Notice of
Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

During your treatment at Five Rivers Health Centers, doctors, nurses, and other caregivers may gather and/or generate information about your medical history and your current health (“protected health information” or “PHI”). This notice will explain how such information may be used and shared with others. It will also explain your privacy rights regarding your PHI.

We are required by law to make sure your PHI is kept private, to give you this Notice to tell you how we use and share your PHI, and what your rights are. We will notify you if a breach of the privacy of your PHI occurs. We are required to abide by the Notice currently in effect. We reserve the right to change the terms of this Notice and any new terms will affect all PHI that we maintain at that time. If the Notice is revised, we will provide a new version of the Notice to you if you request, and we will post a copy of the revised Notice in our office and on our website. You may receive a paper copy of this Notice at our office during normal business hours upon request. If you agree to receive electronic notices by e-mail, then you may receive an electronic copy of this Notice by e-mail upon request. Even if you have agreed to receive an electronic Notice, you may still request to receive a paper copy in the manner set forth above.

We will ask for your signature to verify that you have received a copy of this Notice. If you request, or are not able to sign, a staff member will sign their name and date.

I. HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

PHI we may use or share without your consent:

For Treatment. We will use PHI about you to provide you with treatment. People who care for you need to know about your health problems so that they can give you safe and complete care. These people include doctors, nurses, health students/residents/interns, home health agencies, nursing homes, laboratories,hospitals, equipment providers, or others we use to help provide services that are part of your ongoing care.Some examples of how we use and share information are: (1) if you have diabetes, the nutritionist needs to know this to help you plan safe meals; and (2) if you are admitted to the hospital, we may share information with the hospital to help with your care.

For Payment. We will share PHI about you so that we can get paid for your care. For example, we may share your PHI with your insurance company so that we get paid for your health care. We may also share it to get an okay from your insurer before you receive certain treatment (prior approval). That way, we know they will pay for your care.

For Health Care Operations. We will use and share medical information about you as part of improving care to all patients. For example, we will use your medical information to train doctors or other healthcare workers and students, or to look at how your care went and how we can improve care in the future. We may also combine health information about many patients to decide what additional services we should offer, what services are not needed, whether certain new treatments are effective, or to compare how we are doing with others and to see where we can make improvements. We may disclose your PHI to other healthcare providers for their health care operations if they have or had a relationship with you.

Business Associates. We may use or disclose your medical information to an outside person or company that assists us in operating our health centers. They perform various services for us. This includes, but is not limited to, auditing, accreditation, legal services, and consulting services. These outside companies are called “business associates” and they contract with us to keep any PHI received from us confidential in the same way we do. These companies may create or receive medical information on our behalf.

Family Members and Friends; Disaster Relief; Deceased Individuals. We may disclose PHI about you to a family member, relative, or another person identified by you who is involved in your health care or payment for your health care. If you are not present or are incapacitated or it is an emergency or disaster relief  situation, we will use our professional judgment to determine whether disclosing your medical information isin your best interest under the circumstances. We may disclose your medical information to a family member, relative, or another person who was involved in the health care or payment for health care of a deceased individual if not inconsistent with the prior expressed preferences of the individual that are known to Five Rivers. But you also have the right to request a restriction on our disclosure of your medical information to someone who is involved in your care.

Appointments. We may use and disclose PHI to contact you for appointment reminders, because you missed an appointment, and to communicate necessary information about your appointment.

Treatment Alternatives. We may use or disclose your PHI to tell you about treatment alternatives or to tell you about other health related benefits and services available to you.

Health Oversight Activities. We may use or disclose your PHI to let health oversight agencies make sure that we are following applicable laws. For example, these health oversight activities may include audits,investigations, inspections, licensure or disciplinary actions; or civil, administrative, or criminal proceedings or actions. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs, and government agencies that ensure compliance with civil rights laws.

Required or Permitted by Law. We may use or disclose your PHI when required or permitted to do so by federal, state, or local law.

Public Health Activities. We may use or disclose your PHI for public health activities that are permitted or required by law. For example, we may disclose information about you to (1) prevent or control disease,injury or disability; (2) report births and deaths, child abuse or neglect, domestic violence and reactions to medications or problems with products; (3) notify people of recalls of products they may be using; and (4)notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Lawsuits and Other Legal Proceedings. We may disclose your PHI in the course of any judicial or administrative proceeding (1) in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), or (2) in response to a subpoena, discovery request, or other lawful process by someone else involved in a dispute, only if efforts have been made to tell you about the requestor to obtain an order protecting the PHI requested.

Law Enforcement. Under certain conditions, we may disclose your PHI to law enforcement officials for law enforcement purposes. These law enforcement purposes include, by way of example, (1) responding to a court order or similar process; (2) as necessary to locate or identify a suspect, fugitive material witness, or missing person; (3) reporting suspicious wounds, burns or other physical injuries; or (4) reporting about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (5)report about a death we believe may be the result of criminal conduct; (6) report about criminal conduct a tour facility; and (7) in emergency circumstances to report a crime.

Abuse or Neglect. We may disclose your PHI to a government authority that is authorized by law to receive reports of abuse, neglect, or domestic violence if we have a reasonable belief that you may be a victim of abuse, neglect or domestic violence and if (i) you agree to the disclosure, (ii) the disclosure is required by law, or (iii) you are unable to agree because of incapacity and a law enforcement or other public official authorized to receive the report represents that the PHI for which disclosure is sought is not intended to be used against you and that an immediate enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until you are able to agree to the disclosure. In any of the situations, we will promptly inform you or your personal representative, if applicable, that such a disclosure has been or will be made unless we reasonably believe that notifying you would place you at risk of serious harm or if the personal representative to whom the disclosure would be made is reasonably believed by usto be responsible for the abuse, neglect, or injury and that informing such person would not be in your best interests. For the purpose of reporting child abuse or neglect, it is not necessary to inform the minor that such disclosure has been or will be made. Disclosure may generally be made to the minor’s parents or other representatives, with the foregoing limitation regarding personal representatives, with certain exceptions.

Organ, Eye and Tissue Donation. We will disclose PHI to organizations that obtain, bank or transplant organs or tissues.

Coroners, Medical Examiners and Funeral Directors. We may release your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. We may also release your PHI to a funeral director, as necessary, to carry out his/her duties.

Research. We may use or disclose your PHI for research projects, such as studying the effectiveness of a treatment you received. These research projects must go through a special process that protects the confidentiality of your medical information. All projects are evaluated to assure that they will be of direct or indirect benefit to our patients and/or community and must be approved by the Five Rivers Health Centers Board of Directors. We may disclose health information about you to people preparing to conduct a research project; for example to help them look for patients with specific health needs.

To Prevent a Serious Threat to Health or Safety. Consistent with applicable laws, we may disclose your PHI if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Military. If you are in the military, we may disclose your PHI if required by military rules.

Inmates at Correctional Institutions. If you are an inmate, we may disclose your PHI to the correctional institution or law enforcement officials for the institution to provide you with health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.

Shared Medical Record/Health Information Exchanges. We participate in one or more electronic Health Information Exchanges that facilitate access to PHI by other health care providers who provide you care.Your healthcare providers can use this electronic network to securely provide access to your health records for a better picture of your health care needs. We, and other healthcare providers, may allow access to your health information through the Health Information Exchange for treatment, payment or other health care operations. For example, if you are admitted on an emergency basis to another hospital that participates in the health information exchange, the exchange will allow us to make your PHI available electronically to those who need it to treat you. This is a voluntary agreement. You may opt-out of sharing via the health information exchange at any time by notifying The FRHC Quality and Compliance Officer at 937-208-8836 or find the link to the Opt-out/ refusal to consent form on our website http://www.fiverivershealthcenters.org/or Facebook page https://www.facebook.com/FiveRiversHealthCenters

Fundraising. We may use PHI, such as your name, address, telephone number, the dates you received services, and the department from which you received service, your treating physician, outcome information,and health insurance status to contact you to raise money for Five Rivers Health Centers. If you do not want us to contact you for our fundraising and you wish to opt out of these contacts, or if you wish to opt back into these contacts, you must call us at 937-734-6846.

Other Uses and Disclosures. Other uses and disclosures not described in this Notice will be made only with your written authorization.

PHI we may use or share only with your consent:

Required Authorization. The following uses and disclosures will be made only with your authorization: (1)most uses and disclosures of psychotherapy notes, (2) uses and disclosures of PHI for marketing purposes,(3) uses and disclosures that constitute the sale of PHI, and (4) other uses and disclosures not described in this Notice.

If you provide us with an authorization, you may withdraw the authorization in writing. Any withdrawal will be effective for future uses and disclosures of PHI, but it will not be effective for PHI that we have used or disclosed in reliance on the authorization.

Highly Confidential PHI. We follow federal and state laws that require special privacy protections when we use or share highly confidential PHI. For Instance, medical Information about communicable disease and HIV/AIDS, and evaluation and treatment for a serious mental illness or substance abuse, is treated differently than other types of medical information. We are required to obtain an authorization before using or disclosing highly confidential PHI in many circumstances.

II. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

The Right to Access to Your Own Health Information. You have the right to look at your own PHI and to get a copy of that information (the law requires us to keep the original record). This includes medical and billing records. You must sign a request form that you can get from the Medical Records Department. If you want copies, we will charge a reasonable fee for them. You can look at your record at no cost. In some cases, we may not let you see or copy your record. If that happens, we will tell you why and explain to you your right to have the denial reviewed. You also have the right to ask for a summary of this information. If you request a summary, we may charge you a nominal fee. You also have the right to request access to your PHI in electronic form, if it is readily producible in such form. We may charge you a nominal fee if you request that an electronic copy be provided on portable media.

The Right to Amend. You can ask us to make changes to your medical record if you think that what we have is wrong or not complete. You must put your request in writing on our amendment request form that we will provide to you upon your request and give a reason why you want to make the changes. We are not obligated to make all requested amendments but will give each request careful consideration. If we accept your request to amend the information, we will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of the information.

The Right to an Accounting. With some exceptions, you have the right to receive an accounting of certain disclosures of your PHI. You have to request this in writing. Your request must tell us a specific time period(beginning after April 14, 2003) of not more than the past six years. We will provide the first list to you free,but we may charge you for any additional lists you request during the same year.

The Right to Request Restrictions. You have the right to request certain restrictions of our use or disclosure of your PHI. For example, you could restrict a specified nurse from use of your information, or request that we not disclose information to your spouse about a surgery you had. We are not required to agree to your request in most cases. But if we agree to the restriction, we will comply with your request unless the information is needed to provide you emergency treatment. We will agree to restrict disclosure of your PHI to a health plan if the purpose of the disclosure is to carry out payment or health care operation sand the PHI pertains solely to the service for which you, or a person other than the health plan, have paid us for in full. Fox example, if you pay for a service completely out of pocket and ask us not to tell your insurance company about it, we will abide by this request. A request for restriction must be in writing to our Billings Department. We reserve the right to terminate any previously agreed-to restrictions (other than a restriction we are required to agree to by law). We will inform you of the termination of the agreed-to restriction and such termination will only be effective with respect to PHI created after we inform you of the termination.

The Right to Request Confidential Communications. You have the right to ask us in writing to send information to you at a different address or contact you in a different way. For example, you may ask us to send information to your work address or a post office box instead of your home address. You do not need to tell us the reason for this. We do not have to comply with your request if it is unreasonable.

The Right to be Notified of a Breach. You have the right to be notified in the event that we (or one of our Business Associates) discover a breach of your unsecured PHI.

The Right to Submit a Complaint. You have the right to complain if you believe your privacy rights have been violated. You may submit a complaint, in writing, to our Privacy Officer or to the Secretary of the U.S.Department of Health and Human Services. Making a complaint will not change how we treat you.

III. APPLICABILITY, CHANGES TO NOTICE, CONTACT INFORMATION, EFFECTIVE DATE

Applicability and Changes to Notice. This Notice applied to your entire PHI maintained by Five Rivers Health Centers, whether it is information we created or that we received somewhere else. We reserve the right to change the terms of the Notice. Your privacy rights may change if the laws change. When that happens, we will change the Notice and post it where you will be able to read it. The new Notice will apply to the entire PHI we have about you. We must follow the terms of the Notice that is currently in effect.

Contact Information. To exercise any of your rights described in this Notice, for more information, or to file a complaint please contact our Privacy Officer at 937-208-8836.

Effective Date. The effective date of this Notice is September 23, 2013