What is the Notice of Privacy Practices?

The Notice explains how we fulfill our commitment to respect the privacy and confidentiality of your protected health information. This Notice explains how we may use and share your protected health information, as well as the legal obligations we have regarding your protected health information, and about your rights under federal and state laws. The Notice applies to all records held by MSNHP, regardless of whether the record is written, computerized or in any other form. We are required by law to make sure that information that identifies you is kept private and to make this Notice available to you. In this Notice, the term “protected health information” refers to individually identifiable information about you, which may include:

• Information about your health condition (such as medical conditions and test results you may have)
• Information about healthcare services you have received or may receive in the future (such as a surgical procedure)
• Information about your healthcare benefits under an insurance plan (such as whether a prescription is covered)
• Geographic information (such as where you live or work)
• Demographic information (such as your race, gender, ethnicity or marital status)
• Unique numbers that may identify you (such as your Social Security number, your phone number or your driver’s license)
• Biometric identifiers (such as fingerprints)
• Full-face photographs

Who follows the MSNHP Health Notice of Privacy Practices

This Notice describes the practices of MSNHP and its physicians, other health care providers and other personnel (collectively referred to as “we” or “us”). The privacy practices described in this Notice will be followed by all healthcare professionals, employees, medical staff, trainees, students, volunteers and business associates of MSNHP.

We may use and disclose your protected health information without your consent to:

• Provide you with medical treatment and other services
• Carry out certain operations necessary to the operation of our facilities and programs, such as quality improvement studies, medical education and verifying the qualifications of doctors
• Coordinate your care, which may include such things as giving you appointment reminders and telling you about other treatment options available through us
• Talk to family or friends involved in your care, unless otherwise indicated by you
• Ensure that we follow the rules of regulatory agencies regarding the quality of care we provide
• Comply with all legal requirements, subpoenas and court orders
• Request payment from you, your insurance company or some other third-party payer
• Meet special situations as described in this Notice, such as public health and safety

You have a right to:

• See and obtain a copy of your medical record in the format of your choosing, with certain restrictions
• Ask us to amend the protected health information we have about you if you feel the information we have is wrong or incomplete
• Ask us to restrict or limit the protected health information we use and share about you
• Ask us to communicate with you about medical matters in a certain way or at a specific location
• Obtain a list of individuals or entities that have received your protected health information from us, subject to limits permitted by law
• Be notified if your protected health information is improperly disclosed or accessed
• Obtain a paper copy of this Notice
• Submit a complaint

How we may use and share your protected health information with others

The following categories describe different ways that we may use and disclose your protected health information. Not every use or disclosure will be listed; however, all the ways we are permitted to use and disclose your information will fall within at least one of the following categories:

For treatment: We may use or disclose protected health information about you to provide, coordinate or manage your medical treatment or services. We may disclose protected health information about you to doctors, nurses, technicians, students or other MSNHP personnel involved in taking care of you. We may share protected health information about you with non-MSNHP health providers, agencies or facilities in order to provide or coordinate the different things you need, such as prescriptions, lab work and X-rays. We also may disclose your protected health information to people outside MSNHP who may be involved in your continuing medical treatment after you leave our care, such as other healthcare providers, home health agencies and transport companies.

For payment: In order to receive payment for the services we provide to you, we may use and share your protected health information with your insurance company or a third party, such as Medicare and Medicaid. We may also share your protected health information with another doctor, facility or service provider that has treated you or has provided services to you, so that they can bill you, your insurance company or a third party. For example, in order for your insurance company to pay for your health-related services at MSNHP, we must submit a bill that identifies you, your diagnosis and the treatment we provided. We may also tell your health plan about a proposed treatment to determine whether your plan will cover the treatment. In addition, insurance companies and other third parties may require that we provide your Social Security number for verification and payment purposes.

For healthcare operations: We may use your protected health information to support our business activities and improve the quality of care. For example, we may use your protected health information to review the treatment and services that we gave you and to see how well our staff cared for you. We may share your information with our students, trainees and staff for review and learning purposes. Your protected health information may also be used or disclosed for accreditation purposes, to handle patients’ grievances or lawsuits and for health care contracting relating to our operations.

Appointment reminders: We may use and share your protected health information to remind you of your appointment for treatment or medical care.

Business associates: We may share your protected health information with a business associate that we hire to help us, such as a billing or computer company or transcription service. Business associates will have assured us in writing that they will safeguard your protected health information as required by law.

Treatment options and other health-related benefits and services: We may use your information to contact you about treatment options and other health-related benefits and services we provide that may be of interest to you. This may include information about our staff or about health-related products and services we offer that may be beneficial for you. However, we will not use your information to engage in marketing activities (other than face-to-face communications) without your written authorization. We also will never sell your protected health information to third parties without your written authorization to do so. However, we may receive payment to disclose your protected health information for certain limited purposes permitted by law.

Individuals involved in your care or payment for your care: Unless you decline, we may release protected health information to people such as family members, relatives or close personal friends who are helping to care for you or pay your medical bills. Additionally, we may disclose information to a patient representative. If a person has the authority under the law to make health care decisions for you, we will treat that patient representative the same way we would treat you with respect to your protected health information. Parents and legal guardians are generally patient representatives for minors unless the minors are permitted by law to act on their own behalf and make their own medical decisions in certain circumstances. If you do not want protected health information about you released to those involved in your care, please notify us.

Disaster relief efforts: We may disclose your protected health information to an organization such as the American Red Cross so that your family can be notified about your condition, status and location in the event of a disaster. If we can reasonably do so while trying to respond to the emergency, we will try to obtain your permission to share this information first.

As required by law: We will share your protected health information when federal, state or local law requires us to do so. This includes to the Secretary of the U.S. Department of Health and Human Services for HIPAA rules compliance and enforcement purposes.

Special situations

Legal proceedings, lawsuits and other legal actions: We may share your protected health information with courts, attorneys and court employees when we get a court order, subpoena, discovery request, warrant, summons or other lawful instructions from those courts or public bodies, and in the course of certain other lawful, judicial or administrative proceedings, or to defend ourselves against a lawsuit brought against us.

Law enforcement: If asked to do so by law enforcement, and as authorized or required by law, we may release protected health information:

• To identify or locate a suspect, fugitive, material witness or missing person
• About a suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement
• About a death suspected to be the result of criminal conduct
• About criminal conduct at MSNHP

To avert a serious threat to health or safety: We may use and disclose your protected health information when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would be to help stop or reduce the threat.

Public health risks: As required by law, we may disclose your protected health information to public health authorities for purposes related to: preventing or controlling disease, injuries or disability; reporting vital events, such as births and deaths; reporting child abuse or neglect; reporting domestic violence; reporting reactions to medications or problems with products; notifying people of recalls, repairs or replacements of products they may be using; notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease and reporting to your employer findings concerning work-related illness or injury so that your workplace may be monitored for safety.

Workers’ compensation: We may share your protected health information for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

Specialized government functions: If you are a member of the armed forces (of either the United States or of a foreign government), we may share your protected health information with military authorities so they may carry out their duties under the law. We may also disclose your protected health information if it relates to national security and intelligence activities, or to providing protective services for the President or for other important officials, such as foreign heads of state.

Health oversight activities: We may disclose your protected health information to local, state or federal governmental authorities responsible for the oversight of medical matters as authorized by law. This includes licensing, auditing and accrediting agencies and agencies that administer public health programs such as Medicare and Medicaid.

Coroners, medical examiners and funeral directors: We may release your protected health information to a coroner or medical examiner as necessary to identify a deceased person or to determine the cause of death. We also may release protected health information to funeral directors so they can carry out their duties.

Organ, eye and tissue donation: If you are an organ donor, we may release your protected health information to organizations that obtain organs or handle organ, eye or tissue transplantation. We also may release your information to an organ donation bank as necessary to facilitate organ, eye or tissue donation and transplantation.

Inmates: If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your protected health information to the correctional institution or law officer as authorized or required by law. This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.

Incidental disclosures: While we will take reasonable steps to safeguard the privacy of your protected health information, certain disclosures of your information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your information. These “incidental disclosures” are permissible.

Uses and disclosures requiring your written authorization

Uses and disclosures not covered in this Notice: Other uses and disclosures of your protected health information not described above in this Notice or permitted by law will be made only with your written authorization. In addition, we will obtain your authorization for most uses and disclosures of psychotherapy notes. When consent for disclosure is required by law, your consent will be obtained prior to such disclosure. If you give us authorization to use or share protected health information about you, you may revoke that authorization in writing at any time. Please understand that we are unable to retract any disclosures already made with your authorization.

Stricter state laws: Certain states have adopted medical privacy laws that are stricter than federal law. For example, New York prohibits the disclosure of HIV-related information and the records of licensed mental health facilities for certain purposes that are permitted by HIPAA. We will follow these stricter state laws, and we will not disclose your protected health information for any purpose prohibited by these laws without your consent.

Your rights concerning your protected health information

Right to ask to see and obtain a copy: You have the right to ask to see and obtain a copy of the protected health information we used to make decisions about your care. This includes medical records (including laboratory testing results) and billing records, but does not include psychotherapy notes. If the record is maintained electronically by MSNHP, you have the right to obtain an electronic copy of the record. Your request must be in writing and must be sent to our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). We may charge you a reasonable fee for the costs of copying, mailing or other expenses associated with complying with your request. We may deny access under certain limited circumstances. If we deny your request, we may provide you a written summary of your record or we may provide you with limited portions of your record. If we deny your request, in part or in its entirety, you may request that the denial be reviewed. A description of the process to have a denial reviewed, as well as information on how to file a complaint with the Secretary of the U.S. Department of Health and Human Services, will be included in the correspondence informing you of our decision to deny your request.

Right to ask for an amendment or addendum: If you feel that the protected health information that we have about you is incorrect or incomplete, you may ask us to amend the information. You have a right to request an amendment as long as the information is kept by or for MSNHP. You are required to submit this request in writing to our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). We may deny your request if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment
• Is not part of the protected health information kept by or for MSNHP
• Is not part of the information you would be permitted to see and copy
• Is determined by us to be accurate and complete

If we deny your request, we will give you a written explanation of why we did not make the amendment. You will have the opportunity to have certain information related to your request included in your medical records, such as your disagreement with our decision. We will also provide you with information on how to file a complaint with us or with the U.S. Department of Health and Human Services.

Right to ask for an accounting of disclosures: You have the right to ask us for a listing of those individuals or entities who have received your protected health information from MSNHP in the six years prior to your request. This listing will not cover disclosures made:

• To you or your personal representative
• To provide or arrange for your care
• To carry out treatment, payment or healthcare operations
• Incident to a permitted use or disclosure
• To parties you authorize to receive your protected health information
• To your family members, relatives or friends who are involved in your care
• For national security or intelligence services
• To correctional institutions or law enforcement officials
• As part of a limited data set for research purposes

You must submit your request in writing to our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). Your request must state the time period for the requested disclosures. The first list requested within a 12-month period will be free. We may charge you for responding to any additional requests in that same period.

Right to request restrictions: You have the right to ask us to restrict or limit the protected health information we use or disclose about you for treatment, payment or healthcare operations. In most cases, we must consider your request, but we are not required to agree to it. However, we must agree to limit disclosures made to your health insurer or other third-party payer about services we provided to you if, prior to receiving the medical services, you pay for the services in full, unless the disclosure of that information is required by law. If multiple medical services are provided to you at one time by MSNHP, you will have to pay for all of the services in order to restrict the disclosure of any one of them to your health insurance. If you require follow-up care related to the undisclosed service and you decide you do not want to pay for that follow-up care at the time it is provided to you, it may be necessary for us to tell your health insurer about the previously undisclosed service. This will be done only to the extent necessary to receive payment for subsequent medical treatment. To restrict information provided to your health insurer or to another third-party payer, you must notify our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). You also have the right to request a limit on the protected health information we disclose about you to someone who is involved in your care or the payment of your care, such as a family member or a friend. For example, you could ask that we not disclose information to a family member about a surgery you had. Your request for any restriction must be made in writing and given to our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com)

Right to request confidential communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at home or only by mail. If you want us to communicate with you in a special way, you will need to give us details about how to contact you, including a valid alternate address. You will also need to give us information about where your bills may be sent. Your request must be made in writing to our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). You do not need to provide a reason for your request. We will comply with all reasonable requests. However, if we are unable to contact you using the requested means or locations, we may contact you using whatever information we have.

Right to receive notice of a breach: You have a right to be notified in the event of a breach of the privacy of your unsecured protected health information by MSNHP or its business associates. You will be notified as soon as reasonably possible, but no later than 60 days following our discovery of the breach. The notice will provide you with the date we discovered the breach, a brief description of the type of information that was involved and the steps we are taking to investigate and mitigate the situation, as well as contact information for you to ask questions and obtain additional information.

Right to a paper copy of this Notice: Upon request, you may at any time obtain a paper copy of this Notice, even if you previously agreed to receive this Notice electronically. To request a copy, please contact our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com).

How to file a privacy complaint: If you believe that your privacy rights have not been followed as directed by federal regulations and state law or as explained in this Notice, you may submit a written complaint to our Privacy Offcer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com).

You will not be retaliated against or denied any health services if you file a complaint: If you are not satisfied with our response to your privacy complaint or you otherwise wish to file a complaint, you may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. The complaint must be in writing, it must describe the subject matter of the complaint and the individuals or organization that you believe violated your privacy and it must be filed within 180 days of when you knew or should have known that the violation occurred. The complaint should then be sent to:

Region II: New York
Att: Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Jacob Javits Federal Building
26 Federal Plaza, Suite 3312 New York, NY 10278
Phone: (800) 368-1019 | Fax: (202) 619-3818 | TDD: (800) 537-7697

Future changes to MSNHP’s privacy practices and this Notice

We reserve the right to change this Notice and the privacy practices of MSNHP covered by this Notice without first notifying you. We reserve the right to make the revised or changed Notice effective for protected health information we already have about you as well as any information we receive in the future. To request a copy of the most recent Notice, please contact our Privacy Officer, Eliza Dewey at 373 Park Avenue South, Floor 2, New York, NY 10016 (eliza@uplivhealth.com). The current Notice will also be posted ou website at uplivhealth.com. At any time, you may request a copy of the Notice currently in effect.