Effective Date: September 20, 2016

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

WHO WILL FOLLOW THIS NOTICE? This Notice describes the practices of Orthopaedic Associates, Inc. (“OA”) and the practices that will be followed by all OA workforce members who handle your medical information.

OUR PLEDGE REGARDING YOUR PROTECTED HEALTH INFORMATION

OA understands that medical information about you and your health is personal. We are committed to protecting medical information about you. We maintain our records and conduct our treatment environment with a goal of providing the highest level of protection for your medical information, while still providing you with the highest level of medical care. This Notice applies to all of the records of your medical care which are received or created by OA.

This Notice will tell you about the ways in which OA may use and disclose medical information about you. Your medical information, also referred to as “protected health information” or “PHI” is that information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health care services.

In this Notice, we also describe your rights and certain obligations OA has regarding the use and disclosure of your protected health information. We are required by law to:

• make sure that medical and other information that identifies you (protected health information) is kept private;
• give you this Notice of our legal duties and privacy practices with respect to protected health information about you; and
• follow the terms of the Notice that is currently in effect.

USES AND DISCLOSURES FOR TREATMENT. PAYMENT AND HEALTH CARE OPERATIONS

By becoming a patient of OA, you are giving consent for OA to use your protected health information for certain activities, including Treatment Payment and other Health Care Operations. Sometimes, you may hear these three activities referred to as “TPO.”

TREATMENT. We may use and disclose protected health information about you so that OA and its medical professionals can treat you. For example, we may use your past medical information in order to diagnose your present illness or we may provide information regarding your medical condition to another doctor to whom we refer you for additional care.

PAYMENT. We may also use and disclose protected health information about you so that we may be paid for the medical treatment we provide you. For example, we will submit protected health information about you to your insurance company in order to receive payment for services we have provided to you.

HEALTH CARE OPERATIONS. We may also use and disclose protected health information about you for OA’s health care operations, in other words, those other tasks that we need to perform to make sure that you are provided the highest quality of medical care. For example, we may use your protected health information to evaluate how we can better meet your needs or we may provide protected health information about you to an auditor who reviews our books so that we can keep our license to provide medical services in Indiana.

OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION

YOUR AUTHORIZATION. We will not use or disclose your PHI for any purpose other than treatment, payment and health care operations unless you have signed a form authorizing the use or disclosure with, the exception of the situations outlined in this notice. If you authorize us to use or disclose protected health information about you, you may revoke that permission, in writing, at any time, and we will no longer use or disclose protected health information about you for the reasons covered by your authorization. You understand that we are unable to take back any uses or disclosures we have already made with your permission and that we are required to retain our records of the medical treatment or other services that we have provided to you.

BUSINESS ASSOCIATES. Certain aspects and components of our services are performed through contracts with outside persons or organizations, such as auditing, billing, legal services, etc. At times, it may be necessary for us to provide your PHI to one or more of these outside persons or organizations who assist us with our health care operations. In all cases, those business associates are required to appropriately safeguard the privacy of your information.

MARKETING. We must receive your authorization for any use or disclosure of PHI for marketing, except if the communication is in the form of a face-to-face communication made to you personally; or a promotional gift of nominal value provided by OA. It is not considered marketing to send you information related to your individual treatment, case management, care coordination or to direct or recommend alternative treatment therapies, health care providers or settings of care. These may be sent without written permission. If the marketing is to result in financial remuneration to OA by a third party, we will state this on the authorization.

FUNDRAISING. We may contact you to donate to a fundraising effort for or on our behalf. You have the right to “opt-out” of receiving fundraising materials/communications and may do so by calling (812) 424-9291 and informing us of your wish not to receive such materials. OA will not condition treatment or payment on your choice with respect to the receipt of fundraising communications.

APPOINTMENT REMINDERS. We may use and disclose your medical information to contact you as a reminder that you have an appointment at the office. If you request that such communications be made confidentially, please contact our office in writing to Brittney Doss, Privacy Officer, Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739. We will accommodate all reasonable requests.

OTHERS INVOLVED IN YOUR HEALTH CARE. We may disclose to a member of your family, a relative, a close friend or any other person you identify, your protected health information that directly relates to that person’s involvement in your medical care. If you are unable to agree or object to this disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may also use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition, or death. Finally, we may use or disclose your protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and
disclosures to family or other individuals involved in your health care.

EMERGENCY SITUATIONS. We may use or disclose your protected health information in an emergency treatment situation. If this happens, your physician will attempt to obtain your acknowledgment of this Notice as soon as reasonably practicable after the delivery of treatment.

HEALTH-RELATED BENEFITS OR SERVICES. From time to time, OA may use and disclose protected health information to tell you about certain health-related benefits or services that may be of interest to you.

REQUIRED BY LAW. We will use or disclose protected health information about you when required to do so by federal, state or local law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, if the law requires us to do so, of any such uses or disclosures. We must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the law.

PUBLIC HEALTH ACTIVITIES. We may disclose your protected health information for public health activities and disclosure for such purposes will be to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for purposes such as controlling disease, injury or disability. Disclosures to public health authorities may include disclosure to a foreign authority that is working with the public health authority.

COMMUNICABLE DISEASES. We may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

HEALTH OVERSIGHT ACTIVITIES. We may disclose protected health information to a health oversight agency for activities authorized by law. These activities include, for example, audits, investigations, and inspections. These activities are necessary for the government to monitor the health care system, the delivery of health care, government benefit programs, other government regulatory programs and civil rights laws.

ABUSE OR NEGLECT. We may disclose your protected heath information to a public health authority authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to a governmental entity or agency authorized to receive such information. In such cases, the disclosure will only be made in accordance with Indiana law.

FOOD AND DRUG ADMINISTRATION. We may disclose your protected health information to a person or company required by the Food and Drug Administration (FDA) to report adverse events, product defects or other problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements; or to conduct post-market surveillance, as required.

LAWSUITS AND DISPUTES. If you are involved in a lawsuit or a dispute, we may disclose protected health information about you in response to a court order or administrative order. We may also disclose protected health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

LAW ENFORCEMENT. We may release protected health information if asked to do so by a law enforcement official, in response to a court order subpoena, warrant, summons, or similar process. Other related disclosures may include disclosures related to individuals who are Armed Forces personnel, to national security and intelligence agencies, as well as disclosures to authorized federal officials for the protection of the President of the United States or other authorized persons or foreign heads of state.

CORONERS FUNERAL DIRECTORS and ORGAN DONATION. We may disclose protected health information about you to a coroner or medical examiner for identification purposes, determining cause of death, or for the coroner or medical examiner to perform other duties required by law. We may also disclose protected health information about you to a funeral director in order to permit the funeral director to carry out legal duties, and may do so if death is reasonably anticipated. Your protected health information may also be disclosed for certain organ donations to which you may have agreed.

RESEARCH. We may disclose your protected health information to researchers when their research has been approved and protocols have been established to ensure the privacy of your information. We may also disclose a limited set of your information, as allowed under the law, for research purposes.

CRIMINAL ACTIVITY. We may disclose your protected health information, consistent with federal and Indiana laws, if we believe that the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public, or if it is necessary for the law enforcement authorities to identify or apprehend an individual.

WORKERS’ COMPENSATION. We may release protected health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illnesses.

EMPLOYER. We may release your PHI to your employer when we have provided health care to you at the request of your employer; in most cases you will receive notice that information is disclosed to your employer.

SALE OF PHI. We must receive your authorization for any disclosure of your PHI which is a sale of PHI. Such authorization will state that the disclosure will result in remuneration to OA.

CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE RECORDS. Federal law and regulations protect the confidentiality of alcohol and drug program records. To the extent PHI in our possession contains information on your alcohol or drug use, it may not be disclosed without 1) your written authorization; 2) a court order; 3) unless the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation. Federal law or regulations do not protect any information about a crime committed by you at our facility or about any threat to commit a crime. Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities.

CONFIDENTIALITY OF PSYCHOTHERAPY NOTES. We must receive your authorization for any use or disclosure of psychotherapy notes for treatment of health oversight activities; for use or disclosure by OA for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; for use or disclosure by OA to defend itself in a legal action or other proceeding brought by you; to the extent required to investigate or determine OA’s compliance with the HIPAA regulations; to the extent that such use or disclosure is required by law and the use of disclosure complies with and is limited to the relevant requirements of such law; for health oversight activities with respect to the oversight of the originator of the psychotherapy notes; for disclosure to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law; or if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.

CONFIDENTIALITY OF HIV TEST OR DIAGNOSIS OF AIDS OR AIDS-RELATED CONDITION. Pursuant to Indiana law, the results of an HIV test or diagnosis of AIDS or AIDS-related conditions may only be disclosed with your authorization, or as otherwise permitted and/or required by state law.

YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU:
Right to Access. You have the right to inspect and copy protected health information that may be used to make decisions about your medical care. Usually this right includes both billing and medical records. You must submit your request in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. Your request to inspect and copy your information may only be denied in very limited circumstances and you have a right to request that any such denial be reviewed. In addition, you have a right to access your PHI in electronic format upon requested, where it is available.

Right to Request Restrictions. You have the right to request that we restrict the use and disclosure of your PHI for treatment, payment and health care operations. We are not required to agree to your request in all circumstances. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. You have the right to require restrictions on disclosure of your PHI to a health plan where you paid out of pocket, in full, for items or services and we are required to honor this request. To request restrictions, you must have your request in writing to Brittney Doss, Privacy Officer, Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply.

Right to Confidential Communications. You also have the right to request to receive private health information communications by alternate means or at alternative locations. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to Brittney Doss, Privacy Officer, Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Amend. If you feel that the protected health information we have about you is incorrect or incomplete, you have the right to request that your protected health information be amended. Only the health care entity (e.g., doctor, hospital, clinic, etc.) that created your protected health information is responsible for amending it. We are not obligated to make all requested amendments but will give each request careful consideration. If an amendment you request is made by us, we may also notify others who work with us and have copies of the uncorrected record if we believe that such notification is necessary. For more information regarding the procedures for submitting such a request, contact Brittney Doss, Privacy Officer, by mail at Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739 or by phone at (812) 424-9291.

Right to an Accounting of Disclosures. You have a right to an accounting of disclosures of your protected health information, for purposes other than treatment, payment or health care operations by OA or any of the people or companies who perform treatment, payment or health care operations on our behalf. To request this list of disclosure we made of protected health information about you, you must submit a request in writing to Brittney Doss, Privacy Officer, Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739. Your request must state a time period which may not be longer than six (6) years prior to the date of your request. Your request should indicate the form in which you want the list (for example, on paper or electronically).

Right to a Paper Copy of this Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this notice at any time.

• You may obtain a copy of this Notice at our website: http://www.oaevansville.com/privacy.
• To obtain a paper copy of this Notice, contact Brittney Doss, Privacy Officer, by mail at Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739 or by phone at (812) 424-9291.

To learn more about these procedures, or to make any of these requests you should contact Brittney Doss, Privacy Officer, by mail at Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739 or by phone at (812) 424- 9291.

CHANGES TO THIS NOTICE.

OA reserves the right to change this notice. We reserve the right to make the revised or changed Notice effective for protected health information we already have about you, as well as any information we create or receive in the future. We will post a copy of the current Notice on OA’s website: http://www.oaevansville.com/privacy. The Notice will contain, in the top right-hand corner, the effective date.

COMPLAINTS.

If you believe your privacy rights have been violated and/or that OA has not followed this policy, you may file a complaint with OA’s privacy officer, Brittney Doss or with the Secretary of the Department of Health and Human Services. To file a complaint with OA, contact Brittney Doss, Privacy Officer, by mail at Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739 or by phone at (812) 424-9291. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

BREACH NOTIFICATIONS.

In the event of any Breach of Unsecured PHI, OA shall fully comply with the HIPAA Breach Notification Rule, which will include notification to you of any impact that Breach may have had on you and/or your family member(s) and actions OA undertook to minimize any impact the Breach may or could have on you.

QUESTIONS.

If you have any questions regarding this notice, please contact Brittney Doss, Privacy Officer, by mail at Orthopaedic Associates, Inc., 515 Read Street, Evansville, Indiana 47710-1739 or by phone at (812) 424-9291.