Close Close


Patients & Visitors' Guide

HIPAA Protected Health Information 

The Health Insurance Portability and Accountability Act (HIPAA) is now in effect.  The regulation provides consumers with critical rights to control the release of their medical information.  The law also outlines how an individual's health care information should be used.

For help in understanding HIPAA, Northeast Hospital Corporation has published, "A Guide To Your Medical Information".  The guide is a brief overview of your rights and our responsibilities to you, the patient and is published in its entirety below.  We also have a link to our  Release of Information form, which must be signed by you as the patient or your legal representative prior to any release of your medical information not otherwise required by law.


HIPAA Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and shared. It also explains how you can get access to this information. Please review it carefully.

For more information on privacy protections at Lahey Health, please visit or call the Lahey Health Privacy Toll-free Hotline: 844-663-4677.

The facilities and offices that make up Lahey Health are considered a single affiliated "covered entity." They will share protected health information with each other, as necessary, to carry out treatment, payment, or health care operations.

Your Rights

This section explains your rights and some of our responsibilities to help you. You have the right to:

Get an electronic or paper copy of your medical record

  • You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this.
  • We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a fee based on the cost of what you request.
  • Lahey Health keeps medical records for at least 20 years after your discharge (from a stay in the hospital) or after your final outpatient visit or treatment, as required by state law. A copy of the hospital's medical record retention policy is available upon request.

Ask us to amend your medical record

  • You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.
  • We may say "no" to your request, but we'll tell you why in writing within 60 days. You will have the right to include a written statement in your record if you disagree with the decision.

Request confidential communications

  • You can ask us to call you in a specific way (for example, at home, at the office, or on your cell phone) or to send mail to a different address.
  • We will say "yes" to all reasonable requests.

Ask us to limit what information we use or share

  • You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say "no" if it would affect your care.
  • If you pay for a service or health care item fully on your own (without insurance coverage), you can ask us not to share that information with your health insurer. We must say "yes" unless a law requires us to share that information.
  • We will not share certain information that has special protections under the law, like notes taken during psychotherapy, unless you specifically tell us we can in writing.
  • We will not share any substance abuse treatment records without your written permission.

Get a list of those with whom we've shared information

  • You can ask for a list (or an accounting) of the times we've shared your health information for 6 years before the date you ask. You can also ask whom we shared it with and why. We will include all the disclosures except for those about treatment, payment, health care operations, and certain other disclosures (such as any you asked us to make). We will provide you with one accounting a year for free but will charge a fee if you ask for another one within 12 months.

Get a copy of this privacy notice

  • We will provide you with a paper copy of this notice at any time, even if you have agreed to receive the notice electronically.

Choose someone to act for you

  • You can choose a health care agent (proxy) or give someone medical power of attorney to exercise your rights and make choices about your health information and treatment if you are not able to make choices. Ask us how to do this.

Refuse to answer questions

  • We may need your help in collecting your health information.
  • If you choose not to answer, we will fill in the information as best we can.
  • You do not have to answer every question to receive services.

File a complaint if you feel your rights are violated or request more information

  • You can complain if you feel we have violated your rights or request further information by contacting the Lahey Health Privacy Toll-free Hotline: 844.663.4677.
  • You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 877.696.6775, or visiting
  • We will not retaliate against you for filing a complaint.

Your Choices

In certain instances, you can tell us how you want us to share your information. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. You have both the right and choice to tell us if we may:

  • Share information with your family, close friends, or others involved in your care
  • Share information about you in a disaster relief situation
  • Include your name and location in a hospital "directory" list that is available to anyone who calls the hospital

If you are not able to tell us your preference-for example, if you are unconscious-we may go ahead and share your information if we believe it is in your best interest.

We will never share or use your information for marketing purposes and will never sell your information unless you give us written permission ahead of time.

If we are raising funds for Lahey Health, we may contact you, but we will also give you an easy way to tell us not to contact you again for this purpose.

Our Uses and Disclosures

How do we typically use or share your health information?

  • Treatment: We use your health information and share it with other professionals who are treating you. Example: We may share your information if a doctor treating you for an illness or injury asks about your overall health condition.
  • Health care operations: We use and share your health information to run Lahey Health, improve patient care, and contact you when necessary. Example: We use health information to evaluate the care and treatment results in your case and those of others with similar conditions.
  • Payment: We use and share your health information to bill and obtain payment from health plans or other entities. Example: We give information about the care you received to your health insurance plan so it will pay for those services.

How else can we use or share your health information?

Lahey Health is allowed or required to share your information in other ways-usually in ways that contribute to the public good. By law, we have to meet many conditions before we can share your information for these purposes. Here are some examples:

  • Public health and safety efforts:
  1. Preventing disease
  2. Helping with product recalls
  3. Reporting adverse reactions to medications
  4. Reporting suspected abuse, neglect, or domestic violence
  5. Preventing or reducing a serious threat to anyone's health or safety

  • Conducting clinical research: Lahey Health's Privacy Board reviews all requests to use identifiable patient information in clinical research.
  • Complying with the law: Lahey Health will share information about you if state or federal laws require it, including with the U.S. Department of Health and Human Services if it wants to see that we are complying with federal privacy law.
  • Responding to organ and tissue donation requests
  • Working with a medical examiner, coroner, or funeral director when an individual dies
  • Addressing workers' compensation, law enforcement, and other government requests
  • Responding to lawsuits and legal actions

Lahey Health must share health information about you in response to a court or administrative order, or in response to a subpoena or search warrant.

Special Confidentiality Protections for Alcohol and Drug Abuse Treatment Records

If you have received treatment, diagnosis, or referral for treatment from our substance use disorder programs, the confidentiality of drug or alcohol use records is protected by federal law and regulations. As a general rule, we may not tell a person outside the programs that you attend any of these programs, or disclose any information identifying you as an alcohol or drug user, unless:

  • you authorize the disclosure in writing; or
  • the disclosure is permitted by a court order; or
  • the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation purposes.

You should also know

  1. A violation by us of the federal law and regulations governing drug or alcohol use is a crime. Suspected violations may be reported to the United States Attorney at 617.748.3100.
  2. Information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime is not protected.
  3. These laws do not protect any information about suspected child abuse or neglect from being reported to appropriate authorities.


For more information see 42 U.S.C. § 290dd-2 and 42 C.F.R., Part 2.

Our Responsibilities

  • Lahey Health is required by law to maintain the privacy and security of your health information.
  • We must let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
  • We must follow the duties and privacy practices described in this notice and give you a copy of it.
  • We will not use or share your information other than as described here unless you tell us in writing we may do so. Even if you give us permission, you may change your mind at any time. Let us know in writing if you change your mind.


For more information, see: privacy/hipaa/understanding/consumers/noticepp.html.


Changes to the Terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our offices, and on our web sites, and


Review our Notice of Privacy Practices in these languages: