We are IHA, (IHA Health Services Corporation), a group practice with primary care and multi-specialty health care providers serving you at IHA office locations. Who will follow this Notice: Our affiliates, IHA Investment Holdings, LLC, Clinsite, Saint Joseph Mercy Health System (SJMH), and Trinity Health, Livonia, Michigan; in addition IHA participates in quality improvement and assessment activities as part of a Physician Organization of Michigan Accountable Care Organization and Insurance or Government Innovative Care Models. IHA shares your health records electronically with your other healthcare Providers in the Health Information Exchange for the purposes of improving the overall quality of health care services provided to you. (e.g., avoids unnecessary duplicate testing). The electronic health records will include sensitive diagnosis such as HIV/AIDS, sexually transmitted diseases, genetic information, mental health substance abuse, pregnancy and prenatal care, etc. Providers and hospital systems in this arrangement work jointly to improve the quality and coordination of your care so that appropriate information is available to your provider to make timely and informed decisions. All of these entities or locations may share health information with each other for treatment, payment, or health care operation purposes described in this notice.

This notice is effective March 1, 2018, and describes how information about you may be used and disclosed; and how you can get access to this information. Please review it carefully.

A federal regulation, known as the “HIPAA Privacy Rule,” requires that we provide detailed notice in writing of our privacy practices; we know that this Notice is long. The HIPAA Privacy Rule requires us to address many specific things in this Notice.

OUR PLEDGE REGARDING HEALTH INFORMATION:

We understand that health information about you and your health care is personal. We are committed to protecting health information about you. We create a record of the care and services you receive from us.

This Notice describes your rights as our patient and our obligations regarding the use and disclosure of health information. Law requires us to:

• Make sure that health information that identifies you is kept private;

• Offer you this Notice of our legal duties and privacy practices with respect to health information about you; and

• Comply with the terms of the Notice that is currently in effect.

HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU:

The following categories describe the different ways we may use and disclose health information for treatment, payment or health care operations. The examples included with each category do not list every type of use or disclosure that may fall within that category.

Treatment: We may use and disclose health information about you to provide you with health care treatment or services. We may disclose health information about you to doctors, nurses, technicians, health students, or other personnel who are involved in taking care of you. They may work at our offices, at the hospital if you are hospitalized under our supervision, or at another doctor’s office, lab, pharmacy, or other health care provider to whom we may refer you for consultation, testing or treatment. For example, we may use and disclose health information when you need a prescription, lab work, x-ray, or health care services. In addition, we may use and disclose health information about you when referring you to another health care provider, including electronic transmission when necessary to other physicians for treatment purposes. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. We may also disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Payment: We may use and disclose health information about you so that the treatment and services you receive from us may be billed to, and payment collected from you, an insurance company, or a third party. For example, we may need to give your health plan information about your office visit so your health plan will pay us or reimburse you for the visit. We may also tell your health plan about treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

Health Care Operations: We may use and disclose health information about you for operations of our health care practice. These uses and disclosures are necessary to run our practice and make sure that all of our patients receive quality care. For example, we may use health information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine health information about many patients to decide what additional services we should offer, what services are not needed, whether certain new treatments are effective, or to compare how we are doing with others and to see where we can make improvements. We share information with Cancer Linq, a learning intelligence network for quality. We may remove information that identifies you from this set of health information so that others may use it to study health care delivery without learning who our specific patients are.

Appointment Reminders: We may use and disclose health information to contact you as a reminder that you have an appointment. Please let us know if you wish us to use a different telephone number or address to contact you for this purpose.

Health-Related Services and Treatment Alternatives: We may use and disclose health information to tell you about health-related services or recommend possible treatment options or alternatives that may be of interest to you. Please let us know in writing, if you do not wish us to send you this information, or if you wish us to use a different address to send this information to you.

Research: We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information. In addition, we may disclose information to Clinsite, a subsidiary of IHA.

Organ and Tissue Donation: If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

As Required by Law: We will disclose health information about you when required to do so by federal, state, or local law.

To Avert a Serious Threat to Health or Safety: We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Military and Veterans: If you are a member of the armed forces or separated/discharged from military services, we may release health information about you as required by military command authorities or the Department of Veterans Affairs as may be applicable. We may also release health information about foreign military personnel to the appropriate foreign military authorities.

Workers’ Compensation: We may release health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks: We may disclose health information about you for public health activities as required or permitted by law. These activities generally include the following: To prevent or control disease, injury or disability; to report births and certain deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify person or organization required to receive information on FDA-regulated products; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

Fundraising: We would not use or disclose your information for fundraising activities unless we first contacted you and obtained your authorization. You can tell us not to contact you again about fundraising.

Health Oversight Activities: We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court order, or appropriate administrative order as required by law, that is signed by a judge. For other requests, we comply with a valid patient authorization.

Law enforcement and Inmates: We may release health information if asked to do so by a law enforcement official in certain limited cases: In response to a court order, warrant, or similar process signed by a judge; If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Coroners, Health Examiners, and Funeral Directors: We may release health information to a coroner or health examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information to funeral directors, as necessary to carry out their duties.

National Security, Protective Services for the President and other Intelligence Activities: We may release health information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, so they may provide protection to the President, other authorized persons or foreign heads of state, or to conduct special investigations.

YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU:

Right to Inspect and Copy: You have the right to inspect and receive a paper or electronic copy of health information that may be used to make decisions about your care. Usually, this includes health and billing records. To inspect and copy health information please contact the person responsible for record disclosures at your office location. A written request is required. If you request a copy of health information about you, we may charge you a reasonable fee for copying, mailing or other supplies and services associated with your request.

We may deny your request to inspect and copy health information only in certain very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed. Another licensed health care professional chosen by our practice will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Amend: If you feel that health information we have about you is incorrect or incomplete, you may request that we amend the information. You have the right to request an amendment for as long as we keep the information. To request an amendment, your request must be made in writing, submitted to IHA’s Compliance Officer, and must be contained on one page of paper legibly handwritten or typed. In addition, you must provide a reason that supports your request for an amendment. We may deny your request in certain cases, including if it is not in writing or if you do not give us a reason for the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

• Is not part of the health information kept by or for our practice;

• Is not part of the information which you would be permitted to inspect and copy; or

• Is accurate and complete

Right to Receive Confidential Communications: You have the right to request that we communicate with you about health care matters in a certain way or at a certain location. For example, you may request that we only contact you at work or by mail to a post office box. You must make your request in writing to IHA’s Compliance Officer at the address below. You must specify how you would like us to contact you (for example, by regular mail to your post office box and not your home). We are required to accommodate reasonable requests.

Right to Request Sharing or Restrictions: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will verify that the person has this authority and can act for you before we take any action. You have the right to request a restriction or limitation on the health information that we use for disclosure about you for treatment, payment and health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not disclose information to your spouse about a surgery you had. We are not required to agree to your request for restrictions if it is not feasible for us to ensure our compliance or believe it will negatively affect the care we may provide you. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request a restriction, you must make a request in writing to IHA’s Compliance Officer at the address below. In your request, you must tell us what information you want to limit and to whom you want the limits to apply, for example, disclosure of specified surgery to your spouse.

Michigan – Health Information Exchange (HIE) – Great Lakes Health Connect (GLHC) Opt Out: HIE electronically moves personal health information securely among doctors, hospitals and other health care providers when it is needed for your care. Your health care provider exchanges electronic medical records through GLHC. GLHC complies with all state and federal regulations regarding the privacy and security of health information. You have the right to opt out and prevent your health information from being sent to the Michigan Health Exchange by completing and submitting an “Opt Out” form. Mail or Fax or Website information is below. Additionally, you may contact GLHC or IHA if you have any questions or concerns.

Great Lakes Health Connect 695 Kenmoor Ave. SE, Suite B Grand Rapids, MI 49546 Phone: 844.454.2443 http://gl-hc.org/

Right to Receive an Accounting of Disclosures: You have the right to request a list accounting for any disclosures of your health information we have made, except for uses and disclosures for treatment, payment, and health care operations, as previously described.

To request this list of disclosures, you must submit your request in writing to IHA’s Compliance Officer. Your request must state a time period that may not be longer than six years. The first list that you request in a 12-month period will be free, but for additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. We will mail you a list of disclosures in paper form within 30 days of your request, or notify you if we are unable to supply the list within that time period and by what date we can supply the list; but this date will not exceed a total of 60 days from the date you made the request.

Right to a Paper Copy of this Notice: You have a right to receive a paper copy of this Notice at any time. To obtain a copy of this notice, please speak with the receptionist at your office location. You may also obtain a copy of this notice from our website: www.ihacares.com.

CHANGES TO THIS NOTICE:

We reserve the right to make changes to this Notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our facility.

COMPLAINTS:

If you believe your privacy rights have been violated, you may file a complaint with us or the Secretary of the Department of Health and Human Services. To file a complaint with us, please contact IHA’s Compliance Officer at the address and number listed below. You will not be penalized for filing a complaint.

OTHER USES OF HEALTH INFORMATION:

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

PRIVACY OFFICIAL CONTACT INFORMATION

IHA Compliance Officer

IHA Health Services Corporation

P O Box 0446

Ann Arbor, MI. 48106-0446

(734) 747-6766 ext. 10599

IHAComplianceOfficer@ihacares.com

Acknowledgement of Receipt of this Notice: We will request that you sign a separate form or notice acknowledging you have received a copy of this Notice. If you choose not to sign, or are unable to sign, a staff member will sign their name, date and confirm the Notice has been offered to you.