The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards to protect individuals’ medical records and other personal health information. It gives patients some control over certain parts of their health information and requires organizations such as TMC HealthCare and its affiliates Tucson Medical Center, TMCOne, TMC Medical Network, and Southern Arizona Medical Services (collectively referred to as TMCH) to implement certain safeguards and practices to keep each patient’s protected health information (PHI) safe. TMCH is required by law to maintain the privacy of PHI, which includes any information that is created or received by TMCH that relates to the health or condition of an individual, the provision of health care to an individual, or payment for the provision of health care to an individual, and either identifies the individual or is reasonably believed to provide information that can be used to identify the individual. As a patient of TMCH, you have several rights under HIPAA.

TMC HealthCare’s Notice of Privacy Practices describes how TMCH uses and discloses your PHI. This notice also describes the rights you have concerning your PHI. This Notice applies to employees, physicians, volunteers, trainees, and other persons whose conduct is under the direct control of TMCH, whether or not the person is paid by TMCH. Please review this notice carefully. If you have any questions about TMC HealthCare’s Notice of Privacy Practices or your privacy rights under HIPAA, please feel welcome to contact the TMCH Corporate Compliance Department at 520-324-1962 or speak directly with one of your healthcare team members.


Patient Census: While you are hospitalized at Tucson Medical Center, TMCH may include your name, location in the facility, general description of your condition, and religious affiliation, if any, in a patient directory or census database, provided you have not opted out. TMCH may disclose this information to anyone who asks for you by name, although religious affiliation may only be disclosed to clergy members. If you choose not to be included in the patient directory or census database, your information will not be disclosed to any callers or visitors asking about you.

Family Members and Others Involved in Your Care: TMCH may disclose your PHI that is directly relevant to a family member or friend who is involved in your medical care or payment for your medical care. TMCH may also disclose your PHI to disaster relief organizations during times of disaster to aid in location of you, your friends, or your family members. If you do not want TMCH to disclose your PHI to family members, friends, or others who are involved in your care, please inform one of your healthcare team members.

Treatment: TMCH may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services with healthcare providers, including doctors, nurses, therapists, clinical students, and other professionals involved in your care. TMCH may disclose PHI regarding your care to your primary care provider to assist with your treatment and follow-up care. TMCH may also use and disclose your PHI to contact you regarding upcoming appointments, to inform you about possible treatment options or alternatives, or to tell you about health-related services available to you.

Payment: TMCH may use and disclose your PHI to obtain payment or be reimbursed for provided services, including disclosures to health plans and health insurance companies.

Operations: TMCH may use and disclose your PHI to improve the quality of care provided to its patients and to conduct its business management and general administrative activities . Such activities may include internal and external audits, quality assessments, and medical reviews.

Research: TMCH may disclose your PHI for research purposes only in accordance with your written authorization except when otherwise authorized by law.

Required by Law: TMCH shall disclose your PHI as required by a federal or state statute, regulation, or court opinion, including mandatory reporting obligations. Such reporting includes information about suspected abuse, abandonment, neglect, exploitation, domestic violence, and workers’ compensation program services.

TMCH shall disclose PHI to the United States Department of Health and Human Services (HHS), including the Centers for Medicare and Medicaid Services (CMS) and the Office for Civil Rights (OCR), when HHS requests access to PHI for the purposes of investigating TMCH’s compliance with the HIPAA Privacy Rule or when self-reporting is required by law.

TMCH shall disclose PHI to the Arizona Department of Health Services, the Arizona Medical Board, and the Arizona Board of Nursing when such agencies request PHI for the purposes of investigating TMCH’s compliance with state and federal laws or when self-reporting is required by law.

Public Health: TMCH may disclose your PHI to a public health authority for the purpose of preventing or controlling disease, injury, or disability. Such reporting may include births, deaths, suspected communicable diseases, suspected overdose events, medication and medical product adverse events, and product recall information.

Public Safety: When TMCH has a good faith belief that disclosing your PHI will prevent or lessen a serious and imminent threat to the health or safety of a person or the public, TMCH may disclose your PHI to a person or entity reasonably equipped to lessen or prevent such threat.

Law Enforcement: TMCH may disclose a limited amount of PHI to law enforcement officials for specific purposes related to identifying or locating a suspect, fugitive, material witness, or missing person.

Coroners, Medical Examiners and Funeral Directors: TMCH may disclose PHI concerning deceased patients to coroners, medical examiners, and funeral directors for the purposes of identifying a deceased patient, determining a cause of death, or for other purposes related to coroner, medical examiner, or funeral director duties.

Organ and Tissue Donation: TMCH may use and disclose PHI as necessary for organ, eye, or tissue donation, procurement, processing, distributing, or using a human body or body parts for use in medical education, therapy, or transplantation.

Military, Veterans, National Security and Other Government Purposes: TMCH may disclose the PHI of a member of the United States Armed Forces to a United States Armed Forces official upon written request. TMCH may disclose PHI to a federal official representing the interests of a federal agency for the purposes of conducting intelligence, counter-intelligence, and other national security activities upon written request. 

Judicial Proceedings: TMCH may disclose PHI necessary to comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena, provided the court has appropriate jurisdiction over TMCH. As allowed by law, TMCH will make reasonable efforts to notify you about the request so you have a chance to object to the disclosure.

Fundraising: TMCH may use limited PHI to conduct fundraising activities provided you have not opted out of receiving fundraising solicitations and communications.

Information with Additional Protection: Certain types of medical information have additional protection under state or federal law. For instance, medical information about communicable disease and HIV/AIDS, drug and alcohol abuse treatment, genetic testing, and court-ordered mental evaluation is treated differently than other types of medical information. For those types of information, TMCH is required to get your permission before disclosing that information to others in most circumstances.

Other Uses and Disclosures: TMCH will obtain your authorization to use or disclose your PHI in the following circumstances: (1) disclosures for certain types of mental health records or substance abuse records, (2) certain types of disclosures containing certain communicable disease information, including HIV or AIDS-related information, (3) disclosures containing information related to genetic testing, or (4) disclosures for marketing purposes.

If you give your authorization to TMCH for a certain type of disclosure, you may end that authorization at any time unless TMCH has already relied on your authorization to use or disclose the information. If you would like to revoke your authorization, please submit the request in writing to the TMC Health Information Management Department at Tucson Medical Center, 5301 E. Grant Rd, Tucson, AZ 85712.

Privacy Breach Notification: In accordance with Breach Notification for Unsecured Protected Health Information requirements, as outlined in the Health Information Technology for Economic and Clinical Health (HITECH) Act, TMCH is required by law to provide notification to affected individuals or their representatives and to the OCR for HHS following the discovery of a breach of unsecured PHI.


Right to Receive a Notice of Privacy Practices: You may download a copy of the current TMC HealthCare Notice of Privacy Practices from TMCH’s website at or you may obtain a paper copy of the current TMC HealthCare Notice of Privacy Practices at any TMCH facility.

Right to Access PHI: You have the right to access the PHI about you that is maintained by TMCH. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as the right to direct TMCH to transmit a copy to a designated person or entity of your choice. You may be charged a reasonable, cost-based fee for copies of PHI.

Right to Request Amendment of PHI: You have the right to request an amendment or correction of your PHI maintained by TMCH if you feel that the information is incomplete or inaccurate. You also have the right to have this request and any decision related to this request included in your record, if you so choose. TMCH must review your request and is required to respond to your request in writing. If you disagree with TMCH’s decision, you have the right to appeal the decision.

Right to Request Restriction of Use and Disclosure of PHI: You have the right to request that TMCH restrict the use and disclosure of your PHI maintained by TMCH. Such a request must be made in writing. While TMCH will make efforts to accommodate such requests, granting such restrictions is not always possible. Upon request, TMCH will restrict the information disclosed to your health plan if you have already fully paid for the service.

Right to Accounting of Disclosures: You have the right to receive an accounting of certain disclosures of PHI by TMCH and its business associates. Such a request must be made in writing. This accounting of disclosures will not include disclosures made for treatment, payment or other healthcare operation purposes. TMCH will provide one accounting of disclosures to you each year at no charge but may charge for additional copies.

Right to Receive Confidential Communications by Alternative Means: You have the right to designate a specific means by which you will receive confidential communications from TMCH. This may include specifying a single address or phone number where TMCH may send information about your healthcare, payment for your healthcare, and related service information.


TMCH may change practices concerning the use or disclosure of PHI or implementation of patient rights. TMCH reserves the right to change this Notice and to make the revisions effective for all PHI maintained. If TMCH changes this Notice, the revised TMC HealthCare Notice of Privacy Practices will be posted on TMCH’s website,, and at all TMCH facilities.

Any revisions of the TMC HealthCare Notice of Privacy Practices by patients or their representatives, including but not limited to strikeouts, insertions, and deletions, shall not be permitted, and TMCH may refuse to provide treatment under such circumstances. 


TMCH is required by law to provide this Notice to you and to follow terms of the Notice that is currently in effect.

If you have concerns about this Notice or need clarification regarding this Notice or any other aspect of your TMCH care, please notify your healthcare providers or other healthcare team members. If you are not comfortable discussing your concerns with your healthcare providers or other healthcare team members, please request to speak with a Manager or Director. You may also contact the TMCH Director of Compliance, Compliance & Privacy Officer at (520)324-1962.

TMCH honors a patient’s right to file a complaint or grievance, as well as the patient’s right to a prompt resolution of complaints and grievances. The TMC Patient Relations Department is available to assist you with concerns related to your TMCH care. You have the right to report a complaint or grievance to the TMC Patient Relations Department; the TMC Patient Relations Department can be reached at (520)324-2836 or through the hospital operator at Tucson Medical Center.

TMCH acknowledges a patient’s right to file a privacy-related complaint with the Arizona Department of Health Services Bureau Chief, 150 N. 18th Ave., #450, Phoenix, Arizona, 85007, phone: (602)364-3030, or with the federal government via the Office for Civil Rights, Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C., 20201, in addition to, or instead of, contacting the TMC Patient Relations Department.

TMCH shall not retaliate against you or your representatives for filing a complaint or grievance with TMCH or any other agency. Additionally, your care will not be affected by the filing of a complaint or grievance with TMCH or any other agency.

Effective date: October 1, 2018