Notice of Privacy Practices

Effective September 23, 2013

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (Notice) will be used by Hendrick Health, including but not limited to, Hendrick Medical Center; Hendrick Medical Center South; Hendrick Medical Center Brownwood; Hendrick Clinic; Hendrick Anesthesia Network; Hendrick Hospice Care, Inc.; Hearing Healthcare; Hendrick Professional Pharmacy; Hendrick Medical Supply; Hendrick HouseCalls; and other Hendrick Health affiliates; (referred to collectively as Hendrick).

1. Purpose. Hendrick and its professional staff, employees, physicians, residents, students, and volunteers follow the privacy practices described in this Notice. Please note that the physicians, dentists, podiatrists, and select allied health professionals that provide medical and other health care services at Hendrick are independent practitioners, and not the agents, servants, or employees of Hendrick. Hendrick maintains your medical information in records that will be maintained in a confidential manner, as required by law. However, Hendrick must use and disclose your medical information as described herein to the extent necessary to provide you with quality health care. To do this, Hendrick must share your medical information as necessary for treatment, payment and health care operations.
2. What Are Treatment, Payment, and Health Care Operations? Treatment includes sharing information among health care providers involved in your care. For example, your physician may share information about your condition with the pharmacist to discuss appropriate medications or with radiologists or other consultants in order to make a diagnosis. Hendrick may use your medical information as required by your insurer or HMO to obtain payment for your treatment and hospital stay. We also may use and disclose to your medical information to improve the quality of care, for example, for review and training purposes or for use as part of Hendrick’s participation in an accountable care organization.
3. How will Hendrick Use My Medical Information? Your medical information may be used or disclosed without your specific authorization for the following purposes:

   Hospital Directory, which may include your name, general condition, and your location in the facility. Religious affiliation to a hospital chaplain or member of the clergy. To discuss your care and condition with family members or close friends who may be involved in your treatment or who are involved in the payment for your treatment; or to notify friends or family members should an emergent situation arise while you are at our facility (You will have an opportunity to agree or object). American Red Cross (or a government disaster relief agency) if you are involved in a disaster relief effort. Appointment reminders. To inform you of treatment alternatives or benefits or services related to your health that may be of interest to you. (You will have an opportunity to refuse to receive this information). Used (or disclosed to a business associate) for fundraising activities, but such information will be limited to your name, address, phone number, and the dates you received services at Hendrick. (You will have an opportunity to refuse to receive, or opt out of, these communications). As required by law. Public health activities, including disease prevention, injury or disability; reporting births and deaths; reporting child abuse or neglect; reporting gunshot wounds, reporting reactions to medications or product problems; notification of recalls;

   infectious disease control; notifying government authorities of suspected abuse, neglect or domestic violence (if you agree, or as required or authorized by law). Health oversight activities (e.g., audits, inspections, investigations, and licensure). Lawsuits and disputes. Law enforcement (e.g., in response to a court order or subpoena). To coroners and medical examiners. Organ and tissue donation. Certain research projects approved by an Institutional Review Board. To prevent a serious threat to health or safety. To military command authorities if you are a member of the armed forces. National security and intelligence activities. Protection of the President or other authorized persons for foreign heads of state, or to conduct special investigations. Inmates (Medical information about inmates of correctional institutions may be released to the institution). Workers’ Compensation (Your medical information regarding benefits for work- related illnesses may be released as appropriate). To carry out treatment, payment, and health care operations functions through business associates (e.g., to install a new computer system, to obtain third party billing and collections assistance, etc.).

   Certain types of information may be subject to additional restrictions on disclosure, such as AIDS test results and (as further described below) psychotherapy notes.
4. Incidental Disclosures. While we will take reasonable and appropriate steps to safeguard the privacy of your health information, certain disclosures of your health information may occur during, or as an unavoidable result of, our otherwise permissible uses or disclosures of your health information. For example, during the course of a treatment session, other individuals receiving services in the treatment area may see, or overhear discussion of, your health information.
5. De-Identified Information. We may from time to time de-identify your medical information in a manner that cannot be recompiled to identify you, and disclose such de-identified information to research, benchmarking and other organizations without your authorization.
6. Other uses and disclosures require your authorization; Revocation of Authorization. Disclosure of your health information or its use for any purpose other than those listed above requires your specific written authorization. For example, with limited exceptions, we may not use or disclosure your protected health information in any of the following instances without your specific written authorization: (i) uses or disclosures of your protected health information containing psychotherapy notes (please note that state law also limits our ability to disclose mental health records not constituting ; (ii) uses or disclosures of your protected health information for marketing purposes other than those described above (including, but not limited to, any marketing or communications for which our Company has received remuneration from a third party); or (iii) disclosure of your protected health information which constitutes a sale of protected health information. Also, other state and federal laws may limit our ability to disclose the following medical records or information without your authorization: (a) mental health records not constituting psychotherapy notes, (b) drug/alcohol treatment records and (c) information relating to HIV/AIDS test results. If you change your mind after authorizing a use or disclosure of your information, you may revoke the authorization in writing at any time. However, your decision to revoke the authorization will not affect or undo any use or disclosure of information that occurred before you notified us of your decision.
7. You Have Rights Regarding Your Medical Information. You have the following rights regarding your medical information, provided that you make a written request to invoke the right on any necessary form provided by Hendrick.
   • Right to Request Restriction. You may request limitations on your medical information we use or disclose for health care treatment, payment, or operations (e.g., you may ask us not to disclose that you have had a particular surgery), but, except in limited circumstances, we are not required to agree to your request. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment. Notwithstanding the foregoing, if you pay out of pocket, in full, for any health care services you receive from Hendrick, you have the right to restrict disclosures of your health information for payment or health care operations purposes to your health plan, and Hendrick must agree to this restriction.
   • Right to Confidential Communications. You may request communications in a certain way or at a certain location, but you must specify how or where you wish to be contacted.
   • Right to Inspect and Copy. You have the right to inspect and copy your medical information. You may request paper or electronic copies of your record. We may charge a reasonable, cost-based fee for copying, mailing and supplies. Under limited circumstances, your request may be denied; in some cases you may request review of the denial by another licensed health care professional chosen by Hendrick. Hendrick will comply with the outcome of the review.
   • Right to Request Amendment. If you believe that the medical information we have about you is incorrect or incomplete, you may request an amendment on the form provided by Hendrick, which requires certain specific information. Hendrick is not required to accept the amendment, but will provide a written explanation regarding any amendment that is not accepted.
   • Right to Accounting of Disclosures. You may request a list of the disclosures of your medical information that have been made to persons or entities that were not authorized by you or for purposes other than for health care treatment, payment or operations in the past six (6) years, but not prior to April 14, 2003 (such list will not include disclosures made pursuant to an authorization or for treatment, payment, and health care operations). After the first request, there may be a reasonable, cost-based charge imposed.
   • Right to a Copy of this Notice. You may request a paper copy of this Notice at any time, even if you have been provided with an electronic copy. You may obtain an electronic copy of this Notice at our web site, <http://www.hendrickhealth.org>.
   • Right to be notified of any breach of your unsecured health information (as the term “breach” is defined in the HIPAA Rules).
8. Requirements Regarding This Notice. Hendrick is required by law to provide you with this Notice. We will be governed by this Notice for as long as it is in effect. Hendrick may change this Notice, and these changes will be effective for medical information we have about you as well as any information we receive in the future. Each time you register at Hendrick for health care services as an inpatient or outpatient, you may receive a copy of the Notice in effect at the time. A copy of the most current Notice will also be posted in all patient registration areas.
9. Complaints. If you believe your privacy rights have been violated, you may file a complaint with Hendrick or with the Secretary of the United States Department of Health and Human Services. You will not be penalized or retaliated against in any way for making a complaint to Hendrick or the Department of Health and Human Services.

Contact: Hendrick Privacy Officer at 325-670-3028 if:

• You have a privacy complaint
• You have any questions about this Notice; or
• You wish to exercise your individual rights described in Section 7

• Privacy Policy in English
• Privacy Policy in Spanish