Notice of Privacy Practices

Emplify Health notice of privacy practices

Your information. Your rights. Our responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Information

In this HIPAA Notice of Privacy Practices (“HIPAA Notice”), when we use “your information” or “your protected health information,” we are referring to information that identifies you and relates to your health or condition, your healthcare services or payment for those services. It includes health information, like diagnosis and treatment plans. It also includes demographic information like your name, address, phone number and date of birth.

Your Rights

When it comes to your protected health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

We will provide a copy or a summary of your protected health information, usually within 30 days of your request.

Ask us to correct your medical record

We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
We will say “yes” to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain protected health information for treatment, payment or our operations. We are not required to agree to your request.
If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared your information

You can ask for a list (accounting) of the times we’ve shared your protected health information with outside organizations or individuals during the six years prior to the date you ask. This list must include the date we shared the information, a description of the information we shared, who we shared it with, and why.
We will include all the times we’ve shared your information, except for when it was about treatment, payment and healthcare operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this HIPAA Notice

You can ask for a paper copy of this HIPAA Notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your protected health information.
We will verify the person has this authority and can act for you before we rely on any decisions made by this person.

File a complaint if you feel your rights are violated

You can complain if you feel we have violated your rights by contacting us using the information on page 2.
You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling (877) 696-6775.
Complaints will in no way affect how we care for you.
We will not retaliate against you for filing a complaint.

Your Choices

For certain protected health information, you can tell us your choices about what we share. If you have a clear preference for how we share your protected health information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. In these cases, you have both the right and choice to tell us to:

Share protected health information with your family, close friends, or others involved in your care
Share protected health information in a disaster relief situation
Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information, to the extent permitted by law.

In the case of fundraising

We may use your information to contact you for our own fundraising efforts which support important activities through the Gundersen Medical Foundation and The Bellin Health Foundation. You can tell us not to contact you again. To opt-out of receiving fundraising communications from us, contact the Gundersen Medical Foundation by calling (800) 362-9567, ext. 56600 or by email at gmf@gundersenhealth.org and contact The Bellin Health Foundation by calling (920) 433-3731 or by email at thebellinhealthfoundation@emplifyhealth.org.

In these cases, we never share your protected health information unless you give us written permission:

Most marketing purposes
Sale of your information

Our Uses and Disclosures

How do we typically use or share your protected health information? We typically use or share your health information in the following ways without your written authorization:

Treat you (treatment)

We may use your protected health information to provide you with medical treatment or services and, to the extent permitted by applicable law, share it with other professionals who are treating you. Example: A provider treating you for an injury asks another provider about your overall health condition.

Payment for services you receive (payment)

We can use and share your protected health information to bill and obtain payment from health plans or other entities for care that you receive. This may include certain activities that your health insurance plan may undertake before it approves or pays for the health services, such as making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity; and undertaking utilization review activities.

Run our organization (healthcare operations)

We can use and share your protected health information to run our organization, improve your care, contact you when necessary and to train our staff and students.

Example: We use protected health information about you for certain administrative, financial, legal, quality assessment and improvement, accreditation, credentialing and training activities.

Business associates

We may share your protected health information with third parties we contract with to provide certain products or services on our behalf. We usually call them “business associates.” Business associates are required by law to safeguard your information in the same way we do.

How else can we use or share your health information?

We are allowed or required to share your protected health information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your protected health information for these purposes.

Help with public health and safety issues

We can share protected health information about you for certain situations such as:

Preventing or controlling disease and managing epidemics
Helping with product recalls
Reporting adverse reactions to medications
Reporting of events that we are required or permitted to report
Preventing or reducing a serious threat to anyone’s health or safety

Do research

Under certain circumstances, we can use or share your protected health information for clinical or medical research.

Comply with the law

We will share protected health information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Respond to organ and tissue donation requests

We can share protected health information about you with organ procurement organizations.

Work with a medical examiner or funeral director

We can share protected health information with a coroner, medical examiner or funeral director when an individual dies.

Address workers’ compensation, law enforcement and other government requests

We can use or share protected health information about you:

For workers’ compensation claims
For specific instances, we may share with law enforcement officials
With health oversight agencies for activities authorized by law
For special government functions such as military, national security, and presidential protective services

Health information availability after death

We may use or disclose protected health information without your authorization 50 years after the date of your death.

Respond to lawsuits and legal actions

We can share protected health information about you in response to a court or administrative order, discovery request or in response to a subpoena.

When Emplify Health is required to obtain authorization to use or disclose your health information

Except for the situations listed above, any other use or disclosure of your health information requires us to obtain your specific written authorization.

Special situations. Some types of health information are specially protected under other state or federal laws and those laws may impose more restrictive requirements on disclosure of this information, even for purposes described above. When those more restrictive laws apply, we may need your specific written authorization to release these types of health information, even in some cases, for the purposes of treatment, payment and healthcare operations. The types of health information that are subject to additional restrictions include HIV test results, and information related to treatment for mental illness, developmental disability or alcohol or drug abuse.

Authorization required for certain uses or disclosures. We must obtain your written authorization for most uses or disclosures of the following: (1) psychotherapy notes; (2) uses or disclosures of your health information for marketing purposes; and (3) disclosures of your health information in exchange for direct or indirect remuneration to Emplify Heath.

Federal and state laws require certain substance use disorder records (“Part 2 Records”) to be kept confidential. Written consent is usually needed to share Part 2 Records, with some exceptions (medical emergencies, research, audits, public health, court orders, etc.). Part 2 Records may be shared with your consent for treatment, payment, healthcare operations and program coordination. Please refer to our Part 2 Programs Notice for more information.

Please note that if your information is disclosed under this HIPAA Notice, it may be subject to redisclosure by recipients.

Withdrawing authorization. If you do sign an authorization form, you may withdraw your authorization at any time, as long as your withdrawal is in writing. If you wish to withdraw your authorization, please submit your written withdrawal to Release of Information. Please understand that we cannot take back any disclosures that were made before you withdrew your authorization.

Our Responsibilities

We are required by law to:

Maintain the privacy and security of your protected health information.
Promptly notify you if a breach occurs that may have compromised the privacy or security of your information.
Follow the duties and privacy practices described in this HIPAA Notice and give you a copy of it. Not use or share your information other than as described in this HIPAA Notice unless you tell us we can. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

Changes to the terms of this HIPAA Notice

We can change the terms of this HIPAA Notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office and on our website.

Contact Information
Emplify Health’s Privacy Officer:
Email: PrivacyOffice@emplifyhealth.org
Phone: (608) 775-7439

Other instructions for HIPAA Notice

Effective Date of this Notice: February 23, 2026

Emplify Health participates in the About Health Organized Health Care Arrangement (OHCA), an organized system of health care in which more than one covered entity participates in the joint arrangement. The purpose of the participation includes conducting quality assessment and improvement activities, conducting utilization review, and performing other clinically integrated network activities. Your health information may be shared with other About Health OHCA participants for these purposes.
We electronically exchange healthcare information to facilitate access to health and/or mental health information that may be relevant to your care. For example, if you are admitted to a hospital on an emergency basis and cannot provide important information about your health condition, health information exchange will allow us to make your medical information available to those who need it to treat you at the hospital. Access to your health and/or mental health information is readily available, when needed, which means better care for you. You have the right to opt-out of the health information exchange by contacting our Privacy Office.
We participate in an arrangement to help facilitate access to health information that may be needed to provide you with care. As part of this arrangement, we have agreed to store health information of our patients in a jointly shared electronic medical record with other health care provider participants in this arrangement. When it is needed, this shared electronic medical record will provide participants with access to health information essential to providing you with medical care. The need for this could occur, for example, if you were admitted to a hospital on an emergency basis and you were unconscious and could not provide important information about your health condition. Each participant in the shared electronic medical record has implemented policies and procedures governing appropriate access to health information in the shared electronic medical record in accordance with state and federal law. Any access to your health information that we store in the shared electronic medical record by a non-Emplify Health participant will only be made for the purposes described in this notice.
By accessing your Emplify MyChart account, you have the ability to view online, download and share your health information.

Applicability of this HIPAA Notice

This HIPAA Notice applies to Emplify Health in our capacity as a covered entity health care provider subject to HIPAA and to the entities in our affiliated covered entity (“Emplify Health Affiliated Covered Entity” or the “Emplify Health ACE”). The following is a partial list of the entities in our Emplify Health Affiliated Covered Entity. For a complete list of the entities in our Emplify Health Affiliated Covered Entity, please visit our website.

Bellin Gundersen Health System, Inc.
Bellin Health Systems, Inc.
Bellin Memorial Hospital, Inc.
Bel-Regional Home Medical, Inc. (d/b/a Bellin Health Home Care Equipment)
Oconto Hospital & Medical Center, Inc. (d/b/a Bellin Health Oconto Hospital)
Gundersen Lutheran Health System, Inc. d/b/a Gundersen Health System
Harmony Community Healthcare, Inc. d/b/a Gundersen Harmony Care Center
Memorial Hospital of Boscobel d/b/a Gundersen Boscobel Area Hospital & Clinics
Moundview Memorial Hospital and Clinics, Inc. d/b/a Gundersen Moundview Hospital & Clinics
Palmer Lutheran Health Center, Inc. d/b/a Gundersen Palmer Lutheran Hospital & Clinics
Saint Elizabeth’s Hospital of Wabasha, Inc. d/b/a Gundersen St. Elizabeth’s Hospital & Clinics
St. Joseph’s Health Services, Inc. d/b/a Gundersen St. Joseph’s Hospital & Clinics
Tri-County Memorial Hospital, Inc. d/b/a Gundersen Tri-County Hospital & Clinics
Tri-State Ambulance, Inc. d/b/a Gundersen Tri-State Ambulance
Tri-State Regional Ambulance, Inc.
Tweeten Lutheran Health Care Center, Inc. d/b/a Gundersen Tweeten Care Center

This HIPAA notice also covers the privacy practices of all other providers approved to practice at any Emplify Health facility listed above. These providers include area physicians, podiatrists, dentists, nurse practitioners, physician assistants and other health professionals. References to “we”, “us” or “our” in this HIPAA notice mean the individuals and entities described above.

Who is not covered by this notice

This notice does not apply to care you receive from other providers in their personal offices or at other locations than the sites described above. Your providers may have their own policies and procedures that apply to your health information that they record or maintain outside of Emplify Health.
You should review your provider’s notice for information on how they will handle your health information outside of Emplify Health sites.

Notice of Privacy Practices of Substance Use Disorder Treatment Programs

Effective Date of this Part 2 Programs Notice: February 16, 2026

Part 2 Programs

In addition to the privacy protections afforded to all medical records under HIPAA, there is another federal law that provides additional confidentiality protections for substance use disorder records. That law can be found at 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (“Part 2”).

Certain Emplify Health facilities and/or departments operate substance use disorder programs under Part 2 (“Emplify Part 2 Programs”). This notice (“Part 2 Programs Notice”) is intended to provide patients of Emplify Part 2 Programs with a summary of the laws and regulations governing substance use disorder treatment records protected under Part 2 (“Part 2 Records”).

To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your Part 2 Records, we will comply with the more stringent law.

This Part 2 Programs notice describes:

How Part 2 Records may be used and disclosed
Your rights with respect to your Part 2 Records
How to file a complaint concerning a violation of the privacy or security of your Part 2 Records, or of your rights concerning your Part 2 Records

You have the right to obtain a paper or electronic copy of this Part 2 Programs Notice upon request and to discuss it with our Privacy Officer at the contact information listed below, if you have any questions.

How we may use and share your Part 2 records

We will obtain your written consent to use and disclose your Part 2 Records unless we are permitted to use and disclose such records without your written consent by Part 2. You may revoke your written consent in writing, except to the extent that our Part 2 Program or other lawful holder of the information has already acted in reliance on your consent, and subject to limitations described below for disclosures to the criminal justice system. You may revoke the consent by contacting the Privacy Office.

The following are examples of circumstances where Part 2 allows use and disclosure of your Part 2 Records with your written consent.

Designated person or entities. We may use and disclose your Part 2 Records in accordance with consent to any person or category of persons identified or generally designated in the consent. For example, if you provide written consent naming your spouse or health care provider, we will share your information with them as provided in your consent.
Consent for treatment, payment or healthcare operations. We may use and disclose your Part 2 Records with your consent for treatment, payment or health care operations. The written consent may be a single consent for all future uses and disclosures for treatment, payment and healthcare operations purposes, until such time as the consent is revoked by you. Organizations who receive your information for these purposes are required by law or contract to protect your information as required by Federal law protecting Part 2 Records or by HIPAA. Recipients who are required to protect your information as required by HIPAA may share your information only as allowed by HIPAA except that they may not re-disclosure information for civil, criminal, administrative and legislative proceedings against you.
Central registry or withdrawal management program. We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For example, if you consent to participating in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.
Criminal justice system. We may disclose information from your Part 2 Records to those persons within the criminal justice system who have made your participation in a Part 2 Program a condition of the disposition of any criminal proceeding against you. The written consent must state that it can be revoked upon the passage of a specific amount of time or occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which the consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of a legal agreement or sentencing conditions.
PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by state law. We will first obtain your consent to disclose Part 2 Records to a prescription drug monitoring program prior to reporting such information.

The following is a summary of the limited circumstances under which we may acknowledge your presence or disclose your Part 2 Records, or information from your Part 2 Records to individuals outside of the Part 2 Program without your written consent.

Qualified service organizations

We may disclose your Part 2 Records to our qualified service organizations to the extent necessary for these organizations to provide services to or on behalf of the Part 2 Program.

Reporting certain criminal conduct

We may disclose to law enforcement the following information about certain criminal conduct committed by you:
Information related to a suspected criminal conduct committed by you on the premises of an Emplify Health facility;
Information related to suspected criminal conduct committed by you against Emplify Health personnel; and
Reports of suspected child abuse and neglect made under state law to the appropriate state or local authorities.

Medical emergencies

We may disclose your information to medical personnel to the extent necessary during a medical emergency if you are unable to provide prior authorization of the disclosure. We may also disclose your identifying information to medical personnel of the Food and Drug Administration (“FDA”) who assert a reason to believe that your health may be threatened by an error in the manufacture, labeling or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.

Research

In certain cases, we may disclose your information for scientific research, subject to certain safeguards.

Audit and evaluations

We may disclose information to others for specific audits or evaluations. This includes those who provide financial assistance to Emplify Health or those who conduct audits and evaluations required under federally funded health care programs and federal agencies who oversee those programs.

Persons involved in your care

Depending on your age and mental capacity, we may be allowed to disclose certain information to your legally authorized representative (such as a parent of a minor or court appointment guardian), for payment purposes. Your legally authorized representative may be allowed to authorize disclosures of your information.

Deceased patients

We may disclose your information relating to cause of death under laws which require the collection of death or other vital statistics or permitting inquiry into the cause of death. For other disclosures where authorization is required, we may disclose your information if authorization was given by an executor, administrator, or other personal representative appointed under applicable state law. If there is no such appointed representative, the authorization may be given by the patient’s spouse or, if none, by any responsible member of the patient’s family.

Judicial proceedings

We may disclose information about you in response to a court order and subpoena that comply with the requirements of the regulations and other applicable law. However, Part 2 Records, or testimony about your records, cannot be shared in any civil, administrative, criminal or legislative proceedings against you unless you provide specific written consent, or a court issues an appropriate order. Your Part 2 Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, the organization or other holder of the Part 2 Record in accordance with Part 2. A court order authorizing use or disclosure of Part 2 Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Records may be used or disclosed.

We will ask for your written consent before using or disclosing your Part 2 Records for situations not described in this Part 2 Programs Notice. You may revoke your written consent at any time.

Communications within Part 2 Program and Emplify Health

We may use or disclose information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse, provided such communication is either within the Part 2 Program, or between the Part 2 Program and Emplify Health with your written consent. For example, our staff, including doctors, nurses and other clinicians, will use your health information to provide your treatment care. Your health information may be used in connection with billing statements we send you and in connection with tracking charges and credits to your account. We may also use your health information to check for eligibility for insurance coverage and prepare claims for your insurance company where appropriate. We may use and disclose your health information in order to conduct our healthcare business and to perform functions associated with our business activities, including accreditation and licensing.

Violations of laws and regulations

A violation of the federal law and regulations governing the confidentiality of substance use disorder records is a crime. Suspected violations may be reported to the Substance Abuse and Mental Health Services Administration Center for Substance Abuse Treatment at 5600 Fishers Lane Rockville, MD 20857 or (240) 276-1660 or to the US Attorney for the district in which the violation occurred.

Your Rights as a Patient in the Program

As a patient in an Emplify Part 2 Program, you have certain rights with regard to your Part 2 Records, in addition to those rights described in our HIPAA Notice:

You have a right to request restrictions of disclosures made with your prior consent for purposes of treatment, payment and healthcare operations. We will review your request but are not required to agree unless the request relates to sharing information with your insurance provider and your care has already been paid for by another source. If we agree to your request, we may still share your information where needed for emergency care or where required by law.
You have a right to request and obtain restrictions on disclosures of Part 2 Records to your health plan for those services for which you have paid in full.
You have the right to an accounting of disclosures of electronic records of your care by an Emplify Part 2 Program to people outside our program for the past 3 years. In addition, if you provided consent to share your information for treatment through a health information exchange, care management organization, or other intermediary, you have a right to a list of disclosures by an intermediary for the past 3 years.
You have the right to obtain a paper or electronic copy of this notice as well as our HIPAA Notice upon request. You may also find this notice on our website.
You have a right to elect not to receive fundraising communications.
You have a right to file a complaint to the Emplify Health’s Privacy Office, listed below, and the Secretary of the Department of Health and Human Services. For directions on how to contact the Secretary, please contact the Privacy Officer whose contact information is below. You will not be retaliated against for filing a complaint.

Our commitment to you

The Emplify Part 2 Programs are required by law to maintain the privacy of Part 2 Records, to provide patients with notice of its legal duties and privacy practices with respect to such records, and to notify affected patients following a breach of unsecured records.

The Emplify Part 2 Programs are required to abide by the terms of the Part 2 Programs Notice currently in effect. We reserve the right to make changes to this Part 2 Programs Notice at any time, and any changes will apply to all Part 2 Records we maintain. If we make changes to how we manage your Part 2 Records, we will change our notice and provide you with a new notice at your next visit if you are still receiving care from any of our Part 2 Programs. If you are no longer receiving care from any of Part 2 Programs, you may request an updated copy or our notice or you may find the most recent notice in effect on our website.

If you have a concern or question about this Part 2 Programs Notice or your privacy, you may contact the Privacy Officer whose contact information is below.

Emplify Health’s Privacy Officer:
Email: PrivacyOffice@emplifyhealth.org
Phone: (608) 775-7439