Joint Notice of Privacy Practices



Penn Medicine Princeton Health (“Princeton Health”) understands that information about you and your health is very personal. Therefore, we strive to protect your privacy. We are required by law to maintain the privacy of our patients’ protected health information (“PHI”) and to provide you with notice of our legal duties and privacy practices with respect to your PHI. We will only use and disclose your PHI as described in this Notice. We are required to abide by the terms of this Notice so long as it remains in effect. We reserve the right to change the terms of this Notice and to make the new notice provisions effective for all PHI we maintain. Any revised notice will be available upon request and on our website at

Pursuant to Princeton Health being identified as an Organized Health Care Arrangement (“OHCA”) for purposes of federal privacy requirements, the entities participating in the Princeton Health OHCA (listed below) will share PHI with each other, as necessary to carry out treatment, payment, or health care operations relating to the OHCA.

You will be asked to sign an acknowledgement that you have received this Notice. If you have questions regarding the information in this Notice, or if you would like to obtain a copy of this Notice, please contact the Princeton Health Privacy Officer.


The terms of this Notice apply to Princeton Health, and its affiliated entities, divisions, programs, departments and units, including, but not limited to:

•  Penn Medicine Princeton Medical Center
•  Penn Medicine Princeton Medical Center Princeton Rehabilitation
•  Penn Medicine Princeton HomeCare

•  Penn Medicine Princeton Health Occupational Health

•  Penn Medicine Princeton House Behavioral Health

•  Penn Medicine Princeton Medical Center Princeton Management Services

•  Penn Medicine Princeton Medical Center Foundation

•  Penn Medicine Princeton HomeCare Princeton Caregivers

•  Penn Medicine Princeton Medicine Physicians

All employees, medical staff, trainees, students, volunteers, and agents of Princeton Health must follow these privacy practices.


This section describes the ways we may use or disclose your PHI without your consent or authorization.

For Treatment. We may use your PHI as necessary to provide you with medical treatment or services. For example, a healthcare provider, such as a physician, nurse, or other person providing health services to you, will record information in your medical record that is related to your treatment. This information may be used to diagnose or treat your condition. Healthcare providers will also record actions taken by them in the course of your treatment and note how you respond to the actions.

For Payment. We may use and disclose your PHI to others for purposes of receiving payment for treatment and services that you receive. For example, a bill may be sent to you or a third-party payor, such as an insurance company or health plan. The information on the bill may contain information that identifies you, your diagnosis, and treatment or supplies used in the course of treatment.

For Healthcare Operations. We may use and disclose your PHI for operational purposes. This is necessary to operate Princeton Health, including by ensuring that our patients receive high quality care and that our health care professionals receive superior training. For example, your PHI may be disclosed to members of the medical staff, risk or quality improvement personnel, and others to evaluate the performance of our staff, assess the quality of care and outcomes in your case and similar cases, and to learn how to improve our facilities and services.

For Health Information Exchange. We participate in one or more health information exchanges (HIEs) and may electronically share your PHI for treatment, payment, and healthcare operations purposes with other participants in the HIEs. HIEs allow your health care providers to efficiently access and use your pertinent medical information necessary for treatment and other lawful purposes. If you do not opt-out of this exchange of information, we may provide your health information to the HIEs in which we participate in accordance with applicable law. In order to opt-out, you must complete and submit a Health Information Exchange Opt-Out form. Upon receipt of your request, your PHI will continue to be used and disclosed in accordance with this Notice and the law, but will no longer be available electronically to otherwise authorized providers through our HIE(s).

Inpatient Directory. Unless you notify us that you object (see “opt-out” information at the end of this Notice), we may include your name, location in the facility, general condition, and, if you wish, your religious affiliation in our inpatient directory. The directory information, except for your religious affiliation, may be released to individuals who ask for you by name so they can generally know how you are doing. Your religious affiliation may be given to a member of our chaplaincy services department, such as a priest or rabbi, even if they do not ask for you by name. If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest.

Appointments and Services. We may use your PHI to remind you about appointments or to follow up on your visit.

Health Products and Services. We may use your PHI to communicate with you about treatment alternatives or other health-related benefits and services that may be of interest to you.

Fundraising. We may use or share your information to contact you to donate to a fundraising effort on our behalf. For example, to raise funds for the Penn Medicine Princeton Medical Center Foundation or Princeton Health activities and services. You have the right to opt-out of fundraising communications (see “opt-out” information at the end of this Notice).

Persons Involved In Your Care. Unless you object, we may, in our professional judgment, disclose your PHI to family, friends, or others identified by you to facilitate that person’s involvement in caring for you or in payment for your care. We may use or disclose your PHI to assist in notifying a family member, personal representative, or any other person responsible for your care of your location and condition. We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts to locate a family member or other persons who may be involved in some aspect of caring for you.

Research. We may use your health information for research purposes when an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your health information has approved the research.

Business Associates. We may contract with certain outside persons or organizations to perform certain services on our behalf, such as auditing, accreditation, legal services, etc. At times it may be necessary for us to provide your information to one or more of these outside persons or organizations. In such cases, we require these business associates, and any of their subcontractors, to appropriately safeguard the privacy of your information.

Marketing Activities. We may contact you as part of our marketing activities, as permitted by law.

Other Uses and Disclosures. We are permitted or required by law to make certain other uses and disclosures of your PHI without your consent or authorization. For example, subject to conditions specified by law, we may share your PHI:

  • for any purpose required by law;
  • for judicial and administrative proceedings pursuant to legal authority; to certain governmental agencies if we suspect child abuse or neglect, or if we believe you to be a victim of abuse, neglect or domestic violence;
  • or judicial and administrative proceedings pursuant to legal authority;
  • to certain governmental agencies if we suspect child abuse or neglect, or if we believe you to be a victim of abuse, neglect or domestic violence;
  • to entities regulated by the Food and Drug Administration, if necessary, to report adverse events, product defects, or to participate in product recalls;
  • to assist law enforcement officials in their law enforcement duties, including for purposes of identifying or locating suspects, fugitives, witnesses, or victims of crime;
  • for specialized government functions such as protection of public officials or reporting to various branches of the armed services if necessary. We may also release your PHI, if necessary, for national security, intelligence, or protective services activities;
  • to a correctional institution or law enforcement official if you are an inmate of a correctional institution or under the custody of a law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
  • to comply with laws and regulations related to workers' compensation;
  • for public health activities, such as required reporting of disease, injury, birth, and death, for required public health investigations, and for other health oversight activities;
  • to your employer in accordance with applicable law, if we are retained to conduct an evaluation relating to medical surveillance of your workplace or to evaluate whether you have a work-related illness or injury. You will be notified of these disclosures by your employer or Princeton Health as required by applicable law;
  • to medical examiners, funeral directors, or coroners to enable them to carry out their lawful duties;
  • if necessary, to arrange for cadaveric, organ, eye, or tissue donation or transplantation; and
  • to avert a serious threat to the health or safety of you or any other person pursuant to applicable law.


Except as outlined above, we will not use or disclosure your PHI for any other purpose unless you have signed a form authorizing the use or disclosure. The form will describe what information will be disclosed, to whom, for what purpose, and when. You have the right to revoke a written authorization to use or disclose your PHI at any time provided that your revocation is in writing, except to the extent Princeton Health has taken action in reliance on your authorization. These situations can include:

  • uses and disclosures of psychotherapy notes (where appropriate);
  • uses and disclosures of PHI for marketing purposes or other activities where we receive remuneration in exchange for disclosing such PHI;
  • uses and disclosures of PHI specifically protected by federal and/or state law and regulations; and
  • any other uses and disclosures of PHI not described in this Notice.


HIV-related information, genetic information, substance use disorder treatment records, mental health records, and other specially protected health information may have additional confidentiality protections under applicable federal and state laws. Any disclosures of these types of records will be subject to these special protections. If your treatment involves this information, you may contact the Privacy Officer for further explanation.

Confidentiality of Mental Health Records. Information directly or indirectly identifying you, currently or formerly, as receiving mental health services may be disclosed as permitted by law and as otherwise described below:

  • with your written authorization, or, if applicable, your legal guardian or authorized representative’s written authorization;
  • in response to a court order;
  • to Princeton Health workforce members involved in your care;
  • to workforce members of another agency, so long as the disclosure is relevant to your current treatment and in compliance with HIPAA;
  • to carry out the provisions of NJSA 2A:82-41 relating to rights of a person against whom a claim is asserted;
  • to clinical records audit teams, monitoring, and site review staff designated by the New Jersey Department of Health and Senior Services, Department of Human Services, the Office of Legislative Services, the Center for Medicaid and Medicare Services, and for certain other audit activities permitted by law;
  • to a person participating in a Professional Standards Review Organization;
  • to officials within the offices of the State Medical Examiner or a County Medical Examiner making investigations and conducting autopsies, pursuant to N.J.S.A. 52:17B-78 et seq.;
  • to the NJ Department of Children and Families in connection with investigations and reports of child abuse or neglect;
  • your current medical condition may be disclosed to a relative or friend upon proper inquiry and after you have had the opportunity to object and do not express an objection;
  • in certain circumstances, to any licensed provider under contract with the Division of Mental Health Services or the Department of Human Services, or to the your primary care physician or other treating physician if its appears the information is to be used for your benefit;
  • to the estate administrator or executor of a deceased person who has received services or for whom services were sought, or, if no such person exists, to next of kin with proper written authorization.

Confidentiality of Substance Use Disorder Patient Records. The confidentiality of substance use disorder patient records maintained by Princeton Health is protected by federal regulations. Generally, Princeton Health may not acknowledge the presence of an identified patient in a Princeton Health facility or component of a Princeton Health facility which is publicly identified as a place where only substance use disorder diagnosis, treatment, or referral for treatment is provided unless the patient consents to the disclosure in writing, or the disclosure is authorized by a court order.

Any answer to a request for disclosure of patient substance abuse disorder treatment records which is not permissible under the federal regulations must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder.

There are limited situations in which the federal regulation permits the disclosure of patient substance use disorder treatment information without your authorization. These include:

  • to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient’s prior informed consent cannot be obtained;
  • for the purpose of conducting scientific research, with certain confidentiality protections as specified by regulations; and
  • in the course of a review of records on the substance use disorder program premises for an audit or evaluation, with certain confidentiality protections as specified by regulations.

Violation of the federal regulations governing confidentiality of substance use disorder information is a crime. Suspected violations may be reported to the United States Attorney for the judicial district in which the violation occurs and, if applicable, to the Substance Abuse and Mental Health Services Administration (SAMHSA) office responsible for opioid treatment program oversight.

United States Attorney’s Office
970 Broad Street, 7th Floor
Newark, NJ 07102

SAMHSA Center for Substance Abuse Treatment
5600 Fishers Lane
Rockville, MD 20857
Phone: 240-276-1600

Information related to a patient’s commission of a crime on the premises of a substance use disorder treatment program or against personnel of such a program is not protected. Reports of suspected child abuse and neglect made under state law to appropriate state or local authorities are not protected. The federal regulations do not prohibit Princeton Health from giving a patient access to their own records, including the opportunity to inspect and copy any records that a substance use disorder program maintains about the patient. The federal regulations governing substance use disorder treatment information are set forth at 42 C.F.R. § 2.1 et seq.


This section describes your rights pertaining to your PHI.

Restrictions on Use and Disclosure of Your PHI. You have the right to request a restriction on certain uses and disclosures of your PHI for treatment, payment, or health care operations. Princeton Health is not required to agree to your restriction request, unless otherwise described in this Notice, but will attempt to accommodate reasonable requests when appropriate. We retain the right to terminate an agreed-to restriction if we believe such termination is appropriate. In the event we have terminated an agreed upon restriction, we will notify you of such termination.

Restrictions on Disclosures to Health Plans. You have the right to request a restriction on certain disclosures of your PHI to your health plan. We are required to honor such requests only when you or someone on your behalf, other than your health plan, pays for the health care items(s) or services(s) in full. Such requests must be made in writing and signed by you and, when applicable, your personal representative.

Access to Your PHI. Generally, you have the right to access, inspect, and/or receive paper and/or electronic copies (if we maintain your health information electronically) of certain PHI that we maintain about you. Requests for access must be made in writing and signed by you or, when applicable, your personal representative. You may also request that Princeton Health transmit a copy of your health information to another company or person you have designated. We will charge you for a copy of your medical records in accordance with a schedule of fees under federal and state law. You may also access much of your PHI via Princeton Health’s patient portal.

Confidential Communications. You have the right to request communications regarding your PHI from Princeton Health by alternative means or at alternative locations and we will accommodate any reasonable requests by you. Requests must be made in writing and signed by you or, when applicable, your personal representative.

Amendments to Your PHI. You have the right to request an amendment of your PHI that you feel is inaccurate or incomplete. Requests for amendments must be made in writing and signed by you or, when applicable, your personal representative and must state the reason(s) for the request. We may say “no” to your request, but we will tell you why in writing within 60 days.

Accounting of Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures made by us of your PHI, except for disclosures made for purposes of treatment, payment, and healthcare operations or for certain other limited exceptions. This accounting will include only those disclosures made in the six years prior to the date on which the accounting is requested. Requests must be made in writing and signed by you or, when applicable, your personal representative. The first accounting in any 12-month period is free; you will be charged a reasonable, cost-based fee for each subsequent accounting you request within a 12-month period.

Breach Notification. We are required to notify you in writing of any breach of your unsecured PHI without unreasonable delay, but in any event, no later than 60 days after we discover the breach.

Paper Copy of Notice. You have the right to obtain a paper copy of this Notice. You can also access this Notice on our website at


Princeton Health takes safeguarding our patients’ information very seriously. If you believe your privacy rights have been violated, you may file a complaint by contacting the Princeton Health Privacy Officer (contact information located at end of this Notice) and/or the Department of Health and Human Services. Additionally, Princeton Health has established a special hotline to take complaints regarding patient privacy. You may contact the hotline by calling 1-800-779-4035. You will not be retaliated against for filing a complaint.


If you have any questions or need further assistance regarding this Notice, including with exercising your rights described in this Notice, please contact the Princeton Health Privacy Officer at:

Privacy Officer
Penn Medicine Princeton Health
One Plainsboro Road
Plainsboro, New Jersey 08536
Phone: 1.800.442.5188

A solicitud, esta información se encuentra disponible en español.

This Notice is effective as of January 1, 2018.