privacy policy

NOTICE OF PRIVACY PRACTICES 

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. (45 CFR § 164.520) 

Effective Date: September 30, 2025 

This Notice of Privacy Practices ("Notice") describes how Houston County Community Hospital, a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 CFR Parts 160 and 164), may use and disclose your protected health information (PHI) and your rights regarding that information. PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition and related health care services (45 CFR § 160.103). 

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to notify you following a breach of unsecured PHI (45 CFR § 164.404). We must abide by the terms of this Notice currently in effect, but we reserve the right to change the terms and apply the revised Notice to all PHI we maintain. We will post the revised Notice in our facility and on our website, and you can request a copy. 

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION 

We may use or disclose your PHI without your authorization for the following purposes (45 CFR § 164.506): 

Treatment: We may use or disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may disclose your PHI to physicians, nurses, or other health care providers involved in your care, or to a pharmacy for filling prescriptions. 

Payment: We may use or disclose your PHI to obtain payment for services provided. For example, we may disclose PHI to your health insurer to determine eligibility or coverage, or to bill for services. 

Health Care Operations: We may use or disclose your PHI for our operations, such as quality assessment, employee review, training programs, accreditation, certification, licensing, or credentialing activities. 

Other Permitted Uses and Disclosures Without Authorization (45 CFR § 164.512): 

• To you or your personal representative. 
• To business associates who perform functions on our behalf, under agreements that require them to protect your PHI (45 CFR § 164.502(e)). 
• For public health activities, such as reporting diseases or vital events. 
• To report abuse, neglect, or domestic violence. 
• For health oversight activities, such as audits or investigations. 
• For judicial and administrative proceedings, in response to a court order. 
• For law enforcement purposes, such as identifying suspects or reporting crimes. 
• To coroners, medical examiners, or funeral directors. 
• For organ, eye, or tissue donation. 
• For research purposes under certain conditions. 
• To avert a serious threat to health or safety. 
• For specialized government functions, such as military or national security. 
• For workers' compensation. 

If your PHI includes records subject to 42 CFR Part 2 (confidentiality of substance use disorder patient records), such records are protected under federal law and regulations governing Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, as amended by the 2024 Final Rule). We will obtain your written consent for uses and disclosures of Part 2 records for treatment, payment, and health care operations, except as permitted by Part 2 (42 CFR § 2.31). You may revoke consent in writing, except to the extent we have already acted on it. We will not condition treatment on consent (42 CFR § 2.20). Disclosures may be made without consent in medical emergencies, for research/audit under certain conditions, or by court order (42 CFR §§ 2.51-2.67). Recipients of Part 2 information are prohibited from re-disclosing it without consent or as otherwise permitted by Part 2. Violations of Part 2 may be reported to the United States Attorney or SAMHSA (42 CFR § 2.4). 

Uses and Disclosures Requiring Authorization: For other uses and disclosures, we will obtain your written authorization, which you may revoke in writing at any time, except to the extent we have relied on it (45 CFR § 164.508). This includes most uses and disclosures for marketing, sales of PHI, and psychotherapy notes (if maintained). 

Fundraising: We may use limited PHI (e.g., name, address, dates of service) to contact you for fundraising. You have the right to opt out of such communications (45 CFR § 164.514(f)). 

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION 

You have the following rights (45 CFR §§ 164.522-164.528): 

• Right to Inspect and Copy: You may inspect and obtain a copy of your PHI in our designated record set, with some exceptions. We may charge a reasonable fee. 
• Right to Amend: If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny the request under certain circumstances. 
• Right to an Accounting of Disclosures: You may request a list of disclosures of your PHI made in the last six years (or shorter period), excluding those for treatment, payment, operations, or certain others. 
• Right to Request Restrictions: You may request restrictions on uses or disclosures of your PHI for treatment, payment, or operations, or to persons involved in your care. We are not required to agree, except for disclosures to health plans for payment or operations if you have paid out-of-pocket in full. 
• Right to Request Confidential Communications: You may request communications by alternative means or locations (e.g., by mail instead of phone). 
• Right to a Paper Copy of This Notice: You may obtain a paper copy at any time. 

OUR RESPONSIBILITIES 

We are required to (45 CFR § 164.530): 

• Maintain the privacy and security of your PHI. 
• Provide this Notice and abide by its terms. 
• Notify you if we are unable to agree to a requested restriction. 
• Accommodate reasonable requests for confidential communications. 
• Obtain your authorization for uses/disclosures not described here. 

COMPLAINTS 

If you believe your privacy rights have been violated, you may file a complaint with us at: 

Houston County Community Hospital, 5001 East Main Street, Erin TN 37061; Anne Sauer, Privacy Officer; 731-968-1805; anne.sauer@henderson.health or with the Secretary of the U.S. Department of Health and Human Services at [HHS Regional Office or www.hhs.gov/ocr/privacy/hipaa/complaints] (45 CFR § 164.530(d)).  

We will not retaliate against you for filing a complaint. 

For records subject to 42 CFR Part 2, you may also complain to the United States Attorney in the district where the violation occurred or to the Substance Abuse and Mental Health Services Administration (SAMHSA) (42 CFR § 2.4). 

CONTACT INFORMATION 

For more information or to exercise your rights, contact our Privacy Officer at 731-968-1805, anne.sauer@henderson.health, or Houston County Community Hospital, 5001 E Main St, Erin TN 37061. 

Compliance with Rule Changes 

This Notice complies with the HIPAA Privacy Rule (45 CFR Part 164, Subpart E) and, where applicable, 42 CFR Part 2 (as amended February 2024, with compliance required by February 16, 2026). It also adheres to Tennessee state laws, including the Tennessee Information Protection Act (Tenn. Code Ann. §§ 47-18-3301 et seq., effective July 1, 2025), which exempts PHI governed by HIPAA and does not impose additional requirements on this Notice. The 2024 HIPAA reproductive health privacy rule (89 FR 32976) was vacated in June 2025 and does not require modifications.