Privacy Notice

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

PRINTER-FRIENDLY VERSION

Aviso de prácticas de privacidad

Effective Date of this Notice is September 18, 2013. 
Revised March 8, 2021; February 6, 2026

Your Rights

Access your protected health information (PHI) in paper and electronic form

You have the right to review and access your PHI and instruct that we send a copy of your PHI directly to someone else.

PHI is information about you (such as your name, date of birth, or medical record number) that relates to your past, present or future physical or mental health, health care services or payment for services. PHI does not include psychotherapy notes or information we compiled for legal purposes.

If you ask for an electronic copy of your PHI in a certain form and format, we will give it to you if we can easily create it. If not, we will provide it in a readable electronic way as agreed by you and MetroHealth

Complete an Authorization to Release Health Information Form (en español) and submit it to our Health Information Management Department in one of the following ways:

Mail:     The MetroHealth System
             Health Information Management Department – G-108
             2500 MetroHealth Drive
             Cleveland, OH  44109

Email:  ReleaseofInformation@metrohealth.org

Fax: 216-778-2114

Call: 216-778-4252

We will provide a copy of your PHI (or a summary if you agree), usually within 30 days of your request.

We charge fees for medical records as allowed by state and federal law. See fee schedule.

If we deny your request for PHI, we will explain in writing the reason and your options. For example, we may deny your request if:

We do not have the requested PHI. If we know where the PHI is maintained, we will tell you.

A licensed health care professional determines that giving the requested PHI will endanger the patient or others. We will explain your right to have the denial reviewed.

We are not able to provide the PHI because of problems with technology.

Revoke your authorization for release of PHI

You may cancel your authorization at any time by sending a written request to our Privacy Officer at: HIPAAPrivacy@metrohealth.org. We are unable to take back any disclosures we have already made with your authorization. 

Create a MyChart account to access your PHI

For fast access to your PHI, you can create an online MyChart account.

MyChart helps you review and manage information about your health and communicate with your health care team.

MyChart contains most, but not all, of your medical records. To obtain all of your records, you can request your full medical record through MyChart or submit a record request to the MetroHealth Health Information Management Department.

See MyChart Terms and Conditions of Use.

Request a correction to your paper or electronic PHI

You can ask us to correct PHI that you think is incorrect or incomplete.

Complete the Record Amendment Form and submit it to HIPAAPrivacy@metrohealth.org.

We will respond to your request in writing within 60 days

We may say “no” to your request and will tell you why in writing.

Request confidential communication

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.

We will say “yes” to all reasonable requests.

Complete the Confidential Communication Request Form (en español) and submit it to HIPAAprivacy@metrohealth.org

Ask us to restrict PHI we share

You can ask us not to use or disclose your PHI. To make that request, complete the PHI Restriction Request Form and submit it to HIPAAPrivacy@metrohealth.org.

We are not required to agree to a restriction request except if:

The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and

The PHI pertains solely to health care items or services for which the patient or person (other than the health plan) on behalf of the patient has paid in full.

Get a list of those with whom we have shared your PHI

You can ask for a list (accounting) of when we disclosed your PHI for six years prior to the date you ask, who we shared it with, and why. To make that request, complete the Account of Disclosures Request Form (en español) and submit it to HIPAAPrivacy@metrohealth.org.

We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as those you asked us to make).

We will provide one accounting a year. We will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Choose someone to act for you

A person with authority can exercise your rights related to your PHI.

This includes, for example, someone:

• You named as a health care power of attorney
• You named as a HIPAA representative
• The court named as your legal guardian

We will check that the person has this authority and can act for you before we take any action.

Instruct us NOT to:

Share information with your family, close friends, or others involved in your care

Include your information in a facility directory

Contact you again when we communicate about fund-raising

If you are not able to tell us your preference, for example if you are unconscious, we share your PHI if we believe it is in your best interest. We may also share your PHI when needed to lessen a serious and imminent threat to health or safety.

Get a copy of this Notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

File a complaint if you believe your privacy rights have been violated

You can tell us if you feel we have violated your rights by contacting the MetroHealth Privacy Officer, using the information on page 1 of this Notice.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by:

Sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201

Calling 1-877-696-6775, or

Visiting Filing a HIPAA Complaint | HHS.gov

We will not retaliate against you for filing a complaint

Our Responsibilities

We are required by law to maintain the privacy and security of your PHI.

We will only use and disclose your PHI as described in this Notice.

We will obtain your written authorization before using or disclosing PHI:

• For marketing purposes
• To sell
• That are considered psychotherapy notes, except to carry out certain treatment, payment or operations.

We honor your right to revoke your authorization.

We will promptly inform you if a breach occurs that compromised the privacy or security of your PHI.

How We Use and Disclose Your PHI

Except for the following purposes, we will use and disclose your PHI only with your authorization. 

For your treatment

We use and share your PHI to provide, coordinate and manage your health care. For example, we share your PHI with:

Doctors, nurses, technicians, medical students, or other hospital staff who are involved in taking care of you

Service providers that help with other health-related needs, such as food, housing, social and mental health support.

Service providers include, for example, United Way 211, Unite Us, and Better Health Partnership.

We use and share your PHI to provide you with appointment or medication reminders. You may request that we provide such reminders in a certain way or at a certain place. We will try to honor all reasonable requests.

We may also communicate to you by newsletters, mailings, email, or other means about treatment options, health-related information, disease management programs, wellness programs or other community-based activities in which MetroHealth participates.

For payment

We use and share your PHI to bill and get payment from health plans or other entities. For example, we share your PHI to: 

• Bill and collect payment from your insurance company or other third party.
• Obtain precertification and preauthorization of services

For operations

We use and share your PHI to run our practice, train providers and improve our services. For example, we use and share your PHI with: 

• Doctors, nurses, technicians, medical students and others for review and learning reasons
• Auditors and agencies that review the quality of care we provide
• Organizations that create quality standards for treating certain conditions

Other ways we use or share your PHI

We share your PHI in other ways, described below.  We must meet certain legal requirements before we can share your PHI for these purposes.  

Maintain a facility directory

We may compile the following directory information about patients receiving inpatient or outpatient services at our hospitals: name; location; general condition; and religious affiliation. This information may be disclosed to clergy or, except for religious affiliation, to any person who asks for a patient by name.

You may request that any or all of this information not be disclosed by notifying Patient Access Services at the time you register

Inform individuals involved in your care or payment for your care

We may disclose your PHI to a person who is involved in your medical care or helps pay for your care, such as a family member or friend.

We also may notify your family about your location or general condition or disclose PHI to an entity assisting in a disaster relief effort.

Help with public health and safety issues

We can share your PHI in certain situations, such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety
• Sharing information in a disaster relief situation

Conduct research

Under certain circumstances, we may use and disclose PHI for research purposes.

• All MetroHealth research is approved through a special review process to protect patient safety, welfare and confidentiality. This process evaluates a proposed research project and its use of PHI to balance the benefits of research with the need for privacy of PHI.
• Even without special approval, we may permit researchers to look at records to help them identify patients who may be included in their research project or for similar purposes, so long as they do not remove or take a copy of any PHI.

Share PHI via Health Information Exchange

We may share your PHI electronically with non-MetroHealth providers and health plans through a Health Information Exchange (HIE). This allows your health care providers to access some of your MetroHealth records to coordinate services for you. It also allows us to share your PHI with your insurers for payment purposes.

• The approved HIE maintains appropriate safeguards to protect the privacy and security of your PHI. Only authorized individuals may access your PHI from the HIE.
• If you do not wish to have your PHI shared with a HIE, please contact the MetroHealth Privacy Officer.
• Please be aware that any restrictions on the disclosure of your PHI to an HIE may result in a health care provider not having access to information that is needed to provide your care.

Share PHI with community-based organizations

MetroHealth partners with many community-based organizations to help address social needs that might impact your health. One way we do this is through a network of greater Cleveland organizations, connected electronically by the UniteOhio software platform.

With your consent, we share information with a network of health and social service partners powered by Unite Us software. Your personal information may be shared securely on the network.

To understand how your information may be used and is kept safe on the network, please visit www.uniteus.com/privacy.

You can always limit the information you provide on the network by requesting to have it removed. If you no longer want your information shared on the network, you can email consent@uniteus.com or ask any network partner. It will take three business days to stop sharing your information.

Fundraising

We may contact you to provide information about MetroHealth-sponsored activities, including fundraising.

• To conduct fundraising, we may use your contact and demographic information, date of service, department of service, treating physician, health status and outcome.
• You have the right to opt-out of future communications. To do so, contact The MetroHealth System's Foundation and System Philanthropy Department by:
  • Email at mhfdevelopment@metrohealth.org
  • Phone at 800-325-5606, ext. 85665 (calling from in Ohio) or 800-554-5251, ext. 85665 (calling from outside Ohio)

We will process your opt-out request promptly, but may not be able to stop contacts that we initiated before receiving your request

Respond to organ and tissue donation requests

We can share PHI for an organization’s procurement, banking, or transplantation of cadaveric organs, eyes, or tissues. 

Work with coroners, medical examiners or funeral directors

We may share your PHI with coroners, medical examiners and funeral directors so they can do their jobs.  

Address requests related to Workers’ Compensation

We may disclose PHI for Workers’ Compensation or similar programs that provide benefits for work-related injuries or illness. 

Comply with the law

We will share your PHI if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we are complying with federal privacy law. 

Address law enforcement requests

In certain instances, we may disclose your PHI to law enforcement officials, such as:

• In response to a valid court order, subpoena or search warrant
• To identify or locate a suspect, fugitive or missing person
• To report a crime committed on MetroHealth premises

Respond to health oversight agencies for activities authorized by law

We may share PHI with health oversight agencies or authorized government officials of the health care system, civil rights and privacy laws and compliance with government programs. 

Respond to request by specialized government functions, such as:

National security and intelligence activities

Protective services for the President and others

Correctional institutions and other law enforcement officials having lawful custody of an inmate

Respond to lawsuits and legal actions

We can share PHI in response to a court or administrative order, or in response to a subpoena.

Share with business associates

We share PHI with third parties so that they can perform a job we have asked them to do. For example, we may use another company to perform billing services on our behalf. All of these third parties are required to protect the privacy and security of your PHI. 

MetroHealth MapApp

The MetroHealth offers MetroHealth MapApp to assist patients, visitors and staff with driving directions, parking assistance and locating the quickest path to an appointment, office or building location. Click here to read the Privacy Policy.

Special Protections for HIV, Substance Use Disorder Treatment, Mental Health and Genetic Information

Special privacy protections apply to HIV/AIDS-related, substance use disorder treatment, mental health and genetic information. This means that parts of this Notice may not apply to these types of information because stricter privacy requirements may apply. MetroHealth will only disclose this information as permitted by applicable state and federal laws.

For example, if you are a recipient of substance use disorder (SUD) treatment, provided by a federally assisted alcohol and drug abuse program, your health information has additional protections per special federal confidentiality laws (42 CFR Part 2). MetroHealth will obtain your authorization before using or disclosing your SUD treatment records, except as permitted by law.

Changes to the Terms of this Notice

We reserve the right to change the terms of this Notice and make the new Notice provisions effective for all PHI that MetroHealth maintains. The new Notice will be available upon request, in our office, and on our website.

 

ADDENDUM

Notice of Privacy Practices: MetroHealth Part 2 Programs (for Substance Use Disorder Treatment Records)

As described in The MetroHealth System (“MetroHealth”) Notice of Privacy Practices, patient medical records are protected by federal and state laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Certain substance use disorder (“SUD”) records are also protected by federal regulations under 42 CFR Part 2 (“Part 2”).  At MetroHealth, the Part 2 regulations apply to treatment records from:

• MetroHealth Recovery Services
• MetroHealth Motivation and Engagement Clinic
• MetroHealth – Cuyahoga County Jail Addiction Services
• MetroHealth Inpatient Dual Diagnosis Unit at the Cleveland Heights Behavioral Health Hospital

Together, these services and staff are MetroHealth’s Part 2 Programs.  We are required by law to maintain the privacy of your SUD health information and records, to provide you with notice of our legal duties and privacy practices with respect to records, and to notify you following a breach of unsecured records.

This notice for MetroHealth’s Part 2 Programs (“this Notice”) supplements our Notice of Privacy Practices and describes the additional confidentiality protections that apply to SUD records.  This Notice applies only to your Part 2 protected records.  It does not apply to information related to care provided outside these Part 2 Programs, such as SUD screening performed by your MetroHealth primary care provider or in the emergency room.

This Notice describes:

• How health information related to SUD treatment may be used and disclosed;
• Your rights with respect to your SUD treatment information; and
• How to file a complaint concerning a violation of the privacy or security of your SUD treatment information, or of your rights concerning your SUD treatment information

You have a right to a copy of this Notice (in paper or electronic form) and to discuss it with our MetroHealth Privacy Officer at 216-778-1601 or at HIPAAPrivacy@metrohealth.org if you have any questions.

How We May Use and Disclose Your Part 2 Records

MetroHealth will use and disclose your SUD health information only as described in this Notice or with your written consent.  The following categories describe the ways that we may use and disclose your health information without your written consent under Part 2.  To the extent applicable state law is even more restrictive than Part 2 on how we use and disclose any of your health information, we comply with more restrictive state law.

Within our Facilities.  To communicate among staff members within MetroHealth’s Part 2 Programs who have a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment.  In addition, we may share your information with the entity that has direct administrative control over our SUD program(s).

Emergency Treatment.  We may disclose your SUD information to medical personnel to the extent necessary to meet a bona fide medical emergency in which your prior written consent cannot be obtained.

Business Associates / Qualified Service Organizations.  We may disclose your SUD information to third party business associates or qualified service organizations providing services on our behalf (such as transcription, billing, and collection services), who agree in writing to protect the information in the same way that we are required to protect the information.

Audits.  We may disclose your SUD information to entities or other qualified personnel who are legally permitted to perform audits of our facilities, such as government regulators that are authorized by law to oversee our program, or agencies that provide financial assistance to the program or provide payment for health care.

Legal Proceedings.  We may disclose your SUD health information pursuant to court orders that meet the requirements of applicable law.  Part 2 Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written consent or court order.  Records shall only be used or disclosed based on a court order after notice and opportunity to be heard is provided to you (the patient) and/or the holder of the record, where required by 42 U.S.C. 290dd-2 and Part 2.  A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

Reporting Crimes.  We may disclose a patient’s commission (or threatened commission) of a crime in our facility, or against our personnel, to law enforcement.

Reporting Child Abuse or Neglect.  We may report instances of suspected child abuse or neglect to appropriate state or local authorities, as required by applicable law.

Deceased Persons.  We may disclose information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

Research.  Under certain circumstances, we may disclose your health information to qualified personnel who are conducting a specific research project.  Your identifying information will never be published without your written consent.  
De-identified Information.  We may disclose your de-identified information as permitted by law, including for public health purposes.

Other uses and disclosures.  Use or disclosure of your SUD health information for any purpose other than those listed above requires your written consent.  Some examples include:

SUD Counseling Notes.  We will not use and disclose your SUD counseling notes without your written consent, except as otherwise permitted by law.

Release of your Presence in Our Facility.  We will not disclose your presence in treatment to individuals who may call or present in person at a facility, unless you have provided your written consent permitting the release of such information.

Designated Person or Entities. We may use and disclose your SUD health information in accordance with your consent to any person or category of persons identified or generally designated in your consent. For example, if you provide written consent naming your spouse/partner or a healthcare provider, we will share your health information with them as outlined in your consent.

Single Consent for Treatment, Payment or Healthcare Operations.  You may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes.  Records that are disclosed to a Part 2 program, covered entity, or business associate pursuant to such consent may be further disclosed by that Part 2 program, covered entity, or business associate, without your written consent, to the extent HIPAA permits such disclosure.

If you change your mind after consenting to the use or disclosure of your health information, you may withdraw your permission by revoking the consent in writing.  However, your decision to revoke the consent will not affect or undo any use or disclosure of your health information that occurred before you notified us of your decision, or any actions that we have taken based upon your consent.

Criminal Justice System.  If you were mandated to treatment through the criminal legal system (including drug court, probation, or parole) and you sign a consent authorizing disclosures to elements of the criminal legal system such as the court, probation officers, parole officers, prosecutors, or other law enforcement, your right to revoke consent may be more limited and should be clearly explained on the consent you sign.

PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program (PDMP) if required by applicable state law. We will first obtain your consent to a disclosure of SUD Records to a prescription drug monitoring program prior to reporting such information.

Central Registry or Withdrawal Management Program. We may disclose your SUD Records to a central registry or to any withdrawal management or treatment program with your written consent.  For instance, if you consent to participating in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.

Fundraising. We will not use your information for fundraising without first providing a clear and conspicuous opportunity to elect not to receive fundraising communications.  For more information on how to opt-out of these communications, please see below.

Your Rights

As a patient in a MetroHealth Part 2 Program, you have certain rights with regard to your SUD treatment health information, in addition to those described in our Notice of Privacy Practices.

Request Restrictions.  You have the right to request restrictions on how your health information is used or disclosed for treatment, payment, or heath care operations activities, including when you have signed a consent for these disclosures.  However, we are not required to agree to your requested restriction, unless that restriction is regarding disclosure of health information to your health insurance company and: (1) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (2) the health information pertains solely to a health care item or service for which you or another person (other than your health insurance company) paid for in full.

To request restrictions, you can access the form here and submit it to HIPAAPrivacy@metrohealth.org.

Accounting of Disclosures.  You have the right to request an accounting of certain disclosures we make of your health information.  This includes disclosures made with your consent and disclosures for treatment, payment, and health care operations through an electronic health record in the past three years.  In addition, if you provided consent to share your information for treatment through a health information exchange, care management organization, or other intermediary, you have a right to list of disclosures by an intermediary in the past three years.

To request restrictions, you can access the form here and submit it to HIPAAPrivacy@metrohealth.org.

Copy of This Notice.  You have the right to obtain a paper or electronic copy of this Notice upon request.

Discuss This Notice.  You have the right to discuss and ask questions about this Notice.  Please contact our MetroHealth Privacy Officer at 216-778-1601 or at HIPAAPrivacy@metrohealth.org if you have any questions.

Fundraising Communications.  You have the right to elect not to receive fundraising communications from MetroHealth’s Part 2 Programs.  To do so, contact The MetroHealth System's Foundation and System Philanthropy Department by:

Email at mhfdevelopment@metrohealth.org

Phone at 800-325-5606, ext. 85665 (calling from in Ohio) or 800-554-5251, ext. 85665 (calling from outside Ohio)

We will process your opt-out request promptly, but may not be able to stop contacts that we initiated before receiving your request.

Complaints

If you believe that your privacy rights have been violated, you have the right to file a complaint to MetroHealth and the Secretary of the United States Department of Health and Human Services. You will not be retaliated against for filing a complaint.

To file a complaint with MetroHealth, you can contact our Privacy Officer at:

• 2500 MetroHealth Drive, Cleveland, OH 44109
• Phone: 216-778-1601
• Email: HIPAAPrivacy@metrohealth.org

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by:

• Sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201
• Calling 1-877-696-6775, or
• Visiting www.hhs.gov/ocr/privacy/hipaa/complaints

Contact.  For further information about this Notice, please contact our Privacy Officer:

MetroHealth Privacy Officer
2500 MetroHealth Drive
Cleveland, OH 44109
Phone: 216-778-1601
Email: HIPAAPrivacy@metrohealth.org

Effective date of this Notice: 2/16/26

MetroHealth is required to abide by the terms of this Notice currently in effect.  We reserve the right to make changes to this Notice as permitted by law.  We reserve the right to make the new Notice provisions effective for all records we currently maintain, as well as any records we receive in the future.  If we make material or important changes to our privacy practices, we will promptly revise this Notice.  Each version of the Notice will have an effective date listed.  If we change this Notice, you can access the revised Notice on our website at https://www.metrohealth.org/en/patients-visitors/patient-privacy/ or request a copy at any MetroHealth Part 2 Program location.  We will also post this Notice prominently in our Part 2 facilities.