This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

I. Introduction. This Notice of Privacy Practices describes how Concord Orthopaedics Professional Association may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. Protected health information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health condition and related health care services.

II. Your Health Information Rights. While the actual records that we maintain about you belong to us, the information contained in our records belongs to you. Under the federal Privacy Rules (45 CFR Part 160 and Part 164) you have the right to:

• request a restriction on certain uses and disclosures of your information as provided by 45 CFR 164.522. Please note, however, that we are not required to agree to a restriction that you may request. If we believe it is in your best interest to permit use and disclosure of your health information, we will notify you that your request for restriction will not be honored. If we agree to the requested restriction, we may not use or disclose your health information in violation of that restriction unless it is needed to provide emergency treatment.

• obtain a paper copy of this Notice of Privacy Practices upon request

• inspect and obtain a copy of your health record

• amend your health record

• obtain an accounting of certain disclosures of your health information

• receive confidential communications of your health information by alternative means or at alternative locations

• revoke your authorization to use or disclose health information except to the extent that action has already been taken

III. Our Responsibilities. Concord Orthopaedics Professional Association is required to:

• maintain the privacy of your health information

• provide you with this Notice of Privacy Practices outlining our legal responsibilities and privacy practices

• abide by the terms of this notice

• notify you if we are unable to agree to a requested restriction

• accommodate reasonable requests to communicate your health information by alternative means or at alternative locations

We reserve the right to change our Notice of Privacy Practices and to make the new provisions effective for all protected health information we maintain. Should our Notice of Privacy Practices change, we will provide you with a revised notice. We will not use or disclose your protected health information without your authorization, except as described in this notice.

IV. Examples of How We Will Use or Disclose Your Protected Health Information (PHI).

The following are examples of the types of uses and disclosures of your PHI that we are permitted to make.

Treatment: We will use and disclose PHI to provide, coordinate or manage your health care and any related services. For example, we may disclose PHI to your primary care physician who referred you to us, to other physicians who may be involved in your health care, and/or to a physician to whom you have been referred for further management of your health care. In addition, we may disclose PHI to other health care facilities, such as your local hospital, to coordinate diagnostic testing or surgery, or to a physical therapy or home health agency to coordinate your follow-up care.

Payment: PHI will be used as needed to obtain payment for services that we provide to you. For example, we may disclose PHI to your health insurance company and its representatives for reimbursement purposes and to determine eligibility for services such as office visits, diagnostic studies, surgery, etc.

Healthcare Operations: We may use or disclose your PHI as needed to support our own business activities. These activities may include quality assessment, training and supervision of staff members, or other business activities. For example, we may share your PHI with third party business associates that perform various services that are essential to the operations of our organization, such as billing services. We will limit the amount of PHI that we provide to the minimum necessary to accomplish the particular task and we will have a written contract that contains terms that will protect the privacy of your PHI. In addition, we may use or disclose your protected health information to provide you with appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

V. Uses and Disclosures We May Make Unless You Object. In the following situations, we may disclose your protected health information if we inform you about the disclosure in advance and you do not object:

• to notify or assist in notifying a family member, personal representative or other person responsible for your care of your location and general condition

• to communicate with a family member, other relative, caregiver or close personal friend who is involved in your medical care or payment for your care

VI. Uses and Disclosures Not Requiring Your Authorization. The federal privacy rules provide that we may use or disclose your protected health information without your authorization in the following circumstances (in accordance with applicable federal and state law):

• As Required By Law—to the extent that the use or disclosure is required by state or federal law

• Health Oversight Activities—in the context of audits, investigations, inspections and licensing activities

• Workers’ Compensation—to comply with laws relating to Workers' Compensation or other similar programs established by law

• Food and Drug Administration (FDA)—to report adverse events with respect to food, supplements, products and product defects

• Public Health—to public health authorities charged with preventing or controlling disease, injury, or disability

• Relating to Decedents—regarding an individual’s death, to coroners, medical examiners or funeral directors

• Organ/Tissue Donation—if you are an organ donor, to assist in procurement, banking or transportation of donated organs or tissue

• Law Enforcement—as required by law or in response to a valid search warrant or court order

• Legal Proceedings—in response to an order of a court, subpoena, discovery request or other lawful process

• To Avert a Serious Threat to Health or Safety—to warn of a patient's violent behavior when a patient has communicated a serious threat of physical violence against a reasonably identifiable victim

• Criminal Activity—to law enforcement authorities if evidence of criminal conduct on our premises, to report suspected child abuse or neglect, or abuse of incapacitated adults, or an injury that we believe may have been the result of an illegal act

• Military and Veterans—if you are a member of the armed forces, as required by military command authorities

• National Security and Intelligence Activities—to authorized federal officers for national security activities

VII. Uses and Disclosures of Protected Health Information Based upon Your Written Authorization Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law as described in this notice. You may revoke this authorization at any time in writing, except to the extent that we have already relied upon your authorization in making a disclosure.

VIII. For More Information or to Report Complaints If you wish to exercise any of the rights outlined in this notice or if you have questions and would like additional information, you may contact our Privacy Officer at Concord Orthopaedics, 264 Pleasant Street, Concord, NH 03301 / (603) 224-3368. If you believe that your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the United States Department of Health and Human Services. Your right to do so is respected by Concord Orthopaedics Professional Association and you will experience no adverse consequences by doing so.

Effective Date: April 14, 2003