Menu

Privacy and SMS Policies

Notice of Privacy Practices

Effective Date: July 31, 2026

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH MID-ATLANTIC MOTHERS’ MILK BANK (412) 281-4400 OR INFO@MIDATLANTICMILKBANK.ORG IF YOU HAVE ANY QUESTIONS.

This Notice of Privacy Practices (“NPP”) describes how personal and health information may be used and disclosed, and how you can get access to this information. The NPP is applicable to all families that are engaged with the mission of the milk bank, including milk donors, the children of milk donors, milk recipients, and/or the parents/guardians of recipients. The Three Rivers Mothers’ Milk Bank d/b/a Mid-Atlantic Mothers’ Milk Bank (“MAMMB”) is a HIPAA-covered entity with a legal obligation to protect its patients’ protected health information (“PHI”).

This NPP describes how medical information about you may be used and disclosed, your rights with respect to your health information and how you can get access to this information. Please review it carefully.

The following is the NPP of MAMMB as described in the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA. HIPAA requires MAMMB, by law, to maintain the privacy of your personal health information and to provide you with notice of MAMMB’s legal duties and privacy policies with respect to your personal health information. We are required by law to abide by the terms of this NPP. HIPAA requires us to:

  • Keep medical information that identifies you private;
  • Give you this NPP that identifies our legal duties and privacy practices with respect to medical information about you and your child; and
  • Follow the terms of this NPP and provide a revised NPP whenever there are material changes to MAMMB’s privacy practices.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and how to exercise them.

Specifically, you have the right to:

Get an electronic or paper copy of your medical record

  • You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you.
  • We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

Ask us to correct or amend your medical record

  • You can ask us to correct health information about you that you think is incorrect or incomplete.
  • We may say “no” to your request, but we will tell you why in writing, usually within 60 days of your request.

Request confidential communications

  • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests.

Ask us to limit what we use or share

  • You can ask us not to use or share certain health information for treatment, payment or our operations. We are not required to agree to these requests. For example, we may say “no” if it would affect your care.
  • If you pay for a service or healthcare item out-of-pocket in full, you can ask us not to share that information for the purpose of payment with your health insurer. We will say “yes” unless a law requires us to share that information.

Obtain a list of those with whom we’ve shared your information

  • You can ask us for a list (accounting) of the instances we have shared your health information for six years prior to the date you ask, with whom we shared it and why.
  • We will include all disclosures except disclosures for treatment, payment, or healthcare operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting or list of disclosures per year for free but may charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this privacy notice

  • You can ask for a paper or electronic copy of this notice at any time, even if you have agreed to receive the notice electronically.
  • We will provide you with a paper or electronic copy promptly.

Choose someone to act for you

  • If you have given someone healthcare power of attorney or if someone is your legal guardian, that person (your “personal representative”) can exercise your rights and make choices about your health information.
  • If someone has been appointed to act for you, a copy of the document appointing that person must be provided to us. We will make reasonable efforts to ensure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated

  • Protecting your confidential information is important to us. If you feel we have violated your rights, please contact us using the information at the end of this Notice.
  • You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, SW, Washington, DC 20201, calling 800.368.1019 or visiting hhs.gov/ocr/about-us/contact-us/index.
  • We will not retaliate against you for filing a complaint either to MAMMB or to the Office for Civil Rights.

Please ask us how to accomplish any of the above items by contacting us using the information at the end of this Notice. You may have to complete a form and submit your request in writing. For example, to obtain a copy, amend or restrict your medical records, or to receive a listing of disclosures, you must fill out a form.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your reasonable instructions.

In these cases, you have both the right and choice to tell us to:

  • Share information with your family, close friends or others involved in your care.
  • Share information in a disaster relief situation.
  • Include your information in a hospital directory.

If you are not able to tell us your preference (for example, if you are unconscious), we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

We never share your information unless you give us written authorization for the following:

  • Marketing purposes
  • Sale of your information
  • Most, but not all, sharing of psychotherapy notes

In the case of fundraising:

  • We may contact you for fundraising purposes to support MAMMB and its mission, but you can tell us not to contact you again for this purpose.
  • If your information is disclosed in accordance with your written authorization, the released information may no longer be protected by federal and state privacy regulations.

How MAMMB May Use and Share Your Health Information

MAMMB may, without your written permission, use your health information within MAMMB and share or disclose your health information to others outside MAMMB in the following ways:

For treatment, payment, and healthcare operations, MAMMB may use and disclose your health information without your written authorization.

a. Treatment
MAMMB may use your health information and share it with other professionals who are treating you. Note, however, that we may ask for your written permission if certain kinds of information are being disclosed (such as mental health information).

b. Payment
MAMMB may use and share your health information to bill and get payment from health plans or other entities. We may also disclose your information to other providers for their payment activities.

c. Healthcare operations
MAMMB may use and disclose your health information to run our organization, improve your care or our services, and contact you when necessary.

Those instances that require the use or disclosure of your health information
MAMMB may disclose your health information without your written permission:

  • With some limited exceptions, to you or someone who has the legal right to act on your behalf (your personal representative).
  • To the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected.
  • When required by law.

Other purposes for which MAMMB is allowed or required to use or disclose your health information

MAMMB may use or disclose your health information to others with your authorization, unless the law provides a relevant exception to the need for prior authorization— usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes. For more information, visit hhs.gov/hipaa/index. Examples include:

a. To help with public health and safety issues
MAMMB may share health information about you for certain situations such as:

    • Preventing disease
    • Helping with product recalls
    • Reporting adverse reactions to medications
    • Reporting suspected abuse, neglect or domestic violence
    • Preventing or reducing a serious threat to anyone’s health or safety

b. For research
Your medical information may be used for research purposes in accordance with state and federal law. For example, researchers may look at your medical information:

    • To plan future research studies. For example, your information could be viewed by researchers through MAMMB’s affiliated Human Milk Science Institute and Biobank.
    • To identify and contact you regarding your interest in taking part in a specific research study. Your part in that study can only start after you have been told about the study, are given a chance to ask questions, and have shown your willingness to be in the study by signing a consent form. If you prefer not to be contacted by a researcher not involved in your clinical care, you can contact MAMMB to be removed from the contact registry by calling 412-281-4400.
    • To remove information that identifies you.
    • To gather information that might be used to publish an article, however, your identity or identifiable information will never be released in the article without your authorization.

All research projects for which MAMMB shares health information are carefully reviewed by an institutional review board or privacy board to protect the safety, welfare and confidentiality of MAMMB patients. If you have questions regarding the above, please call MAMMB at 412-281-4400.

c. To respond to organ and tissue donation requests
If applicable, MAMMB may share patient information with organ procurement organizations for the purpose of facilitating a patient’s organ, eye or tissue donation and transplantation.

d. To work with a coroner, medical examiner or funeral director
MAMMB may share health information with a coroner, medical examiner or funeral director when an individual dies.

e. To address workers’ compensation, law enforcement and other government requests
If applicable, MAMMB may use or share health information about you:

    • For workers’ compensation claims
    • For law enforcement purposes or with a law enforcement official
    • With health oversight agencies for activities authorized by law
    • For special government functions such as military, national security, and presidential protective services

f. To respond to lawsuits and legal actions
MAMMB may disclose health information about you in response to a court or administrative order, outside of any protections given to SUD Program Records, or non-sensitive information in response to a subpoena if there is a qualified protective order or satisfactory assurances.

g. To business associates
MAMMB may disclose your health information to our “business associates” — individuals or companies that provide services to MAMMB. MAMMB requires that business associates keep your information safe.

h. For immunization purposes
If applicable, MAMMB may disclose immunization records to schools to support public health efforts if we obtain and document an oral or written agreement from the parent, guardian or other person acting in loco parentis.

i. To parents and legal guardians of minors
MAMMB may share a minor’s health information with his or her parents or guardians unless such disclosure is otherwise prohibited by law. Note, however, that if a minor is emancipated, married, pregnant or a parent, we will not share information with the minor’s parents or guardians. Also, if a minor is receiving certain types of treatment (such as genetic or HIV testing; testing for sexually transmitted diseases; mental health, or drug or alcohol abuse counseling; or other certain types of treatments), we will not disclose information to the minor’s parents or guardians except in certain situations as required or allowed by law (including, but not limited to, if doing so is necessary to protect the minor’s safety or that of a family member or other individual or if, in the professional judgment of the healthcare provider, notification would be in the minor’s best interest and we have first sought unsuccessfully to persuade the minor to notify his or her parents).

Substance Use Disorder Program Records (“SUD Programs”)

Substance use disorder records, including any information that would identify you as having or having had a substance use disorder (collectively, “SUD Records”) are protected by the federal law and regulations set forth in 42 USC § 290dd-2 and 42 CFR Part 2 (collectively, “Part 2”), in addition to HIPAA.

MAMMB must obtain your written consent to use and disclose your SUD Records, with minimal exceptions for situations such as medical emergencies where patient consent cannot be obtained.

When you consent to use and disclosures for all future treatment and to run our business, we may share your information with other substance use disorder treatment programs, doctors’ offices, and health care businesses for those activities. Once a HIPAA-covered entity or business associate receives your records under this consent, they may further use or redisclose them in accordance with HIPAA regulations. However, your information still cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless (1) you provide a specific, separate written consent, or (2) a court issues a specialized Part 2 order and a subpoena.

SUD Program – Supplemental Rights
You have certain rights regarding your SUD Records in addition to the rights described elsewhere in this Notice.

  • You have a right to request restrictions on disclosures made with your prior consent for purposes of treatment, payment and healthcare operations.
  • If you provided consent to share your SUD Records for treatment through a health information exchange, care management organization, or other intermediary, you have a right to a list of disclosures by an intermediary for the past three years.

Additional State and Federal Requirements

Some Pennsylvania and federal laws provide additional privacy protection of your health information. These include:

  • Sensitive health information. Some types of health information are particularly sensitive, and the law, with limited exceptions, may require that we obtain your written permission or in some instances, a court order, to use or disclose that information. Sensitive health information includes information dealing with mental health and developmental disabilities, HIV/ AIDS, alcohol and drug abuse treatment, genetic testing and genetic counseling.
  • Prior to receiving care from MAMMB, a patient signs, where required by law, a consent to allow MAMMB to use and disclose sensitive health information in a similar way HIPAA allows us to use and share non-sensitive health information for treatment, payment and healthcare operations as described in this Notice. For example, MAMMB may use and share sensitive health information in order to better coordinate care for MAMMB patients.
  • Information used in certain disciplinary proceedings. State law may require your written permission if certain health information is to be used in various review and disciplinary proceedings by state health oversight boards (such as the Department of Professional Regulation).
  • Information used in certain litigation proceedings. State law may require your written permission for certain providers to disclose information in certain legal proceedings.
  • Disclosures to certain registries. Some laws require your written permission if we disclose your health information to certain state-sponsored registries.

MAMMB is committed to following all state and federal legal requirements.

Our Responsibilities

  • We are required by law to maintain the privacy and security of your protected health information.
  • We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
  • We must follow the duties and privacy practices described in this Notice and offer you a written copy of it.
  • We will not use or share your information other than as described here unless you tell us we can do so in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

Legal Proceedings and Court Orders

We must follow certain procedures before using or sharing your information for investigations and legal proceedings.

  • We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings against you without your written consent or a court order.
  • We will only respond to a court order to use or share your health information if it is accompanied by a subpoena or other similar legal mandate requiring us to comply.
  • We will only use or share your information in proceedings against you based on a court order after we have received notice and an opportunity to be heard or you tell us that you have received notice.
  • We may use or share your information to respond to legal proceedings against our program based on a court order and you may not be notified in advance. You have the right to seek to overturn or change the court order after you learn about it.

Changes to This Notice

We may change the terms of this Notice, and the changes will apply to all information we have about you. If revised, the new Notice will be available upon request and on our website. However, any changes to the terms will not change MAMMB’s commitment to complying with applicable laws and ensuring the privacy of patient information.

Who Will Follow This Notice

This Notice will be followed by:

  • All employees, staff, volunteers, and workforce members who have access to PHI of MAMMB donors or recipient patients of the donated milk.

Contact Us

Denise O’Connor, Executive Director, Mid-Atlantic Mothers’ Milk Bank
3127 Penn Avenue, Pittsburgh, PA 15201
privacy@midatlanticmilkbank.org
412-281-4400

For Milk Donors and the parents/guardians of Donor Milk Recipients that choose to receive messages through texting, please read the following:

Text (SMS) Privacy Policy

This Text (SMS) Privacy Policy describes the policies and procedures of Mid-Atlantic Mothers’ Milk Bank (MAMMB) regarding the collection, use, and disclosure of your information when you participate in the mission of the organization including being a milk donor or milk recipient. It will also include information about your privacy rights and how relevant laws protect you.

MAMMB uses your personal data to provide and improve its work of collecting, processing, and distributing donor milk. By participating in the mission of MAMMB you agree to the collection and use of information in accordance with this Privacy Policy.

MAMMB maintains strict privacy policies, ensuring that personal information and mobile information of our users and members is not sold, shared, rented, released, or traded to third parties for marketing/promotional purposes.

Texts are only sent to individuals who have agreed to this method of communication. If you are receiving text messages from MAMMB and would like to stop receiving them, reply “STOP” to the number from which you received the message. You will then receive a message asking you to confirm you desire to unsubscribe (reply “YES” to confirm or “NO”). If you reply “YES” to the confirmation message you will no longer receive further text messages from us.

Collecting and Using Your Personal Data

While engaging with MAMMB, we may ask you to provide certain information that can be used to contact or identify you. This information, which is collected through online forms, verbally, or via email, may include but is not limited to:

  • Name
  • Address
  • Email
  • Phone number

MAMMB may use your personal data for the following purposes:

  • Contacting you regarding steps in the milk donor screening and donation process
  • Contacting you regarding the process of receiving donor milk for your child
  • Other activities to support the mission of MAMMB including events and fundraising

Other data, including personal health information is collected as needed to support the collection and distribution of donor milk. Please refer to MAMMB’s Notice of Privacy Policy for details regarding PHI, when it is disclosed, and the steps taken to protect that data.

Retention of Your Personal Data

MAMMB will retain your personal data for as long as is necessary for the purposes set out in this Text (SMS) Privacy Policy. MAMMB will retain and use you personal data to the extent necessary to comply with our legal obligations (for example, compliance with applicable laws and accreditation requirements), resolve disputes, and enforce our legal agreements and policies. MAMMB will also retain usage data for internal analysis purposes. Usage data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the operations of the organization, or where legally necessary.

Security of Your Personal Data

Personal information is only shared as required for the purposes outlined in this Text (SMS) Privacy Policy. MAMMB takes many precautions to secure your data:

  • Keeping documents that contain personal health information stored securely. Personnel access electronic records only through our HIPAA compliant system.
  • All staff and volunteers that have access to personal data receive specific training on confidentiality and privacy.
  • All vendors that perform work that may expose them to personal information have a business agreement in place that addresses privacy and HIPAA compliance. Such vendors include office cleaners, IT services, and other services necessary for the operations of the milk bank.

Changes to this Privacy Policy

MAMMB may update its Text (SMS) Privacy Policy periodically. We will notify you of any changes by posting the new policy on midatlanticmilkbank.org. We will also let you know via email prior to the change becoming effective.

Contact Us

If you have any questions about this Text (SMS) Privacy Policy contact us at:

Mid-Atlantic Mothers’ Milk Bank
3127 Penn Avenue
Pittsburgh, PA 15201
info@midatlanticmilkbank.org
phone: 412-281-4400

SMS Terms and Conditions

  1. MAMMB will reach out to you as “Mid-Atlantic Mothers’ Milk Bank”
  2. The information that is communicated via SMS include reminders for scheduled phone interviews and other components of the donor screening process, co-ordination of milk drop-offs, shipments, or pickups, information about milk bank events, or other activities related to the mission of MAMMB. Health related information will not be communicated. Users are asked to not include any health, medical, or personal information in replies to messages received from MAMMB.
  3. You can cancel the SMS (texting) service at any time. Text “STOP” to the number from which you received the message. You will then receive a message asking you to confirm you desire to unsubscribe (reply “YES” to conform or “NO”). If you reply “YES” to the confirmation message you will no longer receive further text messages from us.
  4. If you experience issues with the messaging program, reply “HELP” for more assistance or reach out to us by email (info@midatlanticmilkbank.org) or phone (412-281-4400).
  5. Carriers are not liable for delayed or undelivered messages.
  6. As always, message and data rates may apply for messages sent to you by MAMMB and to MAMMB from you. Message frequency varies. For questions about or text or data plan, contact your wireless provider.
  7. For privacy related information, please also refer to Mid-Atlantic Mothers’ Milk Bank’s Privacy Policy.

Last updated: February 15, 2025