Patient Confidentiality Policy

This notice describes how medical information about you may be used and disclosed, and how you may access this information.  Please review it carefully.


This notice describes the privacy practices of the Kennedy Health System and that of:

  • Any health care professional authorized to enter information into your medical record while working at any Kennedy site,
  • All departments and units of the health system,
  • Any member of a volunteer group we allow to help you while you are a patient in the health system, and
  • All employees, staff and other health system personnel

All Kennedy Health System entities, sites, and locations that are subject to HIPAA regulation follow the terms of this notice. In addition, these entities, sites, and locations may share medical information with each other for treatment, payment, or health care operations purposes described in this notice. All of these entities, sites and locations are hereafter referenced as "Kennedy."


This notice tells you how Kennedy may use and disclose PHI about you. It also describes your rights and certain obligations Kennedy has regarding the use and disclosure of PHI. Kennedy is required by law to:

  • Make sure that medical information that identifies you is kept private;
  • Give you this notice of our legal duties and privacy practices with respect to medical information about you; and
  • Follow the terms of the notice that is currently in effect.

Kennedy understands that medical information about you and your health is personal, and we are committed to protecting it. This information is "protected health information," or "PHI" for short. PHI includes information that can be used to identify you that we have created or received from other sources and relates to your past, present, or future health or condition, the provision of health care to you, or the payment for this health care. This notice applies to all of the records of your care generated by Kennedy, whether made by a Kennedy employee, your doctor or other health care professional. Your doctor may have different policies or procedures regarding the doctor’s use and disclosure of your medical information created in his or her office.


The following categories describe different ways that we use and disclose medical information about you. For each category, we will explain what we mean and provide examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose PHI falls into one of the categories.

  1. Uses and Disclosures Relating to Treatment, Payment, or Health Care Operations do not require your prior written authorization. We may use and disclose your PHI for the following reasons:
    1. For Treatment. Kennedy may use PHI about you to provide you with medical treatment or services. We may disclose PHI about you to doctors, nurses, technicians, students, interns, residents or other hospital and health system personnel who provide you with health care services or are involved in your care. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may affect the healing process. In addition, the doctor may need to tell the dietitian that you have diabetes so that we can arrange for appropriate meals. Various departments may share PHI about you in order to coordinate items or services you may require, such as medications, laboratory work and x-rays. We also may disclose PHI about you to people who may become involved in your medical care after you leave Kennedy. These people might include family members, nursing facilities, or other medical service providers that may assist in your care. Finally, if you need emergency treatment and you are unable to communicate your consent to us (for example, you are unconscious or in severe pain), we may disclose your PHI without your authorization if we think you would agree to the disclosure if you were able to do so.
    2. To Obtain Payment for Treatment. We may use and disclose your PHI in order to bill and collect payment for treatment and services provided to you. For example, Kennedy may provide portions of your PHI to our billing department and to your health plan to get paid for health care services we provided to you. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. We may also provide your PHI to our business associates such as billing companies, claims processing companies, and others that process Kennedy’s health care claims.
    3. For Health Care Operations. We may use and disclose PHI about you for hospital and health system operations. These uses and disclosures are necessary to run the health system and make sure that all of our patients receive quality care. For example, we may use PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine medical information about many patients to decide what additional services Kennedy should offer, what services are not needed, and whether certain treatments are effective. We may also disclose information to doctors, nurses, technicians, house staff, students, volunteers and other Kennedy personnel for review and learning purposes. We may also combine PHI we have with medical information from other health care providers to compare how we are doing and to evaluate where we can improve our services. We will remove information that identifies you from this set of PHI so that others may use it to study health care and health care delivery without learning the names of specific patients.
  1. Disclosures That Do Not Require Your Authorization. We may use and disclose your PHI without your authorization for the following reasons:
  1. Information provided to you.
  2. When a disclosure is required by federal, state or local law, judicial or administrative proceedings, or law enforcement. Kennedy makes disclosures when a law requires that we report information. These may include disclosures to government agencies and law enforcement personnel about victims of abuse, neglect, or domestic violence; when dealing with gunshot or other wounds; or when ordered in a judicial or administrative proceeding. Other examples include: responding to law enforcement officials concerning subpoenas, warrants, summons or similar process; identifying/locating a suspect, fugitive, material witness, or missing person; disclosing information about the victim of a crime, if the victim is not able to communicate his/her wishes; reporting death we believe may be the result of criminal conduct; reporting information related to criminal conduct at Kennedy; and reporting in emergency circumstances a crime, the location of the crime or victims, and the identity/description/location of the person who committed the crime. If you are an inmate of a correctional institution or under the custody of a law enforcement institution or law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. This release would be necessary (a) for the institution to provide you with health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the correctional institution.
  3. For public health activities. We may disclose PHI to prevent or control disease, injury or disability; to report births and deaths; to report reactions to medications or problems with products; to notify patients of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or to provide medical examiners and funeral directors necessary information relating to an individual’s death.
  4. For health oversight activities. We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure surveys. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
  5. Lawsuits and disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court or administrative order. We may disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request and allow you the opportunity to obtain an order protecting the information requested.
  6. For purposes of organ and tissue donation. We may release PHI to organizations that handle organ or tissue procurement, transplantation or banking as necessary to facilitate organ or tissue donation and transplantation.
  7. For specific government functions. We may disclose PHI of military personnel and veterans, as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority. We may disclose PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. We may also disclose PHI about you to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state or to conduct special investigations.
  8. To avert a serious threat to health or safety. We may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
  9. Research. Under certain circumstances, we may use and disclose PHI about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received a different medication for the same condition. All research projects, however, are subject to a special approval process. This process evaluates the proposed research project and its use of medical information, balancing the research benefits with the patients’ need for privacy. Before we use or disclose PHI for research, the project will have been approved through this research approval process. We may, however, disclose PHI about you to medical staff or Kennedy associates preparing to conduct a research project, provided that the PHI they review is not removed from Kennedy. In addition, some research will be conducted using a limited data set of PHI that excludes patient names and other identifying information that we maintain for research and quality improvement. We will contact you to obtain your specific permission if the researcher will be disclosing information that could be used to identify you or if the researcher will be involved in your care at Kennedy.
  10. Workers’ compensation. We may release PHI about you for workers’ compensation or similar programs as required by law. These programs provide benefits for work-related injury or illness.
  11. Appointment reminders and health-related benefits or services. We may use and disclose PHI to contact you as a reminder that you have an appointment for services at Kennedy. We may also use and disclose PHI to provide you with information about treatment options or alternatives that may be of benefit to you. We may also use and disclose PHI to tell you about health-related benefits or services provided by Kennedy that may be of interest to you.
  12. Fundraising activities. We may use your PHI to raise funds for Kennedy. The money raised through these activities is used to expand and support the health care services and educational programs Kennedy provides to the community. We may disclose your PHI to a foundation related to Kennedy so that the foundation may contact you to solicit donations for Kennedy. We only would release contact information, such as your name, address and phone number and the dates you received services at Kennedy. If you do not wish to be contacted as part of our fundraising efforts, please contact the Chief Privacy Officer listed in Section V below in writing.
  13. Health plan. We may disclose your PHI to the sponsor of your health plan.
  14. Change of ownership. In the event that Kennedy is sold or merged with another organization, your PHI/record will become the property of the new owner.
  1. Uses and Disclosures that Require You to Have the Opportunity to Agree or Object.
  1. Patient directories. We may include the following information in a patient directory while you are a patient: name, location in the system, your general condition (e.g., good, fair, serious, or critical) and your religious affiliation. The directory information, except religious affiliation, may also be released to people who ask for you by name, except if you are being treated in a behavioral health unit. This is so your family, friends and clergy may visit you in the hospital and learn how you are doing generally. Your religious affiliation may be given to a member of the clergy, such as a priest, minister, or rabbi, even if clergy do not ask for you by name. You may object to your PHI being placed in the directory. The opportunity to object may be obtained retroactively in emergency situations.
  2. Individuals involved in your care or payment for your care. Unless you object in whole or in part, we may release PHI about you to a family member, friend, or other person who is involved in your medical care. We may also give information to someone who helps pay for your care. In addition, we may disclose PHI about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. The opportunity to object may be obtained retroactively in emergency situations.
  3. Persons acting on behalf of you. If you are not present or able to agree or object to a disclosure, we will use professional judgment and experience to determine whether it is in your best interest to allow another person to act on your behalf to pick up filled prescriptions, medical supplies, x-rays, or other similar forms of your PHI.
    1. All Other Uses and Disclosures Require Your Prior Written Authorization. In any other situation not described in Sections III A, B, and C above, we will ask for your written authorization before using or disclosing any of your PHI. If you choose to sign an authorization to disclose your PHI, you can later revoke that authorization in writing to stop any future uses and disclosures. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written authorization. We are unable to take back any disclosures of your information that we have already made with your authorization.


  1. Right to inspect and obtain copies of your PHI. You have the right to look at and obtain copies of your PHI that may be used to make decisions about your care. Usually this includes medical and billing records. The right does not include a right to psychotherapy notes. To inspect and obtain a copy of your PHI, you must make the request in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing and other supplies associated with your request. We will respond to you within 30 days after receiving your written request.

    We may deny your request in certain circumstances. If we do, we will tell you in writing our reasons for the denial and explain your right to have the denial reviewed. If you request a review of the denial, another licensed health care professional chosen by Kennedy, usually the Chief Privacy Officer, will review your request and the denial. The person conducting the review will not be the person who denied your request. We will abide by the outcome of the review.

  2. Right to amend. If you believe that there is a mistake in your PHI or that a piece of important information is missing, you have the right to request that we correct the existing information or add the missing information. You have the right to request an amendment for as long as Kennedy keeps the information.

You must provide the request and your reason for the request in writing to the Chief Privacy Officer. We will respond within 60 days of receiving your request. We may deny your request for amendment in writing if:

  • The request does not include a reason to support the request;
  • The PHI is correct and complete;
  • The PHI was not created by us;
  • The PHI is not part of the information which you would be permitted to inspect and copy; or
  • The PHI is not part of our records.

If we deny your request, our denial will be in writing, stating the reasons for the denial and explaining your right to file a written statement of disagreement with the denial. If you do not file one, you have the right to request that your request and our denial be attached to all future disclosures of your PHI. If we approve your request, we will make the change in your PHI, confirm to you that we have done it, and tell others that need to know about the change in your PHI.

  1. Right to an accounting of disclosures. You have the right to get a list of instances in which we have disclosed your PHI. The list will not include uses or disclosures that you have already authorized, such as those made for treatment, payment, or health care operations, directly to you, to your family, in response to your written authorization, or in our facility directory. The list also will not include uses and disclosures made for national security purposes, to corrections or law enforcement personnel, or before April 14, 2003. To request an accounting of disclosures, you must submit your request in writing. Your request must state a time period and may not be longer than six (6) years ago and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. We may charge you for the cost of additional lists. We will notify you of the cost involved and you may choose to withdraw or modify your request before any costs are incurred. We will respond within 60 days of receiving your request.
  1. The right to request restrictions. You have the right to ask that we limit how we use and disclose your PHI for treatment, payment or health care operations. You also have the right to request a limit on your PHI that we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend.

    To request restrictions, you must make your request in writing to the Chief Privacy Officer or designee. In your request, you must tell us what information you want to limit, whether you want us to limit our use, disclosure or both, and to whom you want the limits to apply.

    We will consider your request, but we are not legally required to accept it. If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or permitted to make.

  2. The right to choose how we send PHI to you. You have the right to ask that we send information to you at an alternate address (for example, to your work address rather than your home address) or by alternate means (for example, e-mail instead of regular mail). To request such alternate communication, you must make your request in writing to the Chief Privacy Officer or designee. Your request must specify how and where you wish to be contacted. We will not ask the reason for your request. We will accommodate your request, as long as we can easily provide it in the format requested.
  3. The right to a paper copy of this notice. You have the right to a paper copy of this notice, even if you have agreed to receive this notice via e-mail. You may ask us to give you a copy of this notice at any time. To obtain a copy of this notice, you must make your request in writing to the Chief Privacy Officer.


If you have any questions about this notice or a complaint, if you think that we may have violated your privacy rights, or if you disagree with a decision we made about access to your PHI, you may call Kennedy’s Chief Privacy Officer at (856) 346-7500.

Alternately, you may send a written complaint to:

Chief Privacy Officer
Kennedy Health System
Management Services Center
500 Marlboro Avenue
Cherry Hill, NJ 08034

Or you may send a written complaint to the Secretary of the Department of Health and Human Services at the following address:

The U.S. Department of Health and Human Services
200 Independence Avenue, S.W.,
Washington, D.C. 20201


We will take no retaliatory action against you if you file a complaint about our privacy practices.


We reserve the right to change the terms of this notice and our privacy policies at any time. Any changes will apply to the PHI we already have about you, as well as any information we receive in the future. Before we make an important change in our privacy policies, we will promptly change this notice and post a new notice in our facilities and on our web site.

You can obtain a copy of the current notice:

  • Each time you register at or are admitted to Kennedy for treatment or health care services as an inpatient or outpatient,
  • By requesting a copy of the current notice from the Chief Privacy Officer listed in Section V above,
  • By viewing a copy of the current notice on our web site.


This notice is effective April 14, 2003. It applies to the corporate subsidiaries of Kennedy that qualify as covered entities subject to the Health Insurance Portability and Accountability Act.