Patient Privacy Policy 

HIPAA NOTICE OF PRIVACY PRACTICES

Effective Date: July 1, 2016

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice (“Notice”) is provided to you pursuant to the Health Insurance Portability and Accountability Act of 1996, and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act (as amended from time to time, “HIPAA”). It is designed to tell you how we may, under federal law, use or disclose your health information.

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC (sometimes referred to in this Notice as the “Practice”, “we” or “us”) is required by law to provide you with this Notice of our legal duties and privacy practices with respect to your health information that we maintain. HIPAA places certain obligations upon us with regard to your protected health information (“Health Information”) and requires that we keep confidential any medical information that identifies you. We take this obligation seriously and when we need to use or disclose your Health Information, we will comply with the full terms of this Notice. Anytime we are permitted to or required to share your Health Information with others, we only provide the minimum amount of data necessary to respond to the need or request unless otherwise permitted by law.

I. USES AND DISCLOSURES OF YOUR HEALTH INFORMATION THAT DO NOT REQUIRE YOUR AUTHORIZATION.

We are permitted by law to use and disclose your Health Information without your written or other form of authorization under certain circumstances as described below. This means that we do not have to ask you before we use or disclose your Health Information for purposes such as to provide you with treatment, seek payment for the services we provide to you, or for our health care operations. We may also use or disclose your Health Information without your authorization for other activities or to state and/or federal officials as discussed below.

• Treatment, Payment and Health Care Operations.

o Treatment. We may use and disclose your Health Information to provide you with medical treatment or services. We may disclose your Health Information to doctors, nurses, technicians, medical students, and personnel who are involved in your care. For example, a doctor treating you for an injury may need to know if you have diabetes because diabetes may slow the healing process.

o Payment. We may use and disclose your Health Information so that the treatment and services you receive may be billed to and

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

payment may be collected from you, the government, an insurance company or a third party. For example, we may also tell your insurer or governmental payer about a treatment you are going to receive to obtain prior approval or to determine whether your plan or the government will cover the cost of the treatment.

o Health Care Operations. We may use and disclose your Health Information to manage our operations or the operations of another provider or payer. These uses and disclosures are necessary to run the practice and make sure that all of our patients receive quality care. For example, we may use Health Information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine Health Information about many of our patients to decide what additional services that we should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, direct care providers and other personnel for review and learning purposes. We may also disclose information in order to comply with reporting requirements under state, local or federal law. We may remove information that identifies you from this set of protected health information so others may use it to study health care and health care delivery without learning your identity.

• To Other Healthcare Providers. We may disclose your Health Information to other health care professionals where it may be required by them to treat you, to obtain payment for the services they provided to you or to perform their own health care operations.

• Disclosures to Relatives, Close Friends, Caregivers. We may disclose your Health Information to family members and relatives, close friends, caregivers or other individuals that you may identify so long as we:

o Obtain your authorization;

o Provide you with the opportunity to object to the disclosure and you do not object; or

o We reasonably infer that you would not object to the disclosure.

If you are not present or, due to your incapacity or an emergency, you are unable to agree or object to a use or disclosure of your Health Information, we may exercise our professional judgment in order to determine whether such use or disclosure would be in your best interests. Where we would disclose information to a family member, other relatives, or a close friend, we would disclose only the information that we believe is directly relevant to his or her involvement with your care or payment related to your care. We will also disclose your Health Information in order to notify or assist with notifying such persons of your location, general condition or death. You may, at any time, request that we do NOT disclose your Health Information to any of these individuals.

• Public Health Activities. We may disclose your Health Information for certain public health activities as required by law, including:

o to report Health Information to public health authorities for the purpose of preventing or controlling disease, injury or disability;

o to report certain immunization information where required by law, such as to the state immunization registry or to your child's school;

o to report births and deaths;

o to report child abuse to public health authorities or other government authorities authorized by law to receive such reports;

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

o to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration, such as reactions to medications;

o to notify you and other patients of any product or medication recalls that may affect you;

o to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; and

o to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.

• Health Oversight Activities. We may disclose your Health Information to a health oversight agency such as Medicaid or Medicare that oversees health care systems and delivery, to assist with audits or investigations designed for ensuring compliance with such government health care programs.

• Victims of Abuse, Neglect, Domestic Violence. Where we have reason to believe that you are or may be a victim of abuse, neglect or domestic violence, we may disclose your Health Information to the proper governmental authority, including social or protective service agencies, that are authorized by law to receive such reports.

• Judicial and Administrative Proceedings. We may disclose your Health Information pursuant to a court order, subpoena or other lawful process in the course of a judicial or administrative proceeding. For example, we may disclose your Health Information in the course of a lawsuit you have initiated against another for compensation or damage for personal injuries you received to that person or his/her insurance carrier.

• Law Enforcement Officials. We may disclose your Health Information to police or other law enforcement officials as may be required or permitted by law or pursuant to a court order, subpoena or other lawful process. For example, we may disclose your Health Information to police in order to identify a suspect, fugitive, material witness or missing person. We may also disclose your Health Information to police where it may concern a death we believe is a result of criminal conduct or due to criminal conduct within our premises. We may also disclose your Health Information where it would be necessary in an emergency to report a crime, identify a victim of a crime, or identify or locate the person who may have committed a crime.

• Decedents. We may disclose your Health Information to medical coroners for purposes of identifying or determining cause of death or to funeral directors in order for them to carry out their duties as permitted or required by law.

• Workers Compensation. We may use or disclose your Health Information to the extent necessary to comply with state law for workers’ compensation or other similar programs, for example, regarding a work- related injury you received.

• Research. Although generally we will ask for your written authorization for any use or disclosure of your Health Information for research purposes, we may use or disclose your Health Information to researchers conducting research that has been approved by our research committee.

• Fundraising. We may disclose your demographic information and the dates that you received treatment from a physician, as necessary, in order to contact you for fundraising activities supported by CAO. If you do not want to receive these materials, please contact our office and request that these fundraising materials not be sent to you.

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

• Health or Safety. We may use or disclose your Health Information where necessary to prevent or lessen threat of imminent, serious physical violence against you or another identifiable individual, or a threat to the general public.

• Military and Veterans. For members of the armed forces and veterans, we may disclose your Health Information as may be required by military command authorities. If you are a foreign military personnel member, your Health Information may also be released to appropriate foreign military authority.

• Specialized Government Functions. We may disclose your Health Information to governmental units with special functions under certain circumstances. For example, your Health Information may be disclosed to any of the U.S. Armed Forces or the U.S. Department of State.

• National Security and Intelligence Activities. We may disclose your Health Information to authorized federal officials for purpose of intelligence, counterintelligence and other national security activities that may be authorized by law.

• Protective Services for the President and Others. We may disclose your Health Information to authorized federal officials for purposes of providing protection to the President of the United States, other authorized persons or foreign heads of state or for purposes of conducting special investigations.

• Inmates. If you are an inmate in a correctional institution or otherwise in the custody of law enforcement, we may disclose your Health Information to the correctional institution or law enforcement official(s) where necessary:

o For the institution to provide health care;

o To protect your health and safety or the health and safety of others; or

o For the safety and security of the correctional institution.

• Organ and Tissue Procurement. If you are an organ donor, we may disclose your Health Information to organizations that facilitate or procure organs, tissue or eye donations or transplantation.

• As Required by Law. We may use or disclose your Health Information in any other circumstances other than those listed above where we would be required by state or federal law or regulation to do so.

• HIE Participation. We may use or disclose your Health Information in connection with an electronic Health Information Exchange (“HIE”) that we may participate in for your treatment, whether you have health insurance and what it may cover, and to evaluate and improve the quality of medical care provided to all of our patients. Other health care providers, such as physicians, hospitals and other health care facilities, may also have access to your information in the HIE for similar purposes to the extent permitted by law. You have the right to “opt- out” or decline to participate in the HIE and we will provide you with this right at the earliest opportunity. If you choose to opt-out of the HIE, we will not use or disclose any of your information in connection with the HIE. To “opt-out” or decline to participate in the HIE, please contact the Division’s Administrator.

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

II. USES AND DISCLOSURES OF YOUR HEALTH INFORMATION THAT REQUIRE YOUR WRITTEN AUTHORIZATION.

In general, we will need your specific written authorization on our HIPAA Authorization Form to use or disclose your Health Information for any purpose other than those listed above in Section I. For example, in order for us to send your information to your life insurance company, you would need to sign our HIPAA Authorization Form and tell us what information you would like sent.

We will seek your specific written authorization for at least the following information unless the use or disclosure would be otherwise permitted or required by law as described above:

o HIV/AIDS Information. In most cases, we will NOT release any of your HIV/AIDS related information unless your authorization expressly states that we may do so. There are certain purposes, however, for which we may be permitted to release your HIV/AIDS information without obtaining your express authorization, such as to state agencies, upon court order or as otherwise permitted under applicable law.

• Sexually Transmitted Disease Information. We must obtain your specific written authorization prior to disclosing any information that would identify you as having or being suspected of having a sexually transmitted disease. We may use and disclose information related to sexually transmitted diseases without obtaining your authorization only where permitted by law.

• Tuberculosis Information. We must obtain your specific written authorization prior to disclosing any information that would identify you as having or being suspected of having tuberculosis (“TB”). We may use and disclose information related to TB without

obtaining your authorization where authorized by law.

• Psychotherapy Notes. In most cases we must obtain your specific written authorization prior to disclosing any psychotherapy notes unless otherwise permitted by law. Nevertheless, there are certain purposes for which we may disclose psychotherapy notes, without obtaining your Authorization, including: (1) to carry out certain treatment, payment or healthcare operations (e.g., use for the purposes of your treatment, for our own training, and to defend ourselves in a legal action or other proceeding brought by you), (2) to the Secretary of the Department of Health and Human Services to determine our compliance with the law, (3) as required by law, (4) for health oversight activities authorized by law, (5) to medical examiners or coroners as permitted by state law, or (6) for the purposes of preventing or lessening a serious or imminent threat to the health or safety of a person or the public.

• Mental Health Information. Generally, we must obtain your specific written authorization prior to disclosing certain mental health information or information that would identify you as having a mental health condition. We may use and disclose information related to your mental health without obtaining your authorization only where permitted by law.

• Drug and Alcohol Information. We must obtain your specific written authorization prior to disclosing information related to drug and alcohol treatment or rehabilitation under certain circumstances such as where you received drug or alcohol treatment at a federally funded treatment facility or program.

• Genetic Information. We must obtain your specific written authorization prior to using or disclosing your genetic information for treatment, payment or health care operations purposes. We may use or disclose

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

your genetic information, or the genetic information of your child, without your written authorization only where it would be permitted by law.

• Information Related to Emancipated Treatment of a Minor. If you are a minor who sought emancipated treatment from us, such as treatment related to your pregnancy or treatment related to your child, or a sexually transmitted disease, we must obtain your specific written authorization prior to disclosing any of your Health Information related to such treatment to another person, including your parent(s) or guardian(s), unless otherwise permitted or required by law.

• Marketing Activities. We must obtain your specific written authorization in order to use any of your Health Information to provide you with marketing materials by mail, email or telephone. We may, however, provide you with marketing materials face-to-face without obtaining such authorization, in addition to communicating with you about services or products that relate to your treatment, case management, or care coordination, alternative treatments, therapies, providers or care settings. If you do provide us with your written authorization to send you marketing materials, you have a right to revoke your authorization at any time. If you wish to revoke your authorization, please contact the Division’s Administrator or CAO Privacy Officer’s number or mailing address provided in Section VI of this Notice.

• Activities Where We Receive Money for Giving Your Health Information to a Third- Party. For certain activities in which we would receive remuneration, directly or indirectly, from a third-party in exchange for your Health Information, we must obtain your specific written authorization prior to doing so. We would not, however, require your authorization for activities such as for treatment, public health or research purposes. If you do provide us with your written

authorization, you have a right to revoke your authorization at any time. If you wish to revoke your authorization, please contact the Division’s Administrator.

III. YOUR RIGHTS.

1. Right to Request Additional Restrictions. You have the right to request restrictions on the uses and disclosures of your Health Information, such as:

• For treatment, payment and health care operations,

• To individuals involved in your care or payment related to your care, or

• To notify or assist individuals locate you or obtain information about your condition

Although we will carefully consider all requests for additional restrictions on how we will use or disclose your Health Information, we are not required to grant your request unless your request relates solely to disclosure of your Health Information to a health plan or other payer for the sole purpose of payment or health care operations for a health care item or service that you or your representative have paid us for in - full and out-of-pocket. Requests for restrictions must be in writing. Please contact the Division’s Administrator if you wish to request a restriction.

2. Right to Confidential Communications. You have the right to make a reasonable written request to receive your Health Information by alternative and reasonable means of communication or at alternative reasonable locations.

3. Right to Inspect/Copy Health Information. You have the right to inspect and request copies of your Health Information that we maintain. For Health Information that we maintain in any electronic designated record set, you may request a copy of such

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

Health Information in a reasonable electronic format, if readily producible. However, under limited circumstances, you may be denied access to a portion of your records. For example, if your doctor believes that certain information contained within your medical record could be harmful to you, we would not release that information to you. Please contact the Division’s Administrator. If you would like to inspect or request copies of your Health Information from us. We may charge you a reasonable fee for paper copies of your Health Information or the amount of our reasonable labor costs for a copy of your Health Information in an electronic format.

4. Right to Notice of Breach. We take very seriously the confidentiality of our patients’ information, and we are required by law to protect the privacy and security of your Health Information through appropriate safeguards. We will notify you in the event a breach occurs involving or potentially involving your unsecured Health Information and inform you of what steps you may need to take to protect yourself.

5. Right to Paper Copy of Notice of Privacy Practices. You may at any time request a paper copy of this Notice, even if you previously agreed to receive this Notice by email or other electronic format. Please contact the Division’s Administrator to obtain a paper copy of this Notice.

6. Right to Revoke Authorization. After providing the Practice with your authorization to use and disclose your Health Information, you may, at any time revoke, such authorization, regardless of whether your initial authorization was given verbally or in writing. You are generally required to revoke your authorization in writing by contacting the Division’s Administrator or CAO Privacy Officer at the phone number or mailing address provided in Section VI of this Notice, unless the Privacy Officer directs otherwise. Any revocation will be granted except to the

extent we may have taken action in reliance upon your authorization.

7. Right to Request Amendment. You may request that we amend, or change, your Health Information that we maintain by contacting the Division’s Administrator or the CAO Privacy Officer at the phone number or mailing address provided in Section VI of this Notice. Requests for amendments must be in writing. We will generally comply with your request, unless:

• We believe the information is accurate and complete;

• We maintain the information you have asked us to change, but we did not create or author it; for example, your medical records from another doctor were brought to us and incorporated into your medical records with our doctors; or

• The information is not part of the designated record set or otherwise unavailable for inspection.

8. Right to an Accounting. You may request an accounting of certain disclosures we have made of your Health Information within the period of six (6) years from the date of your request for the accounting. The first accounting you request within a period of twelve (12) months is free. Any subsequently requested accountings may result in a reasonable charge for the accounting statement. Please contact the Division’s Administrator if you wish to request an accounting of disclosures. We will generally respond to your request in writing within thirty (30) days from receipt of the request.

IV. OUR DUTIES.

We are required by law to maintain the privacy of your Health Information and to provide you with a copy of this Notice. We are also required to abide by the terms of this

REVISED: MAY 2016

CENTERS FOR ADVANCED ORTHOPAEDICS, LLC

NOTICE OF PRIVACY PRACTICES

Notice.

HIPAA generally does not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections than those provided under HIPAA. Therefore, to the extent state law applies that is more stringent than HIPAA, we may be required to operate under that applicable state privacy standard.

We reserve the right to amend this Notice at any time in the future and to make the new Notice provisions applicable to all your Health Information, even if it was created prior to the change in the Notice. If we do change this Notice, we will only make changes to the extent permitted by law. We will also make the revised Notice available to you by posting it in a place where individuals seeking services

VI. CONTACT INFORMATION.

from us will be able to read the Notice, as well as on our website provided in Section VII of this Notice. You may obtain the new Notice in hard copy at your Division of care, as well from CAO’s Privacy Officer, provided in Section VI.

V. COMPLAINTS TO THE GOVERNMENT.

You may make complaints to the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights with respect to your Health Information have been violated.

We will not to retaliate against you for any complaint you make to the Practice or to the government about our privacy practices.

VII. ELECTRONIC NOTICE

The current version of this Notice of Privacy page at www.cfaortho.com.

Practices is also available on our web

REVISED: MAY 2016