NOTICE OF PRIVACY PRACTICES OF Digestive Health Specialists, P.A.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective: April 14, 2003

If you have any questions or requests concerning this notice, please contact Peter S. Donaldson, Privacy Official.

TABLE OF CONTENTS

A. We must protect your health information.

B. We may use and disclose your Protected Health Information (PHI) as follows:

1. We may use and disclose PHI about you to provide health care treatment to you.
2. We may use and disclose PHI about you to obtain payment for services.
3. We may use and disclose PHI about you for health care operations.
4. We may use and disclose PHI under other circumstances without your authorization or an opportunity to agree or object.
5. You can object to certain uses and disclosures.
6. We may contact you to provide appointment reminders.
7. We may contact you with information about treatment, services, products or health care providers.

C. You have several rights regarding your PHI.

1. You have the right to request restrictions on uses and disclosures of PHI about you.
2. You have the right to request different ways to communicate with you.
3. You have the right to see and copy PHI about you.
4. You have the right to request amendment of PHI about you.
5. You have the right to a listing of disclosures we have made.
6. You have a right to a copy of this Notice.

D. You may have additional rights under other laws.

E. You may file a complaint about our privacy practices.

F. Effective date of this Notice.

A. WE MUST PROTECT HEALTH INFORMATION ABOUT YOU.

We are required by law to protect the privacy of health information about you and that can be identified with you, which we call "protected health information," or "PHI" for short. We must give you notice of our legal duties and privacy practices concerning PHI:

• We must protect PHI that we have created or received about: your past, present, or future health condition; health care we provide to you; or payment for your health care.
• We must notify you about how we protect PHI about you.
• We must explain how, when and why we use and/or disclose PHI about you.
• We may only use and/or disclose PHI as we have described in this Notice.

This Notice describes the types of uses and disclosures that we may make and gives you some examples. In addition, we may make other uses and disclosures which occur as a byproduct of the permitted uses and disclosures described in this Notice

We are required to follow the procedures in this Notice. We reserve the right to change the terms of this Notice and to make new notice provisions effective for all PHI that we maintain by first:

• Posting the revised notice in our offices;
• Making copies of the revised notice available upon request (either at our offices or through the contact person listed in this Notice); and
• Posting the revised notice on our website www.digestivehealth.ws.

B. WE MAY USE AND DISCLOSE PHI ABOUT YOU WITHOUT YOUR PERMISSION IN THE FOLLOING CIRCUMSTANCES.

1. We may use and disclose PHI about you to provide health care treatment to you.

   We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others. For example, we may use and disclose PHI about you when you need a prescription, lab work, an x-ray, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider.

   EXAMPLE: Your doctor may share medical information about you with another health care provider. For example, if you are referred to another doctor, that doctor will need to know if you are allergic to any medications. Similarly, your doctor may share PHI about you with a pharmacy when calling in a prescription or with a laboratory when ordering lab tests.

2. We may use and disclose PHI about you to obtain payment for services.

   Generally, we may use and give your medical information to others to bill and collect payment for the treatment and services provided to you by us or by another provider. Before you receive scheduled services, we may share information about these services with your health plan(s). Sharing information allows us to ask for coverage under your plan or policy and for approval of payment before we provide the services. We may also share portions of medical information about you with the following:

   • Billing departments;
   • Collection departments or agencies, or attorneys assisting us with collections;
   • Insurance companies, health plans and their agents which provide you coverage;
   • Hospital departments that review the care you received to check that it and the costs associated with it were appropriate for your illness or injury; and
   • Consumer reporting agencies (e.g., credit bureaus).

   EXAMPLE: Let's say you have been referred to us for a colonoscopy. We may need to give your health plan(s) information about your condition, for any required pre-authorization, to the hospital where the colonoscopy will be performed and to pathologists, radiologists or other medical professionals that may need to bill you for services they may provide as a result of your colonoscopy. This information is given to our billing department and your health plan so we can be paid or you can be reimbursed. We may also send the same information to any hospital department which reviews our care of your illness or injury.

3. We may use and disclose PHI about you for health care operations.

   We may use and disclose PHI in performing business activities, which we call "health care operations". These "health care operations" allow us to improve the quality of care we provide and reduce health care costs. We may also disclose PHI for the "health care operations" of any "organized health care arrangement" in which we participate. An example of an "organized health care arrangement" is the care provided by a hospital and the physicians who see patients at the hospital. In addition, we may disclose PHI about you for the "health care operations" of other providers involved in your care to improve the quality, efficiency and costs of their care or to evaluate and improve the performance of their providers. Examples of the way we may use or disclose PHI about you for "health care operations" include the following:

   • Reviewing and improving the quality, efficiency and cost of care that we provide to you and our other patients. For example, we may use PHI about you to develop ways to assist our health care providers and staff in deciding what medical treatment should be provided to others.
   • Improving health care and lowering costs for groups of people who have similar health problems and to help manage and coordinate the care for these groups of people. We may use PHI to identify groups of people with similar health problems to give them information, for instance, about treatment alternatives, classes, or new procedures.
   • Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you.
   • Providing training programs for students, trainees, health care providers or non-health care professionals (for example, billing clerks or assistants, etc.) to help them practice or improve their skills.
   • Cooperating with outside organizations that assess the quality of the care we and others provide. These organizations might include government agencies or accrediting bodies.
   • Cooperating with outside organizations that evaluate, certify or license health care providers, staff or facilities in a particular field or specialty.
   • Assisting various people who review our activities. For example, PHI may be seen by doctors reviewing the services provided to you, and by accountants, lawyers, and others who assist us in complying with applicable laws.
   • Conducting business management and general administrative activities related to our organization and the services it provides.
   • Resolving grievances within our organization.
   • Reviewing activities and using or disclosing PHI in the event that we sell our business, property or give control of our business or property to someone else.
   • Complying with this Notice and with applicable laws.
   
   
4. We may use and disclose PHI in other situations without your permission.

   We may use and/or disclose PHI about you without your permission in situations when the use and/or disclosure:

   • is required by law.
   • is necessary for public health activities.
   • relates to victims of abuse, neglect or domestic violence.
   • is for health oversight activities.
   • is for judicial and administrative proceedings.
   • is for police or other law enforcement purposes.
   • relates to a person who has died..
   • relates to organ, eye or tissue donation purposes.
   • relates to medical research in certain limited situations.
   • is to prevent a serious threat to health or safety.
   • relates to specialized government functions.
   • relates to inmates of correctional institutions and in other law enforcement custodial situations.
   
   
5. You can object to certain uses and disclosures.

   Unless you tell us not to, we may use or disclose PHI about you in the following circumstances:

   • We may share your name and your general condition (critical, serious, etc.) with clergy and with people who ask for you by name.
   • We may share with a family member, relative, friend or other person identified by you, PHI directly related to that person's involvement in your care or payment for your care. We also may notify such individuals of your location, general condition or death.
   • We may share with a public or private agency (for example, American Red Cross) PHI about you for disaster relief purposes. Even if you object, we may still share the PHI about you, if necessary for the emergency circumstances.

   If you would like to object to our use or disclosure of PHI about you in the above circumstances, please tell the front desk person who registered you or contact our Privacy Official listed on the cover page of this Notice.

6. We may contact you to provide appointment reminders.

   We may use and/or disclose PHI to contact you to provide a reminder to you about an appointment you have for treatment or medical care.

7. We may contact you with information about treatment, services, products or health care providers.

   We may use and/or disclose PHI to manage or coordinate your healthcare. This may include telling you about treatments, services, products and/or other healthcare providers. We may also use and/or disclose PHI to give you gifts of a small value.

   EXAMPLE: If you are diagnosed with celiac disease, we may tell you about nutritional and other counseling services that may be of interest to you.

Under any circumstances other than those listed above, we will ask for your written authorization before we use or disclose PHI about you. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing. We will not disclose PHI about you after we receive your cancellation, except for disclosures which were being processed before we received your cancellation.

C. YOU HAVE SEVERAL RIGHTS REGARDING YOUR PHI.

1. You have the right to request restrictions on uses and disclosures of PHI about you.

   You have the right to request that we restrict the use and disclosure of your PHI. You must ask us in writing. We are not required to agree to your requested restrictions. Even if we agree to your request, in certain situations your restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described in subsection B.4 of the previous section of this Notice. You may request a restriction by filling out a form that you can obtain from our front desk personnel. Your request will be granted unless we tell you otherwise in writing.

2. You have the right to request different ways to communicate with you.

   You have the right to request how and where we contact you about PHI. For example, you may request that we contact you at your work address or phone number instead contacting you at home. Your request must be in writing. We will accommodate all reasonable requests, if we can. In order for us to do this, you must provide us with information regarding how payment, if any, will be handled. You must also provide us with an alternative address or other method of contact. You may request alternative communication by completing an alternate communication form available from our front desk personnel.

3. You have the right to see and copy PHI about you.

   You have the right to inspect and obtain copies of your PHI contained in clinical, billing and other records used to make decisions about you. Your request must be in writing. We may charge you related fees. There are certain situations in which we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial. You may contact our front desk personnel for request forms.

4. You have the right to request amendment of PHI about you.

   You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you that you believe are incorrect or incomplete. Your request must be in writing and must explain why you want us to make the change. We do have to make the change if: 1) the information was not created by us (unless the creator of the information is no longer available to amend the record); 2) the information is not part of the records used to make decisions about you; 3) we believe the information is correct and complete; or 4) you would not have the right to see and copy the record as described in paragraph 3 above. You may request an amendment of PHI by completing the Medical Record Amendment/Correction form available from our front desk personnel.

5. You have the right to a listing of non-routine disclosures we have made.

   You have the right to request an "accounting of disclosures." This is a list of the non-routine disclosures we made of medical information about you for purposes other than treatment, payment and health care operations. You must submit your request in writing. It must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. If you request a list of disclosures more than once in 12 months, we can charge you a reasonable fee. You may request a listing of disclosures by completing a disclosures request form available from our front desk personnel.

6. You have the right to a copy of this Notice.

   You have the right to request a paper copy of this Notice at any time. You may contact any of our front desk personnel or Peter S. Donaldson, Privacy Official for Digestive Health Specialists, 2025 Frontis Plaza Blvd, Suite 200, Winston-Salem, NC 27103, 336-768-6211. In addition, this notice is posted on our web site www.digestivehealth.ws and in our office. We will provide you with a copy of this notice for you to review when you arrive for your first office visit.

D. YOU MAY HAVE ADDITIONAL RIGHTS UNDER OTHER LAWS.

Some North Carolina laws give greater protection of privacy than federal laws. We must follow both federal and state law. These North Carolina laws may apply to our treatment of you:

• North Carolina law protects not only your rights of privacy, but also your relationship with your physician. State law generally restricts disclosure of your health information in most instances. However, we may disclose health information about you under State law with your permission, pursuant to a court order, or as otherwise may be permitted or required by law. In instances in which your permission is required, we will request that you sign a consent form (which is different than an authorization that is mentioned in other parts of this Notice).
• If you ask for treatment and rehabilitation for drug abuse, your request will be confidential. We will not give your name to any police officer or other law-enforcement officer unless you give us permission to do so. If we refer you to another person for help, we will continue to keep your name confidential.
• If you have a communicable disease (for example, tuberculosis, hepatitis or HIV/AIDS), information about your disease will be kept confidential, and only will be shared without your written permission in limited situations. For example, we will get your permission to share this information for payment purposes. We do not need to get your permission to report information about your disease to State and local health officials or to prevent the spread of the disease.

E. YOU MAY FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES.

If you think we have violated your privacy rights, or you want to complain to us about our privacy practices, you can contact Peter S. Donaldson, Privacy Official, 336-768-6211. You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. If you file a complaint, we will not take any action against you or change our treatment of you in any way.

F. EFFECTIVE DATE OF THIS NOTICE.

This Notice of Privacy Practices is effective on April 14, 2003.