Notice of Privacy Practices

Download our Notice of Privacy Practices Download PDF

Notice of Privacy Practices

Roswell Park wants you to know that we take your privacy very seriously. This page explains our policies and rules on how we will protect and maintain the confidentiality of your health information that is contained in your medical records and in our business records.


Roswell Park Comprehensive Cancer Center (referred to in this document as "Roswell Park" or "We") is required by federal and New York law to maintain the privacy of your health information and to provide you with this notice describing its privacy practices and obligations. Roswell Park will not use or disclose your health information except as described in this notice. For purposes of this notice, your “health information” refers to your demographic, clinical, and biological information that identifies you, or for which there is a reasonable basis to believe it can be used to identify you and relates to your health or condition or to payment of charges for services.  You will be asked to acknowledge in writing on your admission or registration at Roswell Park that you have received a copy of this notice.


Treatment: We will use your health information in providing for and coordinating your care and treatment. We may disclose all or any portion of your medical record to your attending physicians at Roswell Park, consulting physician(s), nurses, technicians, medical students, and other healthcare providers who have a legitimate need for such information to provide or participate in your care and treatment. Your health information will be shared among various Roswell Park departments to coordinate specific services for you, such as providing medications, food service (if you are an in-patient), lab work, and x-rays.

Treatment Alternatives: We may use and disclose your health information in order to contact you and provide you with information about possible treatment options, alternatives, or other health related services that may be of benefit to you.   

Payment: We may use or disclose your health information for the purposes of confirming insurance coverage, billing for your treatment, managing your claims, medical data, and processing reimbursement. Your health information may be released to an insurance company, government health payer such as Medicare or Medicaid, or other entities (or their authorized representatives) involved in the payment of your medical bill and such disclosures may include copies or excerpts from your medical record as necessary for payment of your account. For example, a bill sent to a third-party payer may include information that identifies you, your diagnosis, and the procedures and supplies used.

Healthcare Operations: Roswell Park may use and disclose your health information in the course of routine healthcare operations, including but not limited to administrative, financial, legal, and quality improvement activities.

Individuals Designated by You: Roswell Park may release your health information to family members, friends, or others (as designated by you) who are involved in your medical care or agree to be responsible for your medical bills. Unless you direct otherwise, we may tell your family or friends your general condition and that you are an inpatient at Roswell Park. In addition, in the event you were involved in a disaster, or public health emergency, we may disclose your health information to an organization assisting in that situation so that your family can be notified about your condition, status, and location.

Appointment RemindersWe may, unless you direct us not to, use and disclose your health information to contact you electronically or by telephone or mail as a reminder that you have an appointment for treatment or medical care at Roswell Park.

Hospital Directory: Roswell Park may include your name and room number in its hospital directory while you are an inpatient at Roswell Park. Your religious affiliation may be given to a member of the clergy. You have the right to direct us not to use or disclose your health information in the directory or to give any information out to clergy.

Business Associates: A business associate is an individual or entity under contract with Roswell Park to perform or assist Roswell Park in performing a function or activity involving you or your care that necessitates use or disclosure of your health information. Roswell Park may use and disclose your health information to its business associates. Examples of Roswell Park’s business associates include, but are not limited to, collection agencies, accountants, lawyers, medical transcriptionists, and third-party billing companies. We maintain a written contract with each business associate that requires the business associate to protect the confidentiality of your health information.


Regulatory Agencies: Roswell Park may disclose your health information to a health oversight agency for activities authorized by law, including but not limited to licensure, certification, audits, investigations, and inspections. These activities are necessary for the government and certain private health oversight agencies, (e.g., Joint Commission on Accreditation of Healthcare Organizations or the New York State Department of Health) to monitor the healthcare system.

Law Enforcement/Litigation: Roswell Park will disclose your health information for law enforcement purposes as required by law or in response to a valid subpoena or court order.

Public Health Reporting/Disaster/Emergency Response: As required by law, Roswell Park may disclose your health information to public health or government authorities charged with preventing or controlling disease, injury, or disability or to disaster relief efforts. For example, Roswell Park is required to report the existence of or exposure to communicable diseases, such as AIDS or hepatitis, to the New York State Department of Health.

Workers Compensation: Roswell Park may release your health information to your employer or an insurance company in connection with a workers’ compensation claim filed by you.

Military/Veterans: If you are a member of the armed forces, we may disclose your health information as required by military command authorities.

Inmates: If you are an inmate of a correctional institute or under the custody of a law enforcement officer, Roswell Park may release your health information to the correctional institute or law enforcement official.

Coroners, Medical Examiners, Funeral Directors: Roswell Park may notify a coroner, funeral director, or medical examiner in case of death.

Health Oversight Activities: Roswell Park may release your health information for audits, inspections, licensure, certification, and disciplinary actions.


Research: Research at Roswell Park is overseen by Roswell Park’s Office of Research Subject Protection (“ORSP”) and Institutional Review Board (“IRB”) to assure, both in advance and by periodic review, that appropriate steps are taken to protect the rights and welfare of those participating in research. Roswell Park may use and disclose your health information for research purposes as follows:

  1. As part of a research study or data repository that you participant in, as described in a specific consent signed by you;
  2. As part of a research study or an outcomes analysis that is authorized by Roswell Park’s IRB or ORSP to be conducted without consent; and
  3. As part of other research activities, provided that your name and other direct identifiers are removed and, prior to being disclosed to any outside researcher, a data use agreement is signed in accordance with federal and state law.

Organ/Tissue Donation: To the extent allowed by law, Roswell Park may disclose your health information to organ procurement organizations and other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.

Fundraising: We may disclose certain information to our foundation (the Roswell Park Alliance Foundation) so that the Foundation may contact you for fundraising efforts. If you do not want Roswell Park to contact you for fundraising efforts, you should notify the Roswell Park Alliance Foundation in writing to the Senior Gift Processor, c/o Roswell Park Comprehensive Cancer Center, Elm and Carlton Streets, Buffalo, NY 14263, or call the Foundation at (716) 845-4444.

Healthcare Related Messages, Educational and Research Opportunities/Events: We may use and disclose your health information in order to contact you with healthcare related messages (e.g., annual screening reminders) and provide you with information about our educational and supportive events and resources that may be of interest to you.  You may choose to opt out of receipt of these types of notices by clicking the unsubscribe link in the notice or by calling Roswell Park at 1-800-Roswell (767-9355).


Any other uses and disclosures of your health information not described in this Notice will not be made without your written authorization. For example, the use and/or disclosure of psychotherapy notes and disclosures that constitute a sale of health information require authorization.  Your health information that has been de-identified (your name and other direct identifiers have been removed) is not subject to this notice and may be used and disclosed by Roswell Park for any lawful purpose.  

An authorization permitting Roswell Park to use or disclose your health information can be revoked by you at any time by providing a written notice clearly identifying the written authorization that is being revoked, specifying the portion or all of the authorization being revoked, and delivering the revocation to the Health Information Management Department at Roswell Park. Such revocations shall be effective two business (2) days after receipt thereof by that department.


You have the following rights concerning your health information maintained at Roswell Park:

Right to Confidential Communications: You have the right to receive confidential communications of your health information by alternative means or at alternative locations. For example, you may request that Roswell Park only contact you at work or by mail, and to tell us not to contact you at a certain address or telephone number.

Right to Inspect and Copy: You have the right to inspect and copy all or portions of your medical record in any format you choose. New York State law permits Roswell Park to recover costs that are associated with providing a copy of your medical record.

Right to Amend: If you believe that the health information we have about you is incorrect or incomplete, you may ask us to amend the information.  You have the right to request an amendment for as long as the information is kept in our records.   A written request form, and a copy of this policy and procedure, may be obtained by contacting the Health Information and Medical Records Department at (716) 845-5991, or by contacting your Roswell Park attending physician. Roswell Park may deny such an amendment under certain circumstances.

Right to an Accounting: You have the right to obtain an accounting of certain disclosures of your health information to third parties outside of Roswell Park as provided by 45 CFR §164.528. Disclosures that you have authorized will not be reflected in this accounting.

Right to Request Restrictions: You have the right to request additional restrictions on certain uses and disclosures of your health information under 45 CFR § 164.522. In addition, you have the right to restrict certain disclosures of your health information to a health plan when you pay in full for the healthcare item or service. Roswell Park may agree to honor your request but has the right to refuse requests for restrictions that are not mandated by law. You must make your request in writing, and Roswell Park will respond to your request within ten (10) business days thereafter.

Right to Receive Notification:  You have the right to receive a notification in the event of a breach of your health information. 

Right to Receive Copy of this Notice:  If you receive this notice on our web site or by electronic mail (e-mail), you are also entitled to request a paper copy of the notice. For instructions on how to obtain this information in Braille, another language, or other available formats, please call toll-free at 1-800-Roswell Park (1-800-767-9355) or visit our website at


If you have questions, need additional information, or wish to file a complaint, you may contact the Privacy Officer of Roswell Park at (716) 845-7794. If you believe your privacy rights have been violated, you may file a complaint with Roswell Park or with the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. Federal law and Roswell Park policy prohibit retaliation against a person for filing a complaint.

Changes to this Notice: Roswell Park will abide by the terms of this notice currently in effect. Roswell Park reserves the right to change or modify its privacy practices, provided such changes or modifications comply with applicable law, and further provided it then issues an updated Notice of Privacy Practices. Roswell Park reserves the right to change the terms of this notice to reflect changes in practices and to make the new notice provisions effective for all of your health information that it maintains, including your health information received by Roswell Park prior to such change.

Notice Effective Date: The effective date of the notice is May 1, 2023.

For a simplified and shortened version of this notice please see: