Confidentiality & privacy practices
Your medical care and counseling at Cornell Health is confidential.
Health records are maintained through a secure electronic health records (EHR) system, and are completely separate from all other university records. The privacy of this information is protected by law.
Cornell Health staff refer to the information in your health record only as needed to provide integrated care for you, and communicate with each other about your care through the secure EHR system. The EHR portal, myCornellHealth, facilitates confidential communication between providers and patients / clients.
We reinforce this fundamental commitment to confidentiality through yearly mandatory training for all Cornell Health employees. Every staff member and volunteer must sign a confidentiality agreement on an annual basis. Regular audits of the EHR provide an extra measure of protection.
We will never release any of your health information without your written permission, except in the following instances:
- In the event of your treatment at Cayuga Medical Center or another hospital or urgent care center, the community provider and Cornell Health will share relevant health information as needed for continuity of care.
- If, in our judgment, releasing information is necessary to protect you or others from a serious threat to health or safety.
- If it is authorized or required by law
Our notice of privacy practices
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 requires us to inform all patients/clients of our Notice of Privacy Practices. At Cornell Health, we have a long-standing commitment to the rights and privacy of our patients and clients, and we take this regulation very seriously.
Acknowledgment of Privacy Notice
The HIPAA regulation also requires that we ask for your acknowledgment that you have been made aware of our Privacy Notice. This notice is provided to all incoming students through the health requirements process. Faculty, staff, visitors, and student partners are asked to give this acknowledgment before their first visit.
Sharing your health records
If you want Cornell Health to share your health records or any information about your care – with another health care provider, or with a parent, partner, spouse, or anyone else – federal law requires us to obtain your written permission.
1. To authorize a "Health Record Access Designee"
Some people wish to give permission in advance for a parent, guardian, or spouse to be able to access their personal health information (PHI).
A "Health Record Access Designee" is an individual to whom a patient/client grants authority to have access to some or all of their PHI. For example, a person may want someone to assist with billing questions or to be apprised of their health status. Naming a Health Record Access Designee assures that we have a record of the patient/client’s wishes in this regard and, should the need arise, are able to share information according to those wishes.
We encourage families to have a thoughtful conversation about how to balance the need for privacy with the need for personal or financial support.
- If you would like to designate someone for this purpose, you must use Cornell Health's authorization form. (We are not able to accept external forms.)
- Review the Health Record Access Designee FAQ and Authorization form (pdf).
- Follow instructions carefully to complete and submit the form.
- NOTE: The Designee Authorization form will expire one year from the date the form was signed. It must be renewed should the patient/client want the designee to continue to have access.
2. To authorize a specific "Release of Health Records"
If you believe it would be helpful for your medical clinician, counselor, or psychiatrist to talk with anyone about your health concerns or treatment, please discuss it with them. Together you can decide what should be shared with whom and during what time frame. Or you may want us to provide immunization or other records to another health care provider, school, or employer.
Whenever you want us to release your personal health information (to anyone other than a Health Record Access Designee), we will need documentation of your specific wishes.
- Please use our Authorization for Release of Health Records (pdf).
- To submit the form to Cornell Health, please use one of these options:
- In person at Cornell Health
- By FAX: 607 255-0269
- By mail:
ATTN: Health Records Department
110 Ho Plaza
Ithaca , NY 14853-3101
- Upload at myCornellHealth.health.cornell.edu
From Home Screen, click on “Messages”
Then “New message;” then “Send message or attachment to Health Records”
- Please do not email it to us (email is not a secure means of communications)
Confidentiality & billing
All information about your care at Cornell Health is confidential. However, please be aware of the following:
- Charges that appear on your Bursar bill will include a generic description (such as “Cornell Health services” or “Rx”), but will not include any confidential health information.
- Your Cornell Health bill will contain some brief information about your visit, including a “diagnostic code” that is required by insurance companies to process requests for reimbursement. If you’ve had a visit or procedure that you would like to keep to yourself, look closely at your statement before passing it on to anyone else.
If you want Cornell Health to share information about your care – including details about expenses or bills – with a parent, partner, spouse, or anyone else, please refer to “Sharing your health records” above.
If you have any concerns about the confidentiality of bills from Cornell Health, please speak with your health care provider, or with a Billing Office staff member who can help you make choices about your bills to protect your confidentiality (please see a cashier on Level 4, or call 607-255-7492).
Email & confidentiality
Email is not a confidential form of communication. To help ensure your privacy ...
- Patients and clients are cautioned against communicating sensitive, detailed personal information by email.
- Cornell Health staff members limit the use of email to answering general questions (not associated with a diagnosis, or health advice, etc.), sending appointment reminders, and other similar communications Most communications from Cornell Health will come to you via myCornellHealth, our secure patient portal.
Please visit our Contact Us page to learn more.
Questions or concerns
If you have any concerns about the confidentiality of your health care, please speak with your health care provider, or with Cornell Health’s Privacy Officer (607-255-7896).
Patient / client rights & responsibilities
At Cornell Health, we strive to provide high-quality health care that recognizes the values, experiences, and needs of individuals who make up the diverse community that relies upon us for services. We believe that a confidential, mutually-respectful partnership between health care providers and patients and clients is the best way to develop and maintain optimal health. Understanding your rights and responsibilities as a patient or client of Cornell Health is central to this partnership.
Learn more about ...
Patient / client rights
As a patient or client of Cornell Health, you have the right:
To be treated in a professional, courteous, and caring manner that respects and appreciates differences related to race, ethnicity, national origin, gender, sexual orientation, religion, personal values, age, disability, and economic or veteran status.
To request the health care provider of your choice or change your health care provider, as well as to request a second opinion or referral.
To receive complete information regarding diagnosis, treatment, and prognosis of your health concern in language you can understand. We will provide confidential interpreters when needed.
To receive information you need to participate in decisions about your care, and to give consent before any diagnostic or treatment procedure is performed.
To decline treatment, to the extent permitted by law, and to be informed of the consequences of making this decision.
To expect that your personal privacy will be respected and confidentiality protected to the greatest extent permitted by law.
To ask for and receive an explanation of any charges billed by Cornell Health.
To review any medical records created and maintained by Cornell Health regarding your care and treatment.
To review any health records created and maintained by Cornell Health regarding your care and treatment.
Patient / client responsibilities
As a patient or client of Cornell Health, you have the responsibility:
- To provide accurate and complete information about current and past health issues, medications (including non-prescription products and dietary supplements), and allergies or sensitivities, and other matters pertaining to your health.
- To ask questions to make sure you understand your diagnosis, treatment, expected outcome, and any instructions.
- To follow through on the treatment plan you and your health care provider make together, including completing medications and returning for follow-up appointments.
- To keep your appointment, or change or cancel it in a timely manner, to allow others in need to have access to a health care provider.
- To inform your health care provider about any living will, medical power of attorney, or other directive that could affect your care.
- To provide a responsible adult to transport you home from the facility and remain with you for 24 hours, if required by your health care provider.
- To have health insurance that meets Cornell’s requirements, understand what your insurance does and does not cover, and provide information about your insurance as needed for processing claims.
- To use services wisely, be aware of costs, and accept personal responsibility for paying all charges billed to you that are not covered by your insurance.
- To be respectful of others, including Cornell Health staff, volunteers, patients and clients.
- To communicate with your health care provider, a Patient Advocate (607-255-3564), or any Cornell Health staff member if you have concerns or suggestions about the care you receive here, so we can work together to provide you with the best possible service in the future. You may report any unresolved grievances to the Accreditation Association for Ambulatory Health Care (AAAHC) at firstname.lastname@example.org.