Privacy Notice

NOTICE OF PRIVACY PRACTICES

It is our goal to provide each of our patients with the best medical care and maintain the highest standard of excellence.

Revision date: 9/23/13

Any change to this notice will be posted and dated immediately. A copy of the revised Notice of Privacy Policies will be available upon request.

I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

II. WE HAVE A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (“PHI").

This notice explains how we use and disclose your protected health information ("PHI" for short). We are required by law to protect the privacy of PHI, and to provide you with this notice and follow the privacy practices described in it.

PHI includes information that we create or receive about your past, present, or future physical or mental health or condition, the provision of health care to you,

We may change the terms of this notice and our privacy practices al any time. Any change we make will apply lo the PHI we already have as well as to any new PHI we create or receive. When we change our practices, we will promptly change this notice and post it in the main reception areas of our offices (and on our web site at www.universityorthopedics.com).

III. HOW WE MAY USE AND DISCLOSE YOUR PHI.

We use and disclose PHI for many different reasons. Below, we describe the different reasons and give you some examples.

A. Use and Disclosure of PHI for Treatment, Payment, or Health Care Operations. We may use and disclose PHI for the following reasons:

1. For treatment. We may use and disclose PHI to physicians, nurses, and others who provide you with health care services or who are involved in your care. For example, nurses, physician assistants, and other medical personnel will report PHI lo your physician in order to facilitate providing you care. We also may disclose your PHI to health care providers outside of this practice in order to coordinate your care.

2. For payment. We may use and disclose PH I in order to bi ll and collect payment for the treatment and services we provide to you. For example, we may disc lose PHI to your health plan to get paid for the health care services we provide to you. We may also disclose PHI to billing companies and companies that process our health care insurance claims.

3. For health care operations. We may use and disclose PHI in order to operate this medical practice. For example, we may use PHI in order to evaluate the quality of health care services that you receive, or to evaluate the health care professionals who provide health care services to you. We may also disclose PHI to our accountants, attorneys, and others in order to make sure we are complying with the laws that affect us. We will obtain your consent before disclosing your PHI for the purposes of our health care operations if state law requires us to do so.

B. Other Uses of PHI. We may also use and disclose your PHI for the following reasons:

1. Reports required by law. We may disclose PHI when we are legally required to do so. For example, we may use PHI to make mandatory reports to various government agencies about communicable diseases; patients whom we believe to be victims of abuse, mistreatment, or neglect; problems with medical and other products, and reactions to medications; and certain types of deaths and injuries.

2. Health oversight. We may disclose your PHI to government agencies authorized by law to license, audit, inspect, or investigate health care providers and the health care system.

3. Research. We may use and disclose your PHI for research purposes, provided that certain procedures set by state and federal law are followed.

4. To avoid harm. Consistent with state law, we may disclose PHI to the police or other appropriate persons in order to avoid a serious threat to the health or safety of a patient, another person, or the publ ic.

5. Appointment reminders, treatment alternatives, and health-related benefits or services. We may use PHJ to give you appointment reminders; or give you information about treatment choices or other health care services or benefits we offer.

6. Death Certificates. We may release a copy of the death certificate of a deceased patient to funeral directors or medical examiners.

7. Work Related Injuries & Illnesses. If we provide health care to you for a work-related injury, we may release PHI about you to workers compensation or similar programs that provide benefits for purposes of work related injuries or illness, as permitted by state law.

8. Legal Proceedings. We may disc lose PHI pursuant to a valid court order, search warrant, and, under certain circumstances, in response to a subpoena or other discovery request.

9. As required by law. We will disclose PHI

C. When our Use or Disclosure of PHI Requires Your Prior Written Authorization. We must ask for your written authorization for any use or disclosure of PHI not described in section Ill-A or III-B above. If you authorize us to use or disclose your PH I, you can later withdraw the authorization and stop any future use or disclosure of your PHI based on it. You can withdraw an authorization by written request to the Privacy Officer.

The following three areas REQUIRE authorization:

I. Disclosure of psychotherapy notes

2. Disclosures for marketing purposes

3. Disclosures that constitute sale of PHI

IV. YOUR RIGHTS REGARDING YOUR PHI.

A. Your Right to Request Limits on Our Use and Disclosure of PHI. You may ask that we limit how we use and disclose your PHI. We will consider your request but are not legally required to agree to it. lf we agree to your request, we will comply with your limits, except in emergency situations.

1. You do have the right to restrict disclosures of PHl to a health plan for payment or health care operation purposes (but NOT for treatment purposes) for items or services which you have paid for in full and out-of-pocket.

2. If we decide to use PHI for fund-raising purposes, we must inform you of our intent and you have the right to opt out of receiving fund-raising communications.

3. You have the right to be notified following the breach of your unsecured PHI. Our compliance culture is strict and respectful of the need for complete confidentiality. No efforts are spared in maintaining the HIPAA mandate of privacy and security for PHI.

B. Your Right to Choose How We Send PHI to You. You may ask that we send information to you at a different address (for example, to your work address rather than your home address) or by different means (for example, by mail instead of telephone). We will agree to your request, as long as we can easily provide the information in the way you request.

C. Your Right to View and Get a Copy of Your PHI. You have the right to view or obtain a copy of your PHI. Your request must be in writing. However, there are some circumstances in which we may deny your request. If we deny your request, we will tell you, in writing, our reason(s) for the denial and explain what appeal rights, if any, you have.

If you request a copy of your PHI, we may charge a fee for it if permitted to do so by the law. Instead of providing the PHI you requested, we may offer to give you a summary or explanation of the PHI, as long as you agree to it, and to the associated cost, in advance.

D. Your Right to a List of the Disclosures We Have Made. You have the right to an accounting of instances in which we disclose your PHI to others. Some disclosures will not be listed, however. For example, the list will not include disclosures made for the purpose(s) of treatment, payment, or health care operations, or disclosures that you authorized or that were made directly to you.

We will report disclosures made within the six years prior to your request, unless you request a shorter timeframe. However, our obligation to account for disclosures begins with disclosures made after April 13, 2003.

If you ask for more than one accounting within a twelve-month period, we may charge you a fee for every accounting provided after the first one. For a list of disclosures you must submit a request to the Privacy Officer.

E. Your Right to Correct or Update Your PHI. If you feel that there is a mistake in your PHI, or that important information is missing, you may request a correction. Your request must be in writing and include the reasons for the request. Your request must be made to the Privacy Officer.

We may deny your request for a variety of reasons. If we deny your request, we will inform you in writing of the reason(s) for the denial and explain your rights regarding responding to the denial.

If we agree to your request, we will change your PHI, inform you of the change, and tell others who need to know about the change to your PHI.

F. Your Right to a Paper Copy of This Notice. You have the right to a paper copy ohhis notice, even if you agreed to receive it electronically. You may request a paper copy at any time.

V. PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES.

If you have any questions about this notice, wish to exercise any of the rights explained in it or file a complaint about our privacy practices, feel that we may have violated your privacy rights, or disagree with a decision we made about your PHI, please contact the practice's Privacy Officer, Kim Brown, at (401) 457-1571 or kbrown@univerisityorthopedics.com.

You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

VI. EFFECTIVE DATE OF THIS NOTICE.

This notice is effective as of September 23, 2013, and supersedes any and all prior versions of this notice.

HIPAA HOTLINE: You may leave your name and contact information or remain anonymous. ALL issues will be treated with respect and confidentiality. 401.457.2111