Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE
USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS
INFORMATION. PLEASE REVIEW IT CAREFULLY.

You have the right to obtain a paper copy of this Notice upon request.

This Notice describes the privacy practices of St. Francis Hospital and the physicians
who provide services to patients at this Facility.

Patient Health Information
Under federal law, your patient health information is protected and confidential. Patient
health information includes information about your symptoms, test results, diagnosis,
Treatment, and related medical information. Your Health Information also includes
Payment, billing, and insurance information.

How We May Use and Disclose Your Health Information
Federal privacy laws allow ScionHealth to use and disclose your health information for
the following reasons or to the following entities:

Treatment – We may use and disclose your health information to provide, coordinate or
manage your treatment and related services, including disclosures to doctors, nurses,
technicians, students, volunteers, or other personnel involved in your care. We may
disclose your health information to other providers to facilitate the care they provide you.
For example, we may share your health information to coordinate your health care and
related services, such as care summaries, prescriptions, lab work and x-rays.
Payment – We may use and disclose your health information so that the treatment and
services you receive are billed to and payment is collected from you, an insurance
company or a third party. For example, we may tell your health plan about your
treatment plans to obtain prior approval or determine whether your plan will cover the
treatment.
Health Care Operations – We may use and disclose your health information for our
health care operations. These uses and disclosures allow us to continually improve the
quality and effectiveness of your care. For example, we may use and disclose your
health information to review our treatment and services, manage your care, and evaluate
the performance of our staff and others caring for you. We may also combine your health
information with health information from others so that our quality improvement team and
other participants in our organized health care arrangements can identify improvements
in the care and services you receive.
Facility Directory Purposes – If you receive services in a ScionHealth facility, we may
include certain limited information about you in a facility directory while you are a patient.
This information may include your name, location in the facility, general condition (e.g.,
fair, stable, etc.) and religious affiliation. The directory information, except for your
religious affiliation, may be released to people who ask for you by name. Your religious
affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they
don’t ask for you by name. The facility directory is used so your family, friends and clergy
can visit you and generally know how you are doing. If you would like to opt out of being
in the directory, please contact the Privacy Officer at St. Francis Hospital.
To Family Members and Others Involved in Your Care – Unless you object, we may
disclose to a member of your family, a relative, a close friend or any other person you
identify, your health information that directly relates to that person’s involvement in your
health care. If you are unable to agree or object to such a disclosure, we may disclose
information as necessary if we determine that it is in your best interest based on our
professional judgment. We may use or disclose health information to notify or assist in
notifying a family member, personal representative, or any other person responsible for
your care of your location, general condition, or death.
Disaster Relief – We may use or disclose your health information to an authorized
public or private entity to assist in disaster relief efforts to coordinate notifying your family
members of your location, general condition or death.
Incidental Disclosures – Some incidental disclosures of your health information may
occur during otherwise permitted use or disclosure of your health information. For
example, a visitor may overhear a discussion about your care at the nursing station. We
have implemented appropriate safeguards to protect the privacy of your information,
such as keeping those conversations at a quiet volume.
As Required by Law – We may disclose your health information when we are required
to do so by federal, state or local law.
Public Health Activities – We may disclose your health information to appropriate
bodies for public health activities, including preventing or controlling disease, reporting
adverse events, product defects, or for Food and Drug Administration reporting. We may
provide required immunization records to a school with agreement from a parent,
guardian or other representative.
Crime, Abuse and Neglect Reporting – We may disclose your health information to a
government authority if we reasonably believe you have been a victim of a crime or a
victim of abuse, neglect or domestic violence.
Health Oversight Activities – We may disclose your health information to a health
oversight agency for activities such as audits; investigations; licensure or disciplinary
actions; or for civil, administrative or criminal proceedings.
Judicial and Administrative Proceedings – We may disclose your health information
in response to a court or administrative tribunal order. We may also disclose your health
information in response to a subpoena, discovery request, or other lawful process once
efforts have been made to tell you about the request or obtain an order protecting the
information requested.
Law Enforcement Purposes – In certain circumstances, we may disclose your health
information for law enforcement purposes to a law enforcement official including
disclosures for identification and location purposes; pertaining to crime victims; if we
suspect a death occurred as a result of a crime; if we believe a crime occurred on the
premises; or to alert law enforcement in certain medical emergencies.
Coroners, Medical Examiners, and Tissue Donation – We may disclose your health
information to identify a deceased person or determine the cause of death, to funeral
directors to assist in their duties, or to organ procurement organizations to facilitate
organ, eye or tissue donation and transplantation.
Research – We may use and disclose your health information to researchers in certain
circumstances, such as research that has been approved through a special process
designed to protect your health information privacy.
To Avert a Serious Threat to Health or Safety – We may use and disclose your health
information when necessary to prevent a serious and imminent threat to your health and
safety or the health and safety of the public or another to someone able to help prevent
the threat.
Specialized Government Functions – We may use and disclose your health
information for some military and veteran activities, such as to military authorities if you
are or were previously a member of the armed forces. We may also disclose information
when requested by federal officials for national security or intelligence activities or for the
protection of certain public officials.
Correctional Institutions – If you are an inmate, we may disclose your health
information to your custodial correctional institution or law enforcement officials in certain
circumstances.
Workers’ Compensation – We may disclose your health information to comply with
laws relating to workers' compensation or similar programs.
Communication - We may contact you to provide appointment and refill reminders,
alternative treatments, and other health-related services such as disease management
programs and community-based services that may be of interest to you.
Business Associates – Service providers with whom we have contracted to provide a
service on our behalf may create, receive, maintain or transmit your health information
once they agree in writing to protect the privacy and security of your health information.
To Health and Human Services – We may disclose your health information to the
Secretary of Health and Human Services for compliance reviews and complaint
investigations.
Fundraising – We may use limited health information to contact you for fundraising
activities. For example, we may contact you to raise funds for a ScionHealth foundation.
You have the right to opt out of receiving such communications by providing us notice
through one of the opt out methods we provide.
Marketing – With a few exceptions, we must have your written authorization to use or
disclose your health information to make a communication about a product or service
that encourages the recipients of the communication to purchase or use the product or
service. For example, we may communicate with you face-to-face regarding services
that may be of interest and provide you with promotional gifts of nominal value.
Psychotherapy Notes – We must have your written authorization to use or disclose
your psychotherapy notes except for certain treatment, payment and health care
operations purposes, if the disclosure is required by law or for health oversight activities,
or to avert a serious threat.
Sale of Protected Health Information – With few exceptions, we must have your
written authorization for any disclosure of your health information that is a sale of
protected health information and we must notify you that we will be paid for the
disclosure.
Other Uses and Disclosures – Other uses and disclosures not described in this Notice
will be made only with your written authorization unless otherwise required or permitted
by law.
Revoking an Authorization – You may revoke an authorization at any time in writing,
except to the extent that we have relied on the authorization to disclose your health
information or in certain circumstances when the authorization was obtained as a
condition of obtaining insurance coverage.

Your Health Information Rights

Although your medical record is the property of ScionHealth, the information belongs to
you. You have legal rights regarding your health information, which are described
below. Your legal rights include a:

Right to Inspect and Copy – With some exceptions, you have the right to inspect and
obtain a digital or hard copy of your health information maintained in your designated
record set. We may charge a fee for the associated cost of labor, mailing, or other
supplies. We may deny your request to inspect and copy in certain limited
circumstances. If you are denied access, you may request a review of the denial.
Right to Amend – If you believe the health information we have about you is inaccurate
or incomplete, you have the right to request an amendment of your health information.
This right exists as long as we keep this information. You must provide a reason that
supports your request. We may deny your request for an amendment in some
circumstances.
Right to an Accounting of Disclosures – You have the right to obtain a listing of
certain disclosures we have made of your health information. You can request an
accounting of these disclosures made for up to 6 years prior to the date of your request.
The first request in a 12-month period is provided at no cost to you. There may be a
charge for subsequent requests within the same 12-month period. We will notify you of
the cost involved so you may withdraw or modify your request before incurring any
costs.
Right to Request Restrictions – You have the right to request restrictions on the use or
disclosure of your health information for treatment, payment and health care operations.
You also have the right to request a restriction on disclosures about you to someone
who is involved in your care or the payment for your care, like a family member or friend.
We are not required to agree to your request except when you 1) request a restriction to
your health plan for payment or health care operations purposes, and the disclosure is
not otherwise required by law, and 2) the request pertains solely to a health care item or
service for which we have been paid out-of-pocket in full. If we do agree to a requested
restriction, we will comply with your request unless the information is needed to provide
you emergency treatment. You will need to notify other providers if you want them to
abide by the same restrictions.
Right to Receive Confidential Communications – You have the right to request to
receive communications of health information by alternate means or at alternative
locations. We will accommodate all reasonable requests.
Right to a Paper Copy of this Notice – You may request a paper copy of this Notice at
any time, even if you have agreed to receive this Notice electronically.

All requests made under this section must be made in writing to St. Francis
Hospital to the attention of the Privacy Officer.

Health Information Exchanges (HIE)
We may provide your information to a HIE and patient portal in which we participate. An
HIE is a health information database where other healthcare providers caring for you
can access your medical information from wherever they are if they are members of the
HIE. These providers may include your doctors, nursing facilities, home health
agencies or other providers who care for you outside of our hospitals or practices. For
example, you may be travelling and have an accident in another area of the state. If the
doctor treating you is a member of the HIE in which we participate, he or she can
access information about you that other providers have contributed. Accessing this
additional information can help your doctors provide you with well-informed care quickly
because he or she will have learned about your medical history, allergies or
prescriptions from the HIE. The patient portal is a mechanism by which you can access
your health information online after your care and treatment. If you do not want your
medical information to be placed in the patient portal and shared with HIE-member
healthcare professionals, you can opt out by contacting the Privacy Officer directly,
contact information below. Note that if you opt out, providers may not have the most
recent information about you that may affect your care. You can always opt in at a later
date by revoking the opt out form in writing.

Our Responsibilities
We are required by law to maintain the privacy of protected health information, provide
you with this Notice of our legal duties and privacy practices with respect to protected
health information, and to notify you if you are affected by a breach of unsecured
protected health information.
We are required to abide by the terms of this Notice while it is in effect. We reserve the
right to change the terms of our Notice and to make the new Notice provisions effective
for all protected health information that we maintain. If we change the terms of our
Notice, we will make copies of the new Notice available to you and post a copy of the
new Notice in a prominent location in our facilities and on our website.

State Law Requirements
Certain state health information laws and regulations, such as those dealing with mental
health, HIV/AIDS or drug and alcohol records, may be more stringent that the federal
privacy laws and further limit the uses and disclosures of your health information
described above.

Complaints
If you believe your privacy rights have been violated, or if you disagree with a decision
we made about your records, you may contact the individual listed below. You also
may send a written complaint to the U.S. Department of Health and Human Services
Office for Civil Rights by sending a letter to 200 Independence Avenue, S. W.,
Washington, D.C. 20201, calling (877) 696-6775, or visiting
www.hhs.gov/ocr/privacy/hipaa/complaints. You will not be retaliated against for filing a
complaint.

Contact Us
If you have questions about this Notice, please contact the Privacy Officer at St. Francis
Hospital by calling (706) 596-4000. You may also contact ScionHealth’s Compliance
Hotline at (844) 760-5835.