Mercy Health Services Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Mercy Health Services (MHS) is required by law to maintain the privacy of identifiable information that relates to your physical or mental health, health care you have received, or payment for your care. As required by law, this Notice provides you with information about your rights and our legal duties and privacy practices with respect to your health information. This Notice also describes how MHS may use or disclose your health information. The privacy practices described in this Notice will be followed by all MHS affiliated sites, health care professionals, employees, medical staff, trainees, students, and volunteers of the organizations specified at the end of this Notice. In addition, these organizations, sites, or individuals may share health information with each other and other health organizations affiliated with MHS as part of an organized health care arrangement for treatment, payment, and health care operations purposes as described in this Notice or otherwise permitted by law.

How We May Use and Disclose Medical Information About You

MHS may use or disclose medical information about you, without your written consent (known as an authorization), for purposes related to:

Treatment: Treatment means the coordination of your care between various health care providers and specialists for consultations. For example, a specialist treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. Therefore, the specialist may review medical records from your primary care provider to assess whether you have potentially complicating conditions such as diabetes.

Payment: Payment refers to activities related to verifying your level of insurance benefits, requesting authorizations for treatment and referrals for special tests, and billing/administrative purposes. For example, MHS may need to provide information to your insurance plan about your medical condition in order to determine whether the proposed course of treatment will be covered.

Health Care Operations: Health care operations refers to the administrative and operational activities MHS must engage in, including quality assurance, case management, audits, and physician reviews. For example, MHS may use your medical information to evaluate the performance of our staff in caring for you.

Health Information Exchanges (HIEs):MHS may share information that we obtain or create about you with other health care providers or health care entities, as permitted by law, through Health Information Exchanges (HIEs) in which we participate. An HIE is a technology framework that allows for secure electronic exchange of medical information among participating organizations, such as hospitals, physician offices, labs, radiology centers, and other medical providers. By exchanging information through HIEs, it provides MHS and other participating health care providers faster access to medical information about you, which allows them to make more informed treatment decisions and coordinate your care. MHS participates in the Chesapeake Regional Information System for our Patients, Inc. (CRISP), a statewide HIE. As permitted by law, your health information will be shared with this HIE in order to provide faster access, better care coordination, and assist providers and public health officials in making more informed decisions. You may “opt-out” and prevent searching of your health information through CRISP by calling 1-877-952-7477 or completing and submitting an Opt-Out form to CRISP by mail, fax or through their website at www.crisphealth.org. If you opt-out of CRISP, certain health information about you may still be available through the HIE as permitted or required by law. For example, medical providers who participate in CRISP will still be able to access lab results, radiology reports, and other data and they may send this information to other providers to whom you have been referred for treatment through CRISP’s secure messaging services. In addition, public health reporting and controlled dangerous substance information, as part of the Maryland Prescription Drug Monitoring Program, will still be available to providers through CRISP. MHS also participates in other HIEs, including through its electronic medical records (EMR) system. This allows MHS to share or obtain medical information about you for treatment, payment, or health care operations purposes. You have the right to opt out of these other HIEs. For more information about how to opt out, contact the MHS Privacy Officer, whose contact information is below.

Facility Directory: If you are admitted to Mercy Medical Center or Stella Maris, MHS may include certain limited information about you in its facility directory, including your name, location, general condition, and religious affiliation. MHS may disclose directory information to members of the clergy or, except for religious affiliation, to persons who ask for you by name. If you object to your information being included in the facility directory, you should tell the registration staff during registration, contact the Admitting Office at 410-332-9801 or advise your caregiver of your preferences. If you are unavailable, MHS will use professional judgment to determine whether it is in your best interest to include your information in the directory.

Family Members: Unless you object, MHS may disclose your medical information to family members or other persons who are involved in your medical care or help you pay for your care, provided the information is relevant to that person’s involvement in your care. MHS may also allow them to pick up medical supplies, x-rays, or filled prescriptions on your behalf. If you are unavailable, MHS will use professional judgment to determine what is in your best interest.

Appointment Reminders and Treatment Alternatives: MHS may contact you to remind you about your appointments and bring to your attention alternative treatment options and other health related benefits and services.

Fundraising: MHS may disclose to the Mercy Health Foundation your demographic information, dates on which you received services from MHS, the MHS department or provider from which you received care, the name of your treating provider, your treatment outcome, and your insurance status. You may be contacted as part of our fundraising efforts to support our health care mission. You have a right to opt out of receiving such communications by notifying the Mercy Health Foundation at 410-332-9873 or at updatemyrecord@mdmercy.com.

Organ and Tissue Donation: MHS may disclose your medical information to organizations that handle organ and tissue procurement and donations.

Military Authorities: If you are a member of the U.S. Armed Forces or foreign military, MHS may release medical information about you to appropriate military command authorities.

Workers' Compensation: MHS may disclose medical information to comply with workers' compensation laws.

Public Health Activities: For dMHS may disclose your medical information to public health officials for public health purposes, including: preventing or controlling disease, injury, or disability; reporting child abuse or neglect; reporting adverse events or product defects to the U.S. Food and Drug Administration; and to notify persons that may have been exposed to a disease or may be at risk of contracting or spreading a disease.

Health Oversight: MHS may disclose your medical information to federal or state agencies that oversee the health care system, government programs, and enforcement of civil rights laws for audits, investigations, or inspections.

Legal Proceedings: MHS may disclose your medical information to courts and attorneys in response to a court order, subpoena, or other lawful process, or to defend ourselves against a lawsuit.

Law Enforcement: MHS may disclose your medical information to law enforcement officials as permitted or required by law to aid in the search for a criminal or fugitive or a criminal investigation.

Coroners and Funeral Directors: MHS may disclose your medical information to identify a deceased person, determine cause of death, and to help funeral directors carry out their duties.

National Security: MHS may disclose your medical information to authorized federal authorities for intelligence or other national security activities as permitted by law.

Inmates: If you are an inmate of a correctional facility or under the custody of law enforcement, MHS may release your medical information to the correctional facility or law enforcement officer as permitted or required by law.

Research: MHS may use or disclose your medical information for research purposes under specific rules determined by the confidentiality provisions of applicable law. MHS may use or disclose your medical information to researchers if they have been approved through a special review process designed to protect patient safety, welfare, and confidentiality.

Threats to Health or Safety: As permitted by applicable law and ethical conduct, MHS may use and disclose medical information if it believes, in good faith, that such use or disclosure is necessary to prevent serious harm to you or others. We may also share your information for disaster relief efforts or in emergency situations.

Business Associates: MHS may disclose your medical information to outside businesses known as “business associates” that provide services on its behalf, such as billing or consulting services.

Substance Use Disorder Treatment Records: Some of your medical records may be subject to 42 C.F.R. Part 2, which applies to certain substance use disorder treatment records (“Part 2 Records”). MHS will not use and/or disclose Part 2 Records for treatment, payment, or health care operations purposes (TPO) without obtaining your valid consent. MHS may re-disclose such records in accordance with the Privacy Rule to other covered entities for TPO. Any disclosure made under the regulations must be limited to that information which is necessary to carry out the purpose of the disclosure. MHS may use/disclose Part 2 Records without your consent to public health or health oversight authorities, for research purposes, in the case of a medical emergency, and to our service providers who have agreed to certain confidentiality requirements. MHS will not use/disclose Part 2 Records or provide testimony that relays the contents of such records in civil, criminal, administrative, or legislative proceedings conducted by a Federal, State, or local authority against you or to investigate or prosecute you without your consent or a court order. A separate valid consent is also needed to use and disclose SUD counseling notes. Each disclosure made by MHS will include a copy of the consent and/or a clear explanation of the scope of the consent. As it pertains to Part 2 Records, you have the right to request an accounting of disclosures of records covering disclosures made in the three years prior to the date of the request including disclosures made with your consent and for TPO when such TPO disclosures were made through an electronic health record, a right to request restrictions of disclosures, including to health plans for service(s) paid in full by you, a right to opt out of fundraising communications, a right to receive breach notifications, and a right to file complaints for an alleged violation of Part 2. Part 2 Records disclosed pursuant to the Privacy Rule may be subject to re-disclosure and no longer protected by the Privacy Rule.

Uses and Disclosures Requiring Your Authorization

Uses and disclosures of medical information not described in this Notice will be made only with your written authorization. For example, with limited exceptions, MHS must obtain your authorization before: using and disclosing psychotherapy notes and Substance Use Disorder counseling notes; using or disclosing your medical information for marketing purposes (except for communications made face-to-face or promotional gifts of minimal value provided to you by MHS); or selling or receiving anything of value in exchange for your medical information. If you authorize MHS to use or disclose your medical information, you have the right to revoke the authorization at any time by providing written notice to the MHS Privacy Officer whose contact information is below. Your revocation will be effective once received, but will not impact uses or disclosures MHS made while your authorization was still in effect.

Your Rights Regarding Medical Information

You have the following rights with respect to medical information that MHS maintains about you:

Right to Inspect and Copy. You have the right to inspect and/or receive a copy of your medical and billing records used by MHS to make health care decisions about you. You also have the right to request that MHS send a copy of your medical records to a third party. If you want to review or receive a copy of your records, you must make the request in writing to your provider or the appropriate medical records department.

Right to Request an Amendment. If you believe that medical information MHS maintains about you is inaccurate or incomplete, you may request that MHS amend the information. You must request the amendment in writing to your provider or to the appropriate medical records department. If MHS accepts your request, MHS will notify you and add the supplemental information to your record by addendum. MHS cannot delete what is in the record. If MHS denies your request, an explanation of the denial and your rights will be provided.

Right to an Accounting of Disclosures. You have the right to receive a list of the disclosures MHS has made of your medical information in the six years prior to your request. The accounting of disclosures will not include every disclosure made, including those disclosures made for treatment, payment, health care operations, disclosures authorized by you, and disclosures made to you. To request an accounting of disclosures, submit a written request to the Director of Health Information Services via fax to 410-332-0336 or via mail: ATTN Health Information Services Department, Mercy Medical Center, 301 St. Paul Place, Baltimore, MD 21202.

Right to Request Restrictions. You have the right to request that MHS restrict how it uses and discloses your medical information for treatment, payment, or health care operations, or with family members or others involved in your care. MHS is not required to accept your requested restriction, unless it relates to disclosures made to your health insurer related to a specific service for which you have prepaid in full; however, if the service is part of a group of services “bundled” for health plan billing purposes, it may not be possible for MHS to restrict the disclosure. If MHS agrees to a restriction, you will be notified in writing, and MHS will comply with your request unless the medical information is needed to provide you emergency treatment or we are required by law to disclose it. To request a restriction, submit a written request detailing the requested restriction to the MHS Privacy Officer.

Right to Confidential Communications. You have the right to request that MHS communicate with you about your medical information or services using a certain method (i.e., MyChart, phone, mail) or at a certain location. MHS will honor reasonable requests when feasible. To request an alternative means of communication, submit a written request to your provider or the MHS Privacy Officer.

Right to Receive a Paper Copy of this Notice. You have the right to obtain a paper copy of this Notice at any time. To obtain a copy, contact your provider or the MHS Privacy Officer.

Right to Be Notified of a Breach. MHS is required to notify you of a breach of your unsecured medical information.

Changes to This Notice

This Notice is effective as of February 16, 2026. MHS must abide by the terms of the Notice currently in effect. MHS reserves the right to make changes at any time to its privacy practices and this Notice, and may make the new terms effective for all medical information that MHS already maintains about you as well as information it receives in the future. If changes are made to the Notice, the updated Notice will be posted on the MHS website at https://mdmercy.com, posted in clear and prominent locations throughout MHS sites, and distributed as required.

Questions or Complaints

If you have a question about this Notice or feel that your privacy rights have been violated, please contact the MHS Privacy Officer at 301 St. Paul Place, Baltimore, MD 21202, Phone: (410) 576-LAWS (5297), Email: Compliance@mdmercy.com You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.

All organizations that are part of the MHS designated affiliated covered entity follow this Notice, including, but not limited to:

Mercy Medical Center, Inc.; North Calvert Anesthesiology Services, LLC; Mercy Transitional Care Services, Inc.; Lutherville Hematology and Oncology Services, LLC; Stella Maris, Inc.; St. Paul Place Specialists, Inc.; Maryland Family Care, Inc.; Teresa Hoffman, M.D. and Associates, LLC; Vascular Specialty Services, LLC; Neurosurgical Specialty Services, LLC; The Emergency Room Physicians SPPS, LLC.