www.stjude.org Open in urlscan Pro
184.28.57.27  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET /search-results.html

<form method="GET" id="ecc6186e1bedff79dc073ea9c7e5b9675ceb0f785da85286f976c0aa87146c80" name="searchform" action="/search-results.html" autocomplete="off">
  <input type="text" id="input-ecc6186e1bedff79dc073ea9c7e5b9675ceb0f785da85286f976c0aa87146c80" class="search-input" name="q" value="" placeholder="What are you looking for?" title="Search"
    aria-labelledby="search-button-ecc6186e1bedff79dc073ea9c7e5b9675ceb0f785da85286f976c0aa87146c80">
  <button type="submit" id="search-button-ecc6186e1bedff79dc073ea9c7e5b9675ceb0f785da85286f976c0aa87146c80" class="search-submit">
    <span class="search-submit-text">Search</span>
  </button>
</form>

Text Content

Skip to main content
St. Jude Children's Research Hospital - Homepage
Contact Us Español
Patient Referrals Donate Now
Menu Close
Search
 * Patient Referrals Donate Now
 * About Us
   
 * Care & Treatment
   
 * Research
   
 * Training
   
 * Get Involved
   
 * Ways to Give
   
 * Search
   
 * Contact Us Español


NOTICE OF PRIVACY PRACTICES (HIPAA)

Effective Date: January 27, 2021
Revised January 2021

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED (PROVIDED TO OTHERS) AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

 


REQUEST YOUR MEDICAL RECORD

 
 

This Notice of Privacy Practices explains how St. Jude Children’s Research
Hospital, its medical staff members, employees, volunteers, and clinics may use
and provide your Protected Health Information (called PHI) to others for
treatment, payment, and health care “operations” as described below, and for
other purposes allowed or required by law.


I. OUR RESPONSIBILITIES:

St. Jude takes the privacy of your child’s (your) health information seriously.
We are required by law to keep your health information private and provide you
with this Notice of Privacy Practices. We will act according to the terms
of this Notice. We reserve the right to change this Notice of Privacy Practices
and to make any new practices effective for all Protected Health Information
that we keep. Any changes made to the Notice of Privacy Practices will be
posted in the Patient Registration area, posted on our website (www.stjude.org)
and will be available for you to pick-up at your next appointment. St. Jude is
required to notify you if your unsecured protected health information  is
breached.


II. WHAT IS "PROTECTED HEALTH INFORMATION" (PHI)?

Protected Health Information (PHI) is information about a patient’s age, race,
sex, and other personal health information that may identify the patient. The
information relates to the patient’s physical or mental health in the past,
present, or future, and to the care, treatment, and services needed by a patient
because of his or her health.


III. WHAT DOES "HEALTH CARE OPERATIONS" INCLUDE?

“Health care operations” includes activities such as:

 * discussions between hospital staff and other health care providers;
 * evaluating and improving quality;
 * making travel arrangements to and from St. Jude;
 * arranging temporary housing; reviewing the skills, competence, and
   performance of health care staff;
 * training future health care staff;
 * dealing with insurance companies;
 * carrying out medical reviews and auditing;
 * collecting and studying information that could be used in legal cases; and
 * managing business functions.


IV. HOW IS MEDICAL INFORMATION USED AND DISCLOSED?

St. Jude uses and discloses medical records to record health information, to
plan care and treatment, and to carry out routine health care functions. St.
Jude uses and discloses PHI for treatment, payment, and health care operations.
For example, your insurance company may need us to give them procedure and
diagnosis information to bill for patient treatment we provide. Other health
care providers or health plans reviewing your records must follow the same
federal privacy laws and rules that St. Jude is required to follow. 

Patient records also greatly help our researchers find the best possible
treatment for diseases and medical conditions. All St. Jude researchers must
follow the  same rules and laws that other health care providers have to follow
to keep patient information private. Details that may identify patients will not
be disclosed for research purposes to anyone outside of St. Jude without written
permission from the patient or the patient’s parent or legal guardian.


V. EXAMPLES OF HOW PHI MAY BE USED OR DISCLOSED FOR TREATMENT, PAYMENT OR HEALTH
CARE OPERATIONS

PHI may be used to show that a patient needs certain care, treatment, and
services (such as lab tests, prescriptions, treatment plans, and research study
requirements).

 * We will use medical information to plan treatment.
 * We may disclose Protected Health Information to another provider for
   treatment (such as, referring doctors, specialists, and providers at the St.
   Jude Domestic Affiliate Clinics).
 * We may send claims to your insurance company containing medical information.
   If you pay for a service or health care item out-of-pocket in full, you can
   ask us not to share that information for the purpose of payment or our
   operations with your health insurer. However, please note St. Jude does not
   take action to collect from patients or their families.
 * We might also contact your insurance company’s utilization review department
   to receive precertification (approval for treatment in advance).
 * We may use the emergency contact information you gave us to contact you if
   the address we have on record is no longer correct.
 * We may use information to schedule travel to and from St. Jude.
 * We may use information to provide temporary housing at places like Ronald
   McDonald House, Target House, Tri Delta Place, Parcels @ Concourse, or local
   hotels. 
 * The patient’s name, home address, other contact information, age, gender,
   date of birth, dates of health care, department of service, treating
   physician, outcome information, and health insurance status may be given to
   ALSAC, a charitable organization with the sole purpose of raising funds for
   St. Jude. Before any more information is given to ALSAC, you will be asked to
   sign another consent document known as an Authorization Form. Also, you have
   the right to quit receiving such fundraising communications.


VI. WHY DO I HAVE TO SIGN A CONSENT FORM?

When you sign the Consent for Release of Information, you are giving St. Jude
permission to use and disclose (provide to others) Protected Health Information
for treatment, payment, and health care operations, as described above. This
permission does not include psychotherapy notes (defined in Section VII below),
psychosocial information (defined in Section VIII below), alcoholism and drug
abuse treatment records, marketing, sale of protected health information, and
other privileged categories of information, all of which require a
separate permission. You will need to sign a separate consent form to have
Protected Health Information given out for any reason other than treatment,
payment, or health care operations or as required or permitted by law.


VII. WHAT ARE PSYCHOTHERAPY NOTES?

Psychotherapy notes are notes recorded (in any form) by a mental health
professional for the purpose of studying a conversation that took place during a
private counseling session. This session can be with a single person, a group,
or a family. Conversation notes from a counseling session are separated from the
rest of the patient’s medical

record. Psychotherapy notes do not include:

 * notes about which medicines you are taking or how those medicines affect you;
 * the start and stop times of counseling sessions;
 * the types of treatment you are given; how often treatments are given;
 * the results of clinical tests; and
 * any summary of the following items: diagnosis, functional state, the
   treatment plan, symptoms, expected outcome, and progress to date.


VIII. WHAT IS PSYCHOSOCIAL INFORMATION?

Psychosocial information is information given to your social worker about your
family’s social history and counseling services you have received.


IX. WHAT IS MARKETING?

Marketing is communication about a product or service that encourages those who
receive the information to purchase or use the product or service.


X. WHY DO I HAVE TO SIGN A SEPARATE PERMISSION FORM?

To provide patient Protected Health Information to other people for any reason
other than treatment, payment, and health care operations (described above) or
as required or permitted by law, we must have a permission form know as an
Authorization Form signed by the patient or the patient’s parent or legal
guardian. This form clearly explains

how they wish the information to be used and disclosed. The following are some
examples of information that require separate permission before we can release
it: 

 * Psychotherapy notes
 * Information and photographs shared with ALSAC for its fundraising and public
   relations activities
 * Information used in scientific and educational publications, presentations,
   and materials related to the work at St. Jude
 * Information shared with other clinical and scientific cooperative groups that
   St. Jude works with in carrying out its mission to advance cures, and means
   of prevention, for pediatric catastrophic diseases through research and
   treatment


XI. CAN I CHANGE MY MIND AND WITHDRAW PERMISSION FOR ST. JUDE TO DISCLOSE PHI?

You may change your mind and withdraw (revoke) permission, but we cannot take
back information that has been released up to that point. Permission cannot be
withdrawn if:

 1. the information is needed to maintain the integrity of the research study,
    or
 2. if the permission was originally given to obtain insurance coverage.

All requests to withdraw permission for uses and disclosures of PHI should be
made in writing. The request should be submitted to Patient Registration, which
will forward this information to the Privacy Officer and the Director of Health
Information Management.


XII. BEING LISTED IN THE HOSPITAL DIRECTORY

St. Jude may include certain limited information about the patient in our
hospital directory while the patient is in the hospital. This information may
include the patient’s name, location in the hospital, general condition (for
example, good, fair, etc.), and religion. The hospital location may also include
directory information for Target House, Ronald McDonald House, Tri-Delta Place,
Parcels @ Concourse, or local hotels. The hospital may give this information
to members of the clergy. The hospital may give this information (except your
religion) to other people who ask for the patient by name. For example, if
someone calls St. Jude and asks for the patient by name, St. Jude will attempt
to connect the caller to the patient’s hospital room telephone or we may give
out the main telephone number for the Ronald McDonald House, Target House,
Tri-Delta Place, Parcels @ Concourse, or local hotel. If you do not wish to be
in the Hospital Directory, please inform Patient Registration and ask them for a
Directory Opt-Out Form.


XIII. SHARING INFORMATION WITH ST. JUDE BUSINESS ASSOCIATES

Some services at St. Jude are provided through contracts with business
associates or business partners. Examples include billing transcription,
scheduling travel to or from St. Jude, and assigning temporary housing. When
these services are contracted, we may disclose the minimum amount of your
child’s (your) health information to the business partner that they need to
perform the job we have hired them to do. To protect your child’s (your) health
information, we legally require our business associates and business partners to
follow the same privacy laws that St. Jude must follow. 


XIV. ELECTRONIC MEDICAL INFORMATION SHARING

You have the right to request that your or your child’s electronic health
information be sent to another person or organization through an application
programming interface (API). APIs are computer coding mechanisms that permit two
or more computer programs or apps to share information.

St. Jude is required to comply with patient requests to send information through
an API with some exceptions. Health information transmitted through an API at
your request will no longer be controlled and protected by St. Jude. It will no
longer be subject to the protections and rights outlined in this St. Jude Notice
of Privacy Practices. Also, it may no longer be subject to the same laws and
policies regarding its confidentiality, security, privacy, use, or disclosure.

Before you ask for information to be sent through an API, the staff recommends
you confirm the confidentiality, security, and privacy protections used by the
recipient. If you ask St. Jude to send your or your child’s information through
an API, you do so at your own risk.


XV. WHEN IS MY CONSENT NOT REQUIRED?

The law requires that some information may be disclosed without your permission
during the following times:

 * In an emergency
 * When communication or language is very limited
 * When required by law
 * To the Secretary of Health and Human Services for compliance and enforcement
 * When there are risks to public health
 * To conduct health oversight activities
 * To find out if a research study might be useful
 * To report suspected child abuse or neglect
 * To certain government agencies who monitor activity
 * In connection with court or government cases
 * For law enforcement purposes
 * To coroners and funeral directors and for organ donation
 * If health or safety is seriously threatened


XVI. YOUR PRIVACY RIGHTS

The following explains your rights with respect to your child’s (your) Protected
Health Information (called PHI) and a short description of how you may use these
rights.


1. YOU HAVE THE RIGHT TO REVIEW AND TO BE GIVEN A COPY OF YOUR CHILD'S (YOUR)
HEALTH INFORMATION.

The following explains your rights with respect to your child’s (your) Protected
Health Information (called PHI) and a short description of how you may use these
rights. 1. You have the right to review and to be given a copy of your child’s
(your) health information. This means that except as explained below, you may
review and get a copy of your  child’s (your) PHI that is contained in a
“designated record set” as long as we keep the PHI. A designated record set
contains medical and  billing records and any other records that St. Jude uses
to make decisions about your child’s (your) health care. You may not read or be
given a copy of psychotherapy notes; information collected for use in a civil, 
criminal, or administrative action, or court case; and certain PHI that is
protected by law. In some situations, you may have the right to have this
decision reviewed. You also have the right to review and to be given a copy of
your health information from HIPAA-covered labs. You can typically expect
records within the time period required by law, though at times, an extension
may be required. Please contact the Health Information Management
Services (HIMS) Department if you have questions about access to your child’s
(your) health information and please see Section XVIII below to request a copy
of your records. If needed and at your request, St. Jude may provide an
electronic copy of your child’s (your) record if St. Jude is able to do so. A
fee may be charged for requesting a copy of your health or medical records.


2. YOU HAVE THE RIGHT TO REQUEST THAT ACCESS TO YOUR CHILD'S (YOUR) HEALTH
INFORMATION BE LIMITED.

This means you may ask us to restrict or limit the medical information we use or
disclose for treatment, payment, or health care operations (described above).
St. Jude is not required to agree to a restriction you ask for unless
it involves disclosure to a health plan for which you have paid for the service
in full. But, please note St. Jude does n ot attempt to collect from patients or
their families. We will not ask you to self-pay for care. We will tell you if
we reject your request. If we do agree to the requested restriction, we will
comply with that restriction unless it must be violated to provide emergency
treatment. You may request a restriction by contacting the St. Jude
Privacy Officer.


3. YOU HAVE THE RIGHT TO REQUEST TO RECEIVE PRIVATE COMMUNICATIONS IN ANOTHER
WAY OR AT OTHER LOCATIONS.

We will agree to reasonable requests. To carry out the request, we may also ask
you for another address or another way to contact you, for example, mailing to a
post office box. We will not ask you to explain why you are making the request.
Requests must be made in writing to Patient Registration.


4. YOU HAVE THE RIGHT TO REQUEST CHANGES TO YOUR CHILD'S (YOUR) HEALTH
INFORMATION.

This means you may ask for changes to be made (amended) in PHI about your child
(you) in a designated record set for as long as we keep this information. In
certain cases, we may deny your request for a change. If we deny your request,
you have the right to file a statement with the St. Jude Privacy Officer,
stating that you disagree. We may prepare a response to your statement and will
provide you with a copy of this response. If you wish to change your child’s
(your) PHI, please contact the St. Jude Privacy Officer. Requests for changes
must be in writing.


5. YOU HAVE THE RIGHT TO RECEIVE A RECORD OF WHEN YOUR CHILD'S (YOUR) HEALTH
INFORMATION HAS BEEN DISCLOSED BY ST. JUDE.

You have the right to request a record (accounting) of when St. Jude has
disclosed your child’s (your) PHI. This right applies to any time St. Jude
discloses your child’s (your) PHI for purposes other than treatment, payment, or
health care operations as described in this Privacy Notice. We are also not
required to account for information releases:

 * that you requested,
 * that you agreed to by signing an Authorization Form,
 * that are in our Hospital Directory,
 * that are given to family or friends involved in your care, or
 * certain other releases we are allowed to make without your permission.

The request for a record must be made in writing to the St. Jude Privacy
Officer.

The request should state the time period for the list. Requests for records
about St. Jude disclosures of your child’s (your) PHI may not be made for time
periods of more than 6 years before the date of your request or it could be an
shorter time period depending on what the law requires.


6. YOU HAVE THE RIGHT TO RECEIVE A PAPER COPY OF THIS NOTICE OF PRIVACY
PRACTICES.


XVII. WHAT IF I HAVE A QUESTION OR COMPLAINT?

If you have questions regarding your privacy rights, please call the St. Jude
Privacy Officer at (901) 595-6141. If you believe your privacy rights have been
violated, you may file a complaint by contacting the St. Jude Privacy Officer at
(901) 595-6141, or through the confidential EthicsPoint Hot Line 1-800-433-1847,
by email at hipaaprivacy@stjude.org, or with the U.S. Department of Health and
Human Services. You will not be penalized for filing a complaint. The address
for the U.S. Department of Health and Human Services is:

Office for Civil Rights
U.S. Department of Health and Human Services
Atlanta Federal Center
Suite 16T70
61 Forsyth St., S.W.
Atlanta, GA 30303-8909
(404) 562-7886 (phone)
(404) 562-7881 (fax)
(404) 331-2867 (TDD)
www.hhs.gov/ocr/hipaa


XVII.  REQUEST YOUR MEDICAL RECORDS

To request a copy of your medical records, you must submit written permission.
Download the Authorization for Release of Health Information (en Español). If
you need records sent to St. Jude, please use this form (en Español). Print one
(1) copy to submit and one (1) copy for your records. After completing the form,
be sure to print, sign, and date it. To finalize your request, we require a copy
of the patient ID (if over 18) or guardian ID (if under 18). Return the
completed form and attachments by mail, fax, or email to:

St. Jude Children’s Research Hospital
Health Information Management Department
262 Danny Thomas Place, BP046
Memphis, TN 38105
Phone (901) 595-3680
Fax (901) 595-6300
Email: ISCIHIMSROI@stjude.org

Patients and families may also request to pick up medical records from the
Health Information Management Department. It is open Monday–Friday from 8 a.m.–5
p.m. We will call the number provided on the form when the records are ready for
pick up.

All other medical record requests should be directed to the St. Jude Health
Information Management Department.


DISCRIMINATION IS AGAINST THE LAW

St. Jude Children’s Research Hospital complies with applicable Federal civil
rights laws and does not discriminate on the basis of race, color, national
origin, age, disability, or sex. St. Jude Children’s Research Hospital does
not exclude people or treat them differently because of race, color, national
origin, age, disability, or sex.

St. Jude Children’s Research Hospital:

 * Provides free aids and services to people with disabilities to communicate
   effectively with us, such as:
   * Qualified sign language interpreters
   * Written information in other formats (large print, audio, accessible
     electronic formats, other formats)
 * Provides free language services to people whose primary language is not
   English, such as:
   * Qualified interpreters
   * Information written in other languages

If you need these services, contact the nursing supervisor at 901-595-3300.

If you believe St. Jude Children’s Research Hospital has failed to provide these
services or discriminated in another way on the basis of race, color, national
origin, age, disability, or sex, you can file a grievance with: Patient
Relations Coordinator, St. Jude Children’s Research Hospital, 1-901-595-3300;
1-866-278-5833; TTY 1-901-595-1040; Fax 1-901-595-8600; email:
patientrelationscoordinator@stjude.org. You can file a grievance in person or by
mail, fax, or email. If you need help filing a grievance, the patient relations
coordinator is here to help you. You can also file a civil rights complaint with
the U.S. Department of Health and Human Services, Office for Civil Rights,
electronically through the Office for Civil Rights Complaint Portal, available
at www.hhs.gov/ocr/filing-with-ocr/ index.html; or by mail or phone at: U.S.
Department of Health and Human Services 200 Independence Avenue, SW Room 509F,
HHH Building Washington, D.C. 20201 1-800-368-1019, 1-800-537-7697 (TDD)
Complaint forms are available at www.hhs.gov/ocr/filing-with-cor/index.html.

 * Related Links
 * User Generated Content
 * Canadian Internet privacy policy
 * Conflict of Interest and Commitment in Research Policy & Financial Conflict
   of Interest (FCOI) of Senior/Key Personnel
 * Consultation Disclaimer
 * Notice of Non-Discrimination
 * Email Disclaimer
 * EthicsPoint
 * FAQs
 * Financial Assistance Policy
 * Financial Assistance Statement
 * Financial Conflict of Interest Policy
 * External Resources
 * Help
 * English
 * Español
 * 中文
 * Tiếng Việt
 * 한국어
 * Tagalog
 * русский
 * العربية
 * Français
 * Deutsch
 * 日本語
 * فارسی
 * हिन्दी
 * ગુજરાતી
 * አማርኛ
 * ພາສາລາວ
 * Linking Policy
 * Notice Regarding Living Well Wellness Program
 * Parental Notification
 * Privacy Notice
 * GSA Page
 * Ad Choices
 * St. Jude U.S. Privacy Policy Statement
 * InCharge Mobile Application Privacy Policy
 * Medical Records Release
 * Standard Charges

Related LinksClose
 * Share through
 * Share through Facebook
 * Share through Twitter
 * Share through LinkedIn
 * Share through E-Mail

Share Close



Finding cures. Saving children. ®

CONNECT WITH US

 * Like
 * Follow
 * Follow
 * Subscribe

Sign up for Email or Text Updates

CONTACT US

262 Danny Thomas Place Memphis, TN 38105 Visit St. Jude Donor Services: 
(800) 822-6344 Hospital: 
(866) 278-5833

LEARN MORE ABOUT US

 * Careers
 * Media Resources



© Copyright 2023. St. Jude Children's Research Hospital, a not-for-profit,
section 501(c)(3).

 * Privacy Notice
 * Disclaimer / Registrations / Copyright Statement
 * Linking Policy
 * Notice of Privacy Practices (HIPAA)
 * Ad Choices
 * Notice of Non-Discrimination
 * Site Map

If you speak another language, assistance services, free of charge, are
available to you. Call 1-866-278-5833 (TTY: 1-901-595-1040)

 * Español
 * 中文
 * Tiếng Việt
 * 한국어
 * Tagalog
 * русский
 * العربية
 * Français
 * Deutsch
 * 日本語
 * فارسی
 * हिन्दी
 * ગુજરાતી
 * አማርኛ
 * ພາສາລາວ





Close


Close