NOTICE OF PRIVACY PRACTICES FOR

NORTHWEST PHYSICIANS ASSOCIATES, P.C., ITS SUBSIDIARIES AND d/b/a(s)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions regarding this notice, you may contact our privacy officer at:

Address: Attn: Privacy Office
1012 Water Street, Meadville, PA 16335
Telephone: (814) 333-2001

This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. “Protected Health Information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related healthcare services.

We are required by law (the Health Insurance Portability and Accountability Act; HIPAA), to maintain the privacy of protected health information and to provide individuals with notice of our legal duties and privacy practices with respect to protected health information. We are also required to abide by the terms of the Notice of Privacy Practices currently in effect. We may change the terms of our notice at any time. The new notice will be effective for all protected health information that we maintain at that time. In the event the notice is revised, it will be posted in the waiting area of your physicians’ office. In addition, upon your request, we will provide you with any revised Notice of Privacy Practices. You may obtain the revised notice by accessing our website at www.northwestphysicians.com or by calling the office and requesting that a revised copy be sent to you in the mail or asking for one at the time of your next appointment.

1. Uses and Disclosures of Protected Health Information

Your protected health information may be used and disclosed by your physician, our office staff and others outside of our office who are involved in your care and treatment for the purpose of providing healthcare services to you. Your protected health information may also be used and disclosed to pay your healthcare bills and to support the operations of the physician’s practice.

The following are examples of the types of uses and disclosures of your protected healthcare information that the physician’s office is permitted to make. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our office.

A. Permitted and Required Uses and Disclosures That May Be Made Without Your Authorization or Opportunity to Object

We may use or disclose your protected health information in the following situations without your authorization:

Required by Law: We may use and disclose protected health information when required by federal, state, or local law. For example, we may disclose protected health information to comply with mandatory reporting requirements involving births and deaths, child abuse, disease prevention and control, vaccine-related injuries, medical device-related deaths and serious injuries, gunshot and other injuries by a deadly weapon or criminal act, driving impairments, and blood alcohol testing.

In addition, the following are examples of disclosures required by law:

i. Communicable Diseases: We may disclose protected health information to the appropriate public health agency, as required by law, to report communicable diseases. Also, we may disclose protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

ii. Health Oversight: We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include, but are not limited to, government agencies that oversee the healthcare system, government benefit programs, other government regulatory programs and civil rights laws.

iii. Abuse, Neglect or Domestic Violence: We may disclose, if required by law, your protected health information to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

iv. Food and Drug Administration: We may disclose your protected health information to a person or company when required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, to track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.

v. Legal Proceedings: We may use and disclose protected health information disclosures in judicial and administrative proceedings in response to a court order or subpoena, discovery request or other lawful process. For example, we may comply with a court order to testify in a case at which your medical condition is an issue.

vi. Law Enforcement: We may use and disclose protected health information for certain law enforcement purposes including to:
• Comply with legal process, for example, a search warrant, subpoena or grand jury subpoena.
• Comply with a legal requirement, for example, mandatory reporting of gunshot wounds.
• Respond to a request for information for identification / location purposes.
• Respond to a request for information about a crime victim.
• Report a death suspected to have resulted from criminal activity.
• Provide information regarding a crime on the premises.
• Report a crime in an emergency.

vii. Coroner and Medical Examiners: We may use and disclose protected health information for purposes of providing information to a coroner or medical examiner for the purpose of identifying a deceased patient, determining a cause of death, or facilitating their performance of other duties required by law.

viii. Funeral Directors: We may use and disclose protected health information for purposes of providing information to funeral directors as necessary to carry out their duties.

ix. Organ and Tissue Donation: For purposes of facilitating organ, eye and tissue donation and transplantation, we may use protected health information and disclose protected health information to entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue.

x. Criminal Activity: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.

xi. Specialized Government Functions: We may use and disclose protected health information for purposes involving specialized government functions including:
• Military and veterans activities.
• National security and intelligence.
• Protective services for the President and others.
• Medical suitability determinations for the Department of State.
• Correctional institutions and other law enforcement custodial situations.

xii. Workers Compensation and Similar Programs: We may use and disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

xiii. Inmates: We may use or disclose your protected health information if you are an inmate of a correctional facility and your physician created or received your protected health information in the course of providing care to you.

xiv. Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 of the Privacy Rule.

xv. Emergency: We may use or disclose your protected health information in emergency situations. We may also use or disclose protected health information to notify or assist in notifying a family member, personal representative, or any other person that is responsible for your care of your location, general condition or death.

xvi. Disaster: In the event of a disaster, we may use or disclose your protected health information to an authorized public entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your healthcare.

xvii. Incidental Disclosures: We may disclose protected health information as a by-product of an otherwise permitted use or disclosure. For example, other patients may overhear your name being paged in the waiting room.

xviii. De-identified Information: We may use protected health information in the process of de-identifying information. For example, we may use protected health information in the process of removing those aspects that could identify the patient. De-identified information is information that has had any patient identifiable information removed. De-identified information may be disclosed without the patient’s authorization.

xviv. Business Associates: Our “Business Associates” are entities that provide services to our practice and that require access to protected health information of our patients in order to provide those services. A business associate of our practice may create, receive, maintain, or transmit protected health information while performing a function on our behalf. For example, we may share with our billing company information regarding your care so that the company can file health insurance claims and bill you or another responsible party. In addition, we may share protected health information with a business associate who needs the information to provide a service to us. For example, our attorneys may need access to protected health information to provide legal services to us. Our business associates may use and disclose your protected health information consistent with this notice and as otherwise permitted by law. To protect your protected health information, we require business associates to enter into written agreements that they will appropriately safeguard the protected health information they require to provide the services they have agreed to provide.

B. Permitted Uses and Disclosures That May be Made Without Your Authorization However, With an Opportunity to Object

i. Treatment: We will use and disclose your protected health information to provide, coordinate, or manage your healthcare and any related services.

For example:
• During an office visit, practice physicians and other staff involved in your care may review your medical record.
• We may share and discuss your medical information with an outside physician to whom we have referred you for care.
• We may share and discuss your medical information with an outside physician with whom we are consulting regarding you.
• We may share and discuss your medical information with an outside laboratory, radiology center, or other healthcare facility where we have referred you for testing.
• We may share and discuss your medical information with an outside home health agency, durable medical equipment supplier or other healthcare provider to whom we have referred you for healthcare services and products.
• We may share and discuss your medical information with a hospital or other healthcare facility where we are admitting or treating you.
• We may share and discuss your medical information with another healthcare provider who seeks this information for the purpose of treating you.
• We may use a patient sign-in sheet in the waiting area which is accessible to all patients.
• We may page patients in the waiting room when it is time for them to go to an examining room.
• We may contact you to provide appointment reminders.

ii. Payment: Your protected health information will be used, as needed, to obtain payment for your healthcare services.

For example:
• Sharing information with your health insurer to determine whether you are eligible for coverage or whether proposed treatment is a covered service.
• Submission of a claim to your health insurer.
• Providing supplemental information to your health insurer so that your health insurer can obtain reimbursement from another health plan under a coordination of benefits clause in your subscriber agreement.
• Sharing your demographic information (for example, your address) with other healthcare providers who seek this information to obtain payment for healthcare services provided to you.
• Mailing you bills in envelopes with our practice name and return address.
• Provision of a bill to a family member or other person designated as responsible for payment for services rendered to you.
• Providing medical records and other documentation to your health insurer to support the medical necessity of a health service.
• Allowing your health insurer access to your medical record for a quality review audit.
• Providing consumer reporting agencies with credit information (your name and address, date of birth, social security number, payment history, account number, and our name and address).
• Providing information to a collection agency or our attorney for purposes of securing payment of a delinquent account.
• Disclosing information in a legal action for purposes of securing payment of a delinquent account.

iii. Healthcare Operations: We may use or disclose, as-needed, your protected health information in order to support the business activities of your physician’s practice.

For example:
• Quality assessment and improvement activities.
• Population based activities relating to improving health or reducing healthcare costs.
• Reviewing the competence, qualifications, or performance of healthcare professionals.
• Conducting training programs for medical students.
• Accreditation, certification, licensing, and credentialing activities.
• Healthcare fraud and abuse detection and compliance programs.
• Conducting other medical reviews, legal services, and auditing functions.
• Business planning and development activities, such as conducting cost management and planning related analyses.
• Sharing information regarding patients with entities that are interested in purchasing our practice and turning over patient records to entities that have purchased our practice.
• Other business management and general administrative activities, such as compliance with the federal privacy rule and resolution of patient grievances.

iv. Others involved in your healthcare: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your protected health information that directly relates to that person’s involvement in your healthcare. In addition, we may allow a member of your family, a relative, a close friend or any other person you identify to act on your behalf to pick up prescriptions, medical supplies, x-rays and other similar forms of protected health information (this does not include the release of your medical record).

However, if you are unable to agree or unable to object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment.

C. Permitted Uses and Disclosures That May be Made With Your Verbal Authorization or Opportunity to Object

Your protected health information may be discussed in the presence of a family member, relative, close friend or other individual who is with you and you are capable of making your own decisions if:
• Agreement is obtained from you to discuss protected health information;
• an opportunity is given to you to object to the disclosure of protected health information and objection is not expressed by you; or
• your physician or healthcare provider reasonably infers from the circumstances, based on the exercise of his or her professional judgment, that you do not object to the disclosure.

D. Permitted and Required Uses and Disclosures Made With Your Written Authorization

Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law. For example, your authorization is required for your physician or your physician’s office to use or disclose your protected health information for marketing, research, a financial application, a life insurance application, psychotherapy notes, fundraising, and any other such disclosures. You may revoke this authorization at any time, in writing, except to the extent that your physician or the physician’s practice has taken an action in reliance on the use or disclosure indicated in the authorization.

2. Your Rights

Following is a statement of your rights with respect to your protected health information and a brief description of how you may exercise these rights.

You have a right to request and receive a copy of your protected health information that we maintain in a designated records set. This right is subject to limitations and we may impose a charge for the labor and supplies involved in providing copies. To exercise your right of access, you must complete a medical records release form.

You have the right to request a restriction on certain uses and disclosures of your protected health information. This means you may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment or healthcare operations. We must agree to a request not to disclose your protected health information to a health plan for payment or health care operations purposes if the information pertains solely to a health care item or service for which we have been paid in full by you or someone other than the health plan and the disclosure is not otherwise required by law. You may also request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply.

We are not required to agree to a restriction that you may request. If your physician does agree to the requested restriction, he/she will submit the request to our designated Privacy Officer for approval. All restrictions must be approved by the Privacy Officer to become effective. No restriction agreed to by an employee or by a physician is valid without Privacy Officer approval. If your requested restriction is approved, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment. With this in mind, please discuss any restriction you wish to request with your physician. You may request a restriction by submitting a written request to your physician. The request must tell us: (a) what information you want to be restricted: (b) how you want the information to be restricted; and (c) to whom you want the restriction to apply. You may make this request by completing a Request for Restriction of Protected Health Information form.

You have the right to request to receive confidential communications from us by alternative means or at an alternative location. We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please make this request in writing to your physician’s office.

You have the right to request that your physician amend your protected health information. You have a right to request that we amend protected health information we maintain about you in a designated records set if the information is incorrect or incomplete. This right is subject to limitations. To request an amendment, you must submit a written request to your physician. The request must specify each change that you want and provide a reason to support each requested change. Your physician may not agree to the change and therefore, may deny your request. You have a right to submit, in writing, a statement of disagreement to the denial.

You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information. This right applies to disclosures for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures we may have made to you, to family members or friends involved in your care, or releases authorized by you. You have the right to receive specific information regarding these disclosures that occurred after April 14, 2003. You may request a shorter timeframe. The right to receive this information is subject to certain exceptions, restrictions and limitations. To request an accounting of disclosures, you must submit a written request to your physician.

You have the right to inspect and obtain a copy of your protected health information that we maintain in a designated record set. Generally, this includes your medical and billing records. This right is subject to limitations. In certain cases, we may deny your request. We also may impose charges for the cost involved in providing copies, such as labor, supplies, and postage, as permitted by law. If your records are maintained electronically, you have the right to specify that the records you requested be provided in electronic form. We will accommodate your request for a specific electronic form or format. If we cannot do so, we will work with you to reach an agreement or an alternative readable electronic form. If you request a copy of your information electronically on a moveable electronic media (such as CD or USB drive) we may charge you for the cost of that media.

To exercise your right to your protected health information, you must submit a written request to our privacy officer. The request must: (a) describe the health information to which access is requested; (b) state how you want to access the information, such as inspection, pick-up of copy, mailing of copy; (c) specify any requested form or format, such as paper copy or an electronic means; and (d) include the mailing address, if applicable.

You may also request that your protected health information be directly transmitted to another person or entity. To exercise this right, you must submit a request to our privacy officer. The request must: (a) be in writing and signed by you; and (b) clearly identify both the designated person or entity and where the information should be sent.

You have a right to receive timely written notice of a breach of your unsecured protected health information.

You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically.

3. Complaints

You may file a complaint with us by notifying our privacy officer of your complaint. We will not retaliate against you for filing a complaint. You may contact our privacy officer

at (814) 333-2001 for further information about the complaint process. We will not retaliate against you for filing a complaint.

You may also file a complaint to the Secretary of Health and Human Services if you believe your privacy rights have been violated by us.

This notice was published and becomes effective on April 14, 2003 or on our first day of providing service, whichever date precedes the other. This notice was revised on July 26, 2013.