Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

Effective Date: September 23, 2013

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES YOUR RIGHTS TO ACCESS AND CONTROL YOUR PROTECTED HEALTH INFORMATION. IT ALSO DESCRIBES HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION. “PROTECTED HEALTH INFORMATION” IS INFORMATION ABOUT YOU, INCLUDING DEMOGRAPHIC INFORMATION THAT MAY IDENTIFY YOU AND THAT RELATES TO YOUR PAST, PRESENT OR FUTURE PHYSICAL OR MENTAL HEALTH OR CONDITION AND RELATED HEALTH CARE SERVICES. PLEASE REVIEW THIS NOTICE CAREFULLY.

YOU HAVE THE FOLLOWING RIGHTS WITH RESPECT TO YOUR PROTECTED

HEALTH INFORMATION:

You have the right to:

1. Inspect and copy all or any part of your medical or health record, as provided by federal regulations, including receiving an electronic copy of your PHI if Midwestern University maintains your PHI in an electronic health record. Midwestern University may charge you a reasonable fee to cover its costs for this service. You may also request that we provide a copy of your medical or health record to another person or entity.

2. Request restrictions on the use and disclosure of your PHI. However, Midwestern University is not required to agree to the restriction, except if you pay for a service entirely out-of-pocket. If you pay for a service entirely out-of-pocket, you may request that information regarding the service be withheld and not provided to a third party payor. Midwestern University is obligated by law to abide by such restriction. If you wish to request a restriction on the use and disclosure of your PHI, please provide a written request describing your requested disclosure to the Privacy Officer. We will notify you of our decision regarding the requested restriction.

3. Request that we amend your medical record, to the extent that such amendments are permissible under federal regulations.

4. Request and receive an accounting of disclosures made of your health information, except for disclosures made for the purpose of treatment, payment, health care operations and certain other purposes if such disclosures were made through a paper record or other health record that is not electronic, as set forth in federal regulations. If you request an accounting of disclosures of your PHI, the accounting may include disclosures made for the purpose of treatment, payment and health care operations to the extent that disclosures are made through an electronic health record.

5. Obtain a paper copy of this Notice from Midwestern University upon request.

6. Receive communications regarding your health information by alternative means or have such communications addressed to an alternative location. For example, at your request, we will mail items to a post office box instead of your residence.

7. If you execute any authorization(s) for the use and disclosure of your health information, revoke such authorization(s), except to the extent that action has already been taken in reliance on such authorization.

WE MAY DISCLOSE YOUR HEALTH INFORMATION WITHOUT YOUR AUTHORIZATION FOR THE FOLLOWING REASONS:

1. We may disclose your PHI for the purpose of treatment, payment, or health care operations. Examples of these types of disclosures are provided below:

Treatment purposes

Example: Information obtained by your physician or by another member of your health care team will be recorded in your medical record and used to assess and monitor your health status, determine the appropriate care and treatment for you, and prescribe treatments and medications for you, as necessary.

Payment purposes.

Example: A bill may be sent to you or to a third party payor. The information on the bill or accompanying the bill may include information that identifies you, your diagnosis, the treatments rendered to you, and the medications, supplies and equipment used to perform the treatments.

Health care operations.

Example: Midwestern University and its staff may use information in your health record for business management and general administrative activities.

Example: Midwestern University and its staff may use information in your health record to assess the quality of the care and treatment they provide to you. The information will then be used in an effort to continually improve the quality and effectiveness of the health care and services that we provide to all of our patients.

2. We may disclose your PHI for the purpose of research. We will only disclose your PHI for research purposes without your express authorization if (i) the research protocol has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information; or (ii) where we have received assurances from a researcher that the health information is sought solely for review as necessary to prepare a research protocol or for similar purposes preparatory to research and no health information will be removed from our premises in the course of the review.

3. We may disclose your PHI to public health officials.

4. We may disclose your PHI to law enforcement officials for law enforcement purposes.

5. We may disclose your PHI to an appropriate governmental authority if we reasonably believe that you may be a victim of abuse, neglect, or domestic violence.

6. If we believe it is necessary to avert a serious threat to the health or safety of yourself or the public, we may disclose your PHI to a person or persons who we believe are reasonably able to prevent or lessen the threat.

7. We may disclose your PHI as required by federal and state laws and regulations.

8. We may disclose your PHI to a health oversight agency, such as the Illinois Department of Public Health, the Illinois Department of Financial and Professional Regulation or the United States Department of Health and Human Services for purposes relating to the oversight of the health care system and government benefit programs such as Medicare or Medicaid.

9. We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena, discovery request or other lawful process.

10. We may disclose your PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other purposes as authorized by law. We may also disclose your PHI to funeral directors as necessary to carry out their duties.

11. We may disclose your PHI to organizations involved in the procurement, banking, or transplantation of cadaveric organs, eyes or tissue, for the purpose of facilitating organ and tissue donation where applicable.

12. If you are a member of the United States or foreign Armed Forces, we may disclose your PHI for activities that are deemed necessary by appropriate military command authorities to assure the proper execution of a military mission.

13. We may disclose your PHI to authorized federal officials for the conduct of lawful intelligence, counter-intelligence and other national security functions authorized by law, or for the purpose of providing protective services to the President or foreign heads of state.

14. We may disclose your PHI to a correctional institution or a law enforcement official having lawful custody of you.

15. We may disclose your PHI as authorized by, and in compliance with, laws relating to workers’ compensation and similar programs established by law that provide benefits for work-related illnesses and injuries without regard to fault.

16. We may contact you or provide certain information regarding your care to a third party for the purpose of raising funds for us. You have the right to opt out of receiving such communications

EXAMPLES OF OTHER PERMISSIBLE OR REQUIRED DISCLOSURES

Business Associates. Some activities of Midwestern University are provided on our behalf through contracts with business associates. Examples of when we may use a business associate include coding and claims submission performed by a third party billing company, consulting and quality assurance activities provided by an outside consultant, billing and coding audits performed by an outside auditor, and other legal and consulting services provided in response to billing and reimbursement matters that may arise from time to time. When we enter into contracts to obtain these services, we may need to disclose your health information to our business associate so that the associate may perform the job which we have requested. To protect your health information, however, we require our business associate to appropriately safeguard your information.

Communication with Family Members and for Location Purposes. We may disclose to your family member, friend or any other person that you identify who are involved with your care or payment for your care health information relative to that person’s involvement in your care or payment related to your care or of your location and general condition, unless you object to the disclosure.

Reporting Wrongdoing. Federal law allows for the release of your PHI to appropriate health oversight agencies, public health authorities or attorneys, provided that a work force member or business associate believes in good faith that we have engaged in unlawful conduct or otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers or the public. Any use or disclosure of your PHI that is not listed above will be made only with your written authorization, including the following uses and disclosures.

1. We must obtain an authorization from you to use or disclose psychotherapy notes unless the disclosure is for certain limited treatment, payment or health care operations, required by law, for health oversight activities, to a coroner or medical examiner, or to prevent a serious threat to health or safety.

2. We must obtain an authorization for any use or disclosure of your health information for any marketing communications to you about a product or service that encourages you to use or purchase the product or service unless the communication is either (a) a face-to-face communication or; (b) a promotional gift of nominal value. However, we do not need to obtain an authorization from you for the following communications: (i) to provide refill reminders or other information about a drug that is currently being prescribed for you, unless any payment we receive in exchange for making the communication unreasonably exceeds our cost of making the communication; (ii) any of the following, provided that we are not paid by a third party for making the communication: (1) communications regarding your course of treatment, case management or care coordination; (2) communications describing a health-related product or service that we provide; and (3) communications regarding treatment alternatives.

3. We must obtain an authorization for any disclosure of your health information which constitutes a sale of health information pursuant to federal regulations.

MIDWESTERN UNIVERSITY CLINIC RESPONSIBILITIES

We are required by law to:

1. maintain the privacy of your health information;

2. provide you with this Notice as to our legal duties and privacy practices with respect to the information we maintain and collect about you;

3. abide by the terms of this Notice that are currently in effect; and

4. notify you if we discover a breach of any of your PHI that is not secured in accordance with federal guidelines. Midwestern University reserves the right to change its privacy practices for all protected health information that we maintain. If our privacy practices materially change, Midwestern University will revise this Notice and make available to you a copy of the revised Notice. Unless you authorize us to do so, Midwestern University will not use or disclose your personal health information in a manner inconsistent with this Notice.

FOR MORE INFORMATION OR TO REPORT A PROBLEM

If you believe your privacy rights have been violated, you may file a complaint with the Privacy Officer. Additionally, you may file a complaint with the Secretary of the Department of Health and Human Services. There will be no retaliation against you for filing a complaint.

If you have questions or would like additional information, or if you wish to file a complaint with us regarding our use or disclosure of your PHI, you may contact Midwestern University’s Privacy Officer at 623.572.3945, 630.515.7232, or via e-mail at sshuma@midwestern.edu. Please direct any written correspondence to the Privacy Officer to 555 31st Street, Downers Grove, IL 60515.