Mercy Medical Center Notice of Privacy Practices

Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We at Mercy Medical Center (Mercy), Dubuque and Dyersville, Iowa, are required by law to maintain the privacy of individually identifiable patient health information. (This information is "protected health information" and is referred to herein as "PHI.") We are also required to provide patients with a Notice of Privacy Practices regarding PHI. We are required to post this Notice in a prominent place within our facility. We will only use or disclose your PHI as permitted or required by applicable federal or state law. This Notice applies to your PHI in our possession including the medical records generated by us.

Mercy understands that your health information is highly personal, and we are committed to safeguarding your privacy. Please read this Notice of Privacy Practices thoroughly. It describes how Mercy will use and disclose your PHI.

This Notice applies to the delivery of health care by Mercy and its medical staff in the main hospital, outpatient departments, home care, clinics, and nursing home. This Notice also applies to the utilization review and quality assessment activities of Trinity Health of Novi, Michigan, and Mercy as a member of Trinity Health, a Catholic healthcare system with facilities in seven states.

I. Permitted Use or Disclosure

A. Treatment: Mercy will use and disclose your PHI in the provision and coordination of health care to carry out treatment functions.

• Mercy will disclose all or any portion of your patient medical record information to your attending physician, consulting physician(s), nurses, technicians, medical students, and other healthcare providers who have a legitimate need for such information in your care and continued treatment.
• Mercy is a Catholic-sponsored healthcare provider. Staff spiritual care providers are members of our care staff and will be a part of the Mercy team of care providers who may use your medical information to provide healthcare services to you when you are in our facilities.
• Different departments will share medical information about you in order to coordinate specific services, such as lab work, x-rays and prescriptions.
• Mercy also will disclose your medical information to people or entities outside the hospital, at your request, who will be involved in your medical care after you leave the hospital. These may include, but are not limited to, family members, clergy, nursing homes, community resources such as Meals on Wheels, Lifeline, persons/agencies assisting in securing financial assistance, and others who will provide services that are part of your care.
• Mercy will share certain information such as your name, address, employment, insurance carrier, emergency contact information, and appointment scheduling information in an effort to coordinate your treatment with us and with other healthcare providers.
• Mercy will use and disclose your PHI to inform you of, or recommend, possible treatment options or alternatives that may be of interest to you.
• Mercy will use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care at Mercy – Dubuque or – Dyersville.
• If you are an inmate of a correctional institution or under the custody of a law enforcement officer, Mercy will disclose your PHI to the correctional institution or law enforcement official.

B. Payment: Mercy will disclose PHI about you for the purposes of determining coverage, eligibility, funding, billing, claims management, medical data processing, stop loss / reinsurance, and reimbursement.

• The medical information will be disclosed to an insurance company, third party payer, third party administrator, health plan or other healthcare provider (or their duly authorized representatives) involved in the payment of your medical bill and will include copies or excerpts of your medical records which are necessary for payment of your account. It will also share the necessary information to obtain pre-approval of payment for treatment from your health plan.
• Mercy will disclose PHI to collection agencies and other subcontractors engaged in obtaining payment for care.

C. Healthcare Operations: Mercy will use and disclose your PHI during routine healthcare operations including quality assurance, utilization review, medical review, internal auditing, accreditation, certification, licensing, or credentialing activities of Mercy, and for educational purposes.

• For instance, Mercy will need to share your demographic information, diagnosis, treatment plan, and health status for population-based activities relating to improving health or reducing healthcare costs, protocol development, case management and care coordination, and contacting healthcare providers and patients with information about treatment alternatives, in order for us to operate our business in an efficient, safe and legal manner.

D. Other Uses and Disclosures: As part of treatment, payment, and healthcare operations, we may also use your PHI for the following purposes:

• Fund-raising Activities: Mercy will use some of your PHI for certain fund- raising activities. For example, Mercy may use your demographic information (e.g., name, address and other contact information, age, gender, and insurance status) and the dates Mercy provided service to you. Any communication sent to you will let you know how you may opt out of receiving similar communications in the future. Mercy may disclose limited PHI to a company contracted to conduct fund-raising for the hospital. This company will use your PHI only for the purposes of fund-raising for the hospital. (If you wish to opt-out, you may do so by contacting the Director of Fund Development at (563) 589-8113.)
• Medical Research: Mercy may disclose your PHI without your authorization to medical researchers who request it for approved medical research projects; however, with very limited exceptions such disclosures must be cleared through a special approval process before any PHI is disclosed to the researchers. Researchers will be required to safeguard the PHI they receive.
• Information and Health Promotion Activities: Mercy will use and disclose some of your PHI for certain health promotion activities. For example, your name and address may be used to send newsletters or general communications to you. Mercy may also send you information based on your own health concerns. Mercy may send you this information if it has determined that a product or service may help you. The communication will explain how the product or service relates to your well-being and can improve your health.
• Oak Crest Manor Nursing Home is the home of its residents. Residents' names and room numbers are made available in public areas as well as the Hospital Directory to allow relatives and friends to visit. Social activities include publishing of birthdays within the facility as well as the Oak Crest Manor News. Dates of care conferences are also published to allow residents, family, and friends an opportunity to participate. You may opt out of the Hospital Directory or request that no PHI be made available including birth dates and care conferences by contacting administration at Mercy Medical Center, Dyersville, Iowa.

E. More Stringent State and Federal Laws: The State law of Iowa is
more stringent than the Health Insurance Portability and Accountability Act (HIPAA) in some areas. State law is more stringent when the individual is entitled to greater access to records than under HIPAA and when under state law the records are more protected from disclosure than under HIPAA. Certain federal laws also are more stringent than HIPAA. Mercy will continue to abide by these more stringent state and federal laws. The federal laws include applicable Internet privacy laws, such as the Children's Online Privacy Protection Act, and the federal and state laws and regulations governing the confidentiality of health information regarding substance abuse treatment.

IOWA LAW:

ACCESS TO PHI: Iowa law requires that access to PHI by a nursing home resident or skilled nursing or rehabilitation patient be allowed within 24 hours and that a copy be made available to them within 48 hours.

SUBSTANCE ABUSE: Minors, acting on their own, may seek substance abuse treatment. A minor must authorize the release of any PHI in this instance.

SEXUALLY TRANSMITTED DISEASES: A minor may seek treatment for sexually transmitted diseases. A minor must authorize the release of any PHI in this instance.

II. Permitted Use or Disclosure With an Opportunity for You to Agree or Object

A. Family/Friends: Mercy will disclose PHI about you to a friend or family member who is involved in your medical care. Mercy will also give information to someone who helps you pay for your care. In addition, Mercy will disclose PHI about you to an agency assisting in a disaster relief effort so that your family can be notified about your condition status and location. You have a right to request that your PHI not be shared with some or all of your family or friends.

B. Mercy Directory: Mercy will include certain limited information about you in the Hospital Directory while you are a patient/resident at Mercy. This information will include your name, location in the hospital, your general condition (e.g., fair, satisfactory, critical, etc.) and your religious affiliation. This is so your family and friends can visit you in the hospital and know how you are doing. The Directory information, except for your religious affiliation, will also be disclosed to people who ask for you by name. You have the right to request that your name not be included in the Directory. If you request to opt out of the Hospital Directory, we cannot inform visitors of your presence, location, or general condition.

C. Spiritual Care: Directory information including your religious affiliation will be given to a member of the clergy, such as a priest, minister, or rabbi, even if they do not ask for you by name. Your name, location, and general condition will be disclosed to members of the religious community. It is our policy to notify your local religious organization, by disclosing your name, that you are in the hospital. A spiritual care provider may be called in to consult regarding your care with your approval. You have a right to request that your name not be given to any member of the clergy.

D. Promotional Communications: Mercy does not share or sell your PHI to companies that market healthcare products or services directly to consumers for use by those companies to contact you, such as drug companies. Mercy does maintain a database of individuals for its own promotional communications, disease management, health promotion, and fund-raising purposes. This database includes individuals to whom Mercy may have sent health improvement materials and news about Mercy previously, and also individuals who have donated to Mercy or who have expressed an interest in donating to Mercy or other health-related activities. You may be included in this database. Mercy sends information to the individuals in this database about the programs and services of Mercy. If you wish to be deleted from this database, you may notify the Director of Fund Development at (563) 589-8113 or the Director of Marketing at (563) 589-8035.

E. Condition Reports: Mercy may release information on your general condition to the media if the media requests information about you using your full name, after we have given you an opportunity to agree or object. The following information may then be disclosed: your condition, described in general terms that do not communicate specific medical information, such as "good," "satisfactory," "fair," "serious," or "critical."

III. Use or Disclosure Requiring Your Authorization

A. Marketing: Mercy is not permitted to provide your PHI to any other person or company for marketing to you of any products or services other than Mercy products or services unless you have signed an authorization.

B. Research: Mercy will use or disclose your PHI as part of research that includes providing you with treatment. For example, if you are part of a research study that includes treatment, Mercy may require that you sign an authorization to allow the researchers to use or disclose your PHI for this research.

C. Other Uses: Any uses or disclosures that are not for treatment, payment, or operations and that are not permitted or required for public policy purposes or by law will be made only with your written authorization. Written authorizations will explain why we are using your PHI. You have the right to revoke an authorization at any time.

IV. Use or Disclosure Permitted by Public Policy or Law Without Your Authorization

A. Law Enforcement Purposes: Mercy will disclose your PHI for law enforcement purposes as required by law, such as responding to a court order or subpoena, identifying a criminal suspect or a missing person, or providing information about a crime victim or criminal conduct.

B. Required by Law: Mercy will disclose PHI about you when required by federal, state, or local law to make reports or other disclosures. Mercy also will make disclosures for judicial and administrative proceedings such as lawsuits or other disputes in response to a court order or subpoena and mental health or substance abuse commitments to the court, patient advocate, or attorney representing you. Mercy will disclose your medical information to government agencies concerning victims of abuse, neglect, or domestic violence. Mercy will report drug diversion and information related to fraudulent prescription activity to law enforcement and regulatory agencies. Specialized government functions will warrant the use and disclosure of PHI. These government functions will include military and veterans' activities, national security and intelligence activities, and protective services for the U.S. President and others. Mercy will make certain disclosures that are required in order to comply with workers' compensation or similar programs. PHI will be released for vital record statistics such as births and deaths.

C. Coroners, Medical Examiners, Funeral Directors: Mercy will disclose your PHI to a coroner or medical examiner. For example, this will be necessary to identify a deceased person or to determine a cause of death. Mercy will also disclose your medical information to funeral directors as necessary to carry out their duties.

D. Organ Procurement: Mercy will disclose PHI to an organ procurement organization or entity for organ, eye, or tissue donation purposes.

E. Health or Safety: Mercy will use and disclose PHI to avert a serious threat to health and safety of a person or the public. Mercy will use and disclose PHI to public health agencies for immunizations, communicable diseases, etc. Mercy will use and disclose PHI for activities related to the quality, safety, or effectiveness of FDA-regulated products or activities, including collecting and reporting adverse events, tracking and facilitating product recalls, and post-marketing surveillance. Any patient receiving a medical device subject to FDA tracking requirements may refuse to disclose, or refuse permission to disclose, his or her name, address, telephone number, and social security number, or other identifying information for the purpose of tracking.

F. State Registries: Certain PHI is released to state registries such as cancer registry, trauma registry, birth defects registry, poison control, and state neonatal reporting for maintaining statistics on mortality, morbidity, treatment protocols, and public health issues. Certain PHI is released to the Iowa Hospital Association for patient origin studies, data comparison of length of stays, charges, diagnoses, procedures, and so on.

V. Your Health Information Rights

Although we at Mercy must maintain all records concerning your hospitalization and treatment at the hospital, you have the following rights concerning your PHI:

A. Right to Inspect and Copy: You have the right to access your PHI and to inspect and request a copy of your PHI as long as we maintain it except for psychotherapy notes that will be used in a civil, criminal or administrative action or proceeding, and where prohibited or protected by law.

Mercy will deny your request for access to your PHI without giving you an opportunity to review that decision if:

• You do not have the right to inspect the information; or it is otherwise prohibited or protected by law;
• You are an inmate at a correctional institution and obtaining a copy of the information would risk the health, safety, security, custody, or rehabilitation of you or other inmates, or the disclosure of the information would threaten the safety of any officer, employee, or other person at the correctional institution or who is responsible for transporting you;
• You are involved in a clinical research project and Mercy created or obtained the PHI during that research. Your access to the information will be temporarily suspended for as long as the research is in progress;
• The information to which you seek access was obtained by Mercy from someone other than the healthcare provider under a promise of confidentiality, and your access request is likely to reveal the source of the information; or
• Under other limited circumstances. In these instances, however, Mercy will allow the review of its decision by a healthcare professional chosen by the hospital. This person will not have been involved in the original decision to deny your request.

If your request is granted, you will be asked to pay a reasonable copying charge. You must make your request to access and copy your PHI in writing to the Medical Records Department at Mercy. We will respond to your request within 30 days of its receipt (see Iowa law regarding nursing home resident, skilled and rehabilitation patients). If the hospital cannot respond within 30 days, Mercy will notify you in writing to explain the delay and the date by which we will act on your request. In any event, Mercy will act on your request within 60 days of its receipt.

B. Right to Amend: You have the right to amend your PHI for as long as
Mercy maintains it; however, Mercy will deny your request for amendment if:

• Mercy did not create the information;
• The information is not part of the designated record set;
• The information would not be available for your inspection (due to its condition or nature); or
• The information is accurate and complete.

If Mercy denies your request for changes in your PHI, Mercy will notify you in writing with the reason for the denial. Mercy will also inform you of your right to submit a written statement disagreeing with the denial. You may ask that Mercy include your request for amendment and the denial any time that the hospital discloses the information that you wanted changed. Mercy may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal.

You must make your request for amendment of your PHI in writing to the Medical Records Department at Mercy including your reason to support the requested amendment. Mercy will respond to your request within 60 days of its receipt. If Mercy cannot respond within that time, we will notify you in writing to explain the delay and the date by which the hospital will act on your request. In any event, Mercy will act on your request within 90 days of its receipt.

C. Right to an Accounting: You have a right to receive an accounting of the
disclosures of your PHI that Mercy made, except for the following disclosures:

• To carry out treatment, payment or healthcare operations;
• To you or ones you authorized;
• To persons involved in your care;
• For national security or intelligence purposes;
• To correctional institutions or law enforcement officials; or
• Disclosures that occurred prior to April 14, 2003.

For each disclosure, you will receive: the date of the disclosure, the name of the receiving organization, and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of the written request for the information, if there was one.

You must make your request for an accounting of disclosures of your PHI in writing to Mercy. You must include the time period of the accounting, which may not be longer than 6 years. Mercy will respond to your request within 60 days from its receipt. If Mercy cannot respond within that time, you will be notified in writing to explain the delay and the date by which Mercy will act on your request. In any event, Mercy will act on your request within 90 days of its receipt.

In any given 12-month period, Mercy will provide you with an accounting of the disclosures of your PHI at no charge. Any additional requests for an accounting within that time period will be subject to a reasonable fee for preparing the accounting.

D. Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI:

• To carry out treatment, payment or healthcare operations functions;
• To restrict specific information to only specified family members, relatives, close personal friends, or other individuals involved in your care; or
• To limit information in the facility directory. For example, you may ask that your name not be used in the waiting room or that information about your expected discharge date not be shared with your family. Mercy will consider your request but is not required to agree to the requested restrictions.

E. Right to Confidential Communications: You have the right to receive
confidential communications of your PHI by alternative means or at alternative locations. For example, you may request that Mercy only contact you at work or by mail.

F. Right to Receive a Copy of this Notice: You have the right to receive a paper copy of this Notice of Privacy Practices, upon request.

VI. Complaints

If you believe your privacy rights have been violated, you may file a complaint with Mercy or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with the hospital, please contact Mercy's Privacy Official at (563) 589-9626. All complaints must be submitted in writing directly to the privacy official. Mercy assures you that there will be no retaliation for filing a complaint.

VII. Sharing and Joint Use of Your Health Information

In the course of providing care to you and in furtherance of Mercy's mission to improve the health of the community, Mercy will share your PHI with the following organizations who have agreed to abide by the terms described below:

A. Medical Staff: The medical staff and Mercy participate together in an organized healthcare arrangement to deliver health care to you at Mercy. Both Mercy and its medical staff have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of health care services to you in the hospital. Physicians and allied healthcare providers are members of Mercy's medical staff and will have access to and use of your PHI for treatment, payment, and healthcare operations purposes related to your care within the hospital. Mercy will disclose your PHI to the medical staff for payment, treatment, and healthcare operations.

B. United Clinical Laboratories, Inc. (UCL): UCL and Mercy participate together in an organized healthcare arrangement to deliver health care to you at Mercy. Both Mercy and UCL have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of healthcare services to you in the hospital. Mercy will disclose your PHI to UCL for payment, treatment, and healthcare operations.

C. Tri-State Dialysis Unit (ESRD) of Dubuque Internal Medicine, P.C.: The ESRD facility and Mercy participate together in an organized healthcare arrangement to deliver health care to you at Mercy. Both Mercy and the ESRD facility have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of healthcare services to you in the hospital. Mercy will disclose your PHI to the ESRD facility for payment, treatment and healthcare operations.

D. Business Associates: Mercy will use and disclose your PHI to business associates contracted to perform business functions on its behalf including Trinity Health of Novi, Michigan, its parent company which performs certain business functions for Mercy. Whenever an arrangement between Mercy and another company involves the use or disclosure of your PHI, that business associate will be required to keep your information confidential.

E. Membership in Trinity Health of Novi, Michigan: Mercy, other members of Trinity Health of Novi, Michigan, and Trinity Health participate together in an organized healthcare arrangement for utilization review and quality assessment activities. We have agreed to abide by the terms of this Notice with respect to PHI created or received as part of utilization review and quality assessment activities of Trinity Health and its members. Members of Trinity Health will abide by the terms of their own Notice of Privacy Practices in using your PHI for treatment, payment, or healthcare operations. As a part of Trinity Health, a national Catholic healthcare system, Mercy and other hospitals, nursing homes, and healthcare providers in Trinity Health share your PHI for utilization review and quality assessment activities of Trinity Health, the parent company, and its members. Members of Trinity Health also use your PHI for your treatment, payment to Mercy, and/or for the healthcare operations permitted by HIPAA with respect to our mutual patients.

VIII. Additional Information

For further information regarding the issues covered by this Notice of Privacy Practice, please contact the Privacy Official at (563) 589-9626.

XI. Changes to This Notice

Mercy will abide by the terms of the Notice currently in effect. Mercy reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI that it maintains. Mercy will provide you with the revised Notice at your first visit following the revision of the Notice.