Covenant Health
Notice of Privacy Practices
Effective Date: 02/16/2026
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review this notice carefully.
This Notice of Privacy Practices (“Notice”) describes the privacy practices of all medical practices and facilities owned or operated by Covenant Health and its affiliates who are part of the Covenant Health Affiliated Covered Entity (“Covenant Health ACE”), including how we may use and disclose protected health information (“PHI”) about you and how you can access your PHI. PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition and related health care services. An ACE is a group of covered entities, health care providers or health plans under common ownership or control that designates itself as a single entity for purposes of compliance with the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”).
The members of the Covenant Health ACE will share your PHI with each other for the treatment, payment, and health care operations of the Covenant Health ACE and as permitted by HIPAA and this Notice. Please visit our website at https://covenanthealth.net/ for a current list of the members of the Covenant Health ACE. The list also will be made available upon request.
We are required under HIPAA to maintain the privacy of your PHI, to provide you with notice of our legal duties and privacy practices with respect to your PHI, and to notify affected individuals if a breach of unsecured PHI occurs. This Notice describes how we may use and disclose your PHI to carry out treatment, payment, or health care operations and for other specified purposes that are permitted or required under HIPAA. This Notice also describes your rights under HIPAA with respect to your PHI.
We follow the confidentiality protections of 42 C.F.R. Part 2 (“Part 2”) for substance use disorder records subject to Part 2 (“Part 2 Records”) and our facilities or programs specializing in substance use disorder treatment (“Part 2 Programs”) also follow the privacy practices described in the PART 2 PROGRAM ADDENDUM attached to this Notice (“Part 2 Program Addendum”). Please note, the Part 2 Program Addendum only applies if you are receiving services from the Part 2 Program as described therein.
Your HIPAA Rights
You have the following rights with respect to your PHI:
- Obtain a paper copy of this Notice upon request. You may request a paper copy of this Notice, even if you previously agreed to receive the Notice electronically.
- Request restrictions on certain uses and disclosures of your PHI. You have the right to request restrictions on certain uses and disclosures of your PHI. In your request, please identify: (i) the information you wish to be restricted; (ii) how you want the information restricted; and (iii) to whom you wish the restrictions to apply. We are not required to agree to any such restrictions, except where a disclosure of your PHI (i) is to a health plan for the purpose of carrying out payment or health care operations, (ii) is not otherwise required by law, and (iii) relates only to a health care item or service for which you (or someone on your behalf) have paid us in full. We will not use or disclose your PHI in violation of any restrictions we agree to, other than as required by law, in an emergency, or when the information is necessary to treat you.
- Inspect and obtain a copy of your PHI. Subject to certain exceptions, you have the right to access and obtain a copy of your PHI that may be used to make decisions about you for as long as we maintain the PHI. You may request that copies of your PHI be sent to another entity or person. You may be charged a reasonable fee for the costs of copying, transmitting, or mailing your PHI. We may deny your request to inspect and copy your PHI in certain limited circumstances. If you are denied access to your PHI, you may request that the denial decision be reviewed.
- Request an amendment of your PHI. If you believe that PHI we maintain about you is incomplete or incorrect, you may request that we amend the PHI. You may request an amendment for as long as we maintain the PHI. In certain cases, as permitted under HIPAA, we may deny your request for amendment. For example, the request may be denied if you request to amend information that was not created by us, is not part of our records, or is not part of the information you would be permitted to inspect and copy, or if we determine the records are accurate and complete. If your request for an amendment is denied, you have the right to file a statement of disagreement with the decision and we may provide a rebuttal to your statement.
- Receive an accounting of disclosures of your PHI. You have the right to receive an accounting of certain disclosures of your PHI made by us for the six (6) years prior to the date you request the accounting. This right applies to most disclosures that are made for purposes other than treatment, payment, or health care operations. The accounting will also exclude disclosures we have made directly to you, disclosures to friends or family members involved in your care, disclosures made pursuant to your written authorization, disclosures for national security purposes, and disclosures for notification purposes. The right to receive an accounting is subject to certain other exceptions, restrictions, and limitations under HIPAA. Your request for an accounting must specify the relevant time period for which you would like an accounting, which may not exceed six (6) years. The first accounting you request within a twelve (12)-month period will be provided free of charge, but you may be charged for the cost of providing additional accountings within the same twelve (12)-month period. Following your request for an accounting, you will be notified of the cost associated with providing the accounting and you may choose to withdraw or modify your request at that time.
- Request confidential communications of your PHI by alternative means or at alternative locations. You may request that we contact you about medical matters only in writing or at a different residence or post office box than the one at which you receive your mail. To request confidential communication of your PHI, please specify how or where you would like to be contacted. We will accommodate all reasonable requests for communicating via alternative means or locations. You may exercise any of the rights set forth above by contacting our Privacy and Compliance Office as specified in the How to Contact Us section of this Notice.
You may exercise any of the rights set forth above by contacting our Privacy and Compliance Office as specified in the How to Contact Us section of this Notice.
Examples of How We May Use and Disclose PHI
The following categories describe and provide examples of different ways that we may use and disclose your PHI. Additional restrictions may apply to Part 2 Records received or maintained by Part 2 Programs as described in the Part 2 Addendum.
Treatment: We may use or disclose your PHI to treat you and coordinate and manage your health care and related services with your health care providers. For example, we will share your PHI with doctors, nurses, technicians, therapists, and other people who are taking care of you. We may contact you to communicate treatment options, wellness and educational programs, and other health-related benefits or services that may interest you. We may disclose medical information about you to people outside of the Covenant Health ACE who provide services related to your care, such as home health agencies.
Payment: We may use or disclose your PHI to receive payment for health care treatment, services, and supplies you receive from our health care providers. For example, we give your health plan the information it requires before it will pay us. We also may disclose information to other health care providers to assist them in obtaining payment for services they have provided to you. We may share your information with other health care providers, health care clearinghouses, or health plans for their payment purposes as permitted by law.
Health care operations: We may use or disclose your PHI to operate our facilities and practices, provide you with health care services, and contact you when necessary. The Covenant Health ACE closely works together to improve health care operations across the Covenant Health system, and we may use PHI for those activities. We may also share PHI with another health care provider who has treated you, or with your insurance company. This may be done when the information is needed for the health care operations of the health care provider or the insurance company, such as quality improvement activities, evaluations of health care professionals, and state and federal regulatory reviews.
Business associates: We may share your PHI with certain business associates who provide services on our behalf, such as software vendors and communication service providers. To protect your PHI, we require each business associate to sign an agreement that obligates it to appropriately safeguard your PHI.
Communication with individuals involved in your care or payment for your care: We may, using our professional judgment, disclose your PHI to a family member, other relative, close personal friend, or any person you identify, if the PHI is relevant to that person’s involvement in your care or payment related to your care.
As required by the Secretary of Health and Human Services: We may be required to disclose your PHI to the Secretary of Health and Human Services so that the Secretary may investigate or determine our compliance with HIPAA.
Food and Drug Administration (FDA): We may disclose to the FDA or its agents your PHI that relates to adverse events with respect to drugs, foods, supplements, products and product defects or postmarketing surveillance information to enable product recalls, repairs or replacement.
Workers’ compensation: We may disclose your PHI to the extent authorized by and to the extent necessary to comply with state laws relating to workers’ compensation or other similar programs established by law.
Public health: We may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability.
Law enforcement: We may disclose your PHI for law enforcement purposes as required by law or in response to a validly issued subpoena or other legal process, including state and federal prescription use monitoring programs.
National security and intelligence activities: We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities when required to do so and such disclosure is authorized by law.
As required by law: We may disclose your PHI when required to do so by law.
Health oversight activities: We may disclose your PHI to an oversight agency for activities authorized or monitored by law. These oversight activities include audits, investigations, and inspections as needed for our licensure and for the government to monitor the health care system and government programs, as well as compliance with civil rights laws.
Judicial and administrative proceedings: If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the requested PHI. Additional restrictions may apply to Part 2 Records received or maintained by Part 2 Programs as described in the Part 2 Addendum.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your information.
Coroners, medical examiners, and funeral directors: We will not disclose your PHI to a coroner, medical examiner, or funeral director without your authorization unless required to do so by law. Such disclosure may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors to assist them in carrying out their responsibilities, provided such disclosure is consistent with applicable law.
Organ or tissue procurement organizations: We may, consistent with applicable law, disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
Correctional institution: If you are or become an inmate of a correctional institution, we may disclose to the institution or its agents your PHI to the extent necessary for your health and safety or the health and safety of others.
To avert a serious threat to health or safety: We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Specialized government functions: We may disclose PHI for purposes related to the military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits. We may also disclose PHI about foreign military personnel to the appropriate military authority.
Victims of abuse, neglect, or domestic violence: We may disclose your PHI to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to such disclosure, or if the disclosure is permitted by law and we believe it is necessary to prevent serious harm to you or someone else, or if the law enforcement or public official that is to receive the report represents that such disclosure is necessary and will not be used against you.
Health Information Exchange: For Maine facilities and patients only, we participate in the statewide Health Information Exchange designated by the State of Maine, called HealthInfoNet (HIN). HIN is an electronic repository for health care providers to share PHI to support treatment and continuity of care. You do not have to participate in HIN to receive care. To opt out, please visit www.hinfonet.org or call 1- 866-592-4352.
Facility Directory: Your PHI may be used in our facility directory listing your name and room, unless you ask us not to.
Fundraising: We may contact you for fundraising efforts, but you have the right to opt-out of receiving fundraising communications.
Other Uses and Disclosures of PHI
We will obtain your written authorization before using or disclosing your PHI for purposes other than those provided for in this Notice or as otherwise permitted or required by applicable law. Your authorization is required for any use or disclosure of PHI for marketing communications or sales of PHI that involve financial remuneration to us, as well as disclosures of psychotherapy notes except in certain limit circumstances. You may revoke an authorization at any time by submitting a written revocation to our Privacy and Compliance Office as specified in the How to Contact Us section of this Notice. Please note that we may be required by applicable law to retain certain of your PHI.
Other Restrictions on Uses and Disclosures of PHI
The uses and disclosures of your PHI described above are permitted or required by federal law. Whenever we use, disclose or request your PHI, we will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose for the use, disclosure, or request, taking into consideration practical and technological limitations.
Restrictions on Substance Use Disorder Records
We may receive Part 2 Records about you from a substance use disorder treatment program subject to Part 2 pursuant to a written consent you provide to such program, and we may use and disclose those Part 2 Records for treatment, payment, and health care operations and for other purposes permitted under HIPAA as described in this Notice. However, we will not use or disclose such Part 2 Records, or testimony that relays the content of such Part 2 Records, for purposes of civil, criminal, administrative, or legislative proceedings against you without your written consent or an appropriate court order that meets the requirements of Part 2 and is accompanied by a subpoena or other legal requirement compelling disclosure.
To Report a Problem
If you have questions or would like additional information about our privacy practices, you may contact our Privacy and Compliance Office as specified in the How to Contact Us section of this Notice. If you believe your privacy rights have been violated, you can file a written complaint with our Privacy and Compliance Office as specified in the How to Contact Us section of this Notice or with the Secretary of the United States Department of Health and Human Services. There will be no retaliation against you for filing a complaint.
Updates to this Notice
We may update this Notice from time to time and without prior notice to you to reflect changes in our privacy practices and the updated Notice will be effective for all PHI that we already have about you, as well as any of your PHI that we may receive, create, or maintain in the future. If changes are made to this Notice, an updated Notice will be posted on our website and made available in our facilities upon request.
We may update this Notice from time to time and without prior notice to you to reflect changes in our privacy practices and the updated Notice will be effective for all PHI that we already have about you, as well as any of your PHI that we may receive, create, or maintain in the future. If changes are made to this Notice, an updated Notice will be posted on our website and made available in our facilities upon request.
How to Contact Us
If you have any questions or need further information about this Notice, you may contact our Privacy and Compliance Office via our Patient Relations line at (844) 894-5534 or email us at CompliancePrivacy@covenanthealth.net.