NOTICE OF PRIVACY PRACTICES:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Protected Health Information (PHI). While receiving care from our facility, information regarding your medical history, treatment, and payment for your health care may be originated and/or received by us. Information which can be used to identify you and which relates to your past, present or future medical condition, receipt of health care or payment for health care.

Our Responsibilities. Federal law imposes certain obligations and duties upon us as a covered health care provider with respect to your PHI. Specifically, we are required to:

• Provide you with notice of our legal duties and our facilities policies regarding the use and disclosure of your PHI;
• Abide by the terms of this notice;
• Reserve the right to change our Privacy Practices and apply the revised practices to the PHI previously created or received;
• Inform you of how to complain to the facility if you believe your privacy has been violated;
• Maintain the confidentiality of your PHI in accordance with state and federal law;
• Honor your requested restrictions regarding the use and disclosure of your PHI unless under the law we are authorized to release your PHI without your authorization, in which case you will be notified within a reasonable period of time;
• Allow you to inspect and copy your PHI during our regular business hours;
• Act on your request to amend PHI within sixty (60) days and notify you of any delay which would require us to extend the deadline by the permitted thirty (30) day extension; and
• Accommodate reasonable requests to communicate PHI by alternative means or methods.

How Your PHI May be Used and Disclosed. Generally, your PHI may be used and disclosed by us only with your express written authorization. However, there are some exceptions to this general rule.

Treatment Purposes. We may use or disclose your PHI for treatment purposes. During your care at Exceptional Care and Training Center (ECTC), it may be necessary for various personnel involved in your care to have access to your PHI in order to provide you with quality care. In addition, we may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. Situations may also arise when it is necessary to disclose your PHI to health care providers outside our facility who may also be involved in your care.

Payment Purposes. Your PHI may also be used or disclosed for payment purposes. It is necessary for us to use or disclose PHI so that treatment and services provided by us may be billed and collected from you, your insurance company, or other third party payer. It may also be necessary to release PHI to obtain prior approval from your health insurance. We may also release your PHI to another health care provider or individual or entity covered by the HIPAA privacy regulations who has a relationship with you for their payment activities.

Health Care Operations. Your PHI may also be used for health care operations, which are necessary to ensure our facility provides the highest quality of care. For example, your PHI may be used for quality assurance or risk management purposes. We may at times remove information that could identify you from your record so as to prevent others from learning who the specific residents are. In addition, we may release your PHI to another individual or entity covered by the HIPAA privacy regulations that has a relationship with you for their fraud and abuse detection or compliance purposes, quality assessment and improvement activities, or review, evaluation or training of health care professionals or students.

Notification and Communications to Individuals Involved in Your Care. Unless you have informed us otherwise, your PHI may be used or disclosed by us to notify or assist in notifying a family member or other person responsible for your care. In most cases, PHI disclosed for notification purposes will be limited to your name, location and general condition. In addition, unless you have informed us otherwise, PHI may be released to a family member, relative or close personal friend who is involved in your care to the extent necessary for them to participate in your care. In the event you wish for any of these uses or disclosures to be limited, please contact facility personnel.

Disaster Relief. We may disclose your PHI to an organization assisting in disaster relief efforts; however, we will first ask your permission to disclose such information. If seeking your permission is not feasible, we will disclose the information if in our professional judgment we determine the disclosure is in your best interests or that you would not have objected to the disclosure.

Fundraising Activities. We may use your PHI for the purpose of contacting you as part of a fund-raising effort. Only demographic information and the dates health care was provided to you will be used or disclosed in connection with fundraising efforts. If you do not wish to be contacted for fundraising activities, you may contact the Privacy Officer at ECTC to have your name removed from our fundraising list.

Special Circumstances. Situations may arise which warrant us to use or disclose PHI without your consent or authorization. The law specifically allows us to use or disclose PHI without your consent or authorization in the following special circumstances:

Public Health Risks. We are allowed to use or disclose your PHI for public health risks and purposes. Examples of public health risks that would warrant the use or disclosure of your PHI include:

• Preventing or controlling disease, injury or disability;
• Reporting births or deaths;
• Reporting the abuse or neglect of a child or dependent adult;
• Reporting reactions to medications or problems with products; or
• Notifying individuals exposed to a disease that may be at risk for contracting or spreading the disease.

Health Oversight Agencies. Your PHI may be used or disclosed to a health oversight agency for activities authorized by law. Examples of health oversight activities include state or federal audits, investigations, inspections or judicial/administrative proceedings that you are not the subject of. In most cases, the oversight activity will be for the purpose of overseeing the care rendered by our facility or our facility's compliance with certain laws and regulations.

Judicial and Administrative Proceedings. If you are involved in a lawsuit or other administrative proceeding, we may release your PHI in response to a court or administrative order requesting the release. In some instances, we may also release PHI pursuant to a subpoena or discovery request but only if efforts have been made by the requestor to provide you with notice of the request and you have failed to object or the objection was resolved in favor of disclosure, or in the alternative, the requestor has obtained a protective order protecting the requested information.

Victims of Abuse or Neglect. Other than child and dependent adult abuse which is covered under public health activities, we may use or disclose your PHI to a protective services or social services agency or other similar government authority, if we reasonably believe you have been the victim of abuse, neglect or domestic violence as long as you agree to such disclosure and we feel it is necessary to prevent serious harm to you or other individuals. If you are incapacitated and unable to agree to such a disclosure, we may release your PHI for this purpose but only if failure to release it would materially and adversely affect a law enforcement activity and the information will not be used, in any way, against you.

Law Enforcement. We may also release your PHI to a law enforcement official for the following purposes:

• Pursuant to a court order, warrant, subpoena/summons, or administrative request;
• Identifying or locating a suspect, fugitive, material witness or missing person;
• Regarding a crime victim, but only if the victim consents or the victim is unable to consent due to incapacity and the information is needed to determine if a crime has occurred, non-disclosure would significantly hinder the investigation, and disclosure is in the victim's best interest.
• Regarding a decedent, to alert law enforcement that the individual's death was caused by suspected criminal conduct; or
• By emergency care personnel if the information is necessary to alert law enforcement of a crime, the location of a crime, or characteristics of the perpetrator.

Coroner, Medical Examiners, Funeral Homes. PHI regarding a decedent may be released to a coroner or medical examiner for the purpose of identifying a deceased person, determining cause of death or other duties as authorized by law. PHI regarding a decedent may also be disclosed to funeral directors if necessary to carry out their duties.

Specialized Government Functions. Your PHI may be used or disclosed for a variety of government functions subject to some limitations. These government functions include:

• Military and veterans activities;
• National security and intelligence activities
• Protective service of the President and others;
• Medical suitability determinations for Department of State officials;
• Correctional institutions and law enforcement custodial situations; or
• Provision of public benefits.

Organ Donation. Your PHI may be used or disclosed by us to entities engaged in the procurement, banking or transplantation of organs, eyes or tissues for the purpose of facilitating such donation and transplantation.

Workers' Compensation. We are allowed to disclose your PHI as authorized and to the extent necessary to comply with laws relating to workers' compensation or other programs providing benefits for work- related injuries or illness without regard to fault.

More Stringent Laws. Some of your PHI may be subject to other laws and regulations and afforded greater protection than what is outlined in this Notice. For instance, HIV/AIDS, substance abuse, and mental health information are often given more protection. In the event your PHI is afforded greater protection under Federal or State law, we will comply with the applicable law.

Your Rights. Federal law grants you certain rights with respect to your PHI. Specifically, you have the right to:

• Receive notice of our policies and procedures used to protect your PHI;
• Request that certain uses and disclosures of your PHI be restricted; provided, however, if we may release the information without your consent or authorization, we have the right to refuse your request;
• Inspect your PHI; provided, however, the request must be in writing and may be denied in certain limited situations;
• Obtain a copy of your PHI;
• Obtain a copy of the Notice of Privacy Practices upon request;
• Request that your PHI be amended;
• Obtain an accounting of certain disclosures by us of your PHI for the past six years;
• Revoke any prior authorizations or consents for use or disclosure of PHI, except to the extent that action has already been taken by written notice to ECTC; and
• Request communications of your PHI are done by alternative means or at alternative locations.

Important Contact Information. This notice has been provided to you as a summary of how we will use your PHI and your rights with respect to your PHI. If you have any questions or would like more information regarding your PHI, please contact the Privacy Official at ECTC.

If you believe your privacy rights have been violated, you may file a complaint with our office by contacting the Privacy Official at ECTC. You may also file a complaint with the Secretary of Health and Human Services. There will be no retaliation for the filing of a complaint.

Effective Date. This notice became effective on April 14th, 2003. Please note we reserve the right to revise this notice at any time. A current notice of our privacy practices may be obtained from assigned QMRP or the designated Privacy Official at ECTC.