Notice of Privacy Practices

Download our Notice of Privacy Practices Download PDF

Roswell Park wants you to know that we take your privacy very seriously. This page explains our policies and rules on how we will protect and maintain the confidentiality of your personal information which is contained in your medical records and in our business records.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Roswell Park Comprehensive Cancer Center (referred to in this document as "Roswell Park" or "We") is required by federal and New York law to maintain the privacy of your health information and to provide you with this notice describing its privacy practices and obligations. Roswell Park will not use or disclose your health information, including your medical and billing records maintained at Roswell Park, except as described in this notice. For purposes of this Notice, your “health information” refers to demographic, clinical and biological information, that can be used to identify you, and relates to your health or condition, or to payment of charges for services, as found in your medical record or in other records that are maintained by Roswell Park. You will be asked to acknowledge in writing on your admission or registration at Roswell Park that you have received a copy of this form.

HOW ROSWELL PARK MAY USE OR DISCLOSE YOUR HEALTH INFORMATION:  

Treatment: We will use your health information in providing for and coordinating your care and treatment. We may disclose all or any portion of your medical record information to your attending physicians at Roswell Park, consulting physician(s), nurses, technicians, medical students, and other health care providers who have a legitimate need for such information in order to provide or participate in your care and treatment. A variety of Roswell Park departments will share your health information in order to coordinate specific services, such as providing medications, food service (if you are an in-patient), lab work, and x-rays. We also may, where necessary and appropriate, disclose your health information to health care providers or individuals outside of Roswell Park whom you have authorized to receive your information and/or who are part of your healthcare such as your outside physician(s) and health care providers immediate family members, friends or others (as designated by you).

Treatment Alternatives: We may use and disclose your health information in order to contact you and provide you with information about possible treatment options, alternatives, or other health related services that may be of benefit to you.   

Payment: We may use or disclose your health information for the purpose of confirming insurance coverage, billing for your treatment, managing your claims, medical data and reimbursement processing. The information may be released to an insurance company, government health payer such as Medicare or Medicaid, or other entities (or their authorized representatives) involved in the payment of your medical bill and may include copies or excerpts from your medical record which are necessary for payment of your account. For example, a bill sent to a third-party payer may include information that identifies you, your diagnosis, and the procedures and supplies used.

Healthcare Operations: Roswell Park may use and disclose your health information in the course of routine healthcare operations, including but not limited to administrative, financial, legal, and quality improvement activities.

Individuals Designated by You: Roswell Park may release health information about you to family members, friends, or others (as designated by you) who are involved in your medical care or agree to be responsible for your medical bills. Unless you direct otherwise, we may tell your family or friends your general condition and that you are an inpatient at Roswell Park. In addition, in the event you were involved in a disaster, or public health emergency, we may disclose information about you to an organization assisting in that situation so that your family can be notified about your condition, status and location.

Appointment Reminders: We may, unless you direct us not to, use and disclose your health information to contact you electronically or by telephone or mail as a reminder that you have an appointment for treatment or medical care at Roswell Park.

Hospital Directory: Roswell Park may include your name and room number in its hospital directory while you are a patient at Roswell Park. Your religious affiliation may be given to a member of the clergy. You have the right to direct us not to use or disclose your health information in the directory or to give any information out to clergy.

Business Associates: A business associate is an individual or entity under contract with Roswell Park to perform or assist Roswell Park in performing a function or activity involving you or your care which necessitates a permissible use or disclosure of your health information. Roswell Park may use and disclose health information about you to business associates. Examples of business associates, include, but are not limited to Roswell Park collection agencies, accountants, lawyers, medical transcriptionists and third-party billing companies. We maintain a written contract with each business associate, which requires the business associate to protect the confidentiality of your health information.

USES AND DISCLOSURES REQUIRED BY LAW

Regulatory Agencies: Roswell Park may disclose your health information to a health oversight agency for activities authorized by law, including, but not limited to, licensure, certification, audits, investigations and inspections. These activities are necessary for the government and certain private health oversight agencies, (e.g., Joint Commission on Accreditation of Healthcare Organizations or the NY State Department of Health) to monitor the healthcare system.

Law Enforcement/Litigation: Roswell Park will disclose your health information for law enforcement purposes as required by law or in response to a valid subpoena or court order.

Public Health Reporting/Disaster/Emergency Response: As required by law, Roswell Park may disclose your health information to public health or government authorities charged with preventing or controlling disease, injury, or disability or to disaster relief efforts. For example, Roswell Park is required to report the existence of or exposure to communicable diseases, such as AIDS or hepatitis, to the New York State Department of Health.

Workers Compensation: Roswell Park may release health information about you to your employer or an insurance company in connection with a workers’ compensation claim filed by you.

Military/Veterans: If you are a member of the armed forces, we may disclose your health information as required by military command authorities.

Inmates: If you are an inmate of a correctional institute or under the custody of a law enforcement officer, Roswell Park may release your health information to the correctional institute or law enforcement official.

Coroners, Medical Examiners, Funeral Directors: Roswell Park may notify a coroner, funeral director or medical examiner in case of death.

Health Oversight Activities: Roswell Park may release health information about you for audits, inspections, licensure, certification and disciplinary actions.

OTHER USES AND DISCLOSURES

Research: If you are a participant in research at Roswell Park, your health information may be used or disclosed as part of that research, as described in a specific consent signed by you as part of the process by which you enroll as a participant in the research. There may be instances in which Roswell Park may use and disclose medical information about you in the absence of consent, as part of a clinical research study or an outcomes analysis that has been approved by Roswell Park’s Institutional Review Board. The purpose of IRB review is to assure, both in advance and by periodic review, that appropriate steps are taken to protect the rights and welfare of those participating in research.   In addition, as a major part of our mission is research, we may use your health information for accumulating databanks, outcome reviews and screening for eligibility for participation in clinical trials.

Organ/Tissue Donation: To the extent allowed by law, Roswell Park may disclose your health information to organ procurement organizations and other entities engaged in the procurement, banking or transplantation of organs for the purpose of tissue donation and transplant.

Fundraising: We may disclose certain information to our foundation (the Roswell Park Alliance Foundation) so that the Foundation may contact you for fundraising efforts. If you do not want Roswell Park to contact you for fundraising efforts, you should notify the Roswell Park Alliance Foundation in writing to the Senior Gift Processor, c/o Roswell Park Cancer Institute, Elm and Carlton Streets, Buffalo, NY 14263, or call the Foundation at (716) 845-4444.

Healthcare Related Messages, Educational and Research Opportunities/Events: We may use and disclose your health information in order to contact you with healthcare related messages (e.g., annual screening reminders) and provide you with information about our educational and supportive events and resources that may be of interest to you.  You may choose to opt out of receipt of these types of notices by clicking the unsubscribe link in the notice or by calling Roswell Park at (877)275-7724.

OTHER USES/REVOCATION OF AUTHORIZATION

 Any other uses and disclosures of your health information not described in this Notice will be made with your written authorization. For example, the use and/or disclosure of psychotherapy notes and disclosures that constitute a sale of PHI require authorization.  An authorization permitting Roswell Park to use or disclose your health information can be revoked by you at any time by providing a written notice clearly identifying the written authorization that is being revoked, specifying the portion or all of the authorization being revoked, and delivering the revocation to the Health Information Management Department at Roswell Park. Such revocations shall be effective two business (2) days after receipt thereof by that department.

YOUR HEALTH INFORMATION RIGHTS

You have the following rights concerning your health information maintained at Roswell Park:

Right to Confidential Communications: You have the right to receive confidential communications of your medical information by alternative means or at alternative locations. For example, you may request that Roswell Park only contact you at work or by mail, and to tell us not to contact you at a certain address or telephone number.

Right to Inspect and Copy: You have the right to inspect and copy all or portions of your medical record in any format you choose. New York State law permits Roswell Park to recover costs that are associated with providing a copy of your medical record.

Right to Amend: If you believe that the health information we have about you is incorrect or incomplete, you may ask us to amend the information.  You have the right to request an amendment for as long as the information is kept in our records.   A written request form, and a copy of this policy and procedure, may be obtained by contacting the Health Information and Medical Records Department at 716-845-5991, or by contacting your Roswell Park attending physician. Roswell Park may deny such an amendment under certain circumstances.

Right to an Accounting: You have the right to obtain an accounting of certain disclosures to third parties outside of Roswell Park of your health information as provided by 45 CFR §164.528. Disclosures which you have authorized will not be reflected in this accounting.

Right to Request Restrictions: You have the right to request additional restrictions on certain uses and disclosures of your health information under 45 CFR § 164.522. In addition, you have the right to restrict certain disclosures of protected health information to a health plan when you pay in full for the health care item or service. Roswell Park may agree to honor your request but has the right to refuse requests for restrictions which are not mandated by law. You must make your request in writing, and Roswell Park will respond to your request within ten (10) business days thereafter.

Right to Receive Notification:  You have the right to receive a notification in the event of a breach of your protected health information. 

Right to Receive Copy of this Notice:  If you receive this Notice on our web site or by electronic mail (e-mail), you are also entitled to request a paper copy of the Notice. For instructions on how to obtain this information in Braille, another language, or other available formats, please call toll-free at 1-800-Roswell Park (1-800-767-9355) or visit our website at www.roswellpark.org.

FOR MORE INFORMATION OR TO REPORT A PROBLEM:

If you have questions, need additional information, or wish to file a complaint, you may contact the Privacy Officer of Roswell Park at 716-845-7794. If you believe your privacy rights have been violated, you may file a complaint with Roswell Park or with the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. Federal law and Roswell Park policy prohibit retaliation against a person for filing a complaint.

Changes to this Notice: Roswell Park will abide by the terms of this notice currently in effect. Roswell Park reserves the right to change or modify its privacy practices, provided such changes or modifications comply with applicable law, and further provided it then issues an updated Notice of Privacy Practices. Roswell Park reserves the right to change the terms of this Notice to reflect changes in practices and to make the new notice provisions effective for all protected health information that it maintains, including information received by Roswell Park prior to such change.

Notice Effective Date: The effective date of the notice is November 1, 2022.