Notice of Privacy Practices

This Notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

This notice is effective February 16^th, 2026.

This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your health information and summarizes our duties and your rights concerning your health information. In addition, Kootenai Health provides Substance Use Disorder (SUD) services, which require us to follow the confidentiality protections under 42 CFR Part 2 for SUD records. To explain these additional protections, please review Appendix A Notice of Privacy Practices of Kootenai Health’s Part 2 Program Addendum to this Notice, which applies if you are receiving services from a Part 2 Program.

Your Rights

You have certain rights regarding your health information. This section explains your rights and how you can exercise those rights. More information about the process and forms can be found by visiting https://www.kh.org/patient-and-visitor-information/medical-records/

• Receive a copy of your medical record: You have a right to review and ask for a copy of your medical record that we maintain and use to make decisions about you. If the information is maintained electronically, you have a right to receive that information in an electronic format. You can ask to see or obtain a copy of your health information by contacting the Health Information Management/Medical Records Department at Kootenai. We may charge a reasonable, cost-based fee.
• Request Corrections: You can ask us to correct health information about you that you think is incorrect or incomplete. We may say “no” to your request, but we’ll tell you why in writing within 60 days.
• Request Restrictions: You may ask us to limit how we use or disclose your health information. We are not required to agree to your request, and we may say “no” if it would affect your care.
• If you pay for a service or item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.
• Request Confidential Communications: You may request that we contact you by some other method or at some other location (for example, home or office phone) or send mail to a different address. We will accommodate all reasonable requests.
• Receive a List of Disclosures: You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
• Choose someone to act on your behalf: We may share your health information with your personal representative, as permitted by law. A personal representative is someone legally authorized to act on your behalf regarding your health care decisions or access to your health information. This may include a parent or guardian of a minor, or someone holding a health care power of attorney.
• Obtain a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice upon request. This Notice is available in paper form at all Kootenai Health locations.
• File a complaint if you feel your rights are violated: If you have questions or concerns about your privacy rights or wish to file a formal complaint, please contact the Privacy Officer.

The Privacy Officer may be reached at:
Kootenai Health Privacy Officer
2003 Kootenai Health Way Coeur d’Alene, ID 83814
Phone: (208) 625-6248 or toll-free at (844) 625-6248
Email: [email protected]

You may also file a complaint with the Office for Civil Rights, Health and Human Services, at 1-800-368-1019, TDD: 1-800-537-7697, or by accessing their website https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

We will not retaliate against you for filing a complaint.

Our Uses and Disclosures

We may use or disclose your health information for certain purposes without your written authorization, including the following:

• Treatment: We may use your health information and share it with other professionals who are treating you. For example, we may remind you of an appointment or share information about you with your primary physician for follow-up.
• Payment: We may use or disclose your health information to get payment for services provided to you. For example, we may contact your insurer to confirm, in advance, that your insurer will cover your surgery.
• Healthcare Operations: We may use or disclose your health information for certain activities that are necessary to operate our practice and ensure that our patients receive quality care. For example, to evaluate the performance of those caring for you.

Other Uses and Disclosures Allowed Without Your Written Authorization

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. For more information, see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

• Help with public health and safety issues: We can share health information about you for certain situations such as:
  • Preventing disease
  • Helping with product recalls
  • Reporting adverse reactions to medications
  • Reporting suspected abuse, neglect, or domestic violence
  • Preventing or reducing a serious threat to anyone’s health or safety
• Do research: We can use or share your information for health research.
• Comply with the law: We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
• Respond to organ and tissue donation requests: We can share health information about you with organ procurement organizations.
• Work with a medical examiner or funeral director: We can share health information with a coroner, medical examiner, or funeral director when an individual dies.
• Address workers’ compensation, law enforcement, and other government requests: We can use or share health information about you:
  • For workers’ compensation claims
  • For law enforcement purposes or with a law enforcement official
  • With health oversight agencies for activities authorized by law
  • For special government functions such as military, national security, and presidential protective services
• Respond to lawsuits and legal actions: We can share health information about you in response to a court or administrative order, or in response to a subpoena.
• Idaho Health Data Exchange (IHDE): Kootenai Health participates in the IHDE, which allows medical professionals, payers, and state government agencies to access information about you for treatment, payment, and health care operations. If you do not want the IHDE to use or disclose your information, you must contact IHDE directly to opt out. More information is available from IHDE upon request at https://idahohde.org/patients/faqs/

Uses and Disclosures When You Have the Opportunity to Object

• Disclosure to and Notification of Family, Friends, or Others Involved in Your Care: Unless you object, we may use or disclose information to notify or help notify a family member or other person responsible for your care, your location, and condition. We may also disclose to a family member, other relative, close personal friend, or any other person you identify, information relative to that person’s involvement in your care or payment for your care. If you do not want family members or others to be notified, please tell staff at the registration or front desk, and/or those caring for you.
• Hospital Directory: Unless you object, Kootenai Health will use your name, location in the hospital, general condition, and religious affiliation for directory purposes. That means that when you are a hospital patient, this information may be provided to members of the clergy and, except for religious affiliation, to people who ask for you by name. If you do not want your health information listed in the hospital directory, please tell the Hospital Patient Access staff.
• Disclosure for Disaster Relief Purposes: We may disclose your location and general condition to a public or private entity (such as FEMA or the Red Cross) authorized by its charter or by law to assist in disaster relief efforts.
• Fundraising: We may share limited health information with a business associate or an affiliated foundation to contact you about fundraising for our organization. You may opt out of receiving these communications at any time by notifying the Privacy Officer.

Uses and Disclosures With Your Written Authorization

We will obtain a written authorization from you before using or disclosing your protected health information for any purpose other than those described in this Notice, including most uses or disclosures of psychotherapy notes, for marketing purposes, or if we seek permission to sell your information. Certain types of health information are afforded extra protection under federal or state law. For example, disclosures of information about behavioral health, chemical dependency, sexually transmitted diseases, and genetic testing often require your written permission. Unless required by law, we will obtain your written permission before disclosing such information. You may revoke your authorization at any time by submitting a written notice to the Health Information Management/Medical Records Department at 2003 Kootenai Health Way, Coeur D’Alene, Idaho 83814 or [email protected]. The revocation will not affect disclosures that have already been made, but will stop future disclosures. You may also request a reasonable accommodation for an alternative revocation process by contacting the Privacy Officer.

Redisclosure Notice

Information we disclose to others under this Notice may no longer be protected by federal privacy regulations once it is shared. The person or organization receiving your information could potentially share it with others, and those disclosures may not be subject to the same protections.

Our Legal Duties

• Kootenai Health is required by law to maintain the privacy and security of your health information and to notify affected individuals following a breach of unsecured health information.
• We are required to provide you with a Notice of our legal duties and privacy practices with respect to protected health information and to abide by the terms of the Notice currently in effect.
• We reserve the right to change the terms of the Notice at any time and apply the changes to all information we have about you. The new Notice will be available in our facilities and on our website.

Who Will Follow This Notice

This notice applies to Kootenai Health and its affiliated facilities, including Kootenai Clinic, Kootenai Urgent Care, and Kootenai Outpatient Imaging, as well as their staff, physicians, vendors, volunteers, and students who access or manage your health information.

MultiCare Connected Care Network

Kootenai Health is part of the MultiCare Connected Care Network, which is an Organized Health Care Arrangement (OHCA). An OHCA is (i) a clinically integrated setting in which individuals typically receive health care from more than one health care provider or (ii) an organized system of health care in which more than one health care provider participates. The health care providers who participate in the OHCA will share medical and billing information about you with one another as it may be necessary to carry out treatment, payment, and health care operations activities.

Non-Discrimination and Language Access

Kootenai Health complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex (consistent with the scope of sex discrimination described at 45 CFR § 92.101(a)(2)).

Notice of language availability | Free interpreter services: If you speak a language other than English, Kootenai Health offers interpreter services at no cost to you. To learn more about this free service, scan the QR code or visit https://www.kh.org/non-discrimination/

Appendix A — Notice of Privacy Practices of Kootenai Health’s Part 2 Program Addendum

(For Substance Use Disorder Treatment Records)

FEDERAL LAW PROTECTS THE CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS

In addition to the uses and rights set forth in the Notice of Privacy Practices, persons who are the subject of Substance Use Disorder (SUD) Part 2 records are also entitled to the following additional uses and rights.

This Notice describes:

• How health information about you may be used and disclosed
• Your rights with respect to your health information
• How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information

You have a right to a copy of this Notice (in paper or electronic form) and to discuss it with our Privacy Officer at (208) 625-6248 or [email protected] if you have any questions.

Use And Disclosure That Do Not Require Your Written Consent

In addition to what is listed in the Notice of Privacy Practices, there are more limited situations where we may share your health information without your written consent. These situations are specifically allowed by 42 CFR Part 2 and are described below. If another law is stricter than Part 2 or HIPAA, we will comply with the stricter law when using or disclosing your records.

• Medical Emergencies
  We may disclose your Part 2 Records to medical personnel without your written consent when needed to address a bona fide medical emergency and your consent cannot be obtained, or when the Part 2 Program is closed during a declared disaster and is unable to obtain your consent.
• Audits and Program Evaluation
  We may disclose information to government agencies, payers, accreditation, or quality improvement bodies for audits/evaluations under confidentiality protections. These reviews are permitted only to evaluate how our program operates, determine whether we meet regulatory or payment requirements, or assess the quality and effectiveness of care.
• Crimes on Premises/Against Staff:
  We may notify law enforcement if you commit, or threaten to commit, a crime that occurred on the premises or against our staff or other patients. In such cases, we may disclose only the circumstances of the incident, including that you are a patient in our program, along with your name and address, and your last known location.
• Vital Statistics
  We may disclose patient-identifying information about the cause of death to comply with laws that require reporting of death or other vital statistics, or that permit inquiry into the cause of death.
• Internal Care Communication
  We may share information among our staff and with entities that have direct administrative control over our program when necessary to provide diagnosis, treatment, or referral for treatment of SUD.
• Qualified Service Organization (QSO)/Business Associate (BA)
  We may use and share your health information with a QSO/BA who has agreed in writing to protect it and only use it when necessary to provide services.
• Compliance Investigations by Federal Authorities
  We may disclose your Part 2 Records when required by the U.S. Department of Health and Human Services (HHS) Secretary to investigate or determine our compliance with federal SUD confidentiality laws. These disclosures are limited to what is necessary for the investigation.

Uses and Disclosures That Require Your Written Consent

In all other cases, we require your written consent to use or disclose your Part 2 protected health information.

These generally fall into two categories:

• Treatment, Payment, and Health Care Operations (TPO)
  These are routine activities that support your care, such as providing treatment, billing and payment activities, and health system operations. You may give one written consent that allows us to use and disclose your Part 2 records for these purposes. This single consent can apply to all future TPO uses and disclosures.
  • Treatment Example: Sharing your records with another healthcare provider to coordinate your ongoing treatment.
  • Payment Example: Sharing your records with your health plan or insurance company for reimbursement of services you received.
  • Health Care Operations Example: Using your health information for activities that support the quality and efficiency of care, such as internal audits, staff training, or evaluating program performance.
• Other Uses and Disclosures
  Your written consent/authorization is also required for purposes such as:
  • Sharing your information with criminal justice officials when participation in our program is required by a court order, probation, or parole.
  • Reporting any substance use disorder medication prescribed or dispensed by Kootenai to the applicable state Prescription Drug Monitoring Program (PDMP) when reporting is required by state law.
  • Using or disclosing Part 2 records, or testimony about those records, in any civil, administrative, criminal, or legislative proceeding against you.
  • Sharing your Part 2 records with any other person or category of persons you specifically identified or authorized in your written consent/authorization.

How other entities may disclose your records after you consent.

Records that are disclosed to a part 2 program, covered entity, or business associate under your written consent for TPO may be further disclosed by that part 2 program, covered entity, or business associate, without your written consent, to the extent the HIPAA regulations allow such disclosure.

Use of Records in Legal Proceedings

Federal law strictly limits the use of your SUD treatment records in any legal matter. Part 2 Records, or any testimony describing the contents of such records:

• Shall not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you give specific written consent or a court issues an order permitting it;
• May be used or disclosed under a court order only after you (or the record holder, if required) are given notice and an opportunity to be heard; and
• May not be used or disclosed under a court order unless it is accompanied by a subpoena or similar legal requirement compelling disclosure.

Patient Rights Under Part 2

Federal law gives you important rights over your Part 2 records, in addition to what is listed in the Notice of Privacy Practices. These rights help you control how your information is used and shared. You may exercise any of these rights by contacting the Privacy Officer.

• Right to Discuss This Notice With Us
  You have the right to ask questions and discuss this Notice with the Privacy Officer.
• Right to Opt Out of Fundraising Communications
  We do not use your Part 2 records for fundraising at this time. If we ever choose to fundraise for the benefit of our Part 2 program, we will first provide you with a clear and conspicuous opportunity to elect not to receive fundraising communications, and we will honor your choice.

Complaints

If you believe your privacy rights under Part 2 have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services (HHS).

• To file a complaint with us:
  Contact the Privacy Officer directly. Contact information can be found at the beginning of this Notice.
• To file a complaint with HHS:
  You may file a complaint directly with the HHS, Office for Civil Rights at 1-800-368-1019, TDD: 1-800-537-7697, or by accessing their website https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

You will not be retaliated against for filing a complaint.