I want to

Schedule online

Pay your bill

Get medical records

Find a job

Make a donation

Volunteer
Classes & Events

Careers

For Physicians/APPs

Printable Versions

Printable copies of our Notice of Privacy Practices. Available in English and Spanish.

Notice of Privacy Practices

EFFECTIVE DATE: February 2026 (Sixth Edition)

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET THIS INFORMATION. PLEASE READ IT CAREFULLY.

This Notice applies to the below-listed separate corporate legal entities participating in an Organized Health Care Arrangement (OHCA) referred to in this Notice as “Cone Health.” These separate corporate legal entities may share protected health information (health information) as necessary to carry out treatment, payment and healthcare operations relating to the OHCA and for other purposes as permitted or required by law.

The Moses H. Cone Memorial Hospital Operating Corporation
Alamance Regional Medical Center, Inc.
Moses Cone Medical Services, Inc.
Moses Cone Physician Services, Inc.
Moses Cone Affiliated Physicians, Inc.
ARMC Physicians Care, Inc.

Patients treated for a substance use disorder by Behavioral Health at Alamance Regional Medical Center, Behavioral Health Hospital, Guilford County Behavioral Health Center and the R.E.A.C.H Maternity Clinic at the Center for Women’s Healthcare at MedCenter for Women have additional protections pursuant to 42 C.F.R. Part 2 (“Part 2”). Please see the Supplemental Part 2 Notice of Privacy Practices below.

The Purpose of This Notice

We are committed to protecting health information about you in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and implementing regulations (collectively, “HIPAA”) and other applicable laws. We are required by law to protect the privacy of any health information that identifies you, to provide you with this Notice describing our legal duties and privacy practices at Cone Health, and to follow the terms of the Notice currently in effect.

Who Will Follow This Notice

This Notice describes the practices of Cone Health at all its locations and the practices of:

Any independent healthcare professional who is on our Medical Staff and allowed to enter information into your Cone Health medical record.
All practices, departments and units of Cone Health.
Any member of a volunteer group allowed to provide services within Cone Health.
All Cone Health team members and affiliates.
All students and trainees at Cone Health.

All of these people, entities, sites, and locations follow the terms of this Notice. They may also share health information with one another for purposes of treating you, obtaining payment for your care, conducting Cone Health’s health care operations, and for the other purposes described in this Notice.

This Notice applies to all records of your care and the billing for your care that are created, received, maintained, or transmitted by Cone Health. This includes records made by Cone Health personnel, your independent personal provider, and other independent health care professionals while they are providing services within Cone Health. Your personal provider or other independent health care professionals may have their own policies or Notices about the confidentiality and sharing of your health information that they use in their offices or other locations outside Cone Health.

How We May Use and Share Medical Information About You

The following categories describe different ways that we use and share health information. For each category of uses or sharing, we will explain what we mean and try to give some examples, but not every use or disclosure is listed. Where specific state, federal, or other applicable law requires your consent to share information, we will ask for your consent either at the time of admission or at a later point when it becomes necessary. Please also review the “Special Situations” section below, which includes additional information related to our ability to use or disclosure your health information in the situations described.

For Treatment. We may use and share your health information with the people involved in your care to provide the treatment and services you need, such as prescriptions, laboratory testing, imaging, or surgery. We may also use and share your health information to coordinate and manage your care – for example, by sharing your health information with your referring or consulting physicians.

For Payment. We may use and share your health information so that the treatment and services you get at Cone Health may be billed by Cone Health or other independent providers and payment may be collected from you, an insurance company or health plan, or a third party. For example, we may need to give your insurance company or health plan information about surgery you received at Cone Health so your insurance company or health plan will pay us or pay you back for the surgery. We also may share your information with another health care provider, such as a receiving facility or your personal doctor, so they can bill and receive payment for treating you.

For Health Care Operations. Our team members and business associates may use and share your health information for the health care operations of Cone Health without your written consent. These uses and sharing of health information are needed to run Cone Health and make sure that all patients receive high quality care. For example, we may use your health information to review our treatment and services and to evaluate the qualifications and performance of our team members and medical staff in caring for you. We also may combine health information of many Cone Health patients to decide what other services Cone Health should offer, what services are not needed, and whether certain new treatments work. We also may share information with Cone Health personnel, doctors, and students for teaching purposes. We also may combine the health information we have about you and other patients with health information from other health care providers to compare how we are doing and learn how we can make our care and services better. We may remove information that identifies you from this set of health information, so others may use it to study health care and health care delivery without learning who you are. We may share your information with another health care provider for its health care operations if you also have received care from that provider.

Treatment Alternatives. We may use and share your health information to inform you about or recommend different ways to treat you.
Triad HealthCare Network (THN). Cone Health is a participant in Triad HealthCare Network, LLC (“ACO”), an accountable health care organization made up of participating providers known as “ACO participants”. Through the ACO, our patient information is combined with that of other ACO participants so the ACO can perform certain functions on our behalf, such as care coordination and joint utilization and quality assurance activities. The ACO participants have also created an organized system of health care through the ACO that allows us to use and disclose patient information in our respective records systems for permitted treatment, payment, and health care operations purposes.
Deidentification. Cone Health may disclose your de-identified health information without your consent. De-identification means removing information such as your name, address, and other direct identifiers from your health data, in accordance with HIPAA standards. De-identified data may be used for research, analytics, and operational purposes without revealing your identity.
Business Associates. Cone Health may share your health information with third parties that provide services on behalf of Cone Health involving creation, receipt, maintenance, or transmission of health information for or from Cone Health who have signed agreements, known as Business Associate Agreements, with Cone Health in accordance with HIPAA. These third parties are called Business Associates. Business Associates must comply with most requirements of HIPAA as well as the terms of their Business Associate Agreements.
Health Information Exchanges (HIEs) and Opt-Out Rights. Cone Health participates in health information exchanges (HIEs) such as Care Everywhere, NC HealthConnex, and the Trusted Exchange Framework and Common Agreement (TEFCA) to improve care coordination. These exchanges allow authorized health care providers to securely access and share your health information for your care.

You may opt out of sharing your health information through Care Everywhere at any time. To do so, contact Cone Health’s Health Information Management (HIM) office by email at him.requests@conehealth.com or careeverywhere@conehealth.com. If you opt out, other providers involved in your care will not be able to electronically obtain your full health information via Care Everywhere. However, Cone Health may still retrieve your health information from other providers, even if you opt out. If you do not want other providers to share your information through Care Everywhere, you must contact those providers directly.

You may prevent your health information from being available through NC HealthConnex by submitting an opt out request directly online at https://hiea.nc.gov/patients. If you receive care at other non-Cone Health facilities, you must opt out at each provider to prevent sharing through NC HealthConnex.

The Trusted Exchange Framework and Common Agreement is implemented on an organizational level and does not offer a direct patient opt out mechanism, but patients may be able to opt out of specific state-level HIEs that contribute to TEFCA, such as NC HealthConnex listed above.

Fundraising Activities. We may use information about you to contact you in an effort to raise money for Cone Health and its operations. Specifically, we may use information such as the unit or department from which you received services to target our fundraising efforts. For example, if we are raising money for women’s health services, we may send fundraising materials to people who have received women’s health care services from us in the past. We also may share health information with a business partner or a foundation related to Cone Health so that the business partner or foundation may contact you to raise money for Cone Health. We will only share your information with a business partner or foundation that has signed a Business Associate Agreement with Cone Health. We may only release limited information about you, such as your name, address and phone number, age and date of birth, gender, your physician, the part of Cone Health where you received your care, and the dates you received treatment or services at Cone Health. If you do not want to be contacted for all or certain types of fundraising efforts, you must notify Cone Health Philanthropy at OptOutFundraising@conehealth.com, indicate your choice on the fundraising mailing you received or request the fundraising restriction during registration at a Cone Health registration area. If you do opt out of future fundraising communications, we will not use or share your information for fundraising purposes, but we still may send you general fundraising communications that we send to the community that are not based on information from your treatment or stay at Cone Health. Your decision about whether or not to receive these communications from us will not affect your ability to get treatment at Cone Health. If you decide to opt out of some or all future fundraising communications, you may tell us later that you would like to receive these communications again.
The Directory. Unless you object, we may include certain limited information about you in the Cone Health directory while you are a patient receiving health care at a Cone Health facility. This information may include your name, location within Cone Health, your general condition (e.g., good, fair, serious, critical, etc.), and your religion. The directory information, except for your religion, may be given to people who ask for you by name or made available in press releases to the media. We can also share your religious affiliation with clergy affiliated with your faith, regardless of whether they ask for you by name. If you choose not to be listed in the directory, we will not be able to let your family, friends, clergy, or florists know that you are present at Cone Health. To opt out of being included in the directory, please inform the registration team member during your registration at a Cone Health site.

Individuals Involved in Your Care or Payment for Your Care. Unless you object, we may share health information about you with a friend or family member who is involved in your medical care. We also may share information with someone who helps pay for some or all of your care, such as a family member if you are a dependent covered under the family member’s health plan or if the family member is the guarantor of payment for your health care services. We may share health information about you with a business assisting in a disaster relief effort so that your family can be told about your condition, status, and location. You can object to the sharing of this information by telling us that you do not want any or all people involved in your care to get this information. If you are not present or cannot agree or object, we will decide whether it is in your best interest to share needed information with someone who is involved in your care or payment for your care or with a person or business assisting in a disaster relief effort.

Research. Sometimes, we may use and share health information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who got one medication to those who got another for the same problem. Health information about you that has had identifying information removed may be used for research without your written consent. We may share health information about you with people who are preparing for a research project, such as to help them look for patients with specific medical needs, so long as the medical information they review does not leave Cone Health’s physical premises or electronic health information system. If the researcher will have information about your mental health treatment that reveals who you are, we will get your consent before we may share that information with the researcher. Unless we notify you in advance and you give us written permission, we will not receive any money or other thing of value when we use or share your identifiable health information for research.

Research projects using your identifiable health information require approval by an Institutional Review Board (IRB) and, in most cases, your consent to participate in research and your HIPAA authorization. We may use or share de-identified health information for research or quality improvement without your consent. You may opt out of certain research uses by contacting our Health Information Management office at him.requests@conehealth.com or careeverywhere@conehealth.com.

Artificial Intelligence and Automated Decision Making. Cone Health and our Business Associates may use Artificial Intelligence (AI) technologies to support clinical care, improve operational efficiency, and enhance patient experience. AI tools may assist with clinical documentation, risk prediction, workflow optimization, and other health care operations. AI does not replace the clinical judgment of our providers and care teams; all medical decisions are made by qualified healthcare professionals. Patient identifiable health information processed by AI tools is protected under HIPAA and applicable privacy laws.
As Required or Permitted by Law. We will share health information about you when we have to or may do so under federal, state or local law. For example, North Carolina law requires that we report to state officials’ certain injuries to children or disabled adults. Any health information about you requested to be used or disclosed based on a court order will be limited to the information expressly authorized by the order. If a state or local law is different from HIPAA and not as protective of the privacy of the individual who is the subject of the health information, we will not share your health information unless allowed under HIPAA.

To Avert a Serious Threat to Health or Safety. We may use and share health information about you when we have to in order to prevent a serious threat to your health and safety or the health and safety of the public or another person. The information shared, however, would only be to someone able to help prevent the threat.
Genetic Information. We will not use or disclose health information that is genetic information for underwriting purposes or for any other purpose prohibited by State or federal law. For example, we will not disclose your genetic health information so that your health plan can compute your premium or contribution amounts.
Sensitive Data. We provide enhanced protections for sensitive health information, including genetic data, mental health, HIV Status, and reproductive health as required by law. We will not use or disclose health information that is sensitive for any purpose prohibited by State or federal law.

Special Situations - please review carefully

Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye, or tissue transplantation to facilitate organ or tissue donation and transplantation.
Workers’ Compensation. When you ask for workers’ compensation for a work-related injury or illness, we may share, without your written consent or permission, health information about you to your employer, insurer, or care manager who is paying for your treatment for that work related injury or illness.
Victims of Abuse, Neglect, or Domestic Violence. We may report child abuse or neglect to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect. In addition, we may disclose health information about you if we reasonably believe you to be a victim of abuse, neglect, or domestic violence. We will only disclose this information to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence, and only if (i) the disclosure is required by law and it complies with the applicable law, (ii) you agree to the disclosure, or (iii) it the disclosure is expressly authorized by statute or regulation, and we believe the disclosure is necessary to prevent serious harm. We will promptly inform you of a report made under this section unless we believe informing you would place you at risk of serious harm, or if we would be informing your personal representative and believe they are responsible for the abuse, neglect, or other injury you have suffered.
Public Health Risks. We may share, without your written consent or permission, health information about you for “public health” activities. “Public health” is defined under 45 CFR § 160.103 as population-level activities to prevent disease in and promote the health of populations. Such activities include identifying, monitoring, preventing, or mitigating ongoing or prospective threats to the health or safety of a population, which may involve the collection of protected health information. These activities generally include the reporting, prevention or control of disease, injury, or disability; to report births and deaths; to report suspected abuse or neglect as required by law; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; and to notify a person who may have been exposed to a disease or may be at risk for getting or spreading a disease or condition.
Health Oversight Activities. We may share, without your permission, health information to a health oversight agency for activities imposed by law. These activities include audits, investigations, inspections, and licensure. They are necessary for the government to check on the health care system, government programs, and compliance with civil rights laws.
Lawsuits and Disputes. If there is a civil, criminal, administrative, or legislative proceeding against you, we may disclose your health information because of a court order, and without your written consent. We also may disclose your health information because of a subpoena discovery request, or other lawful process by someone else involved in the process if we have received satisfactory assurances that you had the opportunity to object to the disclosure or with a protective order that provides your medical records or information will be under seal (meaning that the parties may not be use or disclose your information for any purpose other than the proceeding) and returned or destroyed at the end of the proceeding.
Law Enforcement. We may give out your health information without your permission if asked to do so by a law enforcement official in response to a court order, grand jury demand or search warrant; about a death or injury we believe may be the result of a crime; if required by law to report a violent injury, such as a gunshot or stab wound or a poisoning; if a law enforcement official asks us for information to help locate a fugitive or suspect; or about suspected criminal conduct at Cone Health.
Coroners, Medical Examiners and Funeral Directors. We may give out your health information to a coroner or medical examiner without your permission. This may be necessary, for example, to identify a deceased person or to figure out the cause of death. We also may give out health information about patients of Cone Health to funeral directors as needed to carry out their duties.
Security, Intelligence Activities and Protective Services. We may give out your health information without your written consent or permission to authorized federal or state officials for intelligence, counterintelligence and other governmental activities imposed by law to protect our national security.
Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we are required to give out health information without your permission to the correctional institution or law enforcement official who has custody of you if necessary for the correctional institution or Cone Health to provide you with health care, to protect your health and safety or the health and safety of others, to obtain payment, or for the administration or maintenance of the correctional institution.
Behavioral Health Care. Regardless of the other parts of this Notice, Cone Health will not share psychotherapy notes unless Cone Health receives your HIPAA authorization, a court order requiring such disclosure, to defend Cone Health against a legal action brought by the patient, or as required by law. Psychotherapy notes will not be shared with other people working within Cone Health, except for audit and training reasons or to defend a legal action brought against Cone Health by the patient. For patients receiving substance use disorder treatment services, please see the Supplemental Part 2 Notice of Privacy Practices for Cone Health Substance Use Disorder Patients below.
Additional Protections for Minors. Some state and federal laws require additional privacy protections for minors. For example, North Carolina gives unemancipated minors the legal rights to consent to certain types of care and protects the privacy of those encounters, with specific exceptions.

Public Health Risks. We may share, without your permission, health information about you for public health activities. These activities generally include the reporting, prevention or control of disease, injury, or disability; to report births and deaths; to report suspected abuse or neglect as required by law; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; and to notify a person who may have been exposed to a disease or may be at risk for getting or spreading a disease or condition.

Health Oversight Activities. We may share, without your permission, health information to a health oversight agency for activities imposed by law. These activities include audits, investigations, inspections, and licensure. They are necessary for the government to check on the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose health information about you because of a court or administrative order. We also may disclose health information about you because of a subpoena or other lawful process by someone else involved in the dispute by disclosing your medical records or information under seal to the court. The parties to the case or their attorneys may not open the copies of your medical record under seal, unless a judge orders otherwise.

Law Enforcement. We may give out your health information without your permission if asked to do so by a law enforcement official in response to a court order, grand jury demand or search warrant; about a death or injury we believe may be the result of a crime; if required by law to report a violent injury, such as a gunshot or stab wound or a poisoning; if a law enforcement official asks us for information to help locate a fugitive or suspect; or about suspected criminal conduct at the health system.

Coroners, Medical Examiners and Funeral Directors. We may give out your health information to a coroner or medical examiner without your permission. This may be necessary, for example, to identify a deceased person or to figure out the cause of death. We also may give out health information about patients of the health system to funeral directors as needed to carry out their duties.

Security, Intelligence Activities and Protective Services. We may give out your health information without your permission to authorized federal or state officials for intelligence, counterintelligence and other governmental activities imposed by law to protect our national security.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we are required to give out health information without your permission to the correctional institution or law enforcement official who has custody of you if necessary for the health system to provide you with health care, to protect your health and safety or the health and safety of others, to obtain payment, or for operations of the health system.

Behavioral Health Care. Regardless of the other parts of this Notice, any information about your treatment in a special unit, by a designated program or by medical personnel whose primary function is to diagnose, treat, or refer you for alcohol or drug abuse treatment, and psychotherapy notes, will not be disclosed outside the health system except with your written permission, because of a court order, or as required by law. Private notes that a licensed mental health professional has decided to make about a session with you, keep in his or her personal files, and label as psychotherapy notes will not be shared with other people working within the health system, except for training reasons or to defend a legal action brought against the health system, unless you have given permission in writing. Other information about mental health treatment you receive may be shared outside the health system without your permission to obtain payment for your care and to coordinate your care and treatment.

Minors. Some state and federal laws require additional privacy protections health information. For example, some states give unemancipated minors the legal rights to consent to certain types of care and protects the privacy of those encounters, with specific exceptions.

Other Uses and Disclosures of Medical Information

All other information that is shared in a way not addressed in this Notice, including uses or disclosures for marketing purposes, or disclosures of your protected health information in exchange for some form of payment, will be made only after you give your written permission or as required by law. You may change your mind and take back your permission in writing at any time. We will stop sharing this information the day that your written request is received by the applicable location’s health information management office or the area where the record was created. We are unable to take back any disclosures we previously made with your permission.

Data Sharing and Monetization. Cone Health does not sell or monetize your identifiable health information. We may receive reimbursement for the cost of preparing and securely transferring de-identified data for approved research or operational purposes, but we do not sell your identifiable health information for profit. Any use of your identifiable information beyond treatment, payment, or healthcare operations will require your explicit written authorization.

Website Tracking and Online Privacy. Cone Health uses cookies, web beacons, and similar technologies on our websites to improve your experience, analyze usage, and support our services. These technologies may collect information about your device, browser, and interactions with our website. This information is used in accordance with our Website Privacy Policy and is not used to identify you personally unless you choose to provide personal information through our website.

For more details about website tracking, your choices, and how we protect your online privacy, please review our Website Privacy Policy at https://www.conehealth.com/privacy-policy.

Use of Gamification Features. Cone Health may use gamification features—such as badges, points, challenges, or rewards—on our websites, apps, or patient engagement platforms to encourage healthy behaviors, support wellness, and enhance patient education. Participation in gamification activities is voluntary and does not affect your access to care or medical decision-making.

Information collected through gamification features may include your activity, progress, and interactions with these programs. This information is protected under HIPAA and applicable privacy laws and is used only for the purposes outlined in this Notice or our website or app Terms of Use and Privacy Policies.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we keep about you:

Right to Review and Access. You have the right to look at and get a copy of health information that may be used to make decisions about your care, unless your treating physician decides that giving you such information would be harmful to your health or well-being. When we do not allow you to look at or get a copy of your health information, you may ask that the denial be reviewed. Another licensed health care professional chosen by Cone Health will review your request and the denial.

If we have all or any part of your health information in an electronic format, you may ask for an electronic copy of the information or ask that we send an electronic copy to any person or entity you designate in writing.

Your health information is contained in records that belong to Cone Health. To look at or get a copy of health information that may be used to make decisions about you, you may request the records via phone, email or in writing from the applicable location’s health information management office or the area where the record was created. If you ask for a copy of the information, we may charge a fee for our services.

Right to Amend. If you feel that health information we have about you is not right or is incomplete, you may ask us to change the information for as long as the information is kept by Cone Health. You must ask for this change in writing and send it to the applicable location’s health information management office or the area where the record was created. You must also give us your reasons for asking for the change.

We may decide to not make changes if you ask us to change information without providing your request in writing, or your request not include a reason why you are asking for the change, or the information was made by a provider at a non-Cone Health site (such as an inpatient or outpatient care center or a doctor, nurse, or pharmacist who is not a team member of Cone Health). If the information was made by a non-Cone Health provider, we usually can forward your request to that provider. If a doctor, nurse, or pharmacist is no longer available for you to ask for changes, then we can review your request with this in mind. We may also deny changes to information that is not part of the health information kept by Cone Health, is not part of the information which you would be allowed to see and copy or has been found to be accurate and complete.

Request an Accounting of Disclosures. You have the right to ask for a list of with whom we have shared your information over the last 6 years, known as an “accounting of disclosures”. This does not include disclosures made to those involved in treatment, payment, health care operations or disclosures that you gave your consent to share. You must ask for this list in writing from the applicable location’s health information management office or the area where the record was created. You must state a time period that may not be longer than six years before the date of the request. You can get an accounting of disclosures at no charge every 12 months; if an accounting of disclosures is requested more frequently than every 12 months, there may be a fee. In most cases, we will send the accounting of disclosures within 60 days. If we need an extra 30 days, we will let you know.
Right to Request Restrictions. Except where we are required to disclose information by law, you have the right to ask us not to share or to limit the health information we use or share about you with prior consent, for treatment, payment, or health care operations. For example, do you want to limit sharing information with others involved in your care, such as a family member or friend? We are not required to agree to your request, except if you ask us to not disclose your health information to your health plan for services that you have paid out of pocket in full (note this does affect our ability to share your health information for treatment or health care operations purposes or as may otherwise be permitted by HIPAA or applicable law). However, we will make every reasonable effort to the extent feasible to comply with your request for a restriction regarding a particular use or disclosure. If we do agree, we will act on your request unless the information is needed to give you emergency treatment or to share information as required by law. You must make your request in writing and send it to the applicable location’s Health Information Management office or the area where the record was created. In your request, you must tell us what information you want to limit and who you want the limits to apply to.
Right to Ask for a Different Type of Communication. You have the right to ask that we tell you about medical matters in a certain way or at a certain place. For example, you can ask that we only contact you at work or by mail, or at a mailing address other than your home address. During the registration process, you may request your communication preference by stating how or where you wish to be contacted. We will not ask you the reason for your request. We will accommodate all reasonable requests.
Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice or any updated Notice. You may ask us to give you a copy of this Notice at any time or you may get a copy of this Notice at our website, www.conehealth.com. To obtain a paper copy of this Notice, contact our Compliance and Privacy Helpline at 1-855-809-3042 or submit a report at www.conehealth.ethicspoint.com.

Changes to This Notice

We reserve the right to change this Notice and make the changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at Cone Health locations.

Investigations of Breaches of Privacy

We will investigate any unauthorized use or disclosure of your health information that we discover to determine if it is a breach of the federal privacy or security laws about health information. If we determine that a breach has occurred, we will notify you in writing about the breach.

Complaints

If you have a complaint or believe your privacy rights have been violated, you may contact our Compliance and Privacy Helpline at 1-855-809-3042 or submit a report online at http://www.conehealth.ethicspoint.com.

You may also send a written complaint to:

Cone Health Privacy Office
1200 North Elm Street
Greensboro, NC 27401
Email: privacy.officer@conehealth.com

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services:

U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 877-696-6775
Website: https://www.hhs.gov/hipaa/filing-a-complaint/index.html

You will not be retaliated against for filing a complaint. If you need assistance, any Cone Health team member can help you submit your complaint.

SUPPLEMENTAL PART 2 NOTICE OF PRIVACY PRACTICES OF CONE HEALTH FOR SUBSTANCE USE DISORDER PATIENTS

THIS SUPPLEMENT TO THE NOTICE OF PRIVACY PRACTICES OF CONE HEALTH (“SUPPLEMENTAL NOTICE”) DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED BY BEHAVIORAL HEALTH AT ALAMANCE REGIONAL MEDICAL CENTER, BEHAVIORAL HEALTH HOSPITAL, GUILFORD COUNTY BEHAVIORAL HEALTH CENTER AND THE R.E.A.C.H MATERNITY CLINIC AT THE CENTER FOR WOMEN’S HEALTHCARE AT MEDCENTER FOR WOMEN (As applicable, “Your Part 2 Program”). YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION, AND HOW TO FILE A COMPLAINT CONCERNING YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOU HAVE A RIGHT TO A COPY OF THIS SUPPLEMENTAL NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE PRIVACY OFFICER AT PRIVACY.OFFICER@CONEHEALTH.COM IF YOU HAVE ANY QUESTIONS.

PURPOSE OF THIS SUPPLEMENTAL NOTICE

As described in the Notice of Privacy Practices of Cone Health (“HIPAA Notice”), we are committed to protecting health information about you in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and implementing regulations (collectively, “HIPAA”) and other applicable law. We are required by law to make sure that health information that identifies you is kept private, make available to you our HIPAA Notice describing our legal duties and privacy practices at Cone Health with respect to health information about you, and follow the terms of the HIPAA Notice that is currently in effect.

In addition, federal law provides for additional privacy protections for substance use disorder (SUD) patient records (“Records”) maintained by certain treatment programs known as “Part 2” programs. Your Part 2 Program must comply with the Notice as well as the additional protections and provisions set forth in this Supplemental Notice in using or disclosing your Records.

WHO WILL FOLLOW THIS NOTICE

This Supplemental Notice describes the additional practices of Your Part 2 Program at all its locations and the practices of:

Any independent healthcare professional who is on our Medical Staff and allowed to enter information into Your Part 2 Program medical record.
All practices, departments and units of Your Part 2 Program.
Any member of a volunteer group we allow to help you while you are in Your Part 2 Program.
All team members of Your Part 2 Program.
All students and trainees at Your Part 2 Program.

This Supplemental Notice applies to all the Records of your care and billing for care that are created, received, maintained, or transmitted by, at, or to Your Part 2 Program. Your personal doctor or other independent health care personnel treating you may have different policies or Notices about confidentiality and sharing of your health information that they use in their offices or other locations outside Cone Health and Your Part 2 Program.

PART 2 RECORDS: USES, DISCLOSURES, AND RIGHTS

Your Part 2 Program may use and disclose your health information as described in the Notice but is further limited in its use and disclosure of your Records as described in this Supplemental Notice. In other words, this Supplemental Notice describes additional restrictions on Your Part 2 Program’s uses and disclosures of your Records and additional rights you have with respect to these Records. We will make uses and disclosures not described in the HIPAA Notice and this Supplemental Notice only with your written consent.

We are required by law to maintain the privacy of Records, to provide patients with Notice of our legal duties and privacy practices with respect to Records, and to notify affected patients following a breach of unsecured Records.
We are required to abide by the terms of the HIPAA Notice and Supplemental Notice currently in effect.
We reserve the right to change the terms of the HIPAA Notice and this Supplemental Notice and to make the new Notice provisions effective for Records that created, received, maintained, or transmitted by us. We will provide an electronic copy of any revised Notice via email or update it on our website.
Specific Restrictions. We are restricted from using or disclosing any Records that would identity you as having or having had a substance use disorder to initiate or substantiate any criminal charges against you or to conduct any criminal investigation of you. We are also restricted from using your Records in any civil, criminal, administrative, or legislative proceedings against you. This restriction also applies to any recipients of your Records. This restriction also prohibits use of your Records or testimony related to your Records in an application for a warrant, except as otherwise described below.
Part 2 Consent. Except as permitted under both HIPAA and Part 2, use and disclosures of your Records require written permission made in compliance with HIPAA and Part 2 (“Consent”). You have the right to revoke your Consent to the disclosure of your Records, except to the extent that Your Part 2 Program or a third party that is legally holding and permitted to make the disclosure has already disclosed the Records based on your consent. The Consent form will include information concerning how to revoke your Consent.
Notice to Accompany Consent. Any Records disclosed pursuant to your Consent must be accompanied by a Notice that includes a statement required under Part 2. The statement may include details advising that the Records are protected under Part 2 and advising the recipient that the Records may not be used or disclosed, and may not testify using information contained in the Records, in any civil, criminal, administrative, or legislative proceedings brought against you by any Federal, State, or local authority unless you provide additional consent, and except as otherwise permitted by Part 2, or may state “42 CFR part 2 prohibits unauthorized use or disclosure of these records.”
Treatment, Payment, and Health Care Operations. You may issue one single consent for all future uses and disclosures for treatment, payment, and health care operations relating to substance use disorder treatment. Additionally, we may redisclose your Records for these purposes without your written consent, to the extent the HIPAA regulations and Part 2 permit such disclosure.
SUD Counseling Notes. We are required to get your consent for any use or disclosure of any notes made by a Part 2 provider who is a substance use disorder or mental health professional documenting or analyzing the contents of your counselling session(s) that are not part of your Records, unless the use or disclosure is (i) for treatment of you by the creator of the notes; (ii) for training by us and our providers; or (iii) to defend ourselves in a legal action brought by or on behalf of you.
Notification to Law Enforcement. Law enforcement agencies can be notified of a patient’s crime or threat to commit a crime on Part 2 Program premises or against Part 2 Program personnel, but we may only disclose information about the circumstances of the incident, including the status of the patient involved with the crime or threat, the patient’s name, and the patient’s last known whereabouts. We may make reports to law enforcement about an immediate threat to the health or safety of an individual or the public. We will not disclose any patient-identifying information in this sort of situation.
Uses and Disclosures in an Emergency. We may make disclosures to medical personnel without your written consent if there is a determination that a medical emergency exists, i.e., there is a situation that poses an immediate threat to the health of any individual and requires immediate medical intervention. For example, if you are having an adverse reaction to medication, we may need to disclose information regarding substances which you may have ingested. Information disclosed to the medical personnel who are treating such a medical emergency may be redisclosed by such personnel for treatment purposes as needed.
Deceased Patients. We may disclose Records relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death. Any other use or disclosure of Records or information related to Records identifying a deceased patient as having an SUD not otherwise permitted in this Supplemental Notice requires the Consent of the personal representative.
Prevention of Multiple Enrollments. We may disclose limited information from Records to an organization or program involved in withdrawal management or maintenance treatment involving medications designed to support remission of SUD-related symptoms to prevent multiple enrollments in such organizations or programs located within 200 miles of the Cone Health location at which SUD treatment is provided.
Audits and Part 2 Program Evaluations. We may disclose Records for reviews on the premises of the Part 2 Program if (i) the reviewer is a government agency authorized by law to regulate the Part 2 Program; (ii) provides financial assistance to the Part 2 Program; (iii) is a third-party payer or health plan; or (iv) is a quality improvement organization, but only if the reviewer agrees in writing to only disclose the information back to the Part 2 Program and only use it for the purpose of the audit or evaluation. We may allow Records to be removed or copied and disclosed outside the Part 2 Program for reviews and audits if the reviewer agrees in writing to comply with additional Part 2 security and breach notice requirements.
Disclosures for Public Health. We may disclose Records for public health purposes without your Consent only if the information has been de-identified under HIPAA.

Your Rights.

In addition to the Rights set forth in the HIPAA Notice, you have the right to:

Request restrictions of disclosures made with prior consent for purposes of treatment, payment, and health care operations.
Receive an accounting of disclosures of your Part 2 records made with your consent during the past 3 years (except for disclosures made with your consent that are (i) for treatment, payment, and health care operations purposes; and (ii) not made through an electronic health record)
Receive an accounting of disclosures of your Part 2 records made with your consent to an intermediary when the consent has only a general designation of the intermediary’s participating providers.
Obtain a paper or electronic copy of this Notice upon request.
Discuss the Notice with a designated contact person or office.
Revoke your written Consent previously issued if it has not already been relied upon.
File a complaint with the Secretary of the U.S. Department of Health and Human Services for a violation of Part 2 in the same manner as you may file a complaint under the HIPAA Notice.

Use of Records Relating to a Court Order.

Your Records, or testimony relaying the content of such Records, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written Consent or a court order as described below.
Your Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or the holder of the Record.
A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before we use or disclose the Record.

COMPLAINTS - Part 2 Supplement

If you have a complaint or believe your privacy rights regarding your substance, use disorder records have been violated, you may contact our Compliance and Privacy Helpline at 1-855-809-3042 or submit a report online at http://www.conehealth.ethicspoint.com.