Privacy Policy - Northern Medical Specialists

NOTICE OF PRIVACY PRACTICES
Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND
HOW YOU CAN GET ACESS TO THIS INFORMATION
PLEASE REVIEW IT CAREFULLY


OUR POLICY REGARDING YOUR PROTECTED HEALTH INFORMATION


It is our policy to protect our patients right to privacy to the greatest extent possible, while maintaining the highest standard for providing quality health care. We only use and share your individually identifiable health information (also called protected health information, or PHI) as permitted or required by law and only to perform those tasks that are necessary to provide our patients with quality health care and to effectively operate as a medical practice.


We are required by law to maintain the privacy of your PHI and to provide patients with a notice of our legal duties, our privacy practices, and patients rights regarding health information. We are also required to abide by the terms of the notice currently in effect.

We reserve the right to change the terms of this notice and to make new notice provisions at any time, effective for all protected health information maintained by our practice, including information previously created or received before the effective date of the new notice or notice revision. Our most current notice will be posted in the patient waiting areas in all office locations at all times and patients have the right to request a copy of our most current notice at any time from any office manager.

We may use and disclose your PHI in the following ways:

For all uses and disclosures we will use and disclose the minimum amount of information necessary to satisfy the purpose of the use or disclosure.

For treatment purposes
Our practice uses and shares your PHI to provide, coordinate and manage health care or related health services for our patients. We may discuss health information about a patient with another doctor, a hospital, pharmacist, or with a nursing home also providing health care to the patient, or may consult with other health care providers about a patients treatment. For example, your doctor refers you to a specialist. Your doctor may share information about your health, including medical records, lab results and x-ray findings with that specialist so that he/she can better address your medical needs.

For payment purposes
Our practice uses and shares your PHI to obtain payment or be reimbursed for our services. For example, we may use and disclose your PHI to prepare and submit claims to insurance carriers and health plans on behalf of our patients. We may use your information to contact your insurance carrier to check eligibility or coverage under a plan, or to obtain a referral or an authorization for a specialist visit or diagnostic test, as needed.

For health care operations
Health care operations are certain administrative, financial, legal and quality improvement activities that are necessary to run our business and to support our treatment and payment functions. For example, we may use your PHI from the previous year to determine how many flu vaccines we need to have available for patients in the coming year. We may use your health information to evaluate the quality of care you received from us.

-1-

Other ways we may use and disclose your PHI

Appointment reminders
We may use your PHI to place appointment reminder calls to our patients. This reminder may include special instructions for medical testing. We may leave this reminder on your home answering machine or with a person answering at your home number, unless you ask us not to.

Release of information to family/friends
We may share your PHI with a family member, other relative, close personal friend, or any other individual that the patient has identified as involved in the patients health care. We will only share information that is relevant to their involvement. For example, if a son or daughter regularly brings a parent to their doctor appointments, picks up their prescriptions, etc., the doctor may have discussions with the patient about future appointments or prescription needs with their son or daughter present. Patients can verbally identify individuals they wish to involve in their health care to a doctor, nurse or any other staff member. We may also assume this involvement exists based on previous circumstances where the patient did not express an objection to information being discussed with or in the presence of that individual.

In emergency circumstances
If a patient is unable to agree or object to the use or disclosure of health information due to an emergency or the patients incapacity, we will exercise professional judgment as to what is in the patients best interest in determining how much health information about the patient is shared and with whom. We may notify or assist in the notification of a family member, a personal representative of the individual, or another person responsible for the care of the individual of a patients location, general condition or death.

Uses and disclosures under special circumstances

We will use and disclose your PHI when we are required to do so by federal, state or local law.

Workers Compensation
We are required to disclose your PHI concerning a work-related illness or injury to a patients employer, to Workers Compensation insurers, state administrators and other persons or entities involved in Workers Compensation systems. We will use and disclose your PHI to obtain payment for any health care provided to the injured or ill worker.

Public health purposes
We may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of:
- Maintaining vital records, such as births and deaths,
- Reporting child abuse or neglect
- Preventing or controlling disease, injury or disability,
- Notifying a person regarding potential exposure to a communicable disease,
- Notifying a person regarding a potential risk for spreading or contracting a disease or condition,
- Reporting reactions to drugs or problems with products or devices,
- Notifying individuals if a product or device they may be using has been recalled,
- Notifying appropriate government agency(ies) and authority (ies) regarding the potential abuse
or neglect of an adult patient (including domestic violence); however, we will only disclose this information if the patient agrees or we are required or authorized by law to,
- Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

Health oversight activities
We may disclose your PHI to a health oversight agency for activities authorized by law. Oversight Activities can include investigations, inspections, audits, surveys, licensure and disciplinary actions; civil, administrative and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.

-2-

Research
We may use or disclose your PHI for research purposes in certain limited circumstances. For example, we might use PHI to identify prospective research participants or to discuss with you the option of participating in a clinical trial. We will obtain your written authorization to use your PHI for research purposes except when an Internal Review Board or Privacy Board has waived the need for such authorization. There are several conditions that must be met in order for a waiver to be approved and the use and disclosure necessary must involve no more than a minimal risk to your privacy.

Deceased Patients
We may release PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. If necessary, we may also release information in order for funeral directors to perform their jobs.

Lawsuits and similar proceedings
We may use and disclose your PHI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. We may also discuss your PHI in response to a discovery request, subpoena, or other lawful process by another party involved in the dispute, if we have received satisfactory assurances from the party seeking the information that reasonable efforts have been made by such party to inform you of the request, or to obtain an order protecting the information the party has requested.

Law enforcement
We may disclose PHI if asked to do so by a law enforcement official:
- Regarding a crime victim in certain situations, if we are unable to obtain the persons agreement,
- Concerning a death we believe resulted from criminal conduct,
- Regarding criminal conduct at our offices,
- In response to a warrant, summons, court order, subpoena or similar legal process,
- To identify/locate a suspect, material witness, fugitive or missing person,
- In an emergency, to report a crime (including the location or victim(s) of the crime, or the
- description, identity or location of the perpetrator).

Serious threats to health and safety
We may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health
and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.

Military
We may disclose your PHI if you are a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authorities.

National Security
We may disclose your PHI to federal officials for intelligence and national security activities authorized by law. We may also disclose your PHI to federal officials in order to protect the president, other officials or foreign heads of state, or to conduct investigations.

Patients have the following rights regarding PHI that we maintain about you:

Confidential communications
You have the right to request that our practice communicate with you about your health and related issues in a particular manner or at a certain location. Our practice will accommodate reasonable requests. For example, you may ask that we contact you at home rather than at work. Requests for specific type of confidential communication must be made in writing. You do not need to give a reason for your request.

Requesting restrictions
You have the right to request a restriction in our use or disclosure of your health information for treatment, payment or healthcare operations. Additionally, you have the right to request that we

-3-

restrict our disclosure of your health information to only certain individuals involved in your care or the payment of your care, such as family members and friends. We are not required to agree to your restriction, however, if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies, or when the information is necessary to treat you. Requests for a restriction must be made in writing.

Inspection and copies
You have the right to inspect and obtain a copy of your PHI that may be used to make decisions about you, including medical and billing records, but not including psychotherapy notes. Requests for inspection and copies of PHI must be made in writing. NYS law requires that we permit you to visually inspect your PHI within ten (10) days from the date we receive your written request and furnish a copy within a reasonable time. We may impose a reasonable charge for the copying and delivering of these records.

Amendments
You have the right to request that we amend your PHI for as long as we maintain your PHI if you believe it is incorrect or incomplete. You must provide us with a reason that supports your request for an amendment. Requests for an amendment, including the reason supporting your request, must be made in writing. We may deny your request for an amendment to your PHI if 1) you fail to submit your request with a supporting reason in writing; 2) we believe it is accurate and complete; 3) the information is not part of the PHI kept by or for our practice or is not part of the PHI you would be permitted to inspect and copy; 4) we did not originally create the information, unless you are able to provide a reasonable basis to believe that the originator of the PHI is no longer available to amend the information.

Accounting of disclosures
All patients have the right to request that we provide them with a list of certain non-routine disclosures we have made of your PHI except for: disclosures we make to you, or to carry out treatment, payment or health care operations, or as requested by your written authorization, or for emergency or notification purposes, or as permitted or required by law. Request for an accounting of disclosures must be in writing and must state a time period, which may not be longer than six (6) years from the date of the disclosure and may not include dates before April 14, 2003. The first list you request within a 12-month period is free of charge, but we may charge you for additional lists within the same 12-month period.

Right to provide an authorization for other uses and disclosure
We will obtain your written authorization for uses and disclosures that are not identified by this notice or permitted by applicable law. You may revoke any authorization you provide to us regarding the use and disclosure of your PHI at any time, except to the extent that we have acted in reliance upon the authorization. If you refuse to sign an authorization, we cannot deny you treatment, except when such authorization is a condition of research-related treatment. Requests to revoke any authorization must be made in writing.

Right to file a complaint
If you have any questions about this notice or believe we may have violated your privacy rights please speak to the office manager at any one of our locations or contact our Privacy Officer. You can also complain directly to the Secretary of the U.S. Department of Health and Human Services. Individuals will in no way be retaliated against for filing a complaint.

You can contact the office manager at any one of our locations or contact our Privacy Officer at the address and telephone # below for further instructions on or to submit written requests.

Privacy Officer
111 Clocktower Commons Drive
Route 22
Brewster, NY 10509
(845) 279-5187