Notice of Privacy Practices

Mid-Atlantic Nephrology Associates, P.A.
Effective September 23, 2013

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOUR HEALTH INFORMATION

We at Mid-Atlantic Nephrology Associates, P.A. ("MANA") understand that your health information is personal. We are committed to protecting health information about you. This Notice applies to all records of your care that we maintain that contain your protected health information ("PHI").

This Notice will tell you about the ways in which we may use and disclose your PHI. It also describes certain obligations we have regarding the use and disclosure of your PHI and your rights.

We are required by law to:

• Make sure that PHI is kept private;
• Give you this Notice of our legal duties and privacy practices with respect to your PHI;
• Follow the terms of this Notice as currently in effect;
• Follow any more stringent state privacy laws that relate to the use and disclosure of health information; and
• To notify affected individuals following a breach of unsecured PHI.

HOW WE MAY USE AND DISCLOSE YOUR PHI

The following categories describe different ways that we may use and disclose PHI. For each category of uses or disclosures this Notice will describe the category and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways in which we are permitted to use and disclose PHI will fall within one of the categories.

For Treatment. We may use your PHI to provide you with medical treatment or services. We may disclose your PHI to doctors, nurses, technicians, medical students, or other office personnel involved in taking care of you. For example, we would disclose your PHI, as necessary, to a home health agency that provides care to you. We also may disclose your PHI to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you.

For Payment. We may use and disclose your PHI so that the treatment and services we provide may be billed to and payment may be collected from you, an insurance company, a governmental entity such as Medicare or Medicaid, or a third party. For example, we may need to give your health plan information about the treatment we provide to you so that the health plan will pay us or reimburse you for the treatment.

For Health Care Operations. We will use and disclose your PHI for our operations. These uses and disclosures are necessary for us to run our office and make sure that all of our patients receive quality care. For example, we may use your PHI to review our treatment and services and evaluate the staff caring for you. We may also combine medical information about many patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students, and other office personnel for review and learning purposes. In addition, we may use a sign-in sheet at the registration desk where you will be asked to sign your name and indicate your physician. We may also call you by name in the waiting room when your physician is ready to see you.

To, From, and Between Business Associates. We contract with business associates to provide some services. Examples include labs, billing entities, and the copy service used to make copies of your health records. To allow these services to be performed, we may disclose your PHI to our business associates. To protect your health information, we require our business associates to sign contracts agreeing to appropriately safeguard your information.

To Family and Friends. We may disclose your PHI to a family member or friend, provided the information is directly relevant to that person's involvement with your health care or payment for that care. You have a right to request MANA limit such disclosures as described on pages 6-7.

For Treatment Alternatives and Appointment Reminders. We may use and disclose your PHI to tell you about or recommend possible treatment options or alternatives and to provide appointment reminders.

For Health-Related Benefits and Services. We may use and disclose your PHI to tell you about health-related benefits or services, or about other plans or certain value added services, that may be offered from time to time.

As Required By Law. We will disclose your PHI when required to do so by federal, state or local law.

To CRISP. We have chosen to participate in the Chesapeake Regional Information System for our Patients, Inc. (CRISP), a statewide health information exchange. As permitted by law, your health information will be shared with this exchange in order to provide faster access, better coordination of care and assist providers and public health officials in making more informed decisions. You may "opt-out" and disable all access to your health information available through CRISP by calling 1-877-952-7477 or completing and submitting an Opt-Out form to CRISP by mail, fax or through their website at www.crisphealth.org.

By Written Authorization. Except as described herein or as permitted by law, we will disclose your PHI only with your prior written permission (called an "authorization" under HIPAA). Most uses of psychotherapy notes, certain uses and disclosures of your health information for marketing purposes, and any sale of your written medical information require your authorization. You may revoke an authorization, in writing, at any time, unless we have taken action relying on the authorization or if you signed the authorization as a condition of obtaining insurance coverage.

SPECIAL SITUATIONS INVOLVING THE USE AND DISCLOSURE OF YOUR PHI

To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Military and Veterans. If you are a member of the armed forces, we may release your PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.

Workers' Compensation. We may release your PHI for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose your PHI for public health activities (e.g., to prevent or control disease, injury or disability).

Victim of Abuse. We may notify the appropriate government authority, if a MANA representative believes you have been the victim of abuse, neglect, or domestic violence.

Health Oversight Activities. We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release PHI if asked or required to do so by a law enforcement official.

Coroners, Medical Examiners and Funeral Directors. We may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release PHI about patients of the hospital to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. We may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your PHI to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Research. We may release your PHI in certain circumstances for research.

Organ and Tissue Donation. We may use and disclose your PHI to facilitate organ and tissue donation and transplant.

To DHHS. We may release your PHI in response to investigations by the Department of Health and Human Services.

YOUR RIGHTS REGARDING YOUR PHI

You have the following rights regarding any of your PHI that we maintain. Except as otherwise provided below, to exercise these rights, you must submit your request in writing to MANA's HIPAA Privacy Officer at the address below:

Mid-Atlantic Nephrology Associates, P.A.
1589 Sulphur Spring Road, Suite 109
Baltimore, MD 21227
Attention: HIPAA Privacy Officer

Right to Inspect and Copy. With certain exceptions, you have the right to inspect and copy your PHI maintained in MANA's "designated record set." Usually this means your medical and billing records, but does not include psychotherapy notes and information compiled in anticipation of a criminal, civil, or administrative action or proceeding.

We will generally act on your written request within 30 days of receipt. Where appropriate, we may provide you with a summary of your PHI rather than access to, and copies of, it. To the extent we use or maintain this information in an electronic health record, you may request that we provide you with a copy of such information in an electronic format. We will provide access in the electronic form and format requested if it is readily reproducible in the requested format.

If you request a copy of the information, we may charge a reasonable fee for the costs of copying and, in some circumstances, summarizing, the information and mailing it to you. If we and our business associates do not maintain the PHI, but know where it is maintained, you will be informed where to direct your requests.

We may deny your request to inspect and copy your PHI. In certain very limited circumstances, our denial will be unreviewable. Ordinarily, however, you may request within a reasonable period of time that the denial be reviewed. Another licensed healthcare provider chosen by us will review your request and denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Amend. If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You must provide a reason that supports your request. You have the right to request an amendment for as long as the information is kept by or for us.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Is not part of the PHI kept by or for our practice;
• Was not created by our practice, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

We must act on your request for an amendment of your PHI no later than 60 days after receipt of your request. We may extend the time for making a decision for no more than 30 days, but we must provide you with a written explanation for the delay. If we deny your request, we will keep your request on file. We will distribute your request (or a summary) with all future disclosures of the information to which it relates, but only if you ask us to do so. Further, you may submit a written statement disagreeing with the denial and we will keep it on file and distribute it (or a summary) with all future disclosures of the information to which it relates.

Right to an Accounting of Disclosures. We have the right to request an "accounting of disclosures." This is a list of our disclosure of your PHI, with certain exceptions. These exceptions include:

• To you or to persons involved in your health care or payment for that care.
• Pursuant to your written authorization.
• For the purpose of carrying out treatment, payment or health care operations.
• That are incidental to another permissible use or disclosure.
• For disaster relief, national security or intelligence purposes.
• To correctional institutions or law enforcement officers who have you in custody at the time of the disclosure.
• As part of a limited data set.
• To a health oversight agency or law enforcement official if they so request.

Your request must state a time period which may not be longer than six years. The first list you request within a 12 month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

We must act on your request for an accounting of the disclosures of your PHI no later than 60 days after receipt of the request. We may extend the time for providing you an accounting by no more than 30 days, but we must provide you a written explanation for the delay. You may request one accounting in any 12-month period free of charge. We will impose a fee for each subsequent request within the 12-month period.

Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.

We are required to grant your request to restrict or limit the PHI we use or disclose about you for payment and/or health care operations if such PHI relates only to a health care item or service for which you paid us in full, out-of-pocket. In all other circumstances, we are not required to agree with your request.

If we are required to grant your request, or elect to do so, a restriction may later be terminated by your written request, by agreement between you and our practice (including an oral agreement), or unilaterally by us for PHI created or received after you are notified that the restriction has been removed. We may also disclose your PHI if you need emergency treatment, even if we have provided for a restriction.

Any request for a restriction must indicate what information you want to limit, whether you want to limit our use, disclosure, or both, and to whom you want the limits to apply.

Right to Confidential Communications. You have the right to file a request to receive communications from us on a confidential basis by using an alternative means for receipt of information or by receiving the information at an alternative location. We will not ask the reason for this request. All reasonable requests will be granted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. You may ask that MANA give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice. Any changes will apply to PHI we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our office and will make a paper version available to you upon request. A current copy of the Notice will also be posted on our website. The Notice will contain an effective date on the first page, in the top right-hand corner. In addition, if you stop receiving our services for an extended period of time and then resume, we will offer you a copy of the current Notice when you resume your services.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, contact our Privacy Officer:

Mid-Atlantic Nephrology Associates, P.A.
1589 Sulphur Spring Road, Suite 109
Baltimore, MD 21227
Attention: HIPAA Privacy Officer
Compliance Hotline--(410) 536-4637

You will not be retaliated against for exercising any right or process described in this Notice, including the filing of a complaint or testifying, assisting, or participating in an investigation, compliance review, or hearing.

QUESTIONS

If you have any questions regarding this Notice, please feel free to contact our Privacy Officer at the address above.