NOTICE OF CONEMAUGH HEALTH SYSTEM'S PATIENT PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

OUR PLEDGE REGARDING YOUR HEALTH INFORMATION

We understand that information about you and your health is personal. We are committed to protecting the privacy of this information. Each time you visit one of the facilities within the Conemaugh Health System we create a record of your visit. Generally, the record contains such information as your symptoms, examination and test results, your diagnosis, a plan for future care and treatment and billing-related information. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by any of the facilities within the Conemaugh Health System, whether made by Conemaugh Health System personnel, physicians, or other individuals authorized to access or document in your health records. Your doctor may have different policies or notices regarding the use and disclosure of your health information created in his or her office.

This notice explains in detail how we may use or disclose your health information. This notice also describes certain rights you have regarding the use and disclosure of your health information.

OUR RESPONSIBILITIES

Protecting the privacy and appropriate use of your health information is our priority and a crucial part of our commitment to you. By law, we are required to give you this Notice of our privacy practices, and we must follow the terms of the Notice that is currently in effect.

Changes to this Notice - We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our facilities, and it will also be posted on our web site at [www.conemaugh.org]. A copy of the current notice in effect will be available at the registration area of each facility.

Complaints - If you believe your privacy rights have been violated, you may file a complaint with any of our facilities. This complaint can be filed through an anonymous complaint line by calling 1-800-500-0333 or if you wish, you can file your compliant in writing to: Conemaugh Health System's Privacy Officer, 1086 Franklin Street, Johnstown, PA 15905. There will be no retaliation for filing a complaint. You also have the right to complain to the Secretary of the Department of Health and Human Services.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following summary describes different ways that we use your health information within Conemaugh and disclose your health information to persons and entities outside of Conemaugh and we provide you with examples of such uses and disclosures. We have not listed every use or disclosure within the categories, but all permitted uses and disclosures will fall within one of the following categories.

COMMON USES AND DISCLOSURES ALLOWED UNDER LAW

Treatment - We may use health information about you to provide you with health treatment and services. We may disclose health information about you to doctors, nurses, technicians, students, interns, or other personnel who are involved in taking care of you during your visit with us. For example, a doctor treating you for a broken collarbone may need to know if you have diabetes because diabetes may slow the healing process. Different departments within Conemaugh may share health information about you in order to coordinate the various services you need, such as medications, lab work, x-rays or meals.

Payment - We may use and disclose health information about you so the treatment and services you receive at our health care facility may be billed to and payment collected from you, your insurance company or a third party. This may also include the disclosure of health information to obtain prior authorization for treatment and procedures from your insurance plan.

Health Care Operations - We may use and disclose health information about you for health care operations including quality assurance activities; granting medical staff credentials to physicians; administrative activities, including Conemaugh Health System's financial and business planning and development; customer service activities, including investigation of complaints; and certain marketing and fundraising activities. Some additional specific examples of how we may use or disclose your health information for operations are listed below.

• Business Associates - There are some services provided in our organization through contracts with business associates. Examples of business associates include accreditation agencies, management consultants, quality assurance reviewers, certain laboratory services and copy services that make copies of your medical record. We may disclose your health information to our business associates so that they can perform the job we've asked them to do. To protect your health information, we require all of our business associates to sign a contract that states they will appropriately safeguard your information.
• Appointment Reminders - We may use and disclose health information to contact you as a reminder that you have an appointment for treatment or medical care at our health care facility.
• Marketing or Fundraising - We may contact you as part of a marketing and/or fundraising effort. As part of our marketing, we may tell you about Conemaugh Health System's health-related products and services that may be of interest to you. If you receive a communication from us for either marketing or fundraising purposes, in most cases you will be told how you can discontinue any further marketing or fundraising communications.
• Research That Doesn't Involve Your Treatment - When a research study does not involve any treatment, we may disclose your health information to researchers when an Institutional Review Board (IRB) has reviewed the research proposal, has established appropriate protocols to ensure the privacy of your health information, and has approved the research.
• Directory Information - Each facility within the Conemaugh Health System has a "directory" of information about hospitalized patients available to anyone who asks for a patient by name. The directory information includes four items: 1) the patient's name, 2) room number, 3) general condition ("serious, fair, good, etc."), and 4) available to clergypersons only, religious affiliation. This directory information allows visitors to find your room and florists to deliver flowers to you. You will be asked to agree to have this information disclosed each time you come to a Conemaugh facility. You have the right to refuse to have all or part of your information disclosed for such purposes. [If you do refuse to have all your information released, we will not be able to tell your family or friends your room number or that you are in the hospital.]
• Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend or family member who is involved in your medical care, unless you tell us in advance not to do so. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort (such as the Red Cross) so that your family can be notified about your condition, status and location. If you are unable to communicate your wishes, such as in the case of a medical emergency, we may release information to friends or family members as we, in the exercise of our professional judgment, believe to be in your best interest.

SPECIAL SITUATIONS THAT DO NOT REQUIRE YOUR ORAL OR WRITTEN CONSENT OR AUTHORIZATION

The following disclosures of your health information are permitted by law without any oral or written permission from you:

Organ and Tissue Donation - If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans - If you are involved in the armed forces or are a public official, we may release health information about you to the appropriate authorities so that they may carry out their duties under the law.

Worker's Compensation - We may release health information about you in order to comply with the laws related to worker's compensation or similar programs (such as automobile or disaster insurance).

Averting a Serious Threat to Health or Safety - We may use and disclose health information about you when necessary to prevent a serious threat to your health or safety or the health and safety of another person or the public.

Public Health Activities - We may disclose health information about you for public health activities. These generally include the following:

• To prevent or control disease, injury or disability.
• To report births and deaths.
• To report child abuse, neglect, or domestic violence.
• To report reactions to medications, problems with products or other adverse events.
• To notify people of recalls of products they may be using.
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Health Oversight Activities - We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections and licensure surveys. These activities are necessary for government agencies to monitor the health care system, government programs and compliance with civil rights laws.

Lawsuits and Disputes - If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may disclose health information about you in response to a subpoena, discovery request or other lawful process initiated by someone else involved in the dispute. In some circumstances, efforts must be made to tell you about the request for your health information, to obtain an order protecting the information requested or to seek a signed authorization from you to release certain records.

Law Enforcement - We may disclose health information if and to the extent we are asked to do so by law enforcement officials for the following reasons:

• In response to a court order, subpoena, warrant, summons or similar process.
• To identify or locate a suspect, fugitive, material witness or missing person.
• About the victim of a crime if, under certain circumstances, we are unable to obtain the person's agreement.
• About a death we believe may be the result of a criminal conduct.
• About criminal conduct at our facility.
• In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Home Directors - We may disclose health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death of a person. We may also release health information about patients at our facility to funeral home directors as necessary to carry out their duties.

National Security and Intelligence Activities - We may disclose health information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.

Inmates - If you are an inmate of a correctional institution or under custody of a law enforcement official, we may disclose health information about you to the correctional institution or the law enforcement official. This is necessary for the correctional institution to provide you with health care, to protect your health and safety and the health and safety of others, or for the safety and security of the correctional institution

Legal Requirements - We will disclose health information about you without your permission when required to do so by federal, state or local law.

USES OR DISCLOSURES REQUIRING YOUR SPECIFIC WRITTEN "AUTHORIZATION"

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you authorize us to use or disclose health information about you, you may revoke that authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you. Some typical disclosures that require your authorization are as follows:

Certain Disclosures Authorized by You - One of the primary reasons for disclosing health information about you is for follow-up care when your health care records are sent to a new physician or another hospital to continue your health care treatment.

Research Involving Your Treatment - When a research study involves your treatment, we may disclose your health information to researchers only after you have signed a specific written authorization. In addition, for any such research study, an Institutional Review Board (IRB) will already have reviewed the research proposal, established appropriate protocols to ensure the privacy of your health information, and approved the research. You do not have to sign the authorization in order to get treatment from Conemaugh, but if you do refuse to sign the authorization, you cannot be part of the research study.

Drug & Alcohol Abuse Treatment Disclosures - We will disclose drug and alcohol treatment information about you only in accordance with the federal privacy rule and state law. Inmost cases, these laws require us to get your written authorization or the written authorization of your personal representative for such disclosures.

Disclosure of Mental Health Treatment Information - We will disclose mental health treatment information about you only in accordance with the federal privacy rule and state law. In most cases, these laws require us to get your written authorization or the written authorization of your representative for such disclosures.

Disclosure of HIV/AIDS-Related Information - We will disclose HIV/AIDS-related health information about you only in accordance with the federal privacy rule and state law. In most cases, these laws require us to get your written authorization for such disclosures.

Disclosures Requested by Conemaugh - We may ask you to sign an authorization allowing us to use or to disclose your health information to others for specific purposes such as notifying you of future educational or social events that you might enjoy.

YOUR HEALTH INFORMATION RIGHTS

Although your health record is the physical property of the Conemaugh Health System facilities that created it, you have the following rights with respect to the health information we maintain about you:

1. Right to request a restriction on certain uses and disclosures of your information for treatment, payment or healthcare operations. You have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not disclose information about a test you had to a particular individual. We are not required by law to agree to your request; however, we will give every consideration to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. We ask that you make your restriction request in writing and advise us what information you want to limit and to whom you want the limits to apply.
2. Right to obtain a copy of this Notice of Patient Privacy Practices upon request.
3. Right to inspect and request a copy of your health record for a fee. This right may not apply to psychotherapy notes or information gathered for judicial proceedings. As to psychotherapy notes, we may provide you with an opportunity to review your records with your therapist. If clinically appropriate, we may provide copies of these records to you with your written authorization. We may deny your request under very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed by another independent health care professional chosen by someone on our health care team. We will abide by the outcome of that review.
4. Right to request an amendment to your health record if you feel the information is incorrect or incomplete. Please submit your request for an amendment to us in writing and include a reason to support the request. We may deny your request if it is not in writing, if the information was not created by our health care team, if it is not part of the information kept by our facility, if it is not part of the information which you would be permitted to inspect and copy, or if we believe the information is accurate and complete. Please note that even if we accept your request, we are not required to delete any information from your health record.
5. Right to obtain an accounting of disclosures of your health information made by Conemaugh. If you request an accounting of disclosures, we will provide you with the date of each disclosure, who received the health information, a brief description of the health information disclosed and why the disclosure was made. We are required to provide this information to you within 60 days, unless you agree to an extension. We will not charge you for an accounting unless you request more than one in a year's time. We are not required to include in the accounting those disclosures made to you or disclosures for which you have signed an authorization; for purposes of treatment, payment or healthcare operations; for the census; to persons involved in your care; for national security or intelligence; or to correctional facilities or law enforcement officials.
6. Right to request communication of your health information by alternative means or locations. We may deny your request if we deem it to be an unreasonable request or if the request compromises the protection of your health information.
7. Right to revoke your authorization to use or disclose health information except to the extent that action has already been taken. This revocation must be in writing and dated.
8. Right to complain about any aspect of our health information practices to us or to the Department of Health and Human Services of the United States. You can complain to us and expect an investigation and explanation by calling 1-800-500-0333 or writing: Conemaugh Privacy Officer, 1086 Franklin Street, Johnstown, PA 15905. You can make a complaint to the Dept. of Health and Human Services by addressing your written complaint to: Secretary, Dept. of Health and Human Services. You will not be penalized for filing a complaint.
9. Right to ask questions or raise concerns regarding your privacy rights or the information in this Notice by calling 1-800-500-0333 or writing: Conemaugh Health System's Privacy Officer, 1086 Franklin Street, Johnstown, PA 15905.

The effective date of this Notice is April 2003.