THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date August 1, 2020

1. PURPOSE OF THIS NOTICE

Prism is committed to preserving the privacy of your health information. In fact, we are required by law to do so for any health information created or received by us. Prism Health is required to provide this Notice of Privacy Practices ("Notice") to you. The Notice tells you how we can and cannot use and disclose the health information that you have given to us or that we have learned about you when you were a patient in our system. It also tells you about your rights and our legal duties concerning your health information.

This Notice applies to the practices of all Prism Health’s employees, volunteers, students, and service providers, including clinicians, who have access to health information.

For the rest of this Notice, "Prism Health," "we" and "us" will refer to all services, service areas, and workers of Prism Health. When we use the words "your health information," we mean any information that you have given us about you or and your health, as well as information that we have received while we have taken care of you (including health information provided to Prism Health by those outside of Prism Health).

2. USES AND DISCLOSURES OF HEALTH INFORMATION FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS AT PRISM HEALTH.

a. Treatment, Payment and Health Care Operations. The following section describes different ways that we use and disclose health information for treatment, payment and health care operations. For each of those categories, we explain what we mean and give one or more examples. Not every use or disclosure will be noted and there may be incidental disclosure that are a byproduct of the listed uses and disclosures. The ways we use and disclose health information will fall within one of the categories.

i. For Treatment. We may use your health information to provide you with medical or mental health treatment or services. We may disclose your health information to staff physicians, nurse practitioners, and other personnel involved in your health care. We may also disclose your health information to students who are involved in your care. Treatment includes (a) activities performed by nurses, office staff, hospital staff, technicians and other types of health care professionals providing care to you or coordinating or managing your care with third parties, (b) consultations with and between Prism Health providers and other health care providers, and (c) activities of non-Prism Health providers or other providers covering an Prism Health practice by telephone or serving as the on-call provider.

ii. For Payment. We may use and disclose your health information so that we may bill and collect payment from you, an insurance company, or someone else for health care services you receive from Prism Health. We may also tell your health plan about a treatment you are going to receive to obtain prior approval, or to determine whether your plan will pay for the treatment.

iii. For Health Care Operations. We may use and disclose your health information in order to run the necessary administrative, educational, quality assurance and business functions at Prism Health.

iv. For Quality Assessment and Improvement. Prism Health is part of an organized health care arrangement including participants in OCHIN. A current list of OCHIN participants is available at www.ochin.org as a business associate of Prism Health OCHIN supplies information technology and related services Prism Health and other OCHIN participants. OCHIN also engages in quality assessment and improvement activities on behalf of its participants. For example, OCHIN coordinates clinical review activities on behalf of participating organizations to establish best practice standards and assess clinical benefits that may be derived from the use of electronic health record systems. OCHIN also helps participants work collaboratively to improve the management of internal and external patient referrals. Your personal health information may be shared by Prism Health with other OCHIN participants or a health information exchange only when necessary for medical treatment or for the health care operations purposes of the organized health care arrangement. Health care operation can include, among other things, geocoding your residence location to improve the clinical benefits you receive.

3. OTHER PERMITTED USES AND DISCLOSURES OF HEALTH CARE INFORMATION. We may use or disclose your health information without your permission in the following circumstances, subject to all applicable legal requirements and limitations:

a. Required By Law. As required by federal, state, or local law.

b. Public Health Activities. For public health reasons in order to prevent or control disease, injury or disability; or to report births, deaths, suspected abuse or neglect, non-accidental physical injuries, reactions to medications, school immunizations under certain circumstances or problems with products.

c. Victims of Abuse, Neglect or Domestic Violence. To a government authority authorized by law to receive reports of abuse, neglect or domestic violence when we reasonably believe you are the victim of abuse, neglect or domestic violence and other criteria are met.

d. Health Oversight Activities. To a health oversight agency for audits, investigations, inspections, licensing purposes, or as necessary for certain government agencies to monitor the health care system, government programs, and compliance with civil rights laws.

e. Lawsuits and Disputes. In response to a subpoena, discovery request or a court or administrative order, if certain criteria are met.

f. Law Enforcement. To a law enforcement official for law enforcement purposes as required by law; in response to a court order, subpoena, warrant, summons or similar process; for identification and location purposes if requested; to respond to a request for information on an actual or suspected crime victim; to report a crime in an emergency; to report a crime on Prism Health premises; or to report a death if the death is suspected to be the result of criminal conduct.

g. Research. For research purposes under certain limited circumstances. Research projects are subject to a special approval process. Therefore, we will not use or disclose your health information for research purposes until the particular research project, for which your health information may be used or disclosed, has been approved through this special approval process.

h. Serious Threat to Health or Safety; Disaster Relief. To appropriate individual(s) or organization(s) when necessary (i) to prevent a serious threat to your health and safety or that of the public or another person, or (ii) to notify your family members or persons responsible for you in a disaster relief effort.

i. Workers' Compensation. As necessary to comply with laws relating to workers' compensation or similar work-related injury program.

4. WHEN WRITTEN AUTHORIZATION IS REQUIRED. Other than for those purposes identified above, we will not use or disclose your health information for any purpose unless you give us your specific written authorization to do so.

5. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION. You have certain rights regarding your health information which we list below. In each of these cases, if you want to exercise your rights, you must do so in writing by emailing Prism Health at info@prismhealth.org. In some cases, we may charge you for the costs of providing materials to you. You can get information about how to exercise your rights and about any costs that we may charge for materials by contacting info@prismhealth.org.

a. Right to Inspect and Copy. With some exceptions, you have the right to inspect and get a copy of the health information that we use to make decisions about your care. For the portion of your health record maintained in our electronic health record, you may request we provide that information to or for you in an electronic format. If you make such a request, we are required to provide that information for you electronically (unless we deny your request for other reasons). We may deny your request to inspect and/or copy in certain limited circumstances, and if we do this, you may ask that the denial be reviewed.

b. Right to Amend. You have the right to amend your health information maintained by or for Prism Health, or used by Prism Health to make decisions about you. We will require that you provide a reason for the request, and we may deny your request for an amendment if the request is not properly submitted, or if it asks us to amend information that (a) we did not create (unless the source of the information is no longer available to make the amendment); (b) is not part of the health information that we keep; (c) is of a type that you would not be permitted to inspect and copy; or (d) is already accurate and complete.

c. Right to an Accounting of Disclosures. You have the right to request a list and description of certain disclosures by Prism Health of your health information.

d. Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you (a) for treatment, payment, or healthcare operations, (b) to someone who is involved in your care or the payment for it, such as a family member or friend, or (c) to a health plan for payment or health care operations purposes when the item or service for which Prism Health has been paid out of pocket in full by you or someone on your behalf (other than the health plan). For example, you could ask that we not use or disclose information about a surgery you had, a laboratory test ordered or a medical device prescribed for your care. Except for the request noted in 3(c) above, we are not required to agree to your request.

e. Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain place. Prism Health will accommodate reasonable requests. For example, you can ask that we only contact you at work or by mail.

f. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice, whether or not you may have previously agreed to receive the Notice electronically.

g. Right to be Notified of a Breach. You have the right to be notified if there is a breach –a compromise to the security or privacy of your health information–due to your health information being unsecured. Prism Health is required to notify you within 60 days of discovery of a breach.

6. REVISIONS TO THIS NOTICE. We have the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you, as well as any information we receive in the future. Except when required by law, a material change to any term of the Notice may not be implemented prior to the effective date of the Notice in which the material change is reflected. Prism Health will post the revised Notice on its website and provide you a copy of the revised notice upon your request.

7. QUESTIONS OR COMPLAINTS. If you have any questions about this Notice, please contact Prism Health. If you believe your privacy rights have been violated, you may file a complaint with Prism Health or with the Secretary of the Department of Health and Human Services. To file a complaint with Prism Health, contact Prism Health. You will not be penalized for filing a complaint.

This Notice tells you how we may use and share health information about you. If you would like a copy of this Notice, please ask your health care provider.