Notice of Privacy Practices

U.S. - EU Safe Harbor Privacy Statement


Protecting Your Personal Information

Press Ganey Associates, Inc., the Center for Performance Services, Inc. and associated affiliates (“Press Ganey”) are committed to protecting the privacy of your personal information. We are required by the U.S. – EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework to maintain the privacy of your personal information, and to notify you of our privacy practices, our legal duties, and your rights concerning your personal information. This notice describes those practices, duties, and rights (“Notice”).

Personal Information (PI) includes any information that is identifiable to you by name, address, or otherwise, including personal health information. We are required to follow the privacy practices that are described in this notice for as long as it remains in effect.

Press Ganey’s Safe Harbor certification can be found at

For more information about the Safe Harbor Principles, please visit the U.S. Department of Commerce's Website at:

Notice and Disclosure

We may collect PI from you directly or your health care partner in order to improve the delivery of health care or other related services. We do not sell, share, or rent this information to others in any way. We will not use or disclose your PI unless we are allowed or required by law to do so, or with your (or your authorized representative) permission. Uses and disclosures, other than those listed in this Notice, require your written authorization. If there are other legal requirements under applicable laws that further restrict our use or disclosure of your PI, we will also comply with those legal requirements as well. Described below are the general types of uses and disclosures we may make without your express authorization.

  1. Provision of Services
    1. We may collect, use or disclose your PI in connection with the provision of our services as requested by yourself or your health care partner.
  2. Establishment of Legal Claims or Defenses
    1. We may disclose your PI in response to a court or administrative order, subpoena, discovery request, or other lawful process.
    2. We may disclose some of your PI under certain circumstances to law enforcement officials. If you were to be in the custody of law enforcement officials, we would have authority to disclose your PI to such officials for health, safety, security, or related administrative purposes.
    3. If you are a member of the Armed Forces or a foreign military force, we may disclose your PI for military purposes under certain circumstances. We also may disclose your PI to authorized federal officials for purposes of lawful intelligence, counterintelligence, and other national security activities.
  3. Related to data that are manifestly made public by the individual
    1. We may collect, use or disclose data about you that is in the public domain or otherwise legally and publicly available.
Data Integrity

To ensure the reliability of the data collected, we have appropriate policies and procedures in place to ensure your data is, accurate, complete, current, and reliable for its intended use.


We protect your PI by:

  1. Treating all of your PI that is collected as confidential;
  2. Restricting access to your PI within Press Ganey to those employees who need to see your PI in order to carry out business functions;
  3. Maintaining physical, electronic, and procedural safeguards that comply with federal and state regulations to guard your PI, including:
    1. Firewalls, intrusion detection systems other logical perimeter security controls;
    2. Physical security;
    3. Data encryption where appropriate;
    4. Access controls.
  4. These mechanisms undergo routine evaluation improvement consummate with industry standard technologies and controls related to security and privacy.
Onward Transfer

From time to time, we may share your PI with individuals or organizations that perform certain activities for us, such as administrative activities. Our contracts with these vendors provide for privacy protection of your PI.

We may also use or disclose your PI for research if we removed from the PI anything that might possibly identify you other than certain numbers or dates, and then only subject to a special privacy agreement. We must disclose your PI when we are required to do so by law.

In circumstances other than those described above, we may use or disclose your PI only if you (or your personal representative) provide us with a written authorization to do so. If you do provide us with an authorization, you may revoke it in writing at any time. However, your revocation will not affect any use or disclosure made consistent with the authorization while it was in effect.

Access and Amendment

You have the right to request all of the following:

  1. Access to Your Personal Information:
    1. You have the right to review and receive a copy of your PI. We may ask for verification of identity upon your request for such access to your PI. We may charge you a reasonable fee for providing you with copies of your PI.
    2. Your right of access does not include the right to review or obtain copies of certain records including: PI compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; PI gathered in the course of certain ongoing research; and PI that is subject to state or federal laws that prohibit us to release such information.
    3. In addition, in certain situations when disclosure of your PI could be harmful to you or another person, we may limit the information available to you, or use an alternative means of meeting your request. If we limit access based upon the belief that it could harm you or another person, you have the right to request a review of that decision.
  2. Amendment:
    1. You have the right to request that we amend your PI that is part of your medical records
    2. Your request must be in writing, and it must identify the information that you think is incorrect and explain why the information should be amended. We may decline your request for certain reasons, including if you ask us to change information that we did not create or if we believe the PI is accurate and complete. If we decline your request to amend your records, we will provide you a written explanation. You may respond with a statement of disagreement to be appended to the information you wanted amended. If we accept your request to amend the information, we will make reasonable efforts both to inform others to whom we have disclosed the information of the amendment and to include the changes in any future disclosures of that information.
Accounting of Disclosures

You have the right to receive a report of instances in which we or our vendors disclosed your PI for purposes other than for treatment, payment, health care operations, and certain other activities. We will provide you with the date on which we made a disclosure, the name of the person or entity to whom we disclosed your PI, a description of the PI we disclosed, the reason for the disclosure, and other relevant information. If you request this list more than once in a 12-month period, we may charge you a reasonable fee for creating and sending these additional reports.

Confidential Communication

You have the right to request that we communicate with you in confidence about your PI by certain specified means or to a particular location. If you advise us that disclosure of all or any part of your PI could endanger you, we will comply with any reasonable request provided you specify in this regard.

Electronic Notice

If you receive this notice on our Web site or by electronic mail (email), you are also entitled to receive this notice in written form. Please contact us using the information listed at the end of this notice to obtain this notice in written form.

Enforcement and Verification

We are committed to training all employees of the importance of complying with this policy to ensure the safety and privacy of your personal information. We will reassess our policy for compliance to the Safe Harbor Framework no less than annually, and will submit an annual recertification letter to ensure our participation on the Safe Harbor Certification list.

Dispute Resolution

For dispute resolution related to the Safe Harbor Principles that cannot be resolved between Press Ganey and the Complainant, we have agreed to submit to the EU Data Protection Authorities.

Changes to Policy

We reserve the right to revise or amend this Notice of Privacy Practices whenever there is a material change to the uses or disclosures, your rights, our legal duties, or other privacy practices stated in the Notice, within the guidelines of the Safe Harbor Framework. Any revision or amendment to this notice will be posted on our Web site and will be effective for all of your records that Press Ganey has created or maintained in the past, and for any of your records that we may create or maintain in the future. For your convenience, a copy of our current notice of privacy practices is always available on our Web site at and you may request a copy at