Carrier Clinic Privacy Notice

Effective Date: April 2003

1. THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE, PLEASE CONTACT The Health Information Privacy Officer (Director of Health Information Management), Privacy Official (VP & Compliance Officer), or the Patient Representative. This notice describes our hospital’s practices and that of: Any health care professional authorized to enter information into your hospital chart; All departments and units of the hospital; Any member of a volunteer group we allow to help you while you are in the hospital; All employees, staff and other hospital personnel.

2. WE HAVE A LEGAL OBLIGATION TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI).

a. We are legally required to protect the privacy of your health information. We call this information “protected health information,” or “PHI” for short, and it includes information that can be used to identify you that we’ve created or received about your past, present, or future health or condition, the provision of health care to you, or the payment of this healthcare. We must provide you with this notice to explain our privacy practices, when and why we use and disclose your PHI. With some exceptions, we may not use or disclose any more of your PHI than is necessary and relevant to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this notice.

b. However, we reserve the right to change the terms of this notice and our privacy policies at any time. Any changes will apply to the PHI we already have. Before we make an important change to our policies, we will promptly change this notice and post a new notice on designated Patient Units and the Access Center Reception Area. You can also request a copy of this notice from the contact person listed in Section 6 & 7 below at any time and can view a copy of the notice on our Web site at www.carrier.org.

3. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION.

a. During your treatment at Carrier Clinic, there may be instances in which your PHI may inadvertently be disclosed to others on the hospital grounds due to the nature of services that we provide. Some examples of such incidental disclosures that you should be aware of are:

1) The nature of the treatment rendered at Carrier Clinic may reveal information about a patient, for example: Group therapy is utilized at Carrier Clinic as part of the therapeutic process. Personal health information is often disclosed in therapeutic groups in which many patients participate.

2) Luggage and some other personal belongings are labeled and stored in a locked, secured area. When patients are provided access to this area, it may be possible to view the names labeled on the luggage or other personal belongings being stored.

3) If you have grounds privileges, there are parts of the hospital outside of the therapeutic units that are considered to be “common areas,” and shared by other patients, residents, students and visitors, such as the dining room, library, hallways, Access Center, gym, and the surrounding outside areas.

4) Carrier Clinic has on its grounds two hospitals, residential facilities and a day school for adolescents. The “common areas” described above may be shared by residents and students as well as patients of the hospital. In addition, community programs are also offered on the campus for example, Alcoholics Anonymous, Weekend Co-Dependency Programs and other related treatment programs.

b. We use and disclose health information for many different reasons. For some of these uses or disclosures, we need your prior consent or specific authorization. Below, we describe the different categories of our uses and disclosures and give you some examples of each category

c. Uses and Disclosures Relating to Treatment, Payment, or Health Care Operations. We may use and disclose your PHI for the following reasons:

1) For treatment. We may disclose your PHI to physician and, nurses, medical students, technicians, and other health care professionals who are involved in you care. For example, if you were being treated by a physician or therapist prior to this hospitalization, we may disclose your PHI to your outside physician or therapist in order to coordinate your care. We may also disclose your PHI to a new physician or therapist when making a referral for your aftercare. Different departments of the hospital also may share medical information about you in order to coordinate the different things you need, such as prescriptions, lab work and x-rays. We also may disclose medical information about you to people outside the hospital who may be involved in your medical care after you leave the hospital.

2) To obtain payment for treatment. We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your PHI to our billing department and your health plan to get paid for the health care services we provided to you. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. We may also provide your PHI to our business associates, such as billing companies, claims processing companies, and others that process our healthcare claims.

3) For health care operations. We may use and disclose medical information about you for hospital operations. These uses and disclosures are necessary to run the hospital and make sure that all of our patients receive quality care. For example, we may use your PHI in order to evaluate the quality of health care services that you received or to evaluate the performance of the health care professionals who provided health care services to you.

4) Special Situations.

When a disclosure is required by federal, state or local law, judicial or administrative proceedings, or law enforcement. For example, we make disclosures when a law requires that we report information to government agencies and law enforcement personnel about victims of abuse, neglect, or domestic violence; or when the safety of you or another person is at risk; or when required as part of an involuntary commitment process.

For public health activities. For example, we report information about births, deaths, and various diseases, to government officials in charge of collecting that information, and we provide coroners, medical examiners, and funeral directors necessary information relating to an individual’s death.

For Health Oversight Activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

For Research Purposes. We may disclose your PHI to researchers when their research has been approved by an Institutional Review Board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI. We will ask for specific permission (an authorization) or we will ask the Institutional Review Board to waive the requirements to obtain an authorization from you. A waiver of authorization will be based upon assurances from the review board that the researchers will adequately protect your PHI.

Business Associates. There are some services provided in our organization through contracts with business associates. Examples include our medical records transcription services, consultants, accountants and attorneys. When these services are contracted, we may disclose your health information to our business associates so that they can perform the job we’ve asked them to do. To protect your health information, however, we require that the business associates appropriately safeguard your information.

To Avoid Harm. We may release information regarding your criminal conduct at the hospital or against its personnel or when a threat is made to commit such a crime. Reporting is limited to the circumstances of the incident.

For Specific Government Functions. We may disclose PHI of military personnel and veterans in certain situations. We may disclose PHI for national security purposes authorized by law.

For Worker’s Compensation Purposes. We may provide PHI in order to comply with workers’ compensation law.

Appointment Reminders and Health-Related Benefits or Services. We may use your PHI to provide appointment reminders or give you information about treatment alternatives, or other health care services or benefits we offer.

Organ and Tissue Donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans. If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court order.

Response to Certain Court Orders. We may release medical information if required to do so by a law enforcement official in response to certain court orders.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Disclosures to family, friends, or others. With the appropriate authorization, we may provide your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your healthcare. Carrier will not disclose information without the appropriate authorization or consent. The opportunity to consent may be obtained retroactively in emergency situation.

4. CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS REQUIRES AUTHORIZATION. The confidentiality of alcohol and drug abuse patient records maintained by Carrier is protected by federal law and regulations. Generally, Carrier may not say to a person outside Carrier that a patient attends Carrier, or disclose any information identifying a patient as an alcohol or drug abuser unless the patient consents in writing, the disclosure is allowed by court order; or the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation. Accordingly, Carrier may not disclose drug and alcohol medical records without the appropriate patient authorization.

5. OTHER USES OF MEDICAL INFORMATION. Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

6. COMPLAINTS. If you believe your privacy rights have been violated, you may file a complaint with the hospital or with the Secretary of the Department of Health and Human Services in writing. To file a complaint with the hospital, contact The Patient Representative, Health Information Privacy Officer (Director of Health Information Management) and Privacy Official (VP & Corporate Compliance Officer). All complaints must be submitted in writing. You will not be penalized for filing a complaint.

a) If you have any questions about this notice or any complaints about our privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact: The Privacy Official (VP & Compliance Officer), Carrier Clinic, PO Box 147, Rte 601, Belle Mead, NJ 08502, (908) 281-1000, or ttoole@carrierclinic.com.

7. RIGHTS YOU HAVE REGARDING YOUR PHI. You have the following rights regarding medical information we maintain about you:

a) The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask that we limit how we use and disclose your PHI. We will consider your request but are not legally required to accept it. If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.

b) The Right to Choose How We Send PHI to You. You have the right to ask that we send information to you to an alternate address (for example, sending information to your work address rather than your home address) or by alternate means (for example, e-mail instead of regular mail). We must agree to your request so long as we can easily provide it in the format you requested.

c) Right to Inspect and Copy. You have the right to inspect and request a copy of medical information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes. To inspect and copy medical information that may be used to make decisions about you, you must submit your request in writing to the Director Of Health Information Management or the Health Information Management Department. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

1. In certain very limited situations, we may deny your request to inspect and obtain a copy of your PHI. We will respond to you within 30 days after receiving your written request. If we deny your request, we will tell you, in writing, our reasons for the denial and explain your right to have the denial reviewed. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by the hospital will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

a) The Right to Get a List of the Disclosures We Have Made. You have the right to get a list of instances in which we have disclosed your PHI. The list will not include uses or disclosures for treatment, payment, or health care operations, or uses or disclosures pursuant to an authorization that you have already provided. The list also won’t include uses and disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made before April 13, 2003.

1. We will respond within 60 days of receiving your request. The list we will give you will include disclosures made in the last six years unless you request a shorter time. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. We will provide the list to you at no charge.

a) The Right to Correct or Update Your PHI. If you believe that there is a mistake in your PHI or that a piece of important information is missing, you have the right to request that we attach an explanation provided by you explaining your desired correction to the record as a medical record is considered a legal document. You must provide the request and your reason for the request in writing. We will respond within 60 days of receiving your request. We may deny your request in writing if the PHI is (i) correct and complete, (ii) not created by us, (iii) not allowed to be disclosed, or (iv) not part of our records. Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you don’t file one you have the right to request that your request and our denial be attached to all future disclosures of your PHI. If we approve your request, we will make the change to your PHI, tell you that we have done it, and tell others that need to know about the change to your PHI.

b) Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at our Web site, www.carrierclinic.org.

c) The Right to Get This Notice by E-Mail. You have the right to get a copy of this notice by e-mail. Even if you have agreed to receive notice via e-mail, you also have the right to request a paper copy of this notice.

8. CHANGES TO THIS NOTICE. We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in the hospital. The notice will contain on the first page, in the top right-hand corner, the effective date. In addition, each time you register at or are admitted to the hospital for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current notice in effect.

9. EFFECTIVE DATE OF THIS NOTICE.

This notice went into effect on April 14, 2003. Revised October 2003.