THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Effective: April 14th, 2003

If you have any questions or requests, please contact Privacy Officer at 319-337-8522.

We are required to protect the privacy of health information about you and that can be identified with you, which we call "protected health information," or "PHI" for short. We must give you notice of our legal duties and privacy practices concerning PHI:

• We must protect PHI that we have created or received about your past, present, or future health condition, health care we provide to you, or payment for your health care.
• We must notify you about how we protect PHI about you.
• We must explain how, when and why we use and/or disclose PHI about you.
• We may only use and/or disclose PHI as we have described in this Notice.

This Notice describes the types of uses and disclosures that we may make and gives you some examples. In addition, we may make other uses and disclosures which occur as a byproduct of the permitted uses and disclosures described in this Notice.

We are required to follow the procedures in this Notice. We reserve the right to change the terms of this Notice and to make new notice provisions effective for all PHI that we maintain by first:

• Posting the revised notice in our offices;
• Making copies of the revised notice available upon request (either at our offices or through the contact person listed in this Notice); and
• Posting the revised notice on our website.

B. WE MAY USE AND DISCLOSE PHI ABOUT YOU WITHOUT YOUR AUTHORIZATION IN THE FOLLOWING CIRCUMSTANCES.

1. We may use and disclose PHI about you to provide health care treatment to you.

We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others. For example, we may use and disclose PHI about you when you need a prescription, lab work, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider.

EXAMPLE UICH may also need to share your PHI in order to coordinate different services you may need, such as prescriptions, lab work and nursing care. We may also disclose PHI about you to people outside the agency who may be involved in your medical care, such as physical therapist, social worker or others who may provide services as part of your care.

2. We may use and disclose PHI about you to obtain payment for services.

Generally, we may use and give your medical information to others to bill, case manage and collect payment for the treatment and services provided to you. Before you receive scheduled services, we may share information about these services with your health plan(s). Sharing information allows us to ask for coverage under your plan or policy and for approval of payment before we provide the services. We may also share portions of your medical information with the following:

• Billing departments;
• Collection departments or agencies;
• Insurance companies, health plans and their agents which provide you coverage;
• Consumer reporting agencies (e.g., credit bureaus).

  EXAMPLE: Let's say you require IV antibiotics. We may need to give your health plan(s) information about your condition, supplies used (such as medication or pump), and services you received (such as nursing visits).The information is given to our billing department and your health plan so we can be paid or you can be reimbursed.

3. We may use and disclose your PHI for health care operations.

We may use and disclose PHI in performing business activities, which we call "health care operations". These "health care operations" allow us to improve the quality of care we provide and reduce health care costs. Examples of the way we may use or disclose PHI about you for "health care operations" include the following:

• Reviewing and improving the quality, efficiency and cost of care that we provide to you and our other patients. For example, we may use PHI about you to develop ways to assist our health care providers and staff in deciding what medical treatment should be provided to others.
• Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you.
• Providing training programs for students, trainees, health care providers or non-health care professionals (for example, billing clerks or assistants, etc.) to help them practice or improve their skills.
• Cooperating with outside organizations that assess the quality of the care we and others provide. These organizations might include government agencies or accrediting bodies such as the Accreditation Commission for Health Care.
• Assisting various people who review our activities. For example, PHI may be seen by Board of Nursing or Business Consultants reviewing the services provided to you, and by accountants, lawyers, and others who assist us in complying with applicable laws.
• Planning for our organization's future operations for the benefit of our organization.
• Conducting business management and general administrative activities related to our organization and the services it provides, including providing information.
• Resolving grievances within our organization.
• Reviewing activities and using or disclosing PHI in the event that we sell our business, property or give control of our business or property to someone else.
• Complying with this Notice and with applicable laws.

4. We may use and disclose PHI under other circumstances without your authorization.

We may use and/or disclose PHI about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:

• When the use and/or disclosure is required by law. For example, when a disclosure is required by federal, state or local law or other judicial or administrative proceeding.
• When the use and/or disclosure is necessary for public health activities. For example, we may disclose PHI about you if you have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition or reporting reactions to medications or problems with products.
• When the disclosure relates to victims of abuse, neglect or domestic violence.
• When the use and/or disclosure is for health oversight activities. For example, we may disclose PHI about you to Medicare or Medicaid which is authorized by law to oversee our operations.
• When the disclosure is for judicial and administrative proceedings. For example, we may disclose PHI about you in response to an order of a court or administrative tribunal.
• When the disclosure is for law enforcement purposes. For example, we may disclose PHI about you in order to comply with laws that require the reporting of certain types of wounds or other physical injuries.
• When the use and/or disclosure relates to decedents. For example, we may disclose PHI about you to a coroner or medical examiner for the purposes of identifying you should you die.
• When the use and/or disclosure is to avert a serious threat to health or safety. For example, we may disclose PHI about you to prevent or lessen a serious and eminent threat to the health or safety of a person or the public.
• Your Protected Information may be used or disclosed for a variety of government functions subject to some limitations. These government functions include:
  • Military and veterans activities;
  • National security and intelligence activities;
  • Protective service of the President and others;
  • Medical suitability determinations for Department of State officials;
  • Correctional institutions and law enforcement custodial situations; or
  • Provision of public benefits.

5. You can object to certain uses and disclosures.

Unless you object, we may use or disclose PHI about you in the following circumstances:

• Communication with Family Members and Caregivers. With your permission, we will release Protected Information to a family member, relative or close personal friend who is involved in your care to the extent necessary for them to participate in your care. When caring for you in the home, incidental information may be released to persons in your home.

If you would like to object to our use or disclosure of PHI about you in the above circumstances, please call our contact person listed on the cover page of this Notice.

6. We may contact you for ongoing care, supplies, visits, deliveries and inventory.

We may use and/or disclose PHI to contact you to provide a reminder to you about a visit you have for treatment or medical care. We may leave information on your answering machine if you are not available.

• Care Coordination. We may contact you to schedule or remind you of a visit
• Inventory Maintenance. We may contact you for inventory counts.
• Deliveries. We may contact you to schedule time to make inventory deliveries.

7. Identification of our employees and business.

• Name Tags. Our employees may be identified by wearing company name tags,
• Delivery Bags and Boxes. Items you receive from us may be identified by our name, address, and/or our company logo.
• Delivery Staff. Employees who we contract with to deliver care and products on our behalf may be identified by their own company name tag. In some cases, their vehicles could also be identified by their company logo.

** ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN AUTHORIZATION **

Under any circumstances other than those listed above, we will ask for your written authorization before we use or disclose PHI about you. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing. If you cancel your authorization in writing, we will not disclose PHI about you after we receive your cancellation, except for disclosures which were being processed before we received your cancellation.

C. YOU HAVE SEVERAL RIGHTS REGARDING PHI ABOUT YOU.

1. You have the right to request restrictions on uses and disclosures of PHI about you.

You have the right to request that we restrict the use and disclosure of PHI about you. We are not required to agree to your requested restrictions. However, even if we agree to your request, in certain situations your restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described in subsection 4 of the previous section of this Notice. You may request a restriction by contacting the Privacy Officer.

2. You have the right to request different ways to communicate with you.

You have the right to request how and where we contact you about PHI. For example, you may request that we contact you at your work address or phone number or by email. Your request must be in writing. We must accommodate reasonable requests, but, when appropriate, we may request you to specify an alternative address or other method of contact. You may request alternative communications by contacting the Privacy Officer.

3. You have the right to see and copy PHI about you.

You have the right to request to see and receive a copy of PHI contained in clinical, billing and other records used to make decisions about you. Your request must be in writing. We may charge you related fees. Instead of providing you with a full copy of the PHI, we may give you a summary or explanation of the PHI about you, if you agree in advance to the form and cost of the summary or explanation. There are certain very limited situations in which we are not required to comply with your request. For example, you may request to see and receive a copy of PHI by contacting the Privacy Officer.

4. You have the right to request amendment of PHI about you.

You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if: 1) the information was not created by us (unless you prove the creator of the information is no longer available to amend the record); 2) the information is not part of the records used to make decisions about you; 3) we believe the information is correct and complete; or 4) you would not have the right to see and copy the record as described in paragraph 3 above. We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the information, we will make reasonable efforts to inform others of the amendment, including persons you name who have received PHI about you and who need the amendment. You may request an amendment of your PHI by contacting the Privacy Officer.

5. You have the right to a listing of disclosures we have made.

If you ask our contact person in writing, you have the right to receive a written list of certain of our disclosures of PHI about you. A request for any disclosures made up to six (6) years before your request (not including disclosures made prior to April 14, 2003) must be in writing. We are required to provide a listing of all disclosures except the following:

• For your treatment
• For billing and collection of payment for your treatment
• For our health care operations
• Made to or requested by you, or that you authorized
• Occurring as a byproduct of permitted uses and disclosures
• Made to individuals involved in your care, for directory or notification purposes, or for other purposes described in subsection B.5 above
• Allowed by law when the use and/or disclosure relates to certain specialized government functions or relates to correctional institutions and in other law enforcement custodial situations (please see subsection B.4 above) and
• As part of a limited set of information which does not contain certain information which would identify you
• As authorized and to the extent necessary to comply with laws relating to workers' compensation or other programs providing benefits for work-related injuries or illness without regard to fault.

The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the information, a brief description of the information disclosed, and the purpose of the disclosure.

If you request a list of disclosures more than once in 12 months, we can charge you a reasonable fee. You may request a listing of disclosures by contacting the Privacy Officer.

6. You have the right to a copy of this Notice.

You have the right to request a paper copy of this Notice at any time by contacting the Privacy Officer. We will provide a copy of this Notice no later than the date you first receive service from us (except for emergency services, and then we will provide the Notice to you as soon as possible). We reserve the right to revise and change the terms of this notice at any time and it will apply to the past, current and future. You may request a revised copy by contacting the Privacy Officer

D. YOU MAY FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES.

If you think your privacy rights have been violated by us, or you want to complain to us about our privacy practices, you can contact the person listed below:

Alicia Romont, Privacy Officer, University of Iowa Community HomeCare, 2949 Sierra Court, Iowa City, Iowa, 52240

You may also send a written complaint to the United States Secretary of the Department of Health and Human Services.

If you file a complaint, we will not take any action against you or change our treatment of you in any way.

E. EFFECTIVE DATE OF THIS NOTICE

This Notice of Privacy Practices is effective on April 14th, 2003.