UK St. Claire Employee Benefits Plan Notice of Privacy Practices

Notice of Privacy Practices for
UK St. Claire Employee Benefits Plan

Effective Date: 2/17/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions, please contact our Privacy Officer at the address or phone number at the bottom of this Notice.

Our Commitment to Your Privacy

The UK St. Claire Employee Benefits Plan (after this, “Benefits Plan,” “we,” “our,” or “us”) offers group health insurance to employees of UK St. Claire and is committed to protecting health information about you. The Benefits Plan has access to the records of the care and services you get through the Benefits Plan.

This Notice applies to:

All records of your care that the Benefits Plan keeps, and
All records of your care the Benefits Plan gets from a third party.

The Benefits Plan is required by law to:

Keep health information about you private.
Give you this Notice. It explains our legal duties and privacy practices for health information about you.
Tell you if your unsecured health information is breached.
Follow the terms of the Notice now in effect.
Follow the law when we use and share health information about you.

Changes to this Notice

We may change this Notice at any time. Changes will apply to:

Health information we already have; and
New information we get after the change.

The effective date of the changes is listed near the top of the first page of the Notice. Major changes will not take effect before the effective date, unless required by law.

Before we make a major change in privacy policies and procedures, we will change the Notice. If we make a major change to the Notice, and you are covered by the Benefit Plan at the effective date of the changes, we may:

Post the revised Notice on our website (if available) and send you a copy in our next annual mailing; or
We may send you a copy of the revised Notice, or information about the major change and how to obtain the revised Notice, within 60 days.

You may ask for a copy of the Benefit Plan's current Notice at any time.

How We May Use and Share Health Information About You

The Benefit Plan may use and share health information about you to provide, coordinate, or manage your health care services. This may be done for these reasons:

For treatment

For example: Sharing health information about you with health care providers to help with your care.

For payment

For example: Paying claims for services provided to you by doctors and hospitals.

To support the Benefit Plan's healthcare operations

For example: Reviewing health information to improve health care services.

Other ways we use or share health information about you

We are allowed or required to use and to share health information about you in other ways—usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can use or share your information for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

When required by law

Except as explained in the section below on Substance Use Disorder (SUD) Treatment Records, we may use or share health information about you as required by state or federal law. For example, we share health information with the U.S. Department of Health and Human Services as needed to prove we follow federal privacy law.

When we do use or share your information as required by law:

We will only use or share what is needed to comply with the law.
If required by law, you will be notified if health information about you is used by us or shared with others to comply with the law.

For public health activities

We may use or share health information about you for public health reasons to

Public health authorities that are allowed by law to receive health information for the purpose of preventing or controlling disease, injury or disability.
Public health or other governmental authorities that are allowed by law to receive reports of child abuse or neglect.
The Food and Drug Administration (FDA) for public health reasons related to the quality, safety or effectiveness of FDA-regulated products or activities. This includes collecting or reporting adverse events, dangerous products, and defects or problems with FDA-regulated products.
A person at risk of getting or spreading a disease, if the law allows such sharing.
Your employer in order to conduct workplace medical surveillance (for example, to test your blood for radiation exposure) or to evaluate if you have a work-related illness or injury.
Your school or your child's school if the information is limited to proof of immunization and the school is required by law to have such proof prior to enrollment.

If we believe you may be a victim of abuse, neglect or domestic violence

We may share health information about you with a government agency if we believe you are a victim of abuse, neglect or domestic violence and the agency is authorized to receive health information about you in such cases. This includes spousal, adult, or elder abuse, neglect, or domestic violence.

For health oversight activities

Except as explained in the section below on Substance Use Disorder (SUD) Treatment Records, we may use or share health information about you with health oversight agencies for them to use as authorized by law, including audits, investigations, and inspections.

For judicial and administrative legal proceedings

Except as explained in the section below on Substance Use Disorder (SUD) Treatment Records, we may use or share health information about you if ordered by a court of law or an administrative judge. In some cases, we may need to share health information about you if we receive a subpoena, discovery request or other lawful papers.

For law enforcement

Except as explained in the section below on Substance Use Disorder (SUD) Treatment Records, we may share health information about you for a law enforcement purpose with a law enforcement official if certain conditions are met.

To coroners, medical examiners, and funeral directors

We may share health information about you with:

A coroner or medical examiner to help identify a deceased person, find the cause of death, or do other duties allowed by law.
A funeral director, as allowed by law, if the information is needed to carry out funeral duties for the deceased.

For organ, eye, or tissue donation and transplantation.

We may use or share health information with organizations involved in organ, eye or tissue donation and transplants as needed.

For research purposes

We may use or share health information about you for research if certain conditions are met.

To prevent serious threats to health or safety

We may—as allowed and required by the law and ethics standards—use or share health information about you if we believe it is needed to prevent or lessen a serious threat to the health or safety of a person or the public. If such sharing happens, it must be to someone reasonably able to prevent or lessen the threat.

We may also use or share health information about you if we believe it is needed for law enforcement authorities to identify or apprehend a person who:

Admits to a role in a violent crime that we reasonably believe caused serious physical harm to the victim, or
Seems to have escaped from a correctional institution or lawful custody.

For military activities

We may use or share health information about you if you are a member of the U.S. Armed Forces or a member of a foreign military. The information is only shared as needed – and if certain conditions are met – to assure the success of the military’s mission.

For national security and intelligence

We may share health information with authorized federal officials:

To conduct lawful intelligence, counter intelligence, and other national security activities (as authorized by the National Security Act and implementing authority).
To protect the President or other persons, or for some federal investigations.

To correctional institutions or other law enforcement custodians

If a patient is an inmate of a correctional institution or in the lawful custody of a law enforcement official, we may share the patient’s health information with the institution or the official if needed for health and safety. An inmate does not have the right to this Notice.

For workers' compensation

We may share health information about you as authorized by and as needed to comply with laws for workers' compensation or other like programs set up by law.

To family or friends

We may share health information about you with a friend, family member, or other person you choose. The information must relate to their role in your care or payment for care.

For disaster relief and notification

We may use or share health information about you with:

Your family or others responsible for your care to notify them of your location, general condition (such as good or fair), or death.

A disaster relief entity authorized by law or its charter to aid in disaster relief efforts, so that it can help notify your family or others responsible for your care of your location, general condition, or death.

After death

If a patient dies, we may share his or her health information with other persons, such as family, friends, or caregivers.

The person must have been involved in the patient’s medical care or paying medical bills before the patient’s death.
The information must be relevant to that person's involvement.
It must be consistent with the wishes the patient expressed before death.

To business associates

Some services are provided to us through “business associates.” We will share health information about you with our business associates and let them create, use, maintain or send health information about you to perform their jobs for us.
For example, we may share health information about you to an outside billing company that helps us bill insurance companies.
We have agreements with our business associates requiring them to have safeguards in place that will protect health information about you .

For patient communications

We may use or share health information about you to send appointment reminders and other patient notices to you. These communications may be by mail, text messages, or email. In most cases, you have the right to opt out of receiving emails or text messages. But some messages cannot be turned off. This is for your protection, such as a message that your password was changed.

The Benefits Plan, or a third-party administrator of the Benefits Plan, may share health information about you with UK St. Claire. Please note: UK St. Claire, as your employer, will use or share that information only as necessary to perform plan administration functions or as otherwise permitted or required by HIPAA, unless you have authorized further disclosures. UK St. Claire cannot use or share health information about you for actions or choices related to your employment or any other employee benefits or benefit plan.

When Your Authorization Is Required

Some uses and sharing of health information about you require your written permission (“authorization”) before we can proceed. These include:

For psychotherapy notes

If psychotherapy notes are created for your treatment, most use and sharing of these notes require your prior written authorization.

Psychotherapy notes are defined as:
- Notes recorded in any medium by a mental health professional,
- The notes document or analyze the contents of conversation during a private, group, joint, or family counseling session, and
- The notes are kept separate from the rest of your medical record.
Psychotherapy notes do not include:
- Medicine prescriptions and monitoring,
- Counseling session start and stop times,
- The type of treatments and their frequency,
- Results of clinical tests, and
- Any summary of a diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

For marketing

We must get your written authorization to use or share health information about you for marketing purposes. Authorization is not required if we speak to you face-to-face or if you get a promotional gift of nominal value.

For the sale of health information about you

If sharing health information about you would be considered a sale, we must get your written authorization first.

Genetic information

We cannot use or share health information about genetics for underwriting purposes.

Substance Use Disorder (SUD) Treatment Records

Records for substance use disorder (SUD) treatment have special protections under federal law (42 CFR Part 2). If we receive or maintain any information about you from a SUD treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and share the Part 2 Program record for purposes of treatment, payment or healthcare operations, we may use and share your Part 2 Program record for treatment, payment and health care operations purposes as described in this Notice.

If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and share your Part 2 Program record only as expressly permitted by you in your consent as provided to us.

In no event will we use or share your Part 2 Program record or information contained in your Part 2 Program record in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority against you, unless authorized by your consent or the order of a court after it provides you notice of the court order. A court order authorizing use or sharing of the record must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or shared.

Duties regarding public health

We may share de-identified health information with public health authorities, including information about our treatment of SUD. De-identified information does not identify you, according to HIPAA. See more about de-identified health information below.

No limit on your privacy rights

Our participation in care arrangements with other health care providers (and our use of this Notice) does not remove any of your rights or limit our legal duties to protect your SUD records under federal law.

Other Times Health Information May Be Used or Shared

De-identified information

HIPAA lets us use and share health information if information that could identify you is removed. We call this de-identified information. The privacy principles listed above do not apply to de-identified information. While HIPAA does not restrict the use or sharing of this information, other laws may do so.

Health information is considered to be de-identified if:

It does not identify the patient, and
There is no reasonable expectation that the patient could be identified from the information shared.

We use and share de-identified information, as allowed by law, to:

Support patient care, scientific research, and education activities,
Help us improve treatment options,
Reduce health care costs,
Improve the management of our health care operations, and
Advance public health initiatives.

We use and share de-identified information when we work with persons or groups inside and outside the U.S., such as:

Other academic institutions,
Foundations and organizations,
Business associates,
Government agencies, and
Commercial entities.

Limited data set

We may use health information about you to create a “limited data set” by removing certain identifying information. We may use and share a limited data set only for research, public health, or health care operations purposes, and any third party who receives a limited data set must sign an agreement to protect health information about you.

Authorization required

In any other situation not described in this Notice, we are required to obtain your written authorization before using or disclosing health information about you. If you choose to authorize use or disclosure, you can later revoke (take back) that authorization by notifying us in writing of your decision. However, the revocation will not be effective (1) to the extent we took action in reliance on the authorization before receiving the revocation, or (2) if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

Redisclosure of health information

Once health information about you is shared with someone, that person could share that information with others. Here is what you should know:

If the recipient is not covered by HIPAA, HIPAA will not prevent them from sharing health information about you.
In some cases, an even stricter law (such as 42 CFR Part 2, relating to certain substance use disorder records) may still protect health information about you. These laws may apply to sharing for civil, criminal, administrative, and legislative proceedings against you.

Your Rights Related to Health Information About You

Right to inspect and copy

In most cases, you have the right to look at and to get a copy of your medical and billing records that we maintain (or that are maintained for us). Here’s what you should know:

Submit a written or electronic request to our Privacy Office.
We will work with you to provide the requested information in the form and format you requested; a mutually agreeable alternative form and format; or another form and format permitted by law.
You can ask us to send the records directly to another person. To do this, submit a signed written or electronic request to our Privacy Office. Tell us the name of the person and the address to send it to.

If you request copies, we may charge a reasonable cost-based fee.

If we deny your request, you may submit a written or electronic request for a review of that decision.

Right to amend your records

If you believe something in your medical or billing records is incorrect or missing, you can ask us to correct it. Submit your request in writing or electronically that explains what you want us to change and why.

We may deny your request if:

The information was not created by us,
The information is not part of your records, or
We think the record is accurate and complete as it is.

If we deny your request, you may submit a written or electronic statement that explains why you disagree.

Right to an accounting

You have the right to get a list of the times we have shared health information about you.

Exceptions – we do not have to tell you if the sharing was:

For treatment, payment, or health care operations,
Made with you,
Incident to a use or sharing of health information about you allowed or required by the HIPAA privacy rule,
Authorized by you,
For our directory,
With persons (such as friends or family) involved in your care or to notify them,
For disaster relief, national security, or intelligence purposes,
To correctional institutions or other law enforcement custodians,
Part of a limited data set, or
Information created more than 6 years before your request.

You must submit a written or electronic request to get a list of times we shared health information about you. The request must state the time period you want the list to cover (no more than 6 years before the date of the request). You may get a paper or electronic list.

Your first request in a 12-month period is free. Other requests will be charged based on our cost to make the list. We will tell you the cost before you are charged.

Right to request restrictions

You have the right to ask us to restrict or limit how we use or share health information about you:

For treatment, payment or health care operations.
With someone involved in your care or paying for your care, like a family member or a friend.
For example, you could ask that we not use or share information about a surgery you had.

All requests should be in writing or electronic form. Send them to our Privacy Officer at the address listed later in this notice. We will let you know of our decision.

We must agree to your request to not share health information about you to a health plan, if:

The purpose for the disclosure is not related to treatment,
You paid in full and out of pocket for the items or services that the information restriction applies to (such as a genetic test), and
The law does not require us to share the information with health plan about you.

Otherwise, we are not required to agree to your request. If we do agree, we will comply with your request, unless the information is needed to provide emergency treatment.

Except for restrictions that we must comply with relating to health plans, we may terminate our agreement to a restriction at any time by notifying you in writing. That termination will only apply to information created or received after we sent the notice of termination, unless you agree to apply the termination to older information.

Right to a paper copy of this Notice

You have the right to get a paper copy of this Notice upon request. Please contact the Privacy Officer to request a paper copy.

Right to request confidential communications

You have the right to request that health information about you be sent to you in a confidential way. Tell us in writing or electronically how and where you want us to send your information, such as sending mail to an address other than your home, and whether this request is to avoid a life-threatening situation if it is not communicated in confidence.

Right to be notified of a breach

We will tell you if there is a breach of health information about you. A breach is when health information has been used or shared in a way that is not allowed under federal privacy laws and puts health information at risk.

Send any written or electronic requests or appeals to our Privacy Officer listed below.

Contact for Questions, Complaints, or Requests

For any questions, complaints, and requests regarding your privacy rights or this Notice, contact our Privacy Officer.

Privacy Officer address and phone number

Health Plan Privacy Officer

UK St. Claire

222 Medical Circle

Morehead, KY 40351

Phone: 606-783-6583

Email: jill.rhodes@uky.edu

You may send a written complaint to the U.S. Department of Health and Human Services Office for Civil Rights. Our Privacy Officer can give you the address or you can visit the Office for Civil Rights website at www.hhs.gov/ocr/privacy/hipaa/complaints.

Under no circumstances will you be punished or treated differently for filing a complaint.

Be a part of the life change that happens here each day. Explore Careers