applicable law. A patient may provide a single consent for future uses and disclosures of Part 2 records for treatment, payment, and health care operations. When a HIPAA covered entity or business associate receives Part 2 records under that consent, it may redisclose them as HIPAA permits, subject to the continuing Part 2 restriction on use of the records in proceedings against the patient.

Part 2 records, or testimony describing their contents, may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a Part 2 court order entered after the required notice and opportunity to be heard. A court order authorizing use or disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure.

Your Health Information Rights

Right to Inspect and Receive a Copy: With limited exceptions, you may ask to inspect or receive a copy of health information about you in the records we use to make decisions about you. You may request an electronic copy when the information is available electronically. We will provide the requested form and format if it is readily producible; otherwise, we will work with you to provide a readable form and format. You may make a request in writing by contacting the Privacy Officer at the address below. We will respond within the time required by law.

We may charge a reasonable, cost-based fee permitted by applicable federal and Illinois law. We will tell you about any applicable fee. If we deny access, we will explain the reason in writing and tell you about any right to have the denial reviewed.

Right to an Accounting of Disclosures: You may request an accounting of certain disclosures of your protected health information made during the six years before your request. The accounting will not include disclosures that the law excludes, such as most disclosures for treatment, payment, or health care operations and disclosures made pursuant to your authorization. You may request an accounting in writing from the Privacy Officer. We will provide one accounting in a 12-month period without charge. If you request another during that period, we may charge a reasonable, cost-based fee after informing you of the fee and giving you an opportunity to withdraw or modify your request.

Restriction: You have the right to request that we place certain restrictions on our use or disclosure of your medical information. We are not required to agree to these additional restrictions except in limited circumstances described below, but if we do, we will abide by our agreement except in an emergency. Any request for additional restrictions must be in writing. You may obtain a form to request additional restrictions on the use or disclosure of your medical information by using the contact information for our Privacy Officer listed at the end of this notice. We will not be bound to the restrictions unless our agreement is formally put in writing and signed by a person authorized to make such an agreement on our behalf. If you pay in full out of pocket for a health care item or service and ask us not to disclose information about that item or service to your health plan for payment or health care operations, we will honor the request unless the disclosure is required by law.

Confidential Communication: You have the right to request that we communicate with you about your medical information by alternative means or to alternative locations. For example, you might request that we contact you at work or by mail. You must make your request in writing. You may obtain a form to request alternative communications by using the contact information listed at the end of this notice. We will accommodate reasonable requests. We may ask you to specify how or where you want us to contact you and, when relevant, how payment will be handled; we will not require you to explain why you are making the request.

Amendment: If you believe health information we maintain about you is incorrect or incomplete, you may ask us to amend it. Your written request must explain the reason for the requested amendment. You may obtain a form to request an amendment by using the contact information for our Privacy Officer listed at the end of this notice. We may deny a request for reasons permitted by law, including when we did not create the information and its creator is available to act on the request. If we deny your request, we will provide you a written explanation. You may respond with a statement of disagreement to be attached to the information you wanted amended. If we accept your request to amend the information, we will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of that information.

Electronic Notice: If you receive this notice on our web site or by electronic mail (email), you are entitled to receive this notice in written form. Please contact us using the information listed for our Privacy Officer at the end of this notice to obtain this notice in written form.

Health Information Exchange

Riverside Healthcare participates in health information exchanges (HIEs), including Rush Health Connect, the HIE operated by Rush Health. As a participant, we make patient medical information available electronically to other participating hospitals, physicians, and other authorized users for treatment, payment, and healthcare operations purposes. We may also receive information about patients from other participants in our HIEs. These health information exchanges, including Rush Health Connect, may participate in other HIEs on our behalf. In the future, we may also participate directly in additional regional, state or federal HIEs.

You may opt out of electronic exchange of your information through Epic by submitting a request to our Privacy Officer. The Privacy Officer can explain how to submit the request, when it will take effect, and any limits on the request. A request generally will not retrieve information already shared with another organization.

The Privacy Officer can also provide you the form needed to reverse your opt-out should you later choose to make your health information available through the HIEs. Making your information available for treatment through our HIEs is not a condition of receiving care.

Information Sharing Through Our Electronic Medical Record

Riverside Medical Center uses an electronic medical record software called Epic, which has programs that may allow us to electronically exchange medical information with other health care providers. You may opt out of electronic exchange of your information through Epic by submitting a request to our Privacy Officer. The Privacy Officer can explain how to submit the request, when it will take effect, and any limits on the request. A request generally will not retrieve information already shared with another organization. Making your information available in this manner is not a condition of receiving care.

Questions and Complaints

If you want more information about our privacy practices or have questions or concerns, please contact us using the information listed at the end of this notice.

If you believe we have violated your privacy rights, including rights involving records protected by 42 CFR Part 2, or you disagree with a decision about your health information, you may contact our Privacy Officer or use our Compliance Line. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201.

We will not retaliate against you for filing a complaint.