Notice | Medical Information Pledge | Medical Information Disclosure | Your Rights | Your Responsibilities | Changes to Notice | Contact

Notice of Health Information Practices

Effective Date: 10/16/2026
This notice applies to the UAB Employee Assistance Program. It describes how medical information about you may be used and disclosed by the UAB Employee Assistance Program and how you can get access to this information. Please review carefully. 

Who Will Follow This Notice

This notice gives you information required by law about the privacy practices of the UAB Employee Assistance Program, a self-insured group health plan (“the EAP ”).

The EAP provides health benefits to you and receives and maintains your health information in the course of providing these benefits to you. The EAP may hire business associates to help it provide these benefits to you. These business associates will also receive and maintain your health information in the course of assisting the EAP and are also bound to protect your health information as described below. EAP and its business associates are referred to herein as “we” or “our.”

Our Pledge Regarding Medical Information

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive at EAP. We need this record to provide you with quality care and to comply with certain legal and regulatory requirements. This Notice applies to all of the records of your care generated by the EAP. This Notice will tell you about the ways in which we may use and disclose medical information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of medical information.

We are required by law to:

• Make sure that medical information that identifies you is kept private
• Give you this notice of our legal duties and privacy practices with respect to medical information about you
• Notify you in the case of a breach of your unsecured identifiable medical information
• Follow the terms of the Notice that is currently in effect until it is replaced

How We May Use and Disclose Medical Information About You

The following categories describe different ways that we may, but are not required to, use and disclose medical information. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose your information will fall within one of the categories. All information disclosed in counseling sessions is strictly confidential and will be released ONLY with your prior written consent and/or authorization, except as otherwise required by law.

• For Treatment and Treatment Alternatives: With your written consent, w e may use or disclose medical information about you to help your doctors and other health care providers coordinate or arrange your medical treatment or care. For example, your health care provider may request information regarding whether a service will be covered. In addition, we may help your health care provider coordinate or arrange medical services that you need or help your health care provider find a safer prescription drug alternative. We may use and disclose your medical information to tell you about health-related benefits or services that may be of interest to you.
• For Payment: We do not use and disclose medical information about you for payment purposes. Your employer pays a flat rate for your participation in the Plan.
• For Routine Health Care Operations: We may use and disclose medical information about you for our routine EAP operations; however there is no disclosure to any third party, except as provided herein. These uses and disclosures are necessary for the EAP to operate and make sure that all its clients receive quality care. We may also combine medical information about many EAP clients to decide what additional services or benefits we should offer and what services or benefits are not needed. Examples of health care operations include, but are not limited to:
  • Conducting quality assessment and improvement activities
  • Engaging in care coordination or case management
  • Detecting fraud, waste or abuse
  • Providing customer service
  • Business management and general administrative activities related to our organization and the services we provide

Note: We will not use or disclose genetic information about you for underwriting purposes.

• Individuals Involved in Your Care or Payment for Your Care: With your written consent, we may release medical information about you to you, the individual receiving care, a friend or family member who is involved in your medical care or payment for your medical care, and/or to your personal representative(s) appointed by you or designated by applicable law. In certain circumstances, state and federal law may require us to secure permission from a minor, a person under the age of 19, prior to making certain disclosures of medical information to a parent. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your status and location.
• Business Associates: There are some benefits and services the EAP provides through contracts with business associates. For example, we may contract with a third party to host the software network that houses your medical information. When these services are contracted, we may disclose your health information to these business associates so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your information.
• Your Employer: With your written permission, we will disclose to your employer the fact that you attend the EAP. No other information about you will be disclosed.
• As Required By Law: We will disclose medical information about you, without your consent or authorization, when required to do so by federal, state or local law. Examples include: suspected or known child, elder or disabled person abuse or neglect, mandatory reporting of health care providers experiencing psychiatric or substance abuse disorders that may present a danger to self or others to their licensing boards, threat of danger to another individual, imminent threat of suicide by the client, legal subpoena to present records to comply with a court order, mandatory state and federal requirements, and in any emergency medical circumstance that requires immediate medical attention.
• More Stringent Laws: Some of your Protected Information may be subject to other laws and regulations and afforded greater protection than what is outlined in this Notice. For instance, HIV/AIDS, and patient-psychotherapist information are given more protection under Alabama law and substance abuse information is given more protection under federal law. In the event your medical information is afforded greater protection under federal or Alabama law, we will comply with the more stringent law.
• Appointment Reminders and Health-Related Benefits and Services: We may use and disclose health information to contact you about appointments, treatment options, and other health-related benefits or services available from EAP. We may contact you by mail, telephone, text, or email or through the patient portal. For example, we may leave a voice message or send a text reminder to you about upcoming appointments at the telephone number you provide, send a secure message through the patient portal regarding a prescription sent to your pharmacy, or mail you information about services or programs that may be of interest to you. We will not send you communications that constitute marketing under the HIPAA Privacy Rule without your written authorization, except as permitted by law (for example, face-to-face communications or promotional gifts of nominal value).
• Research: We may use and disclose your health information for medical research. All research involving patient information must go through a special review process required by law to protect patient privacy, such as review and approval by an Institutional Review Board or Privacy Board. In most cases, patient authorization is required before health information is used for research. However, in certain circumstances your authorization is not required – for example, when the research involves reviewing patient records to compare the outcomes of different treatments for the same condition, without contacting the patients directly. Some research may also use health information that has been de-identified or provided as a limited data set that does not directly identify you.
• Public Health Activities: We may disclose health information about you to public health authorities authorized by law to prevent or control disease, injury, or disability. For example, we are required to report the existence of a communicable disease, such as tuberculosis, to the Alabama Department of Public Health to protect the health and well-being of the general public. We may disclose health information about you to individuals exposed to a communicable disease or otherwise at risk for spreading the disease. We may disclose health information to an employer if the employer arranged for the health care services provided to determine whether you suffered, or to treat, a work-related injury.
• Victims of Abuse, Neglect, or Domestic Violence: We may disclose health information about you to public health or social service agencies or other government authorities that are authorized by law to receive reports of abuse, neglect, or domestic violence. For example, we are required to report suspected cases of child abuse or neglect, and in some circumstances elder and domestic abuse or neglect to the appropriate State of Alabama authorities. We will make these disclosures only to the extent required or permitted by law.
• Lawsuits and Disputes: If you are involved in a lawsuit or other legal dispute, we may disclose your health information in response to a court or administrative order. We may also disclose your health information in response to a subpoena, discovery request, or other lawful process from someone involved in the dispute, but only if efforts have been made to notify you about the request or to obtain an order protecting the information requested. We may disclose health information for judicial or administrative proceedings, as permitted or required by law.
• Law Enforcement: We may release health information for law enforcement purposes as permitted or required by law. These purposes include responding to a court order, warrant, subpoena, summons, or other lawful process; identifying or locating a suspect, fugitive, material witness, or missing person; reporting information about a victim of crime in limited circumstances; reporting a death that may have resulted from criminal conduct; or reporting suspected criminal conduct that occurred on our premises.
• To Avert a Serious Threat to Health or Safety: We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
• National Security and Intelligence Activities: We may release your health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
• Protective Services for the President and Others: We may disclose your health information to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state or conduct special investigations.
• Workers' Compensation: We may disclose your health information as authorized by law for workers' compensation or similar programs that provide benefits for work-related injuries or illnesses. These disclosures will be limited to health information related to such work-related injuries or illnesses as required by applicable law. Such disclosures may include providing health information to your employer, if your employer arranged for the health care services provided to you and the information is needed to evaluate or treat a work-related illness or injury, or to comply with workplace medical surveillance laws.
• Sale of Protected Health Information: We will not sell your protected health information without your written authorization. Any authorization you provide may be revoked at any time in writing, except to the extent we have already relied on that authorization.
• Psychotherapy Notes: Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. Psychotherapy notes are NOT a part of your medical record and access to these may be denied anyone, including you, without a court order.
• Substance Use Disorder (SUD) Records: If we maintain or receive records related to substance use disorder treatment (“SUD records”) that are subject to 42 CFR Part 2 (“Part 2”), those records are protected by special federal confidentiality rules in addition to HIPAA which are described below. Where the requirements of Part 2 are more restrictive than HIPAA, we will follow the more restrictive Part 2 requirements. All other provisions of this Notice apply to SUD records to the extent they do not conflict with Part 2. See Your Rights and Protections Under Part 2*
• Other Uses and Disclosures: Any uses and disclosures not described in this Notice will be made only with your written consent and/or authorization. For example, we will obtain your written authorization to use or disclose your medical information to an attorney who represents you.

Special Note: Once your health information is disclosed for permitted purposes or according to your request, it may be subject to redisclosure and no longer protected by federal regulations.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you:

• Right to Inspect and Copy: You have the right to inspect and copy medical information that may be used to make decisions about your care. Psychotherapy notes are not included. To inspect and copy medical information that may be used to make decisions about you, you must submit your request in writing to the EAP Entity Privacy Coordinator (see contact information later in this Notice). If you request a copy (paper or electronic) of the information, you will be charged a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
• Right to Amend: If you feel that medical information we have about you is incorrect or incomplete, you may ask us, in writing, to amend the information kept by us. To request an amendment, your request must be made in writing on the required form and submitted to the EAP Entity Privacy Coordinator (see contact information later in this Notice). In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
  • Was not created by us, unless the person or entity that created the information is no longer available to make the amendment
  • Is not part of the medical information we keep
  • Is not part of the information which you would be permitted to inspect and copy
  • Is accurate and complete
• Right to an Accounting of Disclosures: You have the right to request an "accounting of disclosures." This is a list of certain disclosures we made of medical information about you for reasons other than treatment, payment or health care operations. To request this list or accounting of disclosures, you must submit your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information later in this Notice). Your request must state a time period which may not be longer than six years. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
• Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had. We are not required to agree to your request. If we do agree, we will comply with your request, unless the information is needed to provide you emergency treatment. To request restrictions, you must make your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information below). In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit the use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information below). We will not ask you the reason for your request, but your request must clearly state that the disclosure of all or part of the information could endanger you. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
• Right to Revoke Authorization: You have the right to revoke your authorization to use or disclose your medical information except to the extent that action has already been taken in reliance on your authorization. Revocations must be made in writing to the EAP Entity Privacy Coordinator (see contact information below).
• Right to Choose Someone to Act for You: If you have given someone power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
• Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.
  • To download and print a copy of this notice, click here.
  • To obtain a paper copy of this notice, call the UAB Employee Assistance & Counseling Center at 205-934-2281.

Your Responsibilities for Protecting Medical Information

As a member of the EAP, you are expected to help us safeguard your medical information. For example, you are responsible for letting us know if you have a change in your address or phone number. If you suspect someone has tried to access your records or those of another member without approval, you are responsible for letting us know as soon as possible so we can work with you to determine if additional precautions are needed.

Changes to this Notice

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will also post the new Notice on the EAP’s website. The Notice will contain the effective date on the first page.

For More Information or to Report a Problem

If you have questions and would like additional information, you may contact the EAP Entity Privacy Coordinator (see contact information below). If you believe your privacy rights have been violated, you may file a complaint with UAB or with the Secretary of the Department of Health and Human Services. To file a complaint with UAB, contact the EAP Entity Privacy Coordinator (see contact information below). All complaints must be submitted in writing. You will not be penalized for filing a complaint.

EAP Entity Privacy Coordinator
Tami Mayes Long, 205-934-2281

For requests to inspect, copy, amend or restrict your medical information, or for requests for an accounting of disclosures of your medical information, contact the EAP Entity Privacy Coordinator.

UAB Nondiscrimination & Language Accessibility Notice

EAP complies with applicable federal civil rights laws and does not discriminate based on race, color, ethnic or national origin, genetic information, age, disability, religion, veteran’s status, or sex (consistent with the scope of sex discrimination described at 45 CFR 92.10(1)(i)). EAP does not exclude people or treat them less favorably because of race, color, national origin, age, disability, or sex.

• EAP provides free aids and services to people with disabilities to communicate effectively with us, such as:
  • Qualified sign language interpreters
  • Written information in other formats (large print, audio, accessible electronic formats, other formats)
• EAP provides free language services to people whose primary language is not English, such as:
  • Qualified interpreters
  • Information written in other languages

If you need reasonable modifications, appropriate auxiliary aids and services, or language assistant services, contact UAB Guest Services at 205-934-2273.

If you believe that EAP has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, or sex, you can file a grievance with EAP Civil Rights/ADA Coordinator in person or by mail, or email using the following contact information:

EAP Civil Rights/ADA Coordinator
UAB AWARE Program
ADA Specialist Dina Jones
hraware@uab.edu

You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, through the Office for Civil Rights Complaint Portal or by mail or phone to U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Room 509F, HHH Building, Washington, DC 20201, 1-800-368-1019, 1-800-537-7697 (TDD). Complaint forms are available on the U.S. Department of Health and Human Services website.