Skip to Content

Rush Copley Medical Center
HIPAA Joint Notice of Privacy Practices

Effective date of this notice: September 23, 2013. This notice will remain in effect until it is revised and/or updated.
This Notice of Privacy Practices is given on behalf of certain health care provider affiliates of Rush Copley Medical Center, including Copley Memorial Hospital, Rush Copley Medical Group NFP, Fox Valley Cardiovascular Consultants, Atlas Physical Therapy and Sports Medicine Centers, Critical Care Physicians of Illinois, LLC, and all of their employed health care providers, students, and volunteers (collectively “Copley”).
All of these entities may share patient information with each other for treatment, payment, or health care operations.
In the course of receiving medical services, patients provide Copley with personal information about their health, with the understanding that this information will be kept confidential. Copley may obtain health information from examinations, tests or from others who have provided medical care.
Copley uses patient information when providing treatment and may disclose patient information to other health care providers to assist them in providing treatment. Copley may disclose information to insurance companies to receive payment, may also use the information within the organization to evaluate quality and improve processes and may also disclose patient information as required by law or as permitted by Copley policies.
Kinds of Information this Notice Applies to
This notice applies to protected health information (“PHI”) consisting of any information in Copley’s possession that would allow someone to identify a patient.
Joint Notice
Copley and certain non-employed hospital-based physician groups are presenting this notice as a joint notice. Those physician groups include Radiology, Anesthesia, Pathology and the Emergency Department. PHI from Copley will be shared with these physicians as necessary to carry out their treatment, payment, and healthcare operations.
Providers participating in the Organized Health Care Arrangement (OHCA) use the same electronic medical record to document and review the health care services they provide to you. Use of the electronic medical record allows your providers to coordinate your care, improve exchange of important information about your treatment, and get complete and up-to-date information to any provider who uses the shared electronic medical record.
This notice applies to services received at Copley. This includes services from some of the physicians who are not employed by Copley. If services are received from any of these physicians in their own offices, they may give patients a different Notice of Privacy Practices that applies to their offices.
Physicians providing care at Copley Memorial Hospital (Hospital) are independent physicians and not agents, servants, or employees of Hospital, unless specifically identified as an employee on the Hospital website ( or on the Disclosure of Physician Employment Status disclosure form. If you have any questions
about the employment status of any physician, please ask a Hospital representative. Independent physicians exercise their own medical judgment in treating and providing services to patients and are solely responsible for theircompliance with state and federal privacy laws. Nothing in this privacy notice is meant to imply or create any agency or employment relationship between independent physicians and
Copley, either actual or implied, nor does this privacy notice alter, limit, or modify any other consent for treatment or procedures that patients may sign while receiving care at the Hospital.
Copley’s Legal Duties
•Maintain the privacy of PHI.
•Provide this Notice of Privacy Practices and legal duties regarding PHI to anyone who asks for it.
•To abide by the terms of this notice.
How Health Information may be Disclosed
Copley may use PHI or disclose it to others for a number of different reasons. The following examples do not include all of the specific ways information may be used or
1. Treatment.
Copley will use PHI to provide medical care and services. This means
that Copley employees, students, volunteers, and others who work under Copley’s direct control may read PHI to learn about a patient’s medical condition and use it to make decisions about care. For instance, a nurse may read a medical chart in order to care for that patient properly. PHI will be disclosed to others who need it in order to provide medical treatment or services. For instance, Copley may send a doctor the results of laboratory test performed at Copley.
2. Payment.
PHI is disclosed as necessary to obtain payment for the services
provided. For instance, an employee in the business office may use PHI to prepare a bill. That bill may be sent, along with any PHI it contains, to the patient’s insurance company. PHI may be disclosed to companies who Copley utilizes for payment-related services. For instance, PHI may be given to a collection company to collect bills. Copley will not use or disclose more information for payment purposes than is necessary.
3. Health Care Operations.
PHI may be used for activities that are necessary to
operate Copley. This includes reading PHI to review the performance of staff. PHI may be used to plan for services that may be provided in the future, expanded, or reduced. PHI may be provided to students who are authorized to receive training at Copley. PHI may be disclosed as needed to others who Copley contracts with to provide administrative services. This may include lawyers, auditors, accreditation services, and consultants.
4. Legal Requirement to Disclose Information.
PHI will be disclosed when requiredby law. This includes reporting information to government agencies that have the legal responsibility to monitor Copley. For instance, Copley may be required to disclose PHI if an audit is conducted by a federal or state agency. PHI will be disclosed when required by a court order or other judicial or administrative process.


5. Public Health Activities.
PHI will be disclosed when required for public health purposes. This includes reporting patient visits, certain diseases, births, deaths, and reactions to certain medications to federal or state agencies. It may also include notifying people who have been exposed to a disease.

6. To Report Abuse.
PHI may be disclosed when the information relates to a victim of abuse, neglect, or domestic violence. Copley will make this report only in accordance with laws that require or allow such reporting or with patient authorization.

7. Law Enforcement.
PHI may be disclosed for law enforcement purposes. This includes providing information to help locate a suspect, fugitive, material witness, missing person, or in connection with suspected criminal activity.

8. Specialized Purposes.
PHI may be disclosed for a number of other specialized purposes. Copley will only disclose as much information as is necessary for the purpose. For example, Copley may disclose:
•Information of members of the armed forces as required by military command authorities.
•Information to coroners, medical examiners, funeral directors, and organ
procurement organizations (for organ, eye, or tissue donation).
•Information for national security, intelligence, and protection of the President.
•Information about an inmate to a correctional institution or to law enforcement officials to provide the inmate with health care, to protect the health and safety of the inmate and others, and for the safety, administration, and maintenance of the correctional institution.
• Information to an employer for purposes of workers’ compensation and work site\safety laws.

9. To Avert a Serious Threat.
PHI may be disclosed if necessary to prevent serious harm to the public or to an individual. The disclosure will only be made to someone who is able to prevent or reduce the threat.
10. Family and Friends.
Copley may disclose PHI to notify a family member, personal representative, or another person responsible for their care, of their location, general condition, or death. If the patient is present, then prior to disclosing the information, verbal or written consent will be obtained or the patient will have the opportunity to object. PHI will not be disclosed to family or friends if the patient objects. In the event of a disaster PHI may be provided to a disaster relief organization so they can notify family of the patient’s condition and location. In the event of the patient’s incapacity or emergency circumstances, PHI may be disclosed based upon the professional judgment of the physician.
11. Facility Directory and Doors.
Copley Memorial Hospital will list patients in the patient directory and on patient doors when they are admitted. The directory listing includes name, general condition, and location in the hospital. Copley Memorial Hospital will also list the patient’s religion in the directory but will disclose that information only to members of the clergy. Except for members of the clergy, Copley will only disclose the information in the directory to visitors who ask for a patient by name. If requested by a patient, Copley will not list them in the directory or place their name on their room door.

12. Research.
PHI may be disclosed in connection with medical research projects.Federal rules govern any disclosure of PHI for research purposes without patient authorization.
13. Fund Raising.
PHI may be used to contact patients to ask for donations to Copley. PHI may be disclosed to a related foundation for the same purpose. If patients do not want to be contacted for this purpose, they have the right to opt out of fundraising communications with each solicitation.

Breach Notification

1. Notice.
Patients have the right to receive notice in the event of a breach of unsecured PHI. Copley will notify individuals who may be affected by a breach of unsecured PHI. Copley will also notify the Department of Health and Human Services and the media, as applicable, in the event of a breach of this nature. All suspected breaches will be investigated and all necessary notifications will be sent, in accordance with federal law. 
2. Breach.
“Breach” means the unauthorized acquisition, access, use, or disclosure of
PHI which compromises the security or privacy of the PHI.
Patient Rights

1. Authorization.
The following uses and disclosures will be made only with
authorization from the patient: uses and disclosures for marketing purposes, uses and disclosures that constitute sale of PHI and other uses and disclosures not described in this notice. If a patient authorizes Copley to use or disclose their PHI, they have the right to revoke the authorization at any time. For information about how to authorize
Copley to use or disclose PHI or about how to revoke an authorization, contact the Privacy Officer listed under “Whom to Contact” at the end of this notice. Patients may not revoke an authorization for Copley to use and disclose their information to the extent that we have taken action on an authorization. If the authorization is to permit
disclosure of information to an insurance company as a condition of obtaining coverage, other laws may allow the insurer to continue to use PHI to contest claims or coverage, even after revoking the authorization.
2. Request Restrictions.
Patients have the right to restrict how Copley uses or
discloses their PHI, including the right to restrict PHI to health plans if the patient has paid out-of-pocket, in full, for services, and the patient requests that Copley not disclose PHI related solely to those services paid out-of-pocket to a health plan. Copley is not required to agree to the request. If Copley does agree, it will comply with the request unless the information is needed to provide emergency treatment.
Copley cannot agree to restrict disclosures that are required by law.
3. Confidential Communication.
Patients have the right to ask Copley to
communicate with them at a special address or by special means. For example, they may ask Copley to send mail to a different address rather than to their home, or they may ask Copley to speak to them personally on the telephone rather than sending PHI by mail. Patients must make this request in writing to Copley, and the request must specifically and clearly state how or where the patient wants to be contacted.
Copley will not ask the reason for the request and will attempt to accommodate reasonable requests.
4. Inspect And Receive a Copy of PHI.
Patients have a right to inspect their PHI contained in Copley’s records and to receive a paper and/or electronic copy of it. This right is limited to information about them that is kept in records that are used to make decisions about them. For instance, this includes medical and billing records. If patients want to review or receive a copy of these records, they must make the request in writing. Copley may charge a fee for the cost of copying and mailing the records. To ask to inspect records or to receive a copy the patient must contact the medical records department at Copley. Copley will respond to the request within 30 days. Copley may deny access to certain information. If access is denied, Copley will give the reason in writing and explain how patients may appeal the decision.

5. Amend PHI.

Patients have the right to ask to amend PHI which they believe is not correct or not complete. Patients must make this request in writing and give the reason they believe the information is not correct or complete. Copley will respond to the request in writing within 30 days. The request may be denied if Copley did not create the information, if it is not part of the records used to make decisions about the patient at Copley, if the information is something patients would not be permitted to inspect or copy, or if the record is complete and accurate.

6. Accounting of Disclosures.

Patients have a right to receive an accounting of certain disclosures of their PHI to others. This accounting will list when PHI has been given to others. The list will include dates of the disclosures, the names of the people or organizations to whom the information was disclosed, a description of the information, and the reason. Patients must specifically state the time period they want the list to cover. Patients may not request a time period longer than six years. Disclosures for the following reasons will not be included on the list: disclosures for treatment, payment, health care operations; disclosures of information in a facility directory, disclosures for national security purposes, disclosures to correctional or law enforcement personnel, disclosures that patients have authorized, and disclosures made directly to the patient.

7. Paper Copy of this Privacy Notice.

Patients have a right to receive a paper copy of this notice. If patients receive this notice electronically, they may receive a paper copy by contacting the person listed under “Whom to Contact” at the end of this notice.

8. Complaints.

Patients have a right to complain about Copley’s privacy practices if they think their privacy has been violated. Patients may file a complaint with the Privacy Officer listed under “Whom to Contact” at the end of this notice. A complaint may also be filed directly with the Secretary of the U. S. Department of Health and Human Services. All complaints must be in writing. Copley will not take any retaliation against anyone for filing a complaint.


Right to Change this Notice
Copley reserves the right to change the organizations privacy practices as described in this notice at any time. Copley reserves the right to apply these changes to any PHI it already has, as well as to health information received in the future. The new notice will be posted in the Copley facilities and the Copley website at
The new notice will include an effective date.
Whom to Contact
Privacy Officer
Rush Copley Medical Center
2000 Ogden Avenue
Aurora, IL 60504
Copies of this notice are also available throughout the Copley facilities. This notice is also available at:
Last updated: 9/23/13



Notice of Privacy Practices