MyBaystate Health Privacy Policy and Terms of Use

Effective Date: November 1, 2026

Overview and Scope

MyBaystate Health is Baystate Health’s patient portal. It provides secure online access to portions of your electronic medical record (EMR) and tools that may allow you to communicate with your care team, request appointments or prescription renewals, view test results and other health information, manage authorized or proxy access, and use other services made available through the portal. The information available through MyBaystate Health may not be a complete copy of your medical record.

This Privacy Policy and Terms of Use ("Policy and Terms") explains the rules that apply when you access or use MyBaystate Health and describes how information associated with the portal may be collected, used, disclosed, and protected. By accessing or using MyBaystate Health, you agree to these Policy and Terms.

Baystate Health’s Notice of Privacy Practices also applies to protected health information (PHI) maintained by Baystate Health and explains how Baystate Health may use and disclose PHI and the rights you have concerning your health information. If there is a conflict between the privacy provisions in this document and the Notice of Privacy Practices, the Notice of Privacy Practices controls to the extent required by law.

Eligibility, Registration, and Account Access

To create or use a MyBaystate Health account, you must meet Baystate Health’s eligibility requirements and any applicable age requirements. Access for minors may be limited based on age, applicable law, confidentiality requirements, and Baystate Health policy. If you are legally emancipated or otherwise legally authorized to manage your own health information, different rules may apply.

When you register, self-enroll, or verify your identity, you agree to provide information that is true, accurate, and complete to the best of your knowledge. You may not create or access an account for another person unless you are authorized to do so.

Your account credentials and account activity are your responsibility. Keep your password and other authentication information confidential and do not share them. If you learn or suspect that your credentials or account have been compromised, promptly reset your credentials and contact MyBaystate Health Support.

Use a supported device, browser, or mobile application and keep your contact information current. Some portal functions require cookies, scripts or other browser features to be enabled. If these features are disabled or blocked, some portal functions may not work. Technical requirements may change as the portal is updated.

Medical Emergencies and Urgent Matters

FOR ALL MEDICAL EMERGENCIES, CALL 911 OR GO TO THE NEAREST EMERGENCY DEPARTMENT.

Do not use MyBaystate Health messaging, prescription-renewal requests, scheduling tools, or other portal features for urgent or emergency medical needs. Portal communications may not be reviewed immediately. If your concern is not an emergency but you need a response sooner than the response time stated in the portal or by your provider, contact your provider’s office directly by telephone.

Messaging and Electronic Communications

MyBaystate Health messaging is intended to support communication about non-urgent health matters and other services made available through the portal. Messages and requests may be routed to the appropriate Baystate Health department, care-team member, clinical pool, or other authorized workforce member for handling. A person other than the specific provider you expected may review or respond to a message when necessary to address your request.

Your care team may send messages, test results, documents, appointment information, reminders, and other communications through MyBaystate Health. Baystate Health may also send email or in-app notifications alerting you to new portal activity. Notifications sent outside the authenticated portal may not contain the full details of your health information and may be visible to anyone who has access to your email account, device, or notification settings. You are responsible for keeping your contact information current and reviewing portal communications in a timely manner.

Messages you send or receive through MyBaystate Health may become part of your medical record and may be available to Baystate Health workforce members, including members of your care team and other personnel who need access to perform their duties, as permitted by applicable law or hospital policy involved in your care as permitted by law.

Do not use MyBaystate Health to send unlawful, threatening, harassing, abusive, or offensive content.

Proxy and Authorized Access

If you are legally authorized to view or manage another person’s health information, Baystate Health may provide you with proxy or authorized access to that person’s MyBaystate Health information, subject to applicable law, Baystate Health policy, and the permissions available in the portal.

Federal and state laws and Baystate Health confidentiality policies may restrict access to certain sensitive information, particularly information about adolescent patients. As a result, proxy access may not include all information available to the patient. Baystate Health may restrict categories of information from proxy view, and proxy access may change or end when a patient reaches an applicable age or when the patient’s legal status or authorization changes.

If you authorize another person to act as your proxy, you are responsible for your decision to grant that access. Provide proxy access only to people you trust. Available proxy permissions may be modified or removed as permitted by the portal, applicable law, and Baystate Health policy.

Your Clinical Information and Medical Record

Baystate Health maintains medical records as required by law and clinical practice. MyBaystate Health provides online access to information made available from those records, but it may not display every part of your medical record. The availability, timing, and presentation of clinical information may depend on applicable law, clinical workflows, and portal functionality.

Information you enter or submit through MyBaystate Health, including messages, forms, requests, and other health-related information, may become part of your EMR or other Baystate Health records. Information that becomes part of a Baystate Health record may remain there even if you later stop using MyBaystate Health.

If you believe information displayed in MyBaystate Health is inaccurate, contact your provider or use an available record-correction process. Closing or disabling portal access does not delete information that is part of your medical record or other information Baystate Health is required or permitted to retain.

Information MyBaystate Health May Obtain

Information associated with MyBaystate Health may come from the following sources:

• Information you provide directly, including contact information, demographic information, messages, forms, appointment requests, prescription-renewal requests, and other information supported by the portal.
• Information contained in your Baystate Health EMR and related clinical or administrative systems that is made available through the portal.
• Information provided by a proxy, caregiver, or other person or organization you authorize to act on your behalf.
• Technical and security information generated through your use of the portal, such as Internet Protocol (IP) address, device and browser information, login and authentication activity, dates and times of access, feature usage, error information, and security-related event data.

Cookies and Similar Technologies

MyBaystate Health may use cookies, local storage, or similar technologies that are necessary for authentication, session management, security, preferences, performance, and other portal functions. Blocking technologies required for portal operation may prevent you from signing in or cause features not to work correctly.

Baystate Health and its portal service providers may use technical and usage information as permitted by law and applicable agreements to operate, secure, support, troubleshoot, and improve MyBaystate Health. This document does not authorize the disclosure of PHI to advertising services or other third parties except as permitted by applicable law and Baystate Health policy.

How Information May Be Used

Information associated with MyBaystate Health may be used to:

• Provide, administer, authenticate, secure, and support portal accounts and portal services;
• Connect you to information in your EMR and other Baystate Health systems:
• Enable communications with your care team and process requests you submit through the portal;
• Provide portal notices, reminders, appointment communications, results or document notifications, and account-security communications;
• Troubleshoot problems, prevent fraud or misuse, investigate security events, and maintain system reliability;
• Improve portal functionality, accessibility, usability, and performance; and
• Comply with applicable law, legal process, regulatory requirements, and Baystate Health policies.

Use and disclosure of PHI for treatment, payment, health care operations, and other purposes is governed by applicable law and described in the Baystate Health Notice of Privacy Practices.

When Information May Be Shared

Baystate Health does not sell information associated with MyBaystate Health. Information associated with MyBaystate Health may be shared as permitted by law and Baystate Health policy, including in the following circumstances:

Service Providers and Baystate Health Affiliates

Baystate Health may provide information to affiliates, contractors, and service providers, including Oracle Health and other vendors that help host, operate, secure, support, or maintain portal services. These parties may use information only as authorized by their agreements with Baystate Health and applicable law.

People and Services You Authorize

If you grant proxy access, share portal content, connect an authorized third-party application, or otherwise direct Baystate Health to provide information to another person or service, information may be disclosed according to the authorization, permissions you establish, and applicable law. Third-party applications and services may have their own privacy and security practices.

Legal, Regulatory, and Safety Purposes

Information may be disclosed when required or permitted by law, including in response to lawful subpoenas, court orders, legal process, governmental requests, or when reasonably necessary to investigate fraud, misuse, security incidents, threats to safety, or violations of these Policy and Terms, subject to applicable privacy laws and the Baystate Health Notice of Privacy Practices.

Security and Confidentiality

Baystate Health and its service providers use reasonable and appropriate administrative, technical, and physical safeguards to protect information available through MyBaystate Health. However, no electronic system or method of transmission can be guaranteed to be completely secure or continuously available.

You can help protect your information by using a strong password, protecting your authentication methods, signing out on shared devices, keeping your contact information current, and promptly reporting suspected unauthorized access. Do not share your password or authentication codes with others.

Electronic services may be delayed, interrupted, or unavailable because of maintenance, telecommunications failures, system outages, or other circumstances outside Baystate Health’s control. If you need information or care and the portal is unavailable, contact your provider’s office or use another appropriate method of communication.

Third-Party Websites, Applications, and Services

MyBaystate Health may contain links to or connect with websites, applications, devices, or services that are not operated by Baystate Health. Unless Baystate Health expressly states otherwise, Baystate Health does not control those third parties and is not responsible for their content, availability, privacy practices, or security practices. Your use of a third-party service may be governed by separate terms and privacy policies. Review those terms and privacy practices before authorizing access to your information.

Prohibited Use

You may not use MyBaystate Health for any unlawful purpose or in a way that could damage, disable, overburden, impair, interfere with, or attempt to gain unauthorized access to the portal, its systems, its data, or another person’s account. You may not attempt to obtain information or materials through means not intentionally made available through MyBaystate Health.

Copyright, Trademarks, and Limited License

Content available through MyBaystate Health, including text, graphics, logos, icons, images, software, and other materials, may be owned by Baystate Health, its affiliates, Oracle Health, or other licensors and is protected by applicable intellectual property laws. No ownership rights are transferred to you by these Policy and Terms or your access or use of MyBaystate Health.

Baystate Health grants you a personal, limited, non-exclusive, non-transferable, revocable license to use MyBaystate Health for its intended patient-care and account-management purposes, subject to these Policy and Terms. You may not reproduce, sell, resell, commercially exploit, scrape, data-mine, or create derivative works from portal content except as permitted by law or with appropriate authorization.

Availability; No Warranties; Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, MYBAYSTATE HEALTH AND ITS CONTENT AND SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. BAYSTATE HEALTH AND ITS SUPPLIERS DO NOT WARRANT THAT THE PORTAL WILL BE AVAILABLE AT ALL TIMES, ERROR-FREE, OR UNINTERRUPTED, OR THAT ALL DEFECTS WILL BE CORRECTED.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, BAYSTATE HEALTH, ITS AFFILIATES, AND THEIR SUPPLIERS DISCLAIM WARRANTIES, EXPRESS OR IMPLIED, AND WILL NOT BE LIABLE FOR DAMAGES ARISING FROM YOUR ACCESS OR USE OF MYBAYSTATE HEALTH, ITS UNAVAILABILITY OR DELAY, THIRD-PARTY CONTENT, OR YOUR FAILURE TO REVIEW PORTAL COMMUNICATIONS IN A TIMELY MANNER, EXCEPT TO THE EXTENT LIABILITY CANNOT BE LIMITED OR EXCLUDED BY LAW.

Suspension, Termination, and Discontinuing Use

You may stop using MyBaystate Health at any time. Baystate Health may limit, suspend, or discontinue portal access when reasonably necessary for security, legal, operational, patient-safety, or policy reasons, or as otherwise permitted by law.

Ending portal access does not end your relationship with Baystate Health and does not delete information that is part of your medical record or other records Baystate Health is required or permitted to retain.

Governing Law

These Policy and Terms are governed by the laws of the Commonwealth of Massachusetts, without regard to conflict-of-law principles. To the extent permitted by law, any dispute concerning these Policy and Terms or the access or use of MyBaystate Health will be subject to the jurisdiction of the courts located in Hampden County, Massachusetts.

Changes to These Policy and Terms

Baystate Health may revise these Policy and Terms as MyBaystate Health features, technologies, laws, or privacy and security practices change. Baystate Health will take reasonable steps to notify users of material changes when appropriate. The effective and revised dates will be displayed with this document. Your continued use of MyBaystate Health after a revised version becomes effective constitutes acceptance of the revised version to the extent permitted by law.

Contact and Support

For current MyBaystate Health support information, portal access assistance, and links to Baystate Health privacy information, visit baystatehealth.org/mybaystatehealth.

Questions or concerns about Baystate Health’s privacy practices may also be directed using the contact information in the Baystate Health Notice of Privacy Practices.