Skip to main content


How HIPAA protects your child's privacy


What does HIPAA mean, and what does it do?

Most of us feel that our medical and other health information is private and should be protected, and we want to know who has this information. HIPAA is a federal law that gives you rights over your child’s health information, and it limits who can look at and receive your child’s information. HIPAA stands for the Health Insurance Portability and Accountability Act. It applies to all forms of health information, including information in emails, on paper, or spoken.

What information is protected? 

  • Information your child’s doctors, nurses, and other health care providers put in the medical record.
  • Conversations doctors or others have about your child’s care or treatment with nurses and others.
  • Information about your child in the St. Jude computer systems.
  • Billing information about your child at a St. Jude clinic.

How is this information protected? 

St. Jude has safeguards in place such as the following:

  • Storing information in locked cabinets and in rooms with locked doors.
  • Only having conversations about health information in private areas.
  • Limiting St. Jude employees to only the information they need to know about your child to do their jobs.
  • Limiting who can see your child’s health information.
  • Training employees on how to protect your child’s health information.

Who can look at and receive your child’s health information?

Your child’s health information cannot be used or shared without your written permission unless this law allows it. For example, unless you give written permission, your health care provider generally cannot:

  • Give your child’s information to an employer; or
  • Share your child’s information with St. Jude employees not involved in your child’s care.

HIPAA does allow your child’s health information to be used and shared without your written permission in these cases:

  • To set up treatment and care;
  • To pay doctors and hospitals for health care;
  • To use for St. Jude internal operations;
  • With your family, relatives, friends, or others you name, who are involved with your child’s health care or health care bills, unless you say no.

What rights do I have over my child’s health information?

You have the right to do the following: 

  • Ask to see and get a copy of your child’s health records, except in a few cases.
  • Ask to have corrections made to your child’s health information.
  • Ask that your child’s patient information not be given out, except in some cases.
  • Get a Notice of Privacy Practices that tells how your child’s health information may be used and shared.
  • Decide if you want to give permission before your child’s health information can be used or shared for some purposes, such as for fundraising.
  • Get a report called an Accounting that tells you when and why health information was shared for some purposes.
  • Be sent private information like medical records, billing, etc., in a different way or at a different place, such as a PO box, rather than a home address.
  • If your child or anyone else believes that their rights are being denied or health information is not being protected, that person may file a complaint with the St. Jude Privacy Officer or file a complaint with the US Department of Health and Human Services, Office for Civil Rights.

How do I keep my child’s health information from being given out to family members or friends?

  • Visit Patient Registration and ask for a Privacy Restriction Form.
  • Fill out the form and list each person you do not want to receive your child’s health information.
  • Sign the form and turn it in.

Are there times when my child’s information may be given out even if I say no?

  • During an emergency, St. Jude may also share your child’s health information with your family members or other people. For example, after surgery, a surgeon may tell parents, legal guardians, or other family members about your child’s progress and health outlook.
  • St. Jude must give your child’s health information to others if the law requires it or if HIPAA allows it.
  • There may also be times when St. Jude is legally required to share your child’s health information with a parent. They may have to do this even if the parent does not have custody of the child, and even when the patient or primary caregiver does not want the information shared. If you have reason to believe that sharing this information would put your child in danger, please talk about it with a member of the St. Jude clinical staff.


This document is not intended to take the place of the care and attention of your personal physician or other professional medical services. Our aim is to promote active participation in your care and treatment by providing information and education. Questions about individual health concerns or specific treatment options should be discussed with your physician.

St. Jude complies with health care-related federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex.

ATTENTION: If you speak another language, assistance services, free of charge, are available to you. Call 1-866-278-5833 (TTY: 1-901-595-1040).

ATENCIÓN: si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame al 1-866-278-5833 (TTY: 1-901-595-1040).

تنبيه: إذا كنت تتحدث باللغة العربية فيمكنك الاستعانة بخدمات المساعدة اللغوية المتوفرة لك مجانا. .يرجى الاتصال بالرقم. 5833-278-866-1  (الهاتف النصي: 1040-595-901-1).