Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR MEDICAL
INFORMATION MAY BE USED AND DISCLOSED AND
HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW THIS NOTICE CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes how Southern West
Virginia Health System (“SWVHS”) and each of its community health center
facilities may use and disclose your protected health information to carry out
treatment, payment, or healthcare operations and for other purposes that are
required by law, including the Health Insurance Portability and
Accountability Act of 1996 (“HIPAA”) and its regulations. It also describes
your rights to access and control your “Protected Health Information”
(“PHI”). PHI is information about you, including demographic information,
that may identify you and that relates to your past, present, or future physical
or mental health or condition and related healthcare services.

1. OUR COMMITMENT TO YOUR PRIVACY

As part of our mission of providing quality, community-based healthcare
services, it is necessary for us to gather medical and personal information
from our patients that is private. Under Federal and/or State laws, some of the
medical and personal information you provide to us is considered protected
health information. As your healthcare provider, we appreciate and respect
your trust, and we are dedicated to maintaining the privacy of your protected
health information.

In providing healthcare and conducting our business, we will create records
regarding you and the treatment and services we provide to you. This Notice
describes how we may use and disclose your PHI to carry out treatment,
payment, or healthcare operations, as well as other purposes that are permitted
or required by law. It also describes your rights to access and control your
PHI. The terms of this Notice apply to all records containing your PHI that
are created or retained by our organization.

2. OUR DUTIES TO YOU REGARDING YOUR PHI

SWVHS is required by law to (1) make sure that medical information that
identifies you is kept private; (2) give you this Notice of our legal duties and
privacy practices with respect to medical information about you; (3) follow
the terms of the Notice that is currently in effect; and (4) communicate any
changes in the Notice to you.

SWVHS reserves the right to revise or amend this Notice at any time in the
future, without prior notice. This Notice’s effective date is found at the top of
the first page. We reserve the right to make any revision or amendment to this
Notice effective for all your records that our organization has created or
maintained in the past, as well as for any information we receive and for any
records that we may create or maintain in the future. At all times, we will post
a copy of our current Notice in a visible location within each of our offices,
and you may request a copy of our most current Notice at any time. A copy
also may be obtained from our website at www.SWVHS.org.

If you have questions about this Notice, please contact our Compliance
Officer by mail at 7400 Lynn Avenue, Hamlin, West Virginia 25523; or by
telephone at 304-824-5806 ext. 1221.

3. USES AND DISCLOSURES OF PROTECTED HEALTH
INFORMATION

A. Uses and Disclosures of Protected Health Information for
Treatment, Payment, and Healthcare Operations

The law permits us to use or disclose your PHI for the following purposes:

(1) TREATMENT. We may use your PHI to treat you. We will use and
disclose your PHI to provide, coordinate, or manage your healthcare and any
related services. Doctors, nurses, technicians, pharmacists, psychologists,
students, or other healthcare personnel, who are involved in taking care of
you, use medical information about you.

We may use and disclose your PHI to coordinate or manage your healthcare
and any related services. For example, we may ask you to have laboratory
tests (such as blood or urine tests), and we may use the results to help us reach
a diagnosis. We might use your PHI in order to write a prescription for you,
or we might disclose your PHI to a pharmacy when we order a prescription
for you. Our staff, including but not limited to our medical providers and
nurses, may use or disclose your PHI in order to treat you or to assist another
healthcare provider to whom you have been referred to ensure that the
provider has the necessary information to diagnose or treat you. Additionally,
we may disclose your PHI to others who may assist in your care, such as your
spouse, children, or parents.

(2) PAYMENT. Your PHI will be used or disclosed, as needed, in order to
bill for and to obtain payment for the healthcare services and other items you
may receive from us. This may include certain activities that we are required
to undertake before payment can be obtained from your health insurance plan
or other third party.

For example, we may contact your health insurer to certify that you are
eligible for benefits (and to determine that range of benefits), and we may
provide your insurer with details regarding your treatment to determine if
your insurer will cover, or pay for, your treatment. We also may use and
disclose your PHI to obtain payment from third parties that may be
responsible for such costs, such as family members. We also may use your
PHI to bill you directly for services and items.

(3) HEALTH CARE OPERATIONS We will use or disclose, as needed,
your PHI to operate our business and in order to support the daily activities
of providing healthcare services. These activities are necessary to run our
community health centers and to make sure that all our patients receive high
quality care and great customer service.

Under the law, we may use your PHI to evaluate the quality of care you
received from us, or to conduct cost-management and business planning
activities for our organization. We may also use your PHI for employee
review activities, training of medical students, licensing, marketing and
fundraising activities, and conducting or arranging for other business
activities. We also may use PHI from our various health centers to decide
what additional services we need to offer, what services are not needed, and
whether certain new treatments are effective.

For example, we may disclose your PHI to medical students that see patients
in our office as part of their training. In addition, we may use a sign-in sheet
at the registration desk, and we may call you by name in the waiting room
when your healthcare provider is ready to see you. We may use or disclose
your PHI, as necessary, to contact you to remind you of your appointment.
We also may share your PHI with third-party “business associates” that
perform various servicesfor us. Whenever an arrangement between our office
and a business associate involves the use or disclosure of your PHI, we will
have a written agreement in which the business associate shall acknowledge
its obligations in protecting the privacy of your PHI.

Because we constantly strive to improve the healthcare we provide, we may
disclose information to others within our organization for research studies and
learning purposes. Whenever possible, we will remove identifying data, so
others may use it to study medical care and delivery issues without learning
of your identity.

Since we are a Federally Qualified Health Center (“FQHC”) and receive
Federal and State grant funding, we have certain reporting obligations which
require us to supply information to certain governmental agencies, including
the State of West Virginia and the U.S. Health Resources and Services
Administration (“HRSA”). Again, we will always remove information that
specifically identifies you so that the reviewer will not learn who you are.

INFORMATION PROVIDED TO YOU:
Appointment Reminders: We may use and disclose your medical information
to contact you as a reminder that you have an appointment for treatment or
medical care at the hospital or health center. Unless you make an alternative
request, these reminders may include sending postcards to your home or
leaving messages on your answering machine or with whoever answers your
phone to remind you of appointments, to ask you to contact us concerning
your care, or to seek or coordinate your participation in programs we offer,
such as chronic disease management programs. We may also send you
newsletters concerning treatment or care alternatives, benefits, services, and
other general healthcare information.

Treatment Alternatives: We may use and disclose your medical information
to tell you about or recommend possible treatment options or alternatives that
may be of interest to you.

Medical-Related Benefits and Services: We may use and disclose your
medical information to tell you about medical-related benefits or services that
may be of interest to you, such as diabetes management classes, smoking
cessation classes, stress management classes, etc.

B. Uses and Disclosures of Protected Health Information Based Upon
Your Written Authorization

Except as described in this Notice, other uses and disclosures of your PHI will
be made only with your written authorization, unless otherwise permitted or
required by law, as described herein. If you do authorize us to use or disclose
your PHI for another purpose, you may revoke your authorization at any time,
in writing, except to the extent that our organization or any of our healthcare
providers have taken any action in reliance on the use or disclosure indicated
in the authorization prior to receiving your written revocation.

C. Other Permitted and Required Uses and Disclosures that May Be
Made with Your Authorization or Opportunity to Object

We may use and disclose your PHI in the situations listed below. You have
the opportunity to agree or object to the use or disclosure of all or part of your
PHI. If you are not present or able to agree or object to the use or disclosure
of the PHI, then your healthcare provider may determine, using their
professional judgment, whether the disclosure is in your best interest. In this
case, only the PHI that is relevant to your healthcare will be disclosed. Unless
you object, we may disclose your PHI:

To a member of your family, a relative, a close friend, your personal
representative, or any other person that you involve in your care, but
only to the extent that the PHI directly relates to that person’s
involvement in your healthcare;
To notify a family member or other person responsible for your care
of your location, general condition, or death; or
To entities (such as the American Red Cross) to assist in disaster relief efforts.

We will not use or disclose your PHI for marketing purposes until we obtain
your written authorization. We do not and will not provide or sell your PHI
to any outside marketing firms or agencies.

D. Other Permitted and Required Uses and Disclosures That May Be
Made Without Your Authorization or an Opportunity to Object

We may use or disclose your PHI in the following situations that do not
require your authorization or opportunity to object:

Required By Law: We may use or disclose your PHI to the extent that the use
or disclosure is required by law. The use or disclosure will be made in
compliance with the applicable law and will be limited to the relevant
requirements of that law. For example, the Office of Civil Rights or the Office
of the Inspector General may require access to your PHI while conducting
audits or investigations of reported privacy breaches or violations. You will
be notified of any such uses or disclosures, as required by applicable law and
the requirements of HIPAA.

Public Health: We may disclose your PHI for public health activities and
purposes to a public health authority that is permitted by law to collect or
receive the information. As required by law, we may disclose your PHI to
public health authorities for purposes related to: (1) preventing or controlling
disease, injury, or disability; (2) reporting births and deaths; (3) reporting
child abuse or neglect; (4) reporting domestic violence; (5) reporting to the
Food and Drug Administration problems with products and reactions to
medications; (6) notifying people of recalls of products they may be using;
and (7) reporting disease or infection exposure to a person who may have
been exposed or may be at risk for contracting or spreading a disease or
condition.

We may also disclose your PHI to appropriate persons to prevent or lessen a
serious and imminent threat to your health or safety, or the health or safety of
another person or the general public. Any disclosure, however, would only be
to someone able to help prevent the threat. We may also disclose your PHI, if
directed by an appropriate public health authority, to a foreign government
agency that is collaborating with the public health authority. West Virginia
law also requires reporting of weapon or burn-related injuries, cancer, and
lead poisoning.

Communicable Diseases: We may disclose your PHI, if authorized by law, to
a person who may have been exposed to a communicable disease or may
otherwise be at risk of contracting or spreading the disease or condition.
Health Oversight Activities: We may disclose your PHI to health oversight
agencies for activities authorized by law, such as audits, investigations,
inspections, licensure, and other proceedings required by the government to
monitor the healthcare system, government programs, and compliance with
civil rights laws.

Food and Drug Administration: We may disclose your PHI to a person or
company required by the Food and Drug Administration to report adverse
events, product defects or problems, or biologic product deviations; to track
products; to enable product recalls; to make repairs or replacements, or to
conduct post marketing surveillance, as required.

Legal Proceedings: If you are involved in a lawsuit or a dispute, we may
disclose your PHI in response to a court or administrative order. We also may
be required to disclose your PHI in response to a subpoena, discovery request,
or other lawful process by someone else involved in the dispute, where
allowable under HIPAA. We will make a good faith effort to inform you of
all such requests when received.

Military Activity and National Security: When the appropriate conditions
apply, we may use or disclose PHI of individuals who are Armed Forces
personnel or veterans (1) for activities deemed necessary by appropriate
military command authorities; (2) for the purpose of a determination by the
Department of Veterans Affairs of your eligibility for benefits, or (3) to
foreign military authority if you are a member of that foreign military
services. We may also disclose your PHI to authorized federal officials for
conducting national security and intelligence activities including for the
provision of protective services to the President or others legally authorized.

Abuse or Neglect: We may disclose your PHI to a law enforcement agency or
to a public health authority, such as the Department of Health and Human
Resources and Child Protective Services that is authorized by law to receive
reports of child abuse or neglect. In addition, we may disclose your PHI if we
believe that you have been a victim of abuse, neglect, or domestic violence to
the governmental entity or agency authorized to receive such information. In
this case, the disclosure will be made consistent with the requirements of
applicable Federal and State laws.

Law Enforcement: We may disclose your PHI to law enforcement officials
for purposes or in situations such as:

Identifying or locating a suspect, fugitive, material witness or missing
person;
In response to a court order, subpoena, warrant, summons, or similar
process;
About the victim of a crime if, under certain limited circumstances,
we are unable to obtain the person’s agreement;
About a death we believe may be the result of criminal conduct;
About criminal conduct at any of our health centers; and
In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Inmates: If you are an inmate of a correctional institution or under the custody
of a law enforcement official, we may disclose your PHI to the correctional
institution or law enforcement official. This disclosure would be necessary
(1) for the institution to provide you with medical care; (2) to protect your
health and safety or the health and safety of others; or (3) for the safety and
security of the correctional institution.

Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a
coroner or medical examiner for identification purposes, for determining
cause of death, or for other duties authorized by law. We may also disclose
PHI to funeral directors to carry out their duties. PHI may be used and
disclosed for organ, eye, or tissue donation purposes.

Research: We may disclose your PHI to researchers conducting research that
has been approved by an Institutional Review Board, which has reviewed the
research proposal and established protocols to ensure the privacy of your PHI.
For example, a research project may involve comparing the medical treatment
and recovery of all patients who received one medication to those who
received another type of medication for the same condition.

All research projects, however, are subject to a special approval process called
an Institutional Review Board or Privacy Board. This process evaluates a
proposed research project and its use of medical information, trying to balance
the research needs with the patients’ need for privacy of their medical
information. Before we use or disclose PHI for research, the project will have
been approved through this research approval process, but we may disclose
PHI about you to people preparing to conduct a research project, for example,
to help them look for patients with specific medical needs, so long as the
medical information they review does not leave the facility, and so long as the
information sought is necessary for the research purpose. We will ask for your
specific permission if the research involves treatment. If you are asked for
such permission, you have the right to refuse.

Safety: We may disclose PHI to prevent or lessen a serious and imminent
threat to the health or safety of the public or another person. Such disclosures
may include reports to law enforcement, reports to Child Protective Services
or Adult Protective Services, or the filing of a petition for evaluation and/or
involuntary commitment through the State’s Mental Hygiene process.

Worker’s Compensation: We may use and disclose your PHI, as necessary,
to comply with Worker’s Compensation laws regarding work-related injuries
or illnesses.

Change of Ownership: In the event that SWVHS is sold or merged with
another organization, your medical record will become the property of the
new owner.

E. Permitted Uses and Disclosures For Which You May “Opt Out”

SWVHS has chosen to participate in the West Virginia Health Information
Network (“WVHIN”), a regional health information exchange serving all of
West Virginia. As permitted by law, your health information will be shared
with this exchange in order to provide faster access, to facilitate better
coordination of care, and to assist providers and public health officials in
making more informed decisions. You may “opt out” and disable access to
your health information available through WVHIN by completing the OptOut Form, which is available, upon request, at any SWVHS health center.
Public health reporting and Controlled Dangerous Substances information, as
part of the West Virginia Prescription Drug Monitoring Program, will still be
available to providers.

4. NOTICE OF MORE STRINGENT REQUIREMENTS
UNDER WEST VIRGINIA LAW

You should note that the foregoing summary of permitted uses and
disclosures of PHI is based upon Federal requirements. Those requirements
are to be followed unless West Virginia law offers greater protection to PHI.
In certain situations, West Virginia has adopted stronger protections than the
Federal provisions. Since we are providing your healthcare in West Virginia,
these laws will apply even though you may be a citizen of another state.

In West Virginia, mental health information obtained in the course of our care
is considered confidential and may only be disclosed with patient
authorization, under command of a qualified court order, or where necessary
to protect someone from clear and substantial danger of imminent harm. For
this purpose, mental health information includes the fact someone is our
patient or has received treatment; all information related to diagnosis or
treatment; PHI concerning physical, mental, or emotional condition; and
advice, instructions, or prescriptions related to such care, treatment, or
diagnosis.

Under West Virginia law, we may not release or disclose PHI of a mature
minor receiving certain protected healthcare services, including but not
necessarily limited to birth control, prenatal care, drug rehabilitation, or
sexually transmitted disease, without the minor’s prior written consent (even
to parents or guardians).

Under West Virginia law, the identity of a person who has received an HIVrelated test and the results of such test may not be disclosed without the
person’s consent. However, disclosure is permitted to certain parties, such as
to the victim of a sexual assault or to healthcare workers involved in the
treatment of the person. Recipients of such information under one of these
exceptions are prohibited from further disclosing the PHI. We also cannot
disclose to a third party any PHI concerning treatment for substance abuse
disorder without patient authorization.

5. YOUR RIGHTS REGARDING YOUR PHI

A. You Have the Right to Inspect and Obtain a Copy of Your PHI

You may inspect and obtain a copy of PHI about you that is contained in a
designated record set for as long as we maintain the PHI. A “designated record
set” contains medical and billing records that we use for making healthcare
or business operation decisions about you.

Under Federal law, however, you may not inspect or copy the following
records: psychotherapy notes; information compiled in reasonable
anticipation of, or for use in, a civil, criminal, or administrative action or
proceeding; and PHI that is subject to a law that prohibits access to such
information or was obtained from someone other than a healthcare provider
upon a condition of confidentiality. You may request an appointment to
inspect and copy your PHI by completing an Access Request form and
submitting it to our Compliance Officer. If your request is granted, we will
schedule a mutually convenient time for such action.

We are required to respond to your request to inspect and copy your records
within 30 days of receipt of your request if the requested information is
maintained on-site, or within 60 days if the information is maintained off-site.
We also have the right to extend this response time by up to an additional 30
days with written notice to you of the reasons for the delay and the date by
which we will complete our action on your request. We may deny your
request to inspect and copy your records in certain very limited circumstances.
If you are denied access to medical information, you may request that the
denial be reviewed. One of our medical staff will review your request and the
denial. The person conducting the review will not be the person who denied
your request, and we will comply with the outcome of that review.

Please note that all original health records created by us in the course of your
care remain our property. We are required to take reasonable measures to
safeguard these records and to prevent unauthorized additions, deletions, or
changes in these documents. Accordingly, while you have a general right to
inspect and copy your medical records under Federal and State law, we must
control the conditions and circumstances under which any inspection and
copying occurs. No patient or authorized representative will be permitted
unsupervised access to any medical record, and no medical records may leave
our control for inspection and copying purposes. Under both HIPAA and
West Virginia law, we are permitted to charge you a fee for the cost of
copying, mailing, or searching these records, except where expressly
prohibited by such governing laws and regulations. If you request, we may
prepare a summary of your PHI (a fee will be charged). You may request
information concerning our fees from our Compliance Officer.
To request a copy of your medical or billing information, contact our
Compliance Officer, 7400 Lynn Avenue, Hamlin, WV 25523, or call (304)
824-5806, ext. 1221.

B. You Have the Right to Request Restrictions or Limitations on
Certain Uses and Disclosures of Your PHI

You may ask us not to use or disclose any part of your PHI for the purposes
of treatment, payment, or healthcare operations. You may also request that
any part of your PHI not be disclosed to family members or friends who may
be involved in your care or for notification purposes as described in this
Notice. In your request, you must tell us (1) what information you want
restricted; (2) whether you want to restrict our use, disclosure, or both; (3) to
whom you want the restriction to apply (for example, disclosures to your
spouse); and (4) an expiration date.

We are not required to agree to a restriction that you may request. If the
healthcare provider believes it is in your best interest to permit use and
disclosure of your PHI, then it will not be restricted. If your healthcare
provider does agree to the requested restriction, we may not use or disclose
your PHI in violation of that restriction, unless it is needed to provide
emergency treatment. Please discuss any restriction you wish to request with
your healthcare provider.

To the extent that you wish to restrict our ability to use or disclose your PHI
for payment, you will be asked to make alternative arrangements for payment.
We reserve the right to require you to make all payments at the time of service.

To request a restriction of your personal health information, please send your
written request to: SWVHS Compliance Officer, 7400 Lynn Avenue, Hamlin,
WV 25523.

C. You Have the Right to Request to Receive Confidential
Communications From Us By Reasonable Alternative Means or at
an Alternative Location.

You have the right to request that we communicate with you about medical
matters in a certain way or at a certain location. For example, you can ask
that we only contact you at work or by mail.

To request confidential communications of your personal health information,
or if you desire for your billing information to be sent to another address
please send your written request to: SWVHS Compliance Officer, 7400 Lynn
Avenue, Hamlin, WV 25523.

D. You Have a Right to Request That We Amend Your PHI that is in
Your Designated Record Set.

You may request an amendment of PHI about you in a designated record set
for as long as we maintain this information. To request an amendment, your
request must be in writing on forms available from our Compliance Officer
(Request for Amendment/Correction of PHI). You must provide a reason that
supports your request.

Upon the receipt of a written request for amendment, we will consider your
request and will make amendments based on the medical opinion of the
healthcare provider who originated the entry. If the healthcare provider
believes the entry should not be amended, we are not required to make any
amendment. In addition, we may deny your request if you ask us to amend
information that:

Was not created by us, unless the person or entity that created the
information is no longer available to make the amendment;
Is not part of the designated record set kept by us;
Is not part of the information which you would be permitted to inspect
and copy; or
Is accurate and complete.

If we deny your request for amendment, you have the right to file a statement
of disagreement with us, and we may prepare a rebuttal to your statement. We
will provide you with a copy of any such rebuttal. Your statement of
disagreement may not exceed two hundred fifty (250) words. If you submit a
statement of disagreement or clearly indicate in writing that you want your
request for amendment to be made a part of your medical record, we will
attach it to your records and include it whenever we make a disclosure of the
item or statement you believe to be incomplete or incorrect.

For more information about requesting amendments to your designated record
set, contact the SWVHS Compliance Officer, 7400 Lynn Avenue, Hamlin,
WV 25523, or call (304) 824-5806, ext. 1221.

E. You Have a Right to Receive an Accounting of Certain Disclosures
We Have Made of Your PHI

This right applies to disclosures for purposes other than treatment, payment,
or health care operations. This right does not apply to information provided
to you or others pursuant to your authorization, to family members or friends
you have involved in your care, or for certain government functions as
addressed in this Notice. The right to receive this information is subject to
certain other exceptions, restrictions, and limitations. The first accounting of
disclosures you request within a 12-month period shall be free of charge, but
we reserve the right to charge you for additional lists within the same 12-
month period. We will notify you of the costs involved in your request, and
you may withdraw your request before you incur any costs. To request an
accounting of applicable disclosures, contact the SWVHS Compliance
Officer, 7400 Lynn Avenue, Hamlin, WV 25523.

F. You Have a Right to Obtain a Paper Copy of this Notice of Privacy
Practices.

You may ask us to give you a copy of this Notice at any time. Or, you may
request a copy by contacting the SWVHS Compliance Officer, 7400 Lynn
Avenue, Hamlin, WV 25523.

G. You Have the Right to Choose Someone to Act For You

If you have given someone medical power of attorney or if someone is your
legal guardian, that individual can exercise your rights and make choices
about your health information. If alerted to the appointment of a power of
attorney or guardian, we will need to make sure that the person has the proper
legal authority to act on your behalf before we take any action. If you have
documentation to support the appointment of a power of attorney or guardian,
you can supply it to your medical provider.

6. OTHER USES OF YOUR PHI

Other uses and disclosures of your PHI not covered by this Notice or the laws
and/or regulations that apply to SWVHS will be made only with your written
permission. If you provide us with permission to use or disclose your PHI,
you may revoke that permission, in writing, at any time. If you revoke your
permission, we will no longer use or disclose your PHI for the reasons covered
by your written authorization. We are unable to take back any disclosures we
have already made with your permission, and we are required to retain records
of the care that we provided to you under that written authorization.

7. CONTACT INFORMATION AND COMPLAINTS

If you are concerned that we may have violated your privacy rights, or you
disagree with a decision we made about access to your PHI or in response to
a request you made to amend or restrict the use or disclosure of your PHI or
to have us communicate with you in confidence by alternative means or at an
alternative location, you may file a written complaint with our Compliance
Officer, 7400 Lynn Avenue, Hamlin, WV 25523. You also may submit a
written complaint to the U.S. Department of Health and Human Services,
Office of Civil Rights, by sending a letter to 200 Independence Avenue, S.W.,
Washington, D.C. 20201.

We support your right to protect the privacy of your medical information. You
will not be penalized for filing a complaint. We will not retaliate in any way
if you choose to file a complaint with SWVHS or the U.S. Department of
Health and Human Services.

We Are Committed to Earning and Protecting Your Trust!

If you do not understand any portion of the foregoing Notice, or if you need
someone to read it to you, please ask for assistance. We want you to
understand what your PHI is, how your PHI may be used or disclosed, and
your rights to access or control your PHI.

We thank you for being our patient, and we look forward to continuing to
work with you to improve your health and overall wellbeing!

Privacy Practices

Educate yourself on these health topics