Privacy Practices

The Notice of Privacy Practices describes how we may use and disclose protected health information (PHI) and how you can access this information. Please review the notice carefully. If you have any questions, please call our Privacy Officer at (319) 768-1960.

PHI is medical and demographic information that may identify you. It includes past, present or future physical or mental-health conditions and related health care services. Great River Health System and independent providers of diagnostic-testing interpretation services may use and disclose your PHI to carry out treatment, seek payment, conduct health care operations and for other purposes permitted or required by law.

Great River Health System includes Burlington Area Family Practice Center, Great River Klein Center, Great River Health System Center, Great River Physicians and Clinics, Heritage Medical Equipment and Supplies, Heritage Pharmacies, and Home Health and Hospice.

Our promise to you

We are committed to providing you with high-quality care and complying with legal requirements. We understand your PHI is private, and we will protect it.

Who must follow this notice?

  • Business associates, such as people and businesses that create, maintain, receive or send your PHI to provide services to us
  • Our employees, health care providers and volunteers

Law requires us to:

  • Follow the terms of this notice
  • Give you this notice with your PHI
  • Keep confidential PHI that identifies you unless otherwise permitted or required by law
  • Notify you, according to regulations, if there has been a breach of your PHI resulting in compromised information

We may change the terms of our notice anytime, and a new notice will go into effect for the PHI we maintain. On request, we will provide you with a revised printed notice. You also may request a copy by calling Health Information Management at (319) 768-1900, or asking for one when you register for your next appointment. In addition, we will post the notice on our website,

How we may use and disclose your PHI

The following describe ways we may use and disclose your PHI without your written approval. We will ask for your approval for anything not listed.

For treatment. We will use your PHI to provide, coordinate and manage your medical treatment or services. We may disclose information to providers, nurses and other health care providers involved in your care, whether they are affiliated with us or not.

Examples: You may need surgery, and the surgeon may need a medical provider’s recent history and physical before performing the procedure. If you have diabetes, the provider may need to tell a dietitian so appropriate meals are ordered. Other hospital departments also may share your medical information to coordinate your care. This information may include medicines and diagnostic tests. In addition, we may share your PHI with a referral provider to ensure the provider has the necessary information to continue care, diagnose or treat you.

For payment. We will use and disclose relevant PHI so services you receive at our facility can be billed to and payment may be collected from you, an insurance company or a third party. We also may use information for case-management activities.

Example: We may tell your health-insurance plan about a scheduled procedure or test to have it pre-certified and decide whether your plan will cover the treatment or hospital stay.

For health care operations. We may use and disclose your PHI to operate Great River Health System and ensure patients receive high-quality care.

Example: We may use medical or mental-health treatment information to review our treatment and services and to evaluate the performance of our staff. We also may disclose your PHI to physicians, nurses, medical students, and other Great River Health System employees or consultants for review and learning purposes.

To the extent permitted by law, we may disclose your PHI to another health care entity for use in some health care operations if that entity and Great River Health System have a relation to you, the information is about this relation, the disclosure is for a quality-related health care activity and for fraud detection.

For appointment reminders. Unless you tell us otherwise in writing, we may use or disclose your PHI, as necessary, to remind you of an appointment.

For the hospital directory. Unless you object, we may include limited information about you in the hospital directory while you are an inpatient. This information may include your name and location in the hospital. We release directory information only to people who ask for you by name, which shows they already know you are a patient. We may disclose directory information to a member of the clergy if you do not object. In addition, if you do not object, we may disclose one-word descriptions of you condition: undetermined, good, fair, serious or critical.

For treatment alternatives and health-related benefits and services. We may use or disclose your PHI, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may interest you.

Example: We may send you a newsletter about services we offer. If you do not want this information, call the Privacy Officer to have your name removed from the mailing list.

To people involved in your care or payment for your care. We may release medical and mental PHI to a family member involved in your medical care if such information concerns this person’s involvement. We will only provide this information if you agree, are given the opportunity to object and do not or if, in our professional judgment, it would be in your best interest to allow the person to receive the information or act on your behalf.

Example: We may give PHI, including prescription and appointment information, to a friend or family member involved in your care. We also may give such information to someone who pays for your care. In addition, we may disclose PHI to a disaster-relief entity so they can tell your family about your condition, status and location.

As required by law. We will disclose PHI when required by law without your consent or approval, such as information to report child or dependent-adult abuse.

To avert a serious threat to health or safety. We may disclose PHI to prevent a serious threat to your health and safety or the health and safety of the public or someone else. But any disclosure would be only to someone who can help prevent the threat.

To business associates. We identify and enter into agreements with business associates who provide services to us that may use minimally necessary PHI. We may disclose your PHI to such business associates without your consent. Business associates must maintain and comply with privacy laws and keep your PHI confidential. Examples of business associates are accounting firms hired to audit billing and payment information, and software vendors who help us maintain and process PHI.

For research. We sometimes participate in research studies with entities such as drug companies. We will disclose your PHI as permitted by law. In appropriate cases, we will seek your approval to use and disclose such information. We may disclose your information to researchers when a special committee has approved their research and established protocols to ensure the privacy of your PHI.

Military and veterans. If you are a member of the armed forces, we may release PHI as required by military command authorities. We also may release PHI about foreign military employees to the appropriate foreign military authority.

Workers’ compensation. We may release PHI for workers’ compensation or similar programs without consent. These programs provide benefits for work-related injuries or illnesses. For example, if you are injured on the job, we may release applicable information to your employer or its workers’ compensation insurer.

Public-health activities. We may disclose PHI for public-health activities without your consent. These activities include:

  • Notifying someone who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition
  • Notifying the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence
  • Preventing or controlling disease, injury or disability
  • Reporting products regulated by the Food and Drug Administration to carry out functions, such as collecting data about the safety of a product and notifying people about recalls of products they may be using
  • Reporting reactions to medicines or problems with products

Health oversight activities. We may disclose PHI to a health oversight agency, such as the Department of Health and Human Services, for activities allowed by law. These oversight activities include audits, investigations, inspections and licensing procedures. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.

Health information exchange (HIE). We may make your PHI available electronically through an electronic HIE. An HIE transmits electronic health records or other clinical or public health information between its participants. As an HIE participant, we may provide your PHI to other health care providers and health plans that request your information for their treatment, payment and health care operations. Participation in an HIE also permits us to access their information about you for our treatment, payment and health care operations.

Lawsuits and administrative proceedings. If you are involved in a lawsuit or dispute, we may disclose PHI for a court or administrative order. We also may disclose PHI for a subpoena, discovery request or other lawful process by someone involved in the dispute. Any disclosure of mental PHI, drug treatment, or HIV or AIDS-related information must comply with applicable laws. In addition, we may disclose PHI to the opposing party in any lawsuit or administrative proceeding – including mental-health, drug treatment, or HIV or AIDS-related information – in which your physical or mental condition is at issue after you have signed an approval to release the information.

Similarly, we may disclose PHI in proceedings in which you are not a party, but only if we tried to tell you or your attorney about the request or receive an order protecting the information requested.

Law enforcement. If asked by law enforcement, we may release PHI, excluding mental PHI, to:

  • Identify or locate a suspect, fugitive, material witness or missing person
  • Investigate a death we believe may be because of criminal conduct
  • Investigate criminal conduct at Great River Health System
  • Learn more about the victim of a crime if, under limited circumstances, we cannot get the person’s agreement
  • Report a crime in emergency circumstances. This information can include the location of the crime or victims, and the identity, description or location of the person who committed the crime.
  • Respond to a court order, subpoena, warrant, summons or similar process

Coroners, medical examiners and undertakers. We may release PHI, including mental PHI, to a coroner or medical examiner to, for example, identify a deceased person or verify the cause of death.

National-security and intelligence activities. We may release PHI to federal officials for intelligence, counterintelligence and other national-security activities allowed by law.

Protective services for the president and others. We may disclose PHI to federal officials so they may provide protection to the president, other dignitaries or foreign heads of state, and to conduct special investigations.

Inmates. If you are an inmate of a correctional institution or under law-enforcement custody, we may release PHI to the correctional institution or law enforcement. This release would be necessary:

  • For the institution to provide you with health care
  • For the security of the correctional institution
  • To protect your health and safety, or the health and safety of others

Uses and disclosures with your written approval

We can make some uses and disclosures of your PHI only with your written approval, unless law otherwise permits or requires it (described in the next section). You may revoke this approval in writing anytime, unless the health system relies on the disclosure shown in the approval.

Examples of uses and disclosures we may only make with your written approval are:

  • AIDS- or HIV-related information, mental-health or substance-abuse treatment information only with written approval as required by law or regulation unless the law permits or limits otherwise
  • Marketing purposes. We will tell you if we will receive payment from a third party for marketing.
  • Psychotherapy notes only with an approval signed by you or your legal representatives, following applicable law or regulation

We may contact you to raise funds, but you may opt out of receiving such communications by calling Marketing and Public Relations at (319) 768-3300. We will promptly honor your request unless we have already sent a communication to you. If you provide approval for the disclosure of your PHI, you may revoke it anytime by giving us notice according to our approval policy. Your revocation will not be effective for uses and disclosures made in reliance on your approval.

Your PHI rights

You have the following rights about the PHI we maintain:

Right to inspect and request a copy. You have the right to inspect and request a copy of your PHI to use in making care decisions. We keep this PHI in a designated record that usually includes medical and billing records, but does not include psychotherapy notes.

If we maintain the information electronically and you ask for an electronic copy, we will provide the information to you in the format you requested, assuming it is readily producible. If we cannot readily produce the record in the format you request, we will produce it in another readable electronic form we agree to.

If you request a copy of the information, we may charge a fee for the costs of copying, mailing and other supplies associated with your request. We will limit the cost of providing an electronic copy of information from your electronic medical record to labor and supplies. If you want to inspect your records, we may charge an inspection fee that reflects staff time in pulling the records and participating in the inspection.

We may deny your request to inspect or receive a copy in limited circumstances. If we deny your access to PHI, you may choose another licensed health care professional to review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to request amendment. If you think PHI we have is incorrect or incomplete, you may ask us to change the information. You have the right to request an amendment for as long as we keep the information in a designated record set.

To request an amendment, you must contact Health Information Management. We will mail a Health Information Request for Amendment form to you. You must complete this form and return it to the Privacy Officer. You must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to change information that:

  • Is accurate and complete
  • Is not part of the information you can inspect and copy
  • Is not part of the PHI we keep
  • Was not created by us, unless the person or entity that created the information is no longer available to make that amendment

Right to an accounting of disclosures. You have the right to request a list of the disclosures our business associates or we have made about your PHI. An accounting from paper records will not include disclosures for treatment, payment and health care operations. An accounting from your electronic medical record will include disclosures for treatment, payment and health care operations for three years before the request.

The first accounting of disclosures you request in a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will tell you the cost involved and you may choose to withdraw or modify your request before you incur costs.

Right to request restrictions. You have the right to request a restriction on the PHI we use or disclose for treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose to someone involved in your care or in the payment for your care, like a family member or friend. For example, you may request your spouse or child involved in your care not receive some information about your condition.

We are not required to agree to your request, unless the disclosure is to a health plan or other payer to carry out payment or health care operations, and you have paid for the services in full. If we agree to other restriction requests, we will comply unless we need the information to provide you with emergency treatment.

To request restrictions, you may call Health Information Management at (319) 768-1900, and request a form or send a written request that includes:

  • To whom you want the limits to apply (for example, disclosures to your spouse)
  • What information you want limited
  • Whether you want to limit routine access, use or disclosures for treatment, payment or operations

You may send requests to Health Information Management Department, Great River Health System, 1221 S. Gear Ave., West Burlington, IA 52655.

Right to request confidential communications. You have the right to request how and where we communicate with you about medical matters. For example, you can ask we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to Health Information Management Department, Great River Health System, 1221 S. Gear Ave., West Burlington, IA 52655. We will not ask the reason for your request. We will accommodate reasonable requests. Your request must specify how or where you want us to contact you.

Right to request a copy of this notice. You have the right to request a paper copy of this notice. This notice is also available for download.


If you think we have violated your privacy, please call the health system’s Privacy Officer at (319) 768-1931, or contact the U.S. Secretary of Health and Human Services. We will not retaliate for filing a complaint.