Error: You must enable JavaScript to use this site. Click here for instructions on enabling JavaScript.
MyChart ® Epic Systems Corporation

Patient and Web Site User Privacy Rights

Patients Privacy Rights


Northwestern Medicine Faculty Foundation (“NM,” “we,” or “us”) is committed to respecting the privacy and confidentiality of your health information. In addition, the Health Insurance Portability and Accountability Act (HIPAA) requires us to maintain the privacy of your health information. We are also required to give you this notice that explains NM’s privacy practices and legal duties related to your health information, as well as your rights with regard to your health information. This notice describes the practices of all health care professionals allowed to enter information into your health care records at NM, all NM workforce, and any volunteers we allow to help you while you are at NM.

NM seeks to not only provide quality care, but also to make your overall experience here at NM ideal. We strive to accommodate patient needs and requests – including needs and requests with respect to your health information.  Specifically, you have the right to:

  • View and receive a copy of your health information (with some limited exceptions) held by NM.
  • Have your health information amended if you believe that it is wrong or if information is missing, and NM agrees. If NM disagrees, you may have a statement of your disagreement added to your health information.
  • Obtain a listing of those getting your health information from NM. The listing will not cover uses and disclosures made: to you; for payment, treatment or health care operations; pursuant to an authorization; incidentally; for uses and disclosures for which you have the right to object (and you did not object); for national security purposes; to corrections or law enforcement personnel; or as part of a limited data set.
  • Ask NM to communicate with you in a different manner or at a different place (for example, by sending materials to a P.O. box instead of your home address). NM must accommodate reasonable requests.
  • Request NM to limit how your health information is used and disclosed for treatment, payment, or health care operations or for uses or disclosures for which you have the right to object (discussed below). It is your responsibility to make such requests. However, NM is not required to agree to your request, except as otherwise required by law. Even if we do, we may still use or disclose the information for your emergency treatment.
  • Get a separate paper copy of this Notice even if you agreed to receive this Notice by e-mail.

To accomplish any of the above items, contact the Patient Services Center, 1st Floor, Galter Pavilion, 312-695-1920 (TDD: 312-695-3661). For tracking purposes, you may have to complete a form and submit your request in writing.

We use your health information within NM. We share or disclose your health information to others outside NM for many different reasons. The Notice explains the ways we use and disclose your health information. It will also advise you when we need to get your specific permission or authorization to use or disclose your information. With some exceptions, we use or disclose only those portions of your health information that are necessary to satisfy the need for which the information is being used or disclosed.

Those Instances that Require the Use or Disclosure of Your Health Information
NM must use and disclose your health information:

  • to you or someone who has the legal right to act for you (your personal representative);
  • to the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected; and
  • when required by law.

The Use and Disclosure of Your Health Information for Treatment, Payment, and Health Care Operations
NM is allowed to use and disclose your health information without your authorization for treatment, payment, and health care operations.

  1. Treatment. NM will use and disclose your health information to provide, coordinate or manage your health care and related services. For example, your NM primary care doctor may refer you to an NM specialist, such as a radiologist or surgeon. In doing so, the primary care doctor will likely share information about you with the specialist. In some instances, NM may ask that you give us written permission to share your health information with other providers. The reason for this request is to verify that the other doctor is a provider of your care and, thus, should receive your health information. NM may also use your health information to provide appointment reminders or give you information about treatment alternatives, or other health care services or benefits that may be of interest to you.
  2. Payment. NM will use and disclose you health information to bill and collect payment for the health care services it provides to you. For example, if you have health insurance, NM may disclose your information to the insurance company to receive payment. NM may also disclose your information to other providers for their payment activities.
  3. Health Care Operations. NM may use and disclose your health information to carry out ”health care operations.” These are activities that are needed to operate NM facilities and carry out its mission. They include, for example:
    • Conducting quality assessment and improvement activities.
    • Reviewing the qualifications and performance of health care providers, training, and performing accreditation, certification, or licensing activities.
    • Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
    • Managing NM business and performing general administrative activities

NM may disclose your information to other organizations covered under HIPAA and with whom you have a relationship for certain services of their health care operations.

Other Purposes for which NM is Allowed to Use or Disclose Your Health Information
NM may use and disclose your health information to you or your personal representative. In addition, NM may use or disclose your health information to others without your authorization as permitted by law, and examples are listed below. NM must comply with various legal requirements in order to do so.

  • For judicial or administrative proceedings (such as in response to court order).
  • For law enforcement purposes (such as providing limited information to locate a missing person).
  • For public health activities (such as reporting specific diseases or outbreaks).
  • To report to appropriate authorities incidents of abuse, neglect or domestic violence.
  • For government health oversight activities (such as fraud and abuse investigations).
  • To facilitate organ and tissue donation.
  • To coroners, medical examiners and funeral directors.
  • To avoid a serious and imminent threat to health or safety.
  • For specific government functions (such as disclosing health information for national security purposes, including protecting the President of the United States or conducting intelligence operations).
  • For workers’ compensation purposes.
  • To create a collection of de-identified information that can no longer be traced back to you.

NM is allowed to disclose your health information to its “business associates” - individuals or companies that provide services to NM. For example, this would include the company that administers the billing claims for NM, software vendors, and other service providers. NM requires that all business associates appropriately safeguard your information.

NM may use your demographic information (e.g., name, address, phone number) and the dates you received services at NM and disclose that information to either our business associate or certain affiliated entities for our fundraising purposes. For example, in order to provide expanded programs in specialty areas we may want to raise additional money and, therefore, may contact you for a donation. If you do not want to be contacted, please contact the Patient Services Center at 312-695-1920 (TDD: 312-695-3661).

Finally, NM may use or disclose your health information incidentally as part of another use or disclosure that is permitted under law.

Because NM is part of an academic medical center, asking scientific questions and conducting medical research are key parts of our mission. Physician researchers and scientists share a commitment to research that brings the promise of new and better treatments and the constant search for cures. Your medical information may be important to research efforts and may be used for research purposes in accordance with state and federal law.

All research projects conducted at NM by researchers associated with Northwestern University Feinberg School of Medicine are approved through a review process designed to protect the safety, welfare, and confidentiality of our patients. Feinberg acts as a custodian of a secure electronic database that contains a copy a NM’s electronic medical record, including your medical information, as well as information from other participating health care providers, such as Northwestern Memorial Hospital.

Except as otherwise required by certain state or federal laws, researchers may use this database is several ways, some of which may not require your written permission. For example, researchers may look at your medical information as necessary within the database:

  • To plan future research studies. For example, your information could be viewed by researchers trying to determine how often heart disease occurs in individuals of a certain age.
  • To identify and contact you regarding your interest in taking part in a specific research study. Your part in that study can only start after you have been told about the study, are given a chance to ask questions and have shown your willingness to be in the study by signing a consent form.
  • If information that identifies you has been removed.
  • When the research has been approved through a special review process that finds that there is little risk to patient privacy. For example, a research study may involve comparing the outcomes of patients who received different treatments.

In other situations, your written permission will be required. For example, if a research project will involve information that is specially protected under Illinois law – such as mental health, developmental disabilities, HIV/AIDS, and genetic counseling or testing information – your written consent may be needed for the researcher to remove any information that identifies you or to look at your medical information for any of the reasons listed above.

If you have questions regarding the above, please call the Northwestern University Office for the Protection of Research Subjects at 312-503-9338. To learn more about research at Feinberg, please contact the Office of Research at 312-503-1499 or go to

Uses and Disclosures for Which You Have the Opportunity to Object
Unless you object, NM may share relevant health information about you with a family member or other person close to you if they are involved in your care or payment for your care. NM may use or share your health information to notify a family member or other person responsible for you of your location, general medical condition, or death.

NM also may use or share your health information with a public or private agency assisting in disaster relief. This is to coordinate efforts to notify someone on your behalf. If we can reasonably do so while trying to respond to the emergency, we will try to find out if you want us to share this information and abide by your wishes.

Uses and Disclosures of Information for Marketing
We will need your written authorization to use and disclose your health information to contact you for marketing purposes. “Marketing” includes communication about a product or service that encourages you to purchase or use the product or service. Marketing does not include NM’s describing a health-related product or service that NM provides, performing treatment, case management or care coordination, or recommending alternative treatments, therapies, health care providers, or setting of care, unless NM receives compensation from a third party for these activities.  NM may also conduct marketing activities with you without your authorization if the marketing is face-to-face or if it involves a promotional gift of nominal value.

Uses and Disclosures of Information that Require Your Written Permission (Authorization)
Uses and disclosures of your health information for purposes other than those referred to in this Notice will be made only with your written authorization. If you choose to sign an authorization to disclose your health information, you can later take back (revoke) that authorization to stop any future uses and disclosures. However, it will not stop any uses or disclosures that NM has already made before you took back your authorization. Your revocation must be in writing.

Additional State and Federal Requirements
Some Illinois and federal laws provide additional privacy protection of your health information. These include:

  • Sensitive Information. Some types of health information are particularly sensitive, and the law, with limited exceptions, may require that we obtain your written permission or in some instances, a court order, to use or disclose that information. Sensitive health information includes information dealing with genetics, HIV/AIDS, mental health (including psychotherapy notes), alcohol and substance abuse, artificial insemination, and sexual assault.
  • Information Used in Certain Disciplinary Proceedings. State law may require your written permission if certain health information is to be used in various review and disciplinary proceedings by state health oversight boards (e.g., the Department of Professional Regulation).
  • Information Used in Certain Litigation Proceedings. State law may require your written permission for certain providers to disclose information in certain legal proceedings.
  • Disclosures to Certain Registries. Some laws require your written permission if we disclose your health information to certain state-sponsored registries.

NM is committed to following all state and federal legal requirements.

NM must abide by the terms of this Notice as long as it is in effect. NM reserves the right to change its privacy practices and the terms of this Notice at any time. Changes will apply to the protected health information currently residing in NM. Any updated Notice will be posted on the NM web site and in all NM operational practice areas for public viewing. You may pick up a copy at our offices or request a copy of the current Notice by calling the Patient Services Center at the number listed below. You may also view it on our web site at

If you believe that we may have violated your privacy rights or you disagree with any action we have taken with regard to your health information, you may file a complaint with NM or the Office of Civil Rights of the Department of Health and Human Services. The Patient Services Center will provide you with the necessary assistance and paperwork. No retaliatory action will be taken.

If you have any questions about this Notice or any complaints, please contact the Patient Services Center at 312-695-1920 (TDD: 312-695-3661).

This Notice is effective as of June 14, 2010.