ORTHOSOUTH
NOTICE OF PRIVACY PRACTICES

Effective Date: July 26, 2018

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. WE CARE ABOUT THE PRIVACY OF YOUR INFORMATION.

If you have any questions regarding your privacy or any of the information contained in this Notice, please contact our Privacy Liaison at 901-259-4675.

We create a record of the care and services you receive at our clinics. We need this record in order to provide care. We are required by law to maintain the privacy of your information, abide by the terms of this Notice, provide you with this Notice and to notify you in the event your unsecured protected health information is subject to a breach. We reserve the right to change this notice and make the new Notice effective for all protected health information we maintain. A copy of our current Notice will be available and posted at each of the clinics.

“Health information” as used in the Notice includes your billing, personal, demographic, financial (social security number, banking / credit / debit information), health/clinical treatment, and payment information and sensitive information and any other information created/received by or included within our medical or other records about you. As our patient, we will use and disclose your medical information –

• To provide treatment to you and to keep a record describing your care,
• To receive payment for the care we provide,
• To conduct our business activities relating to the services of OrthoSouth, and
• To comply with federal and state law.

Important Summary Information

Acknowledgement of Privacy Practices: We will ask you to sign a form that states you have received this Notice.

Requirement for Written Authorization: We will generally obtain your written permission before using your health information or sharing it with others outside each division’s group practice. For example, we will obtain your written authorization prior to providing you certain marketing information, or to release your information to a third party uninvolved in your health care or payment for your treatment in exchange for remuneration. You may also initiate transfer of your records to another person by completing an authorization form. If you provide us with a written authorization, you may revoke that authorization at any time, except to the extent that we have already relied upon it. To revoke an authorization, please call our Privacy Liaison at 901-259-4675.

Exceptions to Requirement for Written Authorization: There are some situations when we do not need your written authorization before using your health information or sharing it with others. These situations include treatment, payment, health care operations, an emergency, and many other circumstances which are described in detail in this notice.

How is this protected health information used: OrthoSouth physicians and staff use your health information and share it with others in order to treat your condition, obtain payment for that treatment, and run each practice’s normal business operations. Here are some specific examples of how we may use this information without your authorization:

Treatment: We may share this information with doctors or nurses that are involved in taking care of you. We may use health information about you to provide you with medical treatment or services. We may disclose information about you to our doctors, nurses, technicians or other people who are taking care of you. We may also share information about you to other health care providers to assist them in caring for you. A doctor in any of our practices may also share this information with another doctor to whom you have been referred for further care.

Payment: We may use your health information or share it with others for payment purposes. For example, we may share information about you with your insurance company in order to obtain pre- approval before providing you with treatment.

Health Care Operations: We may use your health information or share it with others in order to conduct our normal business operations. This may include measuring and improving quality, evaluating performance, conducting training and getting accreditation certificates, licenses and credentials we need to serve you. We also record telephone messages and telephone conversations between you and the members of OrthoSouth staff in order to conduct ongoing quality improvement monitoring. We may also share your health information with another company that performs business services for us, such as billing companies. If so, we will have a written contract to ensure that this company also protects the privacy of your health information.

Electronic Prescribing: We may use electronic prescribing software to send your prescriptions in a secure manner over the internet. Using this software, we will access important information from other healthcare providers or third party pharmacy benefit payors about your prescription history and current prescription use.

Appointments, Treatment Alternatives, Benefits and Services: We may use your health information when we contact you regarding your services. We may also use your health information in order to recommend possible treatment alternatives, health-related benefits, health education and services that may be of interest to you. We may send a card to you during the holidays or other occasions. We may provide educational material such as newsletters or information about free seminars offered in our area.

Caregivers and Family Involved in Your Care: If you do not object, we may share your health information with a family member, relative, or close personal friend who is involved in your care. We may also notify a family member, personal representative, or caregiver about your general condition, or about the unfortunate event of your death. In some cases, we may need to share your information with a disaster relief organization that will help us notify these persons.

Emergencies: We may disclose your health information if you need emergency treatment or if we are required by law to treat you but are unable to obtain your consent. If this happens, we will try to obtain your consent as soon as we reasonably can after we treat you.

Communication Barriers: We may use and disclose your health information if we are unable to obtain your consent because of substantial communication barriers, and we believe you would want us to treat you if we could communicate with you.

As Required By Law: We may use or disclose your health information if we are required by law to do so. We will notify you of these uses and disclosures if notice is required bylaw.

Public Health: We may disclose your health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.

Communicable Diseases: We may disclose your health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

Health Oversight: We may disclose your health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefits programs, other government regulatory programs and civil rights laws.

Abuse or Neglect: We may disclose your health information to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your health information if we believe that you have been a victim of abuse, neglect or domestic violence to the government entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

Food and Drug Association: We may disclose your health information to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic deviations, track products, to enable product recalls, to make repairs or replacements, or to conduct marketing surveillance as required.

Legal Proceedings: We may disclose your health information in the course of any judicial or administrative proceeding in response to an order of the court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or any other lawful process.

Law Enforcement: We may also disclose your health information, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include legal processes and otherwise required by law, limited information requests for identification and location purposes, pertaining to victims of a crime, suspicion that death has occurred as a result of criminal conduct, in the event that a crime occurs on the premises of any of the practices, and medical emergency (not on the practice premises) and it is likely that a crime has occurred.

Coroners, Funeral Directors, and Organ Donation: We may disclose your health information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties as authorized by law. We may also disclose your health information to a funeral director, as authorized by law, in order to permit the funeral your health information may be used and disclosed for cadaveric organ, eye or tissue donation purposes.

Criminal Activity: Consistent with applicable federal and state laws, we may disclose your health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of the person or the public. We may also disclose your health information if it is necessary to law enforcement authorities to identify or apprehend an individual.

National Security and Intelligence Activities or Protective Services: We may disclose your health information to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials.

Military and Veterans: If you are in the Armed Forces, we may disclose health information about you to appropriate military command authorities for activities they deem necessary to carry out their military mission. We may also release health information about foreign military personnel to the appropriate foreign military authority.

Worker’s Compensation: Your health information may be disclosed by us as authorized to comply with worker’s compensation laws and other similar legally established programs, as previously described herein.

Inmates: We may use or disclose your health information if you are an inmate of a correctional facility and your physician created or received your health information in the course of providing care to you.

Required Uses and Disclosures: Under the law, we must make disclosures when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of federal law.

Research: We may disclose your health information to researchers when their research has been approved by an institutional board that has reviewed the research proposal and established protocols to ensure the privacy of your health information.

All other uses and disclosures not described in this Notice will be made only with your written authorization.

A Summary of Your Rights

All of your rights may be exercised by contacting the Privacy Liaison/Officer of OrthoSouth:

• You have a right to request restrictions on our use or disclosure of your protected health information. However, we are not required to agree to your restrictions in all circumstances. If we do agree to your restriction, we will follow your request, except in the case of an emergency. However, your restriction (if agreed to) will not prevent us from releasing information as required by other state and federal laws. If we accept your restrictions, we have the right to terminate them by notifying you of such. Further, we must comply with your request to restrict information if the information is to be sent to a health plan for payment or health care operations purposes and the disclosure relates to products or services that you have paid for solely out-of- pocket (unless the disclosure is otherwise required by law).
• You have a right to request that we communicate about your treatment and/or protected health information by alternative means or locations. We are required to accept reasonable requests. We require that you make this request in writing.

• You have the right to ask questions and to receive answers.
• You have a right to inspect and copy your medical information. The right is subject to certain specific exceptions and you may be charged a reasonable fee for any copies of your records. To the extent your information is held in an electronic health record, you may be able to receive the information in an electronic format.
• You do not have to sign an authorization form, however, it may prevent us from completing a task you have requested (such as enrollment in a research study or examining you to create a report for your attorney).
• Your refusal to sign an authorization form will not be held against you.
• You may change your mind and revoke your authorization, except in as much as we have relied on the authorization until that point or as needed to maintain the integrity of a research study. You must revoke your authorization in writing. Please contact the Privacy Liaison at 901- 259- 4675.
• You have the right to request amendments to your protected health information. We require that all requests for amendments be made in writing and provide a reason to support the requested amendment. Additionally, under federal law, we may deny this amendment. Please contact the Privacy Liaison for details or to exercise this right.
• You have a right to an accounting of all entities that obtained information unrelated to treatment, payment or health care operations that you did not approve by an authorization (except as required by law) in the six years prior to your request. However, in the event that we maintain your protected health information in an electronic health record, you have a right to an accounting of such information related to treatment, payment or health care operations for the three years prior to your request. To request a list, contact the Privacy Liaison at 901-259-4675.
• We may contact you for purposes of fundraising. You have a right to refuse to receive these communications. If you do not wish to receive information related our fundraising, contact the Privacy Liaison at 901-259-4675.
• You have a right to this Notice. Any material revisions to this Notice will be made available to you. You have a right to contact the Privacy Liaison to request additional information or ask questions.
• You may complain to the Privacy Liaison of OrthoSouth, by calling 901-259-4675 and to the Secretary of the Department of Health and Human Services (http://hhs.gov/ocr/hipaa) if you feel your privacy rights have been violated. We will not retaliate against you for filing a complaint.