It has long been the mission of Pediatric Healthcare Associates to provide you and your family with the highest quality healthcare and health related services. We are committed to making every effort to protect the privacy and confidentiality of your family's health information. In keeping with recently enacted federal legislation, we are pleased to present you our Notice of Privacy Practice. We believe this notice will help you understand our obligations and commitments relative to your privacy, as well as your rights, over medical information. As always, we welcome any suggestions or comments you might have on this or any other part of our practice.

HIPAA (Health Insurance Portability and Accountability Act) Privacy Regulation is a federal regulation that requires that we provide detailed notice in writing of our privacy practices and policies. We do realize this document is long and we have provided a contact number at the end of the notice should you have questions in regards to our privacy practices.

1. OUR COMMITMENT TO PROTECTING HEALTH INFORMATION

This Notice describes the ways that Pediatric Healthcare Associates may use and disclose health information (medical record) about our patients. The Health Insurance Portability and Accountability Act requires that healthcare organizations protect the privacy of health information that identifies a patient or where the information can reasonably be used to identify a patient. Under the regulation, this information is called "protected health information" and we shall refer to this as "PHI." This Notice additionally describes your rights under the regulation and our obligations regarding the use and disclosure of PHI. As a healthcare provider, the law requires us to:

• Maintain the privacy of PHI about our patients;
• Give our patients or their legal guardians this Notice of our legal duties and privacy practice with respect to PHI; and
• Comply with the terms of our Notice of Privacy Practices that is currently in effect.

2 . HOW PEDIATRIC HEALTHCARE ASSOCIATES MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT OUR PATIENTS

The following categories describe the different ways we may use and disclose PHI for treatment, payment, or health care operations. The examples in each category are not all-inclusive and do not constitute a complete list of all uses and disclosures for that category.

Treatment: We may use & disclose PHI about our patients to provide health care services, coordinate health care services with others or manage our patients health care and related services. We may consult with other health care providers (physicians, nurse practitioners, laboratory facilities, hospitals, etc) regarding treatment and coordinate and manage our patients healthcare with others. For example, we may use and disclose PHI when a patient needs a prescription, lab work, an x-ray or other health care services. Additionally, we may use or disclose PHI when we refer you to another health care provider. For example, when we refer you to another health care provider, we may disclose PHI to your new physician regarding your current treatment, including any allergies or current medications or current medications you may be taking. We may also send a report from us to a physician that we refer you to so that the other physician may properly perform treatment. We are not required under certain circumstances to obtain a written authorization from our patients to carry out treatment of patient care.

Payment: Billing insurance companies to receive payment on behalf of the patient is a benefit to the patient. To carry out this benefit to the patient, we may use and disclose PHI so that we can bill and collect payment for the treatment and services provided. This may include providing information about treatment or services with your health plan before the service(s) is received. For example, we may ask for payment authorization from your health plan before we provide care or services. To help you fully understand your out-of-pocket expense, we may use or disclose PHI to determine if your health plan will cover the cost of care and services provided. We may use and disclose PHI for billing, claims management, and collection activities. We may disclose PHI to insurance companies or third party administrators providing you with additional coverage. We may disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us.

We may disclose PHI to another health care provider or to a company or health plan required to comply with the HIPAA Privacy Rule for the payment activities of that health care provider, company, or health plan. For example, we may use an outside lab to process your specimens and that entity may require PHI to appropriately bill the service to your health plan.

Health Care Operations: Health care providers may use and disclose PHI in performing business activities that are referred to as health care operations. Health care operations allows us to improve the quality of care we provide and to reduce health care costs. Health care operations may include the following:

We may use PHI about our patients to:

As Required By Law. We may use and disclose PHI as required by federal, state, or local law. Any disclosure is limited to the requirements of the law.

Public Health Activities. Federal and state law requires disclosures of PHI to public health authorities or their designee to carry out certain activities related to public health, including:

Abuse, Neglect, or Domestic Violence. We may disclose PHI in certain cases to proper government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse, or neglect.

Oversight Activities. We may disclose PHI to a health oversight agency for activities that includes audits, investigations, inspections, licensure and disciplinary activities and other activities conducted to monitor the health care system, government health care programs, and compliance with certain laws.

Lawsuit and Other Legal Proceedings. We may use or disclose when required by a court or in response to subpoenas, discovery requests, or other legal process when efforts have been made to advise you of the request or to obtain an order protecting the information requested.

Law Enforcement. Under certain circumstances we may disclose PHI to law enforcement officials for the following purposes:

Coroners, Medical Examiners, Funeral Directors. We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death. We may also disclose to funeral directors, as authorized by law, so they may carry out their jobs.

Organ and Tissue Donation. If a patient is an organ donor, we may use and disclose PHI to organizations that help procure, locate, and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.

Research. We may use and disclose PHI about our patients for research purposes under certain limited circumstances.

Avert a Serious Threat to Health or Safety. We may use or disclose PHI in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public. Disclosure can only be made to a person who is able to help prevent the threat.

Special Government Functions. Under certain circumstances we may disclose PHI:

Required by HIPAA Privacy Rule. We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule.

Workers' Compensation. We may disclose PHI as authorized by workers' compensation laws or other similar programs that provide benefits for work-related injuries or illness.

3. PATIENTS' RIGHTS REGARDING PROTECTED HEALTH INFORMATION

Under federal law, patients or their legal guardians have the following rights regarding PHI:

Right to Inspect and Copy. You have a right to inspect and copy medical information that may be used to make decisions about patient care. Usually, this includes medical and billing records, but DOES NOT include psychotherapy notes. To inspect and copy medical information that may be used to make decisions about treatment and care, you must submit your request in writing to Pediatric Healthcare Associates Attn: Privacy Officer. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

In very limited circumstances we may deny your request to inspect and copy information. If you are denied access to medical information, you may request that the denial be reviewed. Pediatric Healthcare Associates has a procedure in place where another licensed health care professional will review your request and the denial. The person conducting the review shall not be the person who denied your request. We will comply with the outcome of the review.

Right to Amend. If you believe that medical information we have about you or your child(ren) is incorrect or incomplete, you may ask us to amend the information. To request an amendment, your request must be made in writing and submitted to Pediatric Healthcare Associates, 15 Corporate Drive, Trumbull, CT 06611 Attn: Privacy Officer. You must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may additionally deny your request if you ask us to amend information that:

Right to An Accounting of Disclosures. You have the right to request an "accounting of disclosures." This is a list of the disclosures we made of medical information about you or your child(ren). We are not required to account for disclosures for treatment, payment, health care operations, disclosures to you, or disclosures made through a written authorization.

To request this list, you must submit in writing to Pediatric Healthcare Associates Attn: Privacy Officer. Your request must state the time period, which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you or your child(ren) for treatment, payment or health care operations. You have the right to request a limit on the medical information we disclose to someone who is involved in your care or the payment for your care, like a family member or friend. We are not required to agree to your request. If we do agree to your restriction, we will comply with your request unless the information is needed to provide emergency treatment.

To request a restriction, you must make your request in writing to Pediatric Healthcare Associates, Attn: Privacy Officer. In your request, you must tell us what information you want to limit, whether you want to limit use or disclosure or both, and to whom you want the limits to apply.

Note: Pediatric Healthcare Associates shall respond to your written request for a restriction in writing no later than sixty days upon request. Only restrictions to which a written approval has been given shall apply.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. Example, you can ask that we only contact you by mail.

To request confidential communications, you must make your request in writing to Pediatric Healthcare Associates, Attn: Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Note: Pediatric Healthcare Associates shall notify you in writing if we determine your request not reasonable.

The designated Privacy Officer for Pediatric Healthcare Associates is Paulette Kuntz. Please feel free to contact her with any questions or concerns regarding this policy. Paulette can be reached at (203) 452-6240 ext. 170, or by mail at: Pediatric Healthcare Associates, 15 Corporate Drive, Trumbull, CT 06611 Attn: Privacy Officer.

If you believe your privacy rights have been violated, please contact our Privacy Officer at the number listed above. Every reasonable attempt will be made to investigate and resolve the complaint. In certain circumstances, our Privacy Officer may request that you submit your complaint in writing. Additionally, you may file a complaint with the Secretary of the Department of Health and Human Services.

Pediatric Healthcare Associates has a non-retaliation, non-retribution policy for reporting or complaints. No individual filing a complaint shall be penalized.

4. OTHER USES OF MEDICAL INFORMATION

Uses and disclosures not covered by this Notice shall be made only with your written permission. If you provide us permission to use or disclose medical information about you or your child(ren), you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission and that we are required to retain our records of the care that we provide to our patients.