NOTICE OF PRIVACY PRACTICES

Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

A. PURPOSE OF THE NOTICE.

SUN Orthopaedic Group is committed to preserving the privacy and confidentiality of your health information that is created and/or maintained at our clinic. State and federal laws and regulations require us to implement policies and procedures to safeguard the privacy of your health information. This Notice will provide you with information regarding our privacy practices and applies to all of your health information created and/or maintained at our clinic, including any information that we receive from other health care providers or facilities. The Notice describes the ways in which we may use or disclose your health information and also describes your rights and our obligations concerning such uses or disclosures.

Generally speaking, your protected health information is any information that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or payment for health care provided to you, and individually identifies you or reasonably can be used to identify you. Your medical and billing records at our practice are examples of information that usually will be regarded as protected health information.

We will abide by the terms of this Notice, including any future revisions that we may make to the Notice as required or authorized by law. We reserve the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice, which will identify its effective date, in our clinics and on our website at www.sunortho.com.

The privacy practices described in this Notice will be followed by:

1. Any health care professional authorized to enter information into your medical record created and/or maintained at our clinic;

2. All employees, students, residents, and other service providers who have access to your health information at our clinic; and

3. Any member of a volunteer group that is allowed to help you while receiving services at our clinic.

The individuals identified above will share your health information with each other for purposes of treatment, payment, and health care operations, as further described in the Notice.

B. USES AND DISCLOSURES OF HEALTH INFORMATION FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS.

1. Treatment, Payment and Health Care Operations. The following section describes different ways that we may use and disclose your health information for purposes of treatment, payment, and health care operations. We explain each of these purposes below and include examples of the types of uses or disclosures that may be made for each purpose. We have not listed every type of use or disclosure, but the ways in which we use or disclose your information will fall under one of these purposes.

a. Treatment. We may use your health information to provide you with health care treatment and services. We may disclose your health information to doctors, nurses, nursing assistants, medication aides, technicians, medical and nursing students, rehabilitation therapy specialists, or other personnel who are involved in your health care.

Examples of treatment uses and disclosures include:
• We may order physical therapy services to improve your strength and walking abilities. We will need to talk with the physical therapist so that we can coordinate services and develop a plan of care.
• To maintain consistent quality of care, practice physicians and other staff involved in your care may review your medical record and share and discuss your medical information with each other.
• We may share and discuss your medical information with another health care provider, hospital, laboratory, home health agency or other health care facility with which we share your care.
• We may call patients by their name in the waiting room when it is time for them to go to an examination room.
• We may contact you to provide appointment reminders either via mail or by telephone. This may include leaving appointment information on your answering machine.

b. Payment. We may use or disclose your health information so that we may bill and receive payment from you, an insurance company, or another third party for the health care services you receive from us. We also may disclose health information about you to your health plan in order to obtain prior approval for the services we provide to you, or to determine that your health plan will pay for the treatment.

Examples of payment uses and disclosures include:
• We may need to give health information to your health plan in order to obtain prior approval to refer you to another health care specialist, such as a neurologist, or to perform a diagnostic test such as a magnetic resonance imaging scan ("MRI") or a CT scan.
• Submission of a claim form to your health insurer.
• Providing information and documentation to your health insurer to support the medical necessity of a health service.
• Mailing you bills in envelopes with our return address on the envelope.
• Allowing your health insurer access to your medical record for a medical necessity or quality review audit.
• Providing information to a collection agency or our attorney for purposes of securing payment of a delinquent account.

c. Health Care Operations. We may use or disclose your health information in order to perform the necessary administrative, educational, quality assurance, and business functions of our clinic.

Examples of health care operations include:
• We may use your health information to evaluate the performance of our staff in caring for you.
• We also may use your health information to evaluate whether certain treatment or services offered by our clinic are effective.
• We also may disclose your health information to other physicians, nurses, technicians, or health profession students for teaching and learning purposes.
• Population based activities relating to improving health or reducing health care costs.
• Accreditation, certification, licensing, and credentialing activities.
• Conducting other medical review, legal services, and auditing functions.

C. OTHER PERMITTED OR REQUIRED USES AND DISCLOSURES OF HEALTH INFORMATION

There are certain instances in which we may be required or permitted by law to use or disclose your health information without your permission. These instances are as follows:

1. Individuals Involved in Care or Payment for Care. We may disclose your health information to individuals, such as family members and friends, who are involved in your care or who help pay for your care. We may make such disclosures when: (a) we have your verbal agreement to do so; (b) we make such disclosures and you do not object; or (c) we can infer from the circumstances that you would not object to such disclosures. For example, if your spouse comes into the exam room with you, we will assume that you agree to our disclosure of your information while your spouse is present in the room.

2. Notification Purpose. We may use and disclose your protected health information to notify or to assist in the notification of a family member, a personal representative, or another person responsible for your care, regarding a location, general condition, or death. For example: If you are hospitalized, we may notify a family member of the hospital and your general condition.

3. As required by law. We may disclose your health information when required by federal, state, or local law to do so. For example, we are required by the Department of Health and Human Services (DHHS) to disclose your health information in order to allow DHHS to evaluate whether we are in compliance with the federal privacy regulations. In addition, we may disclose protected health information to comply with mandatory reporting requirements involving birth and deaths, child abuse, disease prevention and control, vaccine-related injuries, medical device-related deaths and serious injuries, gunshot and other injuries by a deadly weapon or criminal act, driving impairments, and blood alcohol testing.

4. Public Health Activities. We may disclose your health information to public health authorities that are authorized by law to receive and collect health information for the purpose of preventing or controlling disease, injury, or disability; to report births, deaths, suspected abuse or neglect, reactions to medications; or to facilitate product recalls.

5. Health Oversight Activities. We may disclose your health information to a health oversight agency that is authorized by law to conduct health oversight activities, including audits, investigations, inspections, or licensure and certification surveys. These activities are necessary for the government to monitor the persons or organizations that provide health care to individuals and to ensure compliance with applicable state and federal laws and regulations. For example: we may comply with a Drug Enforcement Agency inspection of patient records.

6. Judicial or administrative proceedings. We may disclose your health information to courts or administrative agencies charged with the authority to hear and resolve lawsuits or disputes. We may disclose your health information pursuant to a court order, a subpoena, a discovery request, or other lawful process issued by a judge or other person involved in the dispute, but only if efforts have been made to (i) notify you of the request for disclosure or (ii) obtain an order protecting your health information. We may use and disclose health information in defending or asserting a lawsuit involving your treatment at the Practice.

7. Worker’s Compensation. We may use and disclose your health information as authorized by and to the extent necessary to comply with laws and relating to worker’s compensation or similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault. For example, this would include submitting a claim for payment to your employer’s worker’s compensation carrier if we treat you for a work injury.

8. Law Enforcement Official. We may disclose your health information in response to a request received from a law enforcement official to report criminal activity or to respond to a subpoena, court order, warrant, summons, or similar process. In addition, we may disclose:

• To identify or locate a suspect, fugitive, material witness, or missing person.
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement.
• About a death we believe may be the result of criminal conduct. • About criminal conduct at the Practice.
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

9. Coroners, Medical Examiners, or Funeral Directors. We may disclose your health information to a coroner or medical examiner for the purpose of identifying a deceased individual or to determine the cause of death. We also may disclose your health information to a funeral director for the purpose of carrying out his/her necessary activities.

10. Organ Procurement Organizations or Tissue Banks. If you are an organ donor, we may disclose your health information to organizations that handle organ procurement, transplantation, or tissue banking for the purpose of facilitating organ or tissue donation or transplantation.

11. Research and Creation of De-identified Information. We may use your health information in the process of de-identifying the information. For example: Under certain circumstances, we may use and disclose health information about you for research purposes. A research project may involve comparing the health and recovery of all patients who receive one medication to those who receive another, for the same condition or the efficacy of a surgical implant. All research projects are subject to a special approval process. This process evaluates a proposed research project and its use of health information, trying to balance the research needs with patients’ needs for privacy of their health information. Before we use or disclose health information for research, the project will have been approved through this research approval process.

12. To Avert a Serious Threat to Health or Safety. We may use or disclose your health information for purposes involving a threat to public safety, including protection of a third party from harm and identification and apprehension of a criminal. Any disclosure, however, would only be to someone able to help prevent that threat. For example, in certain circumstances, we are required by law to disclose information to protect someone from imminent serious harm.

13. Military and Veterans. If you are a member of the armed forces, we may use or disclose your health information as required by military command authorities.

14. National Security and Intelligence Activities. We may use or disclose your health information to authorized federal officials for purposes of intelligence, counterintelligence, and other national security activities, as authorized by law.

15. Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may use or disclose your health information to the correctional institution or to the law enforcement official as may be necessary (i) for the institution to provide you with health care; (ii) to protect the health or safety of you or another person; or (iii) for the safety and security of the correctional institution.

16. Business Associates. A business associate such as a billing company, an accounting firm, or a law firm sometimes performs certain functions of this practice. We may disclose protected health information to our business associates and allow them to create and receive protected health information on our behalf. We require these associates to agree that they will protect the privacy of your health information in the same manner that we do.

17. Incidental Disclosures. We may disclose protected health information as a by-product of an otherwise permitted use or disclosure. For example, other patients may overhear your name being called in the waiting room.

D. USES AND DISCLOSURES PURSUANT TO YOUR WRITTEN AUTHORIZATION.

Except for the purposes identified in Sections B and C, we will not use or disclose your health information for any other purposes unless we have your specific written authorization. You have the right to revoke a written authorization at any time as long as you do so in writing. If you revoke your authorization, we will no longer use or disclose your health information for the purposes identified in the authorization, except to the extent that we have already taken some action in reliance upon your authorization.

E. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION.

You have the following rights regarding your health information. You may exercise each of these rights, in writing, by providing us with a completed form that you can obtain from front office staff, Operations Manager, or Privacy Officer. In some instances, we may charge you for the cost(s) associated with providing you with the requested information. Additional information regarding how to exercise your rights, and the associated costs, can be obtained from the front desk clerk or the medical records clerk.

1. Right to Inspect and Copy. You have the right to inspect and copy health information that may be used to make decisions about your care. We may deny your request to inspect and copy your health information in certain limited circumstances. If you are denied access to your health information, you may request that the denial be reviewed.

To exercise this right of access, you must submit a written request to our Privacy Officer. The request must (a) describe the health information to which access is requested, (b) describe how you want to access the information, such as inspection, picking-up of copy, or mailing of a copy, (c) specify any requested form or format, such as paper copy or an electronic means, and (d) include the mailing address, if applicable.

2. Right to Amend. You have the right to request an amendment of your health information that is maintained by or for our clinic and is used to make health care decisions about you. We may deny your request if it is not properly submitted or does not include a reason to support your request.

To request an amendment, your request must be made in writing and submitted to the privacy officer. Your request must specify each change you want and a reason must be provided in support of each requested change. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request.

We may also deny your request if the information sought to be amended: (a) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (b) is not part of the information that is kept by or for our clinic; (c) is not part of the information which you are permitted to inspect and copy; or (d) is accurate and complete.

3. Right to an Accounting of Disclosures. You have the right to request an accounting of the disclosures of your health information made by us. This accounting will not include disclosures of health information that we made for purposes of treatment, payment or health care operations or pursuant to a written authorization that you have signed.

To request this list or accounting of disclosures, you must submit your request in writing to the Privacy Officer. Your request must state a time period, which may not be longer than six (6) years and may not include dates before April 14, 2003. Your request should indicate in what form you want the list. The first list you request within a twelve (12) month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

4. Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone, such as a family member or friend, who is involved in your care or in the payment of your care. For example, you could ask that we not use or disclose information regarding a particular treatment that you received. We are not required to agree to your request. If we do agree, that agreement must be in writing and signed by you and us.

To request restrictions, you must make your request in writing to the Privacy Officer. In your request, you must tell us: (a) what information you want to limit; (b) whether you want to limit our use, disclosure or both; and (c) to whom you want the limits to apply, for example, disclosure to your spouse.

You also have the right to request that we restrict use and disclosure of your health information to notify, or assist in notifying a family member, personal representative, or another person responsible for your care, your location and general condition. Without such restrictions, we may disclose health information about you to a friend or family member who is involved in your health care.

5. Right to Request Confidential Communications. You have the right to request that we communicate with you about your health care in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We are not required to agree to confidential communications that are unreasonable.

To make a request for confidential communications, you must submit a written request to our Privacy Officer. The request must tell us how or where you want to be contacted. In addition, if another individual or entity is responsible for payment, the request must explain how payment will be handled.

6. Right to a Paper Copy of this Notice. You have the right to receive a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.

F. QUESTIONS OR COMPLAINTS.

If you have any questions regarding this Notice or wish to receive additional information about our privacy practices, please contact Linda Thoms, Operations Manager or Peter S. Heath, Privacy Officer at the SUN Orthopaedic Group main office at 900 Buffalo Road, Lewisburg at 570-524-4446. If you believe your privacy rights have been violated, you may file a complaint with our clinic or with the Secretary of the Department of Health and Human Services. To file a complaint with our clinic, contact our Operations Manager or Privacy Officer at 900 Buffalo Road, Lewisburg. All complaints must be submitted in writing. You will not be penalized for filing a complaint.