Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

We understand that your health information is important, and we are committed to protecting your privacy. This Notice of Privacy Practices (“notice”) describes the ways we may use and disclose your information. It also describes your rights and our obligations regarding the use and disclosure of your information.

1. Who Will Follow This Notice

The privacy practices in this notice are followed by:

• Health care professionals who enter or access information in your medical record;
• Employees, contractors, physicians, and other health care professionals on our medical staff when they provide services in our facilities with access to your medical or billing records or health information about you; and
• Volunteers and students who may be in our facilities.

2. Our Privacy Obligations

Medical information that identifies you is known as protected health information (PHI). PHI includes demographic, clinical, and financial information that relates to treatment or payment for treatment.

We are required by law to:

• Make sure that your PHI is kept private;
• Give you this notice of our legal duties and privacy practices;
• Follow the terms of the notice that is currently in effect; and
• Notify you if there is a breach of your unsecured PHI.

3. How We May Use and Disclose PHI Without Your Written Authorization

This section describes how we may use your PHI for treatment, payment and health care operations purposes without your written authorization.

Treatment

We use and disclose your PHI to provide treatment and other services to you. For example, we may consult with your physician about your care. We may also recommend alternative treatments, therapies, health care providers, or settings of care, or describe a health-related product or service. We may also contact you as a reminder that you have an appointment. In addition, we may share your PHI with other health care providers involved in your treatment.

Payment

We may use or disclose your PHI to obtain payment for our services. For example, we may disclose your PHI to Medicare, Medicaid, your health insurer, HMO, or other company or program that arranges or pays the cost of your health care. We may also share PHI with your other health care providers if they need this information to receive payment for services they provide to you.

Health Care Operations

We may use or disclose your PHI for our health care operations, which include internal administration and planning and activities that improve the quality and cost effectiveness of care. For example, we may use your PHI to evaluate the quality and competence of our staff and other health care professionals.

Disclosure to Relatives, Close Friends and Other Caregivers

We may use or disclose your PHI to a family member, other relative, close friend or other person identified by you if: 1) we obtain your agreement; 2) provide you with the opportunity to object and you do not object; or 3) we reasonably infer that you do not object to the disclosure.

If you are not present or are unable to agree (for example, if we receive a telephone call from a family member or other caregiver), we may exercise our professional judgment to determine whether a disclosure is in your best interests. If we disclose information under these circumstances, we disclose only information that is directly relevant to the person’s involvement with your care.

Health Information Exchanges

A health information exchange (HIE) allows doctors, nurses, pharmacists, other health care providers and patients to access and share medical information electronically to improve the speed, quality, safety and cost of patient care. We may participate in a health information exchange through which we may disclose your health information, as permitted by law, to other health care providers or external entities for treatment, payment, or health care operations purposes.

Research

As part of our efforts to improve treatments, we conduct and participate in clinical trials and research activities. We may use and disclose your PHI for research purposes without your authorization if an institutional review board (IRB) or privacy board has waived the authorization requirement. Under certain circumstances, your PHI may also be disclosed without your authorization to researchers preparing to conduct a research project, for research on decedents, or as part of a data set that omits your name and other information that can directly identify you.

As Required by Law

We will disclose your PHI if we are required to do so by federal, state, or local law.

Public Health Activities

We may disclose your PHI to public health authorities to prevent or control disease, injury or disability. We may also alert a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.

We may also disclose your PHI to government agencies to report child abuse and neglect, or if we if we reasonably believe that you are a victim of abuse, neglect or domestic violence.

In addition, we may report information about medical devices and medications to the manufacturer and the U.S. Food and Drug Administration.

Threat to Health and Safety

We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. For example, we may give your PHI to an entity assisting in a disaster relief effort.

Health Oversight Activities

We may disclose your PHI to an agency that oversees the health care system and is responsible for ensuring compliance with the rules of government health programs such as Medicare or Medicaid.

Workers’ Compensation

We may disclose your PHI to comply with laws relating to workers’ compensation or other similar programs that provide benefits for work-related injuries or illness.

Lawsuits, Disputes, and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, warrant, discovery request or other lawful due process.

Law Enforcement Officials

We may disclose your PHI to the police or other law enforcement officials as required by law or to comply with a court order.

Military Officials

If you are a member of the United States or foreign armed forces, we may disclose your PHI as required by law.

Correctional Institution

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose PHI to the institution or officials as permitted by law so that the institution may provide you with health care, protect your health and safety, and protect the health and safety of others.

Organ and Tissue Donation

We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.

Coroners, Medical Examiners and Funeral Directors

We may release PHI to a coroner or medical examiner to identify a deceased person or to determine the cause of death. We may also release PHI to funeral directors as necessary to carry out their duties.

4. Uses and Disclosures of Your PHI that Require Your Written Authorization

This Section describes how we may use your PHI only if we have your written authorization. If you give us authorization, you may revoke it, in writing, at any time. However, your revocation will not affect any actions that we took in reliance on your authorization before it was revoked.

Marketing and Sale of PHI

We must obtain your written authorization before we can use your PHI for marketing, as that term is defined by HIPAA. Similarly, we may not sell your PHI without your permission.

For example, we will not accept any payments from other organizations or individuals in exchange for communicating with you about treatments, therapies, health care providers, settings of care, case management, care coordination, products or services unless you have given us your written authorization to do so or the communication is permitted by law.

However, we may provide refill reminders or inform you about a medicine that is currently prescribed to you under certain circumstances. We may also market to you when we see you in-person.

Psychotherapy Notes

Except in limited circumstances, we will not use or disclose any psychotherapy notes about you without your written authorization.

Highly Confidential Information

Federal and applicable state law may require special privacy protections for certain health information about you, for example, information relating to HIV testing, mental/behavioral health, and genetic information. If required by law, we will obtain your authorization before disclosing this information.

5. Your Individual Rights

How to Exercise Your Rights

You may exercise your rights by making a request in writing to the facility manager where you receive treatment or to the Privacy Officer at the address found at the end of this notice. You may obtain request forms at your facility or from the Privacy Officer.

If you have given someone medical power of attorney or if someone is your personal representative or legal guardian, that person can exercise your rights. We will make sure that the person has this authority before we take any action.

Right to Request Restrictions

You may ask us not to use or disclose certain PHI for treatment, payment and health care operations. You may also ask us to not share information with individuals who are involved in your care or payment for care, for example, a family member or friend.

We are not required to agree to your requests, and we may say “no” if it would affect your care or if we are legally required to share the information. However, we will agree to a request to restrict disclosure to a health plan for an item or service for which you (or someone on your behalf other than the health plan) have paid out-of-pocket in full, and the disclosure is not required by law.

Right to Request Confidential Communications

You have the right to ask us to communicate with you about your PHI in a certain way or at a certain location. For example, you may ask us to contact you at a home or office phone number, or to send mail to a different address. We will say “yes” to all reasonable requests.

Right to Inspect and Copy

You may ask to see or get a copy of your medical record and certain other information we have about you. If you request copies, we may charge you a reasonable fee. We will inform you if we cannot fulfill your request, and you may ask us to reconsider by contacting the Privacy Officer at the address below.

Right to Amend

If you think that information in your medical or billing records is incorrect or incomplete, you may ask us to amend that information. We are not required to agree to your request and we may say “no” if the information is accurate and complete. We may also say “no” if we do not maintain the information or in certain other circumstances.

Right to an Accounting of Disclosures

You may ask us for a list (accounting) of disclosures of your PHI during the past six years. We will include all disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as those you asked us to make). We will provide one accounting a year for free, but will charge a reasonable, cost-based fee for additional requests you make within 12 months.

Right to a Paper Copy of This Notice.

You may ask for a paper copy of this notice at any time.

6. Changes To This Notice

We may change the terms of this notice at any time, and the changes will apply to all PHI we have about you. The new notice will be available upon request, in our office, and on our website.

7. For More Information Or To File A Complaint

If you want further information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to your PHI, you may contact our Privacy Officer at:

Attn: Privacy Officer

920 Winter Street

Waltham, MA 02451-1457

1‑800-662-1237 ext. 4235

Privacy@fmc-na.com

You may also file a written complaint with the Office for Civil Rights of the U.S. Department of Health and Human Services at:

200 Independence Avenue, S.W.

Washington, D.C. 20201

1-877-696-6775

www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.