Patient Privacy

JOINT NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION—PLEASE REVIEW IT CAREFULLY.

This Notice serves as a joint notice for BJC Health affiliated hospitals, facilities, and providers and Washington University School of Medicine (collectively referred to herein as “we” or “our” or “us”) of our privacy practices related to health information. We have established one or more organized health care arrangements. Not all of our facilities participate in each of these organized health care arrangements. Specifically, all BJC Health affiliated hospitals and providers participate in one organized health care arrangement together; in another organized health care arrangement a subset of BJC Health affiliated hospitals and providers participate with Washington University School of Medicine. This means that your health information may be shared between participants in each of these arrangements for purposes related to their operating together as integrated health systems, including the provision of treatment, for payment purposes, and for a broad scope of health care operations, which may include joint utilization review, credentialing, education, risk management, patient safety, quality assessment, and improvement activities. Additional information can be found in BJC Health policies on organized health care arrangements, available at BJC.org/patients-visitors/our-policies.

We will follow the terms of this Notice when we share or disclose your health information with each other and other third parties. Because we maintain health information separately, we will respond separately to your questions, requests, and complaints concerning your health information.

OUR DUTIES REGARDING YOUR HEALTH INFORMATION

We are required by law to protect the privacy of your protected health information, to provide you with notice of these legal duties, and to notify you following a breach of unsecured protected health information. This Notice explains how, when, and why we typically use and disclose health information, and your privacy rights regarding your health information. In our Notice, we refer to our uses and disclosures of health information as our “Privacy Practices.” Protected health information generally includes information that we create or receive that identifies you and your past, present, or future health status or care, or the provision of or payment for that health care. We are obligated to abide by these Privacy Practices as of the effective date listed below.

WHO WILL FOLLOW THIS NOTICE

Our Notice serves as a Joint Notice, and we will follow the terms of this Notice. This Notice describes the Privacy Practices of BJC Health and its wholly owned subsidiaries and affiliated facilities and personnel (“BJC affiliated sites”) described in the list located at BJC.org/patients-visitors/patient-privacy, and the Privacy Practices of Washington University School of Medicine and its wholly owned subsidiaries and affiliated facilities and personnel. “Personnel” includes health care professionals, employees, and volunteers for any of the entities and facilities subject to this Notice.

CHANGES TO THIS NOTICE

We reserve the right to change our Privacy Practices and the terms of this Notice. If we make material changes to this Notice, we will provide you with the revised Notice by making it available to you upon request and by posting it at our service sites. We will also post the revised Notice on our websites. Any changes that we make in our Privacy Practices will affect any protected health information that we maintain.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU WITHOUT YOUR WRITTEN CONSENT OR AUTHORIZATION

For Treatment, Payment, and Health Care Operations

For Your Treatment
We may use and/or disclose your health information to health care providers and other personnel who are involved in your care and who will provide you with medical treatment or services. For example, if you have had surgery or just had a baby, we may contact a home health care agency to arrange for home services or to check on your recovery after you are discharged from the hospital.
For Payment for Health Services
We may use and/or disclose your health information to bill and receive payment for the services that you receive from us. For example, we may provide your health information to our billing or claims department to prepare a bill or statement to send to you, your insurance company, including Medicare or Medicaid, or another group or individual that may be responsible to pay for your health services.
For Our Health Care Operations
We may use or disclose your health information to carry out certain administrative, financial, legal, and quality improvement activities that are necessary to run our businesses and to support our treatment and payment activities. For example, we may use and/or disclose your health information to help assess the quality and performance of our physicians and staff and improve the services that we provide. Specifically, we may disclose your health information to physicians, medical, or other health or business professionals for review, consultation, comparison, and planning. We may use and disclose your health information in the course of our training programs and for accreditation, certification, licensing, or credentialing activities. Additionally, we may disclose your health information to auditors, accountants, attorneys, government regulators, or other consultants to assess and/or ensure our compliance with laws or to represent us before regulatory or other governing authorities or judicial bodies.

For Activities Permitted or Required by Law

There are situations where the Health Insurance Portability and Accountability Act (HIPAA) permits us to use and/or disclose your health information without first obtaining your written authorization for purposes other than for treatment, payment, or health care operations. Except for the specific situations where laws require us to use and disclose information (such as reports of births to the health department or reports of abuse or neglect to social services), we have listed all HIPAA permitted uses and disclosures in this section. We must meet many conditions in the law before we can share your information for these purposes. For more information see hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html.

Public Health Activities
We may disclose your health information for public health purposes, including:

to a public health authority that is authorized by law to collect or receive information in order to report, among other things, communicable diseases and child abuse
to the U.S. Food and Drug Administration (FDA) to report medical device or product-related events
to notify a person exposed to a communicable disease
to your employer if we are providing care at your employer’s direction related to a workplace injury
to your school if proof of vaccination is requested

To Report Potential Adult Abuse or Neglect
If we believe a patient is the victim of abuse, neglect, or domestic violence, we may notify the government agency authorized by law to receive reports of those issues. In some situations, we may notify you before reporting such concerns.
Health Oversight Activities
We may disclose your health information to a health oversight agency that is authorized by law to monitor the health care system and our compliance with certain laws.
Law Enforcement Activities
We may disclose your health information in response to a law enforcement subpoena, summons, grand jury subpoena, administrative request, warrant, investigation demand, or a law enforcement official’s request for information to identify or locate a victim, a suspect, a fugitive, a material witness, or a missing person (including individuals who have died), for reporting a crime that has occurred on our premises, or to report a crime that may have caused a need for our emergency services. If Washington University School of Medicine receives a subpoena, summons, grand jury subpoena, court order, administrative request, warrant, or investigation demand that legally requires Washington University School of Medicine to disclose your health records, Washington University School of Medicine will attempt to provide you with notice prior to disclosing your health information to law enforcement if Washington University School of Medicine is permitted to do so.
Judicial and Administrative Proceedings
We may disclose your health information in response to a subpoena, order of a court or administrative tribunal, discovery request, or other lawful process in the course of a judicial or administrative proceeding. Washington University School of Medicine will attempt to provide you with notice prior to disclosing your health information unless such notice has been provided by another party to the dispute and/or a qualified protective order has been filed in the dispute.
Coroners, Medical Examiners, and Funeral Directors
We may disclose your health information to coroners, medical examiners, and funeral directors to identify a deceased person or to determine the cause of death.
Organ Donation
We may disclose your health information to an organ procurement organization or other facility that participates in or makes a determination for the procurement, banking, and/or transplantation of organs or tissues.
Research Purposes
We conduct and participate in medical, social, psychological, and other types of research. Most human subject research projects, including many of those involving the use of health information, are subject to a special approval process which evaluates the proposed research project and its use of health information. In certain circumstances, however, we may disclose health information to researchers preparing to conduct a research project to help them determine whether a research project can be carried out or will be useful, so long as the health information they review does not leave our premises. Our clinicians may offer you the opportunity to participate in a clinical research trial (investigational treatments) and other researchers may contact you regarding your interest in participating in research projects. Your enrollment in a research project will occur only after you have been informed about the research, had an opportunity to ask questions, and have signed a consent form. When approved through a special review process, research may be performed using your health information without your consent.
Avoidance of Harm to a Person or Public Safety
We may disclose your health information if we believe that the disclosure is necessary to prevent or lessen a serious threat or harm to the public or the health or safety of another person.
Specialized Government Functions
We may disclose your health information for specific governmental security needs, or as needed by correctional institutions.
Workers’ Compensation Purposes
We may disclose your health information to comply with workers’ compensation laws or similar programs.
To Business Associates
We may disclose your health information to our “business associates,” which are individuals or companies that provide services to us. For example, a business associate would include the company that administers the billing claims for us, a software vendor that helps us send you reminders about appointments, and other service providers. We require that business associates keep your information safe.
To Inform You of Health-Related Products or Services
We may use or disclose your health information to contact you for medical appointments or other scheduled services, or to provide you with information about treatment alternatives or other health-related benefits and services.
To Parents and Legal Guardians of Minors
When a patient is an unemancipated minor, we may share the minor’s health information with the patient’s parents or guardians unless otherwise prohibited by law.
Billing and Collection Purposes
We may use or disclose your health information for the purpose of obtaining payment for services provided. You may be contacted by mail or telephone at any telephone number associated with you, including wireless numbers. Telephone calls may be made using pre-recorded or artificial voice messages and/or automatic dialing device (an “autodialer”). Messages may be left on answering machines or voicemail, including any such message information required by law (including debt collection laws) and/or regarding amounts owed by you. Text messages or emails using any email addresses you provide may also be used in order to contact you.
Fundraising Purposes
We may use or disclose demographic information, including names, addresses, other contact information, age, gender, and date of birth; the dates that you received health care from us; department of service information; treating physician information; and outcome information to contact you in order to raise funds so that we may continue or expand our health care activities. You have the right to opt out of these fundraising communications. If you do not wish to be contacted as part of our fundraising efforts, please contact the individual(s) listed in the Contact Section of this Notice. If you decide you do not wish to be contacted as part of our fundraising efforts, we will not condition service or payment upon that decision.

Please note that if we receive information relating to your diagnosis, prognosis, or treatment for a substance use disorder from programs subject to 42 CFR Part 2 (“Part 2 Records”), we will not use or disclose your Part 2 Records, or provide testimony relaying the content of your Part 2 Records, in any civil, criminal, administrative, or legislative proceeding against you unless you have provided written consent to this disclosure (separate from your consent for any other use or disclosure), or a court order after notice and an opportunity to be heard is provided to you or us (as the lawful holder of the Part 2 Record), as provided by 42 CFR Part 2. A court order authorizing the use or disclosure of this information must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested information is used or disclosed.

BJC Health operates a 42 CFR Part 2 program. Additional information related to this program’s Notice of Privacy Practices is available at BJCBehavioralHealth.org.

When Your Preferences Will Guide Our Use or Disclosure

A facility directory may include your name, your location in the facility, your general condition such as fair, stable, etc., and your religious affiliation (if provided by you). Unless you tell us that you would like to restrict your information in a facility directory, you will be included and directory information may be disclosed to members of the clergy or to people who ask for you by name.
We may disclose your health information to a family member, other relative, friend, or any other person you identify who is involved in your care or involved with the payment related to your care unless you tell us otherwise.

Uses and Disclosures that Require Your Written Authorization

We will not disclose psychotherapy notes without your written authorization unless the use and disclosure is otherwise permitted or required by law.
We will not engage in disclosures that constitute a sale of your health information without your written authorization. A sale of protected health information occurs when we, or someone we contract with directly or indirectly, receive payment in exchange for your protected health information.
We will not use or disclose your protected health information for marketing purposes without your written authorization. Marketing is defined as receipt of payment from a third party for communicating with you about a product or service offered by a third party.

For situations not generally described in our Notice, we will ask for your written authorization before we use or disclose your health information. You may revoke that authorization, in writing, at any time to stop future disclosures of your health information. Information previously disclosed, however, will not be requested to be returned nor will your revocation affect any action that we have already taken in reliance on your authorization. In addition, if we collected the information in connection with a research study, we are permitted to use and disclose that information to the extent it is necessary to protect the integrity of the research study.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

Requesting Restrictions of Certain Uses and Disclosures of Health Information

You may request, in writing, a restriction on how we use or disclose your protected health information for your treatment, for payment for our health care services, or for activities related to our health care operations. You may also request a restriction on what health information we may disclose to someone who is involved in your care, such as a family member or friend. To make a request, please see the instructions at the end of this Notice.

We are not required to agree to your request in all circumstances. Additionally, any restriction that we may approve will not affect any use or disclosure that we are required or permitted to make under the law. We must agree to your request to restrict disclosure of your health information to your health plan if the disclosure is not required by law and the health information you want restricted pertains solely to a health care item or service for which you (or someone other than your health plan, on your behalf) paid us for in full.

Requesting Confidential Communications

You may request changes in the manner in which we communicate with you or the location where we may contact you. You must make your request in writing. See contact information below. We will accommodate your reasonable request, but in determining whether your request is reasonable, we may consider the administrative difficulty it may impose on us.

Inspecting and Obtaining Copies of Your Health Information

You may ask to look at and/or obtain a copy of your health information. You must make your request in writing. To make a request for your health information, please see the instructions at the end of this Notice.

We may charge a fee for copying or preparing a summary of requested health information. We will respond to your request for health information within 30 days of receiving your request by either providing the information requested, denying the request with a written explanation for the denial, or advising you we need additional time to complete our action on your request (for instance, if your health information is not readily accessible or the information is maintained in an off-site storage location).

Requesting a Change in Your Health Information

You may request, in writing, a correction or amendment to your health information if you think your health information is incorrect or incomplete. We are not required to agree to your request unless if required by applicable state law. Under no circumstances will we erase or otherwise delete original documentation in your health information unless if requested in accordance with applicable state laws. Instructions on how to make a request for amendment or correction to your health information can be found at the end of this Notice.

Requesting an Accounting of Disclosures of Your Health Information

You may ask, in writing, for an accounting of certain types of disclosures of your health information that we have made in the six years prior to your request. The law excludes from an accounting many of the typical disclosures, such as those made to care for you, to pay for your health services, or where you provided your written authorization to the disclosure.

To make a request for an accounting, see contact information below. Generally, we will respond to your request within 60 days of receiving your request unless we need additional time. You are only entitled to one accounting per year.

OUR RESPONSIBILITIES REGARDING YOUR HEALTH INFORMATION

Notification Following a Breach of Unsecured Protected Health Information

We are required by law to notify you in the event your health information is involved in a breach we experienced that may have compromised the privacy or security of your health information.

Obtaining a Notice of Our Privacy Practices

We are required to provide you with our Notice to explain and inform you of our Privacy Practices. Even if you have requested this Notice electronically, you may request a paper copy at any time. You may also view or obtain a copy of this Notice at our websites: BJC.org/patients-visitors/patient-privacy SaintLukesKC.org/patients-visitors/patient-privacy physicians.washu.edu/for-patients/for-your-protection/

COMPLAINTS

We welcome an opportunity to address any concerns that you may have regarding the privacy of your health information. If you believe that the privacy of your health information has been violated, you may file a complaint with the individuals listed in the Contact Section of this Notice. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights by sending a letter to 200 Independence Avenue, SW, Washington, DC 20201, calling 877-696-6775, or visiting hhs.gov/hipaa/filing-a-complaint/index.html.

We will not retaliate against you for filing a complaint with us or the Office for Civil Rights.

Effective Date: February 16, 2026

CONTACT INFORMATION

It is important to note that requests or complaints must be made to the hospital or office where your privacy concern arose. Any requests or complaints to one provider will not be deemed to be filed with any of the other providers covered by or addressed in this Joint Notice.

Contact Information for BJC Health Affiliated Hospitals, Facilities, and Providers:

For questions about this Notice, to report concerns about our Privacy Practices, or to file a complaint concerning the Privacy Practices of BJC Health affiliated hospitals and providers, please contact the Privacy Officer by any means listed below:

BJC Health – Privacy Officer
4901 Forest Park Ave., Suite 1140
St. Louis, MO 63108
Mailstop: 90-75-571
314-362-4855
Email: [email protected]

Contact Information for BJC HealthCare:

To look at or obtain a copy of your health information from a BJC HealthCare affiliated hospital or provider, you may contact 314-362-3935 or visit BJC.org and contact the facility medical records department where your health information is maintained.
To request an amendment or correction to your health information maintained by BJC HealthCare affiliated hospitals and providers, please email [email protected] or call 314-273-2468.
To request a restriction on the use of your health information by BJC HealthCare affiliated hospitals and providers, please email [email protected].
To request an accounting of disclosures by BJC HealthCare affiliated hospitals and providers, please email [email protected] or call 314-454-4997.

Contact Information for Saint Luke’s:

To look at or obtain a copy of your health information from a Saint Luke’s affiliated hospital or provider, you may contact the Medical Records/Release of Information department by email at [email protected], or visit saintlukeskc.org/medical-records.
To request an amendment or correction to your health information maintained by Saint Luke’s affiliated hospitals and providers, please complete and submit the form found at saintlukeskc.org/medical-records and submit via email to [email protected].
To request a restriction on the use of your health information by Saint Luke’s affiliated hospitals and providers, please contact Medical Records at [email protected].
To request an accounting of disclosures by Saint Luke’s affiliated hospitals and providers, please contact Medical Records at [email protected].

Contact Information for Washington University School of Medicine or its Providers:

For questions about this Notice, concerns about our Privacy Practices, or to file a complaint concerning Washington University School of Medicine or its providers, you may contact the Privacy Officer by any means listed below:

Washington University School of Medicine – Privacy Officer
MSC 8095-02-01
660 S. Euclid Ave.
St. Louis, MO 63110
866-747-4975
Email: [email protected]
To look at or obtain a copy of your health information from a Washington University School of Medicine provider, please follow the directions found at physicians.washu.edu/for-patients/medical-records-request/. You may also contact the Washington University Health Information Release Service at 314-273-0453.
To request an amendment or correction to your health information maintained by a Washington University School of Medicine provider, please follow the directions found at physicians.washu.edu/for-patients/medical-records-request/ or contact Washington University School of Medicine Health Information Management by email at [email protected] or by phone at 314-273-1986.
To request a restriction on the use of your health information by a Washington University School of Medicine provider, please contact the Washington University School of Medicine HIPAA Privacy Office at 866-747-4975 or by email at [email protected].
To request an accounting of disclosures by a Washington University School of Medicine provider, please contact the Washington University School of Medicine HIPAA Privacy Office at 866-747-4975 or by email at [email protected].

LIST OF ENTITIES SUBJECT TO THIS NOTICE

As stated in the Notice, all BJC Health affiliated facilities and providers participate in an organized health care arrangement with each other (a BJC Health-specific arrangement) and, separately, some of the BJC Health affiliated facilities and providers participate in an organized health care arrangement with all of the Washington University School of Medicine sites listed below. The BJC Health delivery sites that participate in both the BJC Health-specific arrangement and the BJC Health-Washington University School of Medicine arrangement are indicated below with a *. The BJC Health delivery sites that are not identified with a * participate in only the BJC Health-specific organized health care arrangement.
See Organized Health Care Arrangements policy.

BJC HEALTH SERVICE DELIVERY SITES

BJC HealthCare Hospitals

Alton Memorial Hospital*
Barnes-Jewish Hospital*
Barnes-Jewish St. Peters Hospital*
Barnes-Jewish West County Hospital*
Christian Hospital and Northwest HealthCare*
Memorial Hospital Belleville and Shiloh*
Missouri Baptist Medical Center*
Missouri Baptist Sullivan Hospital*
Parkland Health Center – Bonne Terre*
Parkland Health Center – Farmington*
Progress West Hospital*
St. Louis Children’s at CoxHealth*
St. Louis Children’s Hospital*

BJC HealthCare Long-Term Care Facilities

Barnes-Jewish Extended Care

BJC HealthCare Services

Alton Memorial Physician Billing Services
BJC Behavioral Health
BJC Corporate Health Services
BJC Home Care Services
BJC Medical Group Offices
BJC Retail Pharmacies
BJC Vision Centers
Barnes-Jewish St. Peters Physician Billing Services
Children’s Illinois
Christian Hospital Physician Billing Services
Fairview Heights Medical Group
Missouri Baptist Professional Billing Services
Missouri Baptist Physician Services

Saint Luke’s Hospitals

Allen County Regional Hospital
Anderson County Hospital
Hedrick Medical Center
Saint Luke’s East Hospital 
Saint Luke’s Hospital of Kansas City 
Saint Luke’s North Hospital  
Saint Luke’s South Hospital 
Wright Memorial Hospital

Saint Luke’s Long-Term Care Facilities

Bishop Spencer Place
Saint Luke's Hospice House
Anderson County Hospital Residential Living Care

Saint Luke’s Services

Advanced Urologic Associates
Medical Plaza Imaging Associates
Rockhill Orthopaedic Specialists
Saint Luke’s Home Care & Hospice
Saint Luke’s Physician Group

For more information concerning BJC Health service delivery sites, please visit BJC.org or call 314-362-9355 or 800-392-0936, or visit SaintLukesKC.org or call 816-932-5100.