Privacy Practices


At Banner ― University Family Care/AHCCCS Complete Care (BUFC/ACC), the privacy of your health information is very important to us. We understand that you depend on us to protect your personal information. This notice will tell both current and former members how we work to protect your health information. We are required by law to maintain the privacy of your health information and provide you with a description of our legal duties and privacy practices. We must abide by the terms of this notice and notify you if your health information is subject to a breach of unsecured protected health information.

If you have any questions about this notice, or if you want another copy of this notice, please contact our Customer Care Center at (800) 582- 8686, Monday through Friday, 7:30 a.m. to 5 p.m.


This notice tells you how we use health information about you and when we may share that health information with others. It also tells you about your rights regarding your health information. The law says that we must keep your health information private, we must give you a copy of this Privacy Practices Notice and we must follow the practices listed in this notice.


BUFC/ACC has health information about you that we get from you, your doctors, and your other health care providers. This includes your demographic information (like name, address and date of birth) and information that describes your current or past health condition and care received. We need this information to ensure you receive appropriate health care services and to abide with the law.


This notice tells about the different ways that we use and share your health information. We explain each way and give you some examples to help you understand each of them. We will not use or share your health information in any way that is not mentioned in this Notice of Privacy Practices unless we get your written permission.


We may use or share your health information with your doctors and other health care providers who give you medical treatment and services. For example, we may give a pharmacist or your doctor information about your past prescriptions to decide if a new prescription may be harmful to you.


Your health information can be used to decide if you are eligible for plan benefits, to pay doctors for treatment and services you receive, or to handle benefits with other health care coverage you may have. For example, we may tell your health care provider about your medical history to determine whether a particular treatment is medically necessary and whether the plan will cover the cost of the treatment. We may also share your health information with another health plan to handle coordination of benefits between the health plans.


We may use and share your health information for health care operations. “Operations” are activities that are necessary to operate our health plan and to make sure all of our members receive quality care. Examples of health care operations include the following:

  • To review quality of care and ways we can improve our service.
  • To review provider and health plan performance.
  • To carry out medical reviews to define medical needs, level of care and to decide if there was a good reason for the services.
  • To perform audit functions.
  • To fix internal complaints, such as problems or complaints about your access to care or satisfaction with services.
  • To make a benefit decision, manage a benefit plan and provide customer services.
  • Other uses approved by law.

We may also use and share health information with other people or companies, whom we call “Business Associates.” Business Associates are those people or companies that carry out payments or health care operations for BUFC/ACC. We will only share information the Business Associates need to perform the job we have asked them to do. However, we will not share your health information with these Business Associates unless they agree in writing to protect the privacy of that information.


We may use your health information to contact you so that we can remind you about an appointment, describe or suggest treatment options, or give you other information about health-related topics that you may be interested in. For example, if we offer educational classes on how to live with diabetes, we may contact you to inform you of that class if our records show that you have diabetes. We may also inform you about changes to your health plan coverage.


We may disclose your health information to a friend or family member who is involved in your care or who helps pay for your care. If you are unable to request that we not share your information with a particular friend or family member, we may use our professional judgment to determine if sharing information is in your best interest. If you do not want us to share information with your friends or family members that are involved in your care, please call Customer Care Center at (800) 582-8686.


Special situations may require us to use and share your health information. For example, here are some reasons we may release your information:

  • When the disclosure or use is required to comply with state, federal or local law.
  • To report information to state and federal agencies who manage our business, such as the U.S. Department of Health and Human Services, the Arizona Health Care Cost Containment System (AHCCCS) and other federal and state regulatory agencies. This might be for audits, research, inspection, and licensure purposes or to report information to patient registries for conditions such as tumors, traumas and burns. This is necessary for the government to monitor the health care system, the outbreak of disease, government programs, compliance with civil rights laws, and to improve patient outcomes.


We may use and share your health information when necessary to prevent a serious health and safety threat to you or the public, including in disaster relief efforts. We may also share your health information to help with public health activities, which might include activities:

  • To prevent or control disease, injury or disability.
  • To report births and deaths.
  • To report abuse or neglect.
  • To report reactions to medications or problems with a product to the Food and Drug Administration or to a product manufacturer.
  • To notify people of recalls of products they may be using.
  • To tell a person who may have been exposed to a disease or may be at risk for getting or spreading a disease or condition.
  • To tell government authorities if we believe you have been the victim of abuse, neglect or domestic violence. We will only share this if you agree or when we are required by law to do so.


We may use and disclose health information about you for research with your written authorization, through a special process that protects the confidentiality of your health information, or as otherwise permitted by law. Research proposals are reviewed by an ethics board called an institutional review board, which ensures the privacy of your health information before approving research. We may also use your information to contact you about your interest in participating in research studies. We may also permit researchers to review your information to prepare for research studies, as long as they do not remove or take a copy of your information.


If you are an organ donor, we may share health information to places that receive organs, eye or tissue transplantation, or to an organ donation bank, as need to fulfill your donation wishes.


If you are a member of the armed forces, we may share your health information as needed by military personnel. We may also share health information about foreign military personnel to the correct military authority.


We may share your health information if you get sick or hurt on the job, as required by the state’s workers compensation laws.


We may share your health information in response to a court or administrative order, subpoena, discovery request, or other lawful means by someone involved in the dispute.


We may share your health information if asked to do so by a law enforcement official:

  • If we are required by law to do so.
  • In response to a court order, subpoena, warrant, summons or similar process.
  • For the reporting of certain types of wounds.
  • To identify or locate a suspect, fugitive, material witness, or missing person.
  • To inform them about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement.
  • To inform them about a death we believe may be the result of criminal conduct.
  • To inform them about criminal conduct on our premises.
  • In the case of an emergency, to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.


We may share your health information with a coroner or medical examiner. This may be necessary, for example, to identify someone who has died or to decide the cause of death. We may also share your health information to funeral directors as needed to carry out their duties.

National Security and Intelligence Activities By law we may share your health information to authorized federal officials for intelligence, counterintelligence, and other national security events.


We may use or share your health information when it has been “de-identified.” Health information is identified can not be used to identify you. also a limited data set” that does contain any directly A only for the purposes of research, public matters care operations. For example, include city, county and zip code, but name street address.


We may use or share your health information when it has been “de-identified.” Health information is deidentified when it cannot be used to identify you. We may also use a “limited data set” that does not contain any information that can directly identify you. A “limite4d data set” may only be used for the purposes of research, public health matters or health care operations. For example, a “limited data set” may include your city, county, and zip code, but not your name or street address.


The following are your health information rights. If you would like to use the following rights, please call Customer Care Center to request the forms or to get further information.

  • Review and Copy Your Record. You have the right to review and get copies of your own health information annually. BUFC/ACC has a specific record set which includes, medical claim history, pharmacy claim history, grievance appeals documents, and your BUFC/ACC phone call record. You can receive these at no cost you.
  • You can contact Customer Care Center to initiate the request and the Compliance Department will respond.
  • You will be sent an authorization form to complete and will return it to the Compliance Department with a copy of a picture ID so we can make sure we only send your records to you or someone you allow to receive your records. You can receive your records in paper form or by email (encrypted or not) if you prefer.
  • There is some level of risk that a third party could access your Protected Health Information (PHI) without your consent when electronic media or email is unencrypted. We are not responsible for unauthorized access to unencrypted media or email or for any risks (e.g., Virus) potentially introduced to your computer/device when receiving PHI in electronic format or email.
  • BUFC/ACC must reply to your request for medical records no later than thirty (30) days after receipt of your request. If BUFC/ACC is unable to take action within 30 days, BUFC/ACC may take any additional 30 days provided BUFC/ACC lets you know the reason for the delay and the date the request will be completed. This response will either be a copy of your records in the manner you requested, permission for you to view your records on-site or a reason for denying your request. If a request is denied, in whole or in part, BUFC/ACC must give you a reason for the denial and your rights to a review of the denial of access.

If you request additional copies of your information, we may charge you for our costs to copy the information.

  • We will tell you in advance what this copying will cost. You can look at your record at no cost.
  • Under very limited situations, your request may be denied, such as a request for psychotherapy notes. You may request that a denial be reviewed by contacting the Compliance hotline (complyLine) at (888) 747-7989.
  • Request an Amendment of Your Record. If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as we keep your information. Your request to Customer Care Center must be made in writing and provide a reason that supports your request. We may deny your request for an amendment to your record if it is not in writing or does not include a reason to support the request. We also may deny your request if you ask us to amend information that was not created by us, is not part of the record used to make decisions about you, is not part of the information you are permitted to inspect or copy, or is accurate and complete.
  • Accounting of Disclosures. If we disclose your health information for purposes other than your treatment, payment, or certain of our operations, you have the right to receive a list of those disclosures we made for up to six years prior to the date of your request. We will provide the first list to you free, but we may charge you for any additional lists you request during the same year. We will tell you in advance what this list will cost. You must submit your request for an accounting of disclosures to Customer Care Center in writing on an authorization form we will provide to you.
  • Request Restrictions on Use or Disclosure of Your Health Information. You have the right to ask us not to make certain uses or disclosures of your health that we would normally make for treatment, getting paid, or our operations. We are not required to agree to your request, but if we do agree, we will comply with that agreement unless the information is needed to provide you emergency treatment. Your request for restriction must be made in writing to Customer Care Center. You must tell us what information you want to limit; if you want to limit our use, our disclosure or both; and to whom you want the limits to apply.
  • Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at certain locations. For example, you may ask that we contact you at work instead of your home. Your request for confidential communications must be made in writing to our Customer Care Center.


You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may download a copy of our current notice from our website at


If you believe your privacy rights have been violated, you may file a complaint with us by calling Customer Care Center at (800) 582- 8686, or you may write to us at:

Banner - University Family Care/ACC

Customer Care Center

2701 East Elvira Road. Tucson, AZ 85756

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services or the Office of Civil Rights ( All complaints must be sent in writing. You will not receive a penalty if you decide to file a complaint.


Certain uses and disclosures of health information may only be made with your written authorization. For example, we must obtain your authorization to use or disclose your psychotherapy notes in all situations, except the following: when the use or disclosure is by the originator of the notes for treatment, for us to carry out certain training programs, for us to defend the organization in a legal action you may bring, if the disclosure is to you pursuant to your request under HIPAA, the disclosure is required by law or is to the Department of Health and Human Services, the use or disclosure is for health oversight of the originator of the notes, the user or disclosure is to the coroner, medical examiner or funeral director as described in this Notice, or the use or disclosure is necessary to prevent or lessen a serious and imminent threat to health or safety.

We must also obtain your written authorization to use or disclose your information for certain marketing activities or if we sell your information. You may revoke your authorization as described in the following paragraph.


If we wish to use or disclose your health information for a purpose that is not discussed in this Notice, we will seek your permission. If you give your permission, you may take back that permission any time, unless we have already relied on your permission to use or disclose the information. We are unable to take back any disclosures we have already made with your permission. To take back your permission, please contact Customer Care Center. We must also continue to keep certain records in our files even if you leave our health plan.


Please be aware that we can change this notice at any time. We can revise or change this notice effective for health information we already have about you, as well as any health information we may get in the future. We will post a copy of the current notice on our website at