This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

TriHealth Joint Notice of Privacy Practices

Effective July 1, 2015

This notice describes how medical information about you may be used and disclosed and how you can get access to this information, please review it carefully.

This Notice will tell you about the ways in which we may use and disclose medical information about you. It also describes your rights and certain obligations that we have regarding the use and disclosure of your medical information.

TriHealth entities which are covered by regulations pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") are required by law to maintain the privacy of your health information, give you notice of our privacy practices with respect to your medical information, notify you of any breaches of your unsecured medical information and abide by the terms of this Notice. This Notice applies to the records of your care generated and maintained by the TriHealth affiliated hospitals which include Bethesda Hospital, Inc. and its locations, The McCullough-Hyde Memorial Hospital Inc. and its locations, The Good Samaritan Hospital of Cincinnati, Ohio and its locations, and TriHealth Hospital, Inc. and its locations, as well as applying to TriHealth affiliated physician practices and institutes including Queen City Physicians, Group Health Associates, TriHealth Physician Practices, Health First, TriHealth Heart Institute, TriHealth Digestive Institute, TriHealth Surgical Institute, TriHealth Cancer Institute, TriHealth Orthopedic and Spine Institute, TriHealth Women's Services and Bethesda Family Practice. The TriHealth affiliated hospitals and the TriHealth affiliated physician practices and institutes are referred to in this document collectively as the "TriHealth Facilities" or individually as the "TriHealth Facility". The TriHealth affiliated hospitals and the TriHealth affiliated physician practices and institutes will share your medical information with each other as necessary in order to carry out your treatment, obtain payment for the services provided to you and to operate their health care facilities.

While you are a patient at a TriHealth Facility, you may also receive health care services from other health care providers who are not employees or agents of TriHealth but who will follow the terms of this Notice with respect to the privacy of your health information. Accordingly, this Notice also applies to the records of your care generated by these health care providers at the TriHealth Facility. These health care providers include, but are not limited to, Physicians Anesthesia Service, Anesthesia Group Practice, Obstetrics Anesthesia Associates, Inc., Qualified Emergency Specialists, Inc., Medical X-Ray, Inc. and Northeast Radiology, Inc. These health care providers and the TriHealth Facilities will share your medical information with each other as necessary in order to carry out your treatment, obtain payment for the services provided to you or operate their health care facilities.

How We May Use and Disclose Medical Information About You

The following categories describe different ways that we may use and disclose your medical information. These are examples and, therefore, not every permitted use and disclosure is listed.

For Treatment

We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students and other trainees, or other personnel who are involved in taking care of you at the hospital or health care facility. Different departments of the hospital or health care facility may share medical information about you in order to coordinate the different services you need, such as prescriptions, lab work and X-rays. We may also disclose medical information about you to people outside the hospital or health care facility who may be involved in your medical care after you leave the hospital or health care facility, such as other physicians involved in your care, family members, or other health care related entities such as skilled nursing care facilities with whom you seek treatment.

For Payment

We may use and disclose medical information about you so that the treatment and services you receive at the hospital or health care facility may be billed to and payment may be collected from you, an insurance company, or a third party. For example, we may need to give your health insurance company information about surgery you received at the hospital so your health insurance company will pay us or reimburse you for the surgery. We may also tell your health insurance company about a treatment that you are going to receive in order to obtain prior approval or to determine whether your health insurance company will cover the treatment. We may also disclose your medical information to other healthcare providers so that they can bill for health care services that they provided to you, such as ambulance services.

For Health Care Operations

We may use and disclose medical information about you in order to operate the hospital or health care facility. These uses and disclosures are necessary to run the hospital or health care facility and make sure that our patients receive quality health care. For example, we may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may use and disclose medical information about you for various quality assurance and quality improvement activities. For example, we may participate in quality improvement projects with the Greater Cincinnati Health Council, HealthBridge, Inc. and/or the Health Improvement Collaborative of Greater Cincinnati in an effort to improve care and treatment related to certain diseases such as adult diabetes and pediatric asthma. We may also disclose medical information to doctors, nurses, technicians, medical and nursing students, and other personnel for review and learning purposes. We may also provide medical information to other healthcare providers who have a relationship with you and need the information for their own healthcare operations.

Business Associates

We may disclose medical information about you to our business associates who need that information in order to provide a service to us or on behalf of us. A business associate is a person who is not part of the hospital's or health care facility's workforce, a company or other entity which uses or has access to protected health information in order to perform a function on behalf of the hospital or health care facility. For example, business associates of TriHealth may include billing companies, copying companies, document shredding companies, consultants, accountants and attorneys.

Appointment Reminders

We may use and disclose your medical information to contact you as a reminder that you have an appointment for treatment or medical care at the hospital or health care facility.

Treatment Alternatives

We may use and disclose your medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-Related Benefits and Services

We may use and disclose your medical information to tell you about health-related benefits or services that may be of interest to you.

Fundraising Activities

We may disclose medical information about you to a foundation related to the hospital so that the foundation may contact you to raise money for the hospital. You have the right to opt out of receiving such communications. Any communication sent to you will let you know how you may opt out of receiving similar communications in the future. We only release the following information about you - demographic information (such as your name, address, phone number, age, gender, and date of birth) and the dates you received treatment or services at the hospital, your attending physician, outcome information, and health insurance status.

Hospital Directory

We may include certain information about you in the hospital directory while you are a patient in the hospital. This information may include your name, location in the hospital, your general condition (for example, fair, serious, etc.) and your religious affiliation. The directory information, except religious affiliation, may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. This is so your family, friends and clergy can visit you in the hospital and generally know how you are doing.

Individuals Involved with or Concerned About Your Care

We may release information about your condition or treatment to a friend or family member relevant to his/her involvement in your care or payment for your care. We may also disclose your location and condition to assist or notify a family member or personal representative who is involved in your care. We may also disclose your information in a disaster relief effort so that your family can be notified about your condition and location.

Research

Under certain circumstances, we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. Research projects are subject to a special approval process. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with patients' need for privacy of their medical information.

As Required by Law

We will disclose medical information about you when required to do so by federal, state or local law. For example, Ohio law requires hospitals and other health care providers to report cases of cancer to a registry called the Ohio Cancer Incidence Surveillance System.

To Avert a Serious Threat to Health or Safety

We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Organ and Tissue Donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Worker's Compensation

We may release medical information about you for worker's compensation or similar programs which provide benefits for work-related injuries or illness.

Public Health Activities

We may disclose medical information about you for public health activities such as the prevention or control of disease, injury or disability; reporting of births and deaths; reporting of child abuse or neglect; and, reporting of reactions to medications or problems with products and to fulfill requirements of the U.S. Food and Drug Administration.

Health Oversight Activities

We may disclose medical information to a health oversight agency for activities allowed by law such as audits, investigations, inspections and licensure or disciplinary actions.
Lawsuits and Disputes. We may disclose medical information about you in response to a Court Order, Administrative Order or certain subpoenas.

Law Enforcement

We may release medical information to a law enforcement official about a death we believe may be the result of criminal conduct; about criminal conduct at the hospital or health care facility; and, in emergency circumstances, to report a crime, the location of a crime or victims, or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors

We may release medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information to funeral directors as necessary to carry out their duties.

Military and Veterans

If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

National Security and Intelligence Activities

We may release medical information about you to authorized federal officials for intelligence and other national security activities authorized by law.

Protective Services for the President and Others

We may disclose medical information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Inmates

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or the law enforcement official.

Other Uses of Your Medical Information

The following uses and disclosures of your medical information will be made only with your written permission (your written permission is referred to as an authorization): (i) most uses and disclosures of notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a counseling session and that are separated from the rest of the medical record (if maintained by us); (ii) uses and disclosures for marketing purposes; (iii) uses and disclosures for research purposes (unless an authorization is not required as determined through the special approval process described above); and (iv) disclosures that constitute a sale of your medical information. In addition, other uses and disclosures of your medical information not covered by this Notice or required by the laws that apply to TriHealth will be made only with your authorization. If you provide your permission to use or disclose medical information about you, you may revoke that permission in writing at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons indicated in your written authorization. You understand that we are unable to take back any disclosures that we made before we received your written notice revoking your authorization.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your medical information. This includes your medical and billing records but does not include psychotherapy notes. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

If you are a patient at a Bethesda Hospital location, to inspect or obtain a copy of your medical information, you must submit your request in writing to Bethesda North Hospital, Medical Records Department, 10500 Montgomery Road, Cincinnati, Ohio 45242, Attention: Supervisor.

If you are a patient at a Good Samaritan Hospital location, to inspect or obtain a copy of your medical information, you must submit your request in writing to Good Samaritan Hospital, Medical Records Department, 375 Dixmyth, Cincinnati, Ohio 45220, Attention: Supervisor.

If you are a patient at one of the TriHealth affiliated physician practices or institutes or another TriHealth affiliated health care facility or hospital, to inspect or obtain a copy of your medical information, you must submit your request in writing to the Medical Records Department at the address of the physician practice or facility where you received treatment.

We may deny your request in certain circumstances. If you are denied access to your medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by TriHealth will review your request and the denial. The person conducting the review will not be the same person who denied your request. We will comply with the outcome of the review.

Right to Amend

If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long the information is kept by or for the hospital or health care facility.

If you are a patient at a Bethesda Hospital location, to request an amendment to your medical information, you must submit your request for an amendment, along with your reason for the request, in writing to Bethesda North Hospital, Medical Records Department, 10500 Montgomery Road, Cincinnati, Ohio 45242, Attention: Supervisor.

If you are a patient at a Good Samaritan Hospital location, to request an amendment to your medical information, you must submit your request for an amendment, along with your reason for the request, in writing to Good Samaritan Hospital, Medical Records Department, 375 Dixmyth, Cincinnati, Ohio 45220, Attention: Supervisor.

If you are a patient at one of the TriHealth affiliated physician practices or institutes or another TriHealth affiliated health care facility, to request an amendment to your medical information, you must submit your request in writing to the Medical Records Department at the address of the physician practice or facility where you received treatment.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical information kept by or for the hospital or health care facility;
• Is not part of the information which you would be permitted to inspect and copy; or,
• Is accurate and complete.

Right to an Accounting of Disclosures

You have the right to request an "accounting of disclosures". This is a list of the disclosures we made of your medical information. This list will not include disclosures that we made for purposes of treatment, payment and health care operations. We are also not required to include in this list the disclosures we made by acting upon your written authorizations.

If you are a patient at a Bethesda Hospital location, to request an accounting of disclosures, you must submit your request in writing to Bethesda North Hospital, Medical Records Department, 10500 Montgomery Road, Cincinnati, Ohio 45242, Attention: Supervisor.

If you are a patient at a Good Samaritan Hospital location, to request an accounting of disclosures, you must submit your request in writing to Good Samaritan Hospital, Medical Records Department, 375 Dixmyth, Cincinnati, Ohio 45220, Attention: Supervisor.

If you are a patient at one of the TriHealth affiliated physician practices or institutes or another TriHealth affiliated health care facility or hospital, to request an accounting of disclosures, you must submit your request in writing to the Medical Records Department at the address of the physician practice or facility where you received treatment.

Your request must state a time period which may not be longer than six (6) years and may not include dates before April 14, 2003. The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list.

Right to Request Restrictions

You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a restriction or limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.

We are not required to agree to your request for a restriction or limitation. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

If you paid in full and out of pocket at the time of your appointment and you request that the information related to that specific date of service for which you paid in full not be shared with your health plan for payment or health care operations, we will honor your request.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of this Notice

You have a right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. You may also obtain a copy of this Notice at our website, www.TriHealth.com.

Changes to this Notice

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in the hospital and health care facilities. The Notice will contain on the first page, in the top right-hand corner, the effective date. In addition, if you are a patient at the hospital, each time you register at or are admitted to the hospital for treatment or health care services as an inpatient or outpatient, we will offer you a copy of the current Notice in effect.

For Further Information

For further information about the matters covered by this Notice, you may contact the following:

• If you are a patient at a Bethesda Hospital location contact the Patient Representative at 513-865-1115;
• If you are a patient at a Good Samaritan Hospital location, contact the Patient Representative at 513-862-2582; or
• If you are a patient at one of the TriHealth affiliated physician practices or institutes or another TriHealth affiliated health care facility or hospital, contact TriHealth's Privacy Officer at 513-569-6507.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with TriHealth or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with TriHealth, you must submit your complaint in writing as follows:

• If you are a patient at a Bethesda Hospital location, send your written complaint to the attention of the Patient Representative, Bethesda North Hospital, 10500 Montgomery Road, Cincinnati, Ohio 45242.
• If you are a patient at a Good Samaritan Hospital location, send your written complaint to the attention of the Patient Representative, Good Samaritan Hospital, 375 Dixmyth Avenue, Cincinnati, Ohio 45220.
• If you are a patient at McCullough-Hyde Memorial Hospital, send your written complaint to the attention of the Risk Manager, McCullough-Hyde Memorial Hospital, 110 North Poplar Street, Oxford, Ohio 45056.
• If you are a patient at one of the TriHealth affiliated physician practices or institutes or another TriHealth affiliated health care facility or hospital, send your written complaint to the attention of TriHealth's Privacy Officer, TriHealth, Inc., Corporate Administration Department, 619 Oak Street, Cincinnati, Ohio 45206.

You will not be retaliated against for filing a complaint.