NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective: April 14, 2003

St. Joseph's / Candler Health System, Inc. and United Healthcare (collectively referred to here as "We") are required by law to protect the privacy of your health information. We are also required to send you this notice which explains how we may use information about you and when we can give out or "disclose" that information to others. You also have rights regarding your health information that are described in this notice.

The terms "information" or "health information" in this notice include any personal information that is created or received by a health care provider or health plan that relates to your physical or mental health condition, the provision of health care to you, or the payment for such health care.

We have the right to change our privacy practices. If we do, we will provide the revised notice to you within 60 days by direct mail or post it on our website www.sjchs.org under the Employee Access Section.

HOW WE USE OR DISCLOSE INFORMATION

We must use and disclose your health information to provide information:

• To you or someone who has the legal right to act for your (your personal representative);
• To the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected; and
• Where required by law.

We have the right to use and disclose health information to pay for your health care and operate our business. For example, we may use your health information:

• For Payment of premiums due us and to process claims for health care services you receive.
• For Treatment We may disclose health information to your doctors or hospitals to help them provide medical care to you.
• For Health Care Operations. We may use or disclose health information as necessary to operate and manage our business and to help manage your health care coverage. For example, we might talk to your doctor to suggest a disease management or wellness program that could help improve your health.
• To Provide Information on Health Related Programs or Products such as alternative medical treatments and programs or about health related products and services.
• To Plan Sponsors. Since your coverage is through an employer group health plan, we may share summary health information and enrollment and dis-enrollment information with the plan sponsor. In addition, we may share other health information with the plan sponsor for plan administration if the plan sponsor agrees to special restriction on its use and disclosure of the information.
• For Appointment Reminders. We may use health information to contact you for appointment reminders with providers who provide medical care to you.

We may use or disclose your health information for the following purposes under limited circumstances:

• To Persons Involved With Your Care We may use or disclose your health information to a person involved in your care, such as a family member, when you are incapacitated or in an emergency, or when permitted by law.
• For Public Health Activities such as reporting disease outbreaks.
• For Reporting Victims of Abuse, Neglect or Domestic Violence to government authorities, including a social service or protective service agency.
• For Health Oversight Activities such as governmental audits and fraud and abuse investigations.
• For Judicial or Administrative Proceedings such as in response to a court order, search warrant or subpoena.
• For Law Enforcement Purposes such as providing limited information to locate a missing person.
• To Avoid a Serious Threat to Health or Safety by, for example, disclosing information to public health agencies.
• For Specialized Government Functions such as military and veteran activities, national security and intelligence activities, and the protective services for the President and others.
• For Workers-Compensation including disclosures required by state workers compensation laws of job-related injuries.
• For Research Purposes such as research related to the prevention of disease or disability, if the research study meets all privacy law requirements.
• To Provide Information Regarding Decedents. We may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law. We may also disclose information to funeral directors as necessary to carry out their duties.
• For Organ Procurement Purposes. We may use or disclose information for procurement, banking or transplantation or organs, eyes or tissue.

If none of the above reasons applies, then we must get your written authorization to use or disclose your health information. If a use or disclosure of health information is prohibited or materially limited by other applicable law, it is our intent to meet the requirements of the more stringent law. Once you give us authorization to release your health information, we cannot guarantee that the person to whom the information is provided will not disclose the information. You may take back or "revoke" your written authorization, except if we have already acted based on your authorization. To revoke an authorization, contact the phone number listed on your ID card.

WHAT ARE YOUR RIGHTS

The following are your rights with respect to your health information.

• You have the right to ask to restrict uses or disclosures of your information for treatment, payment, or health care operations. You also have the right to ask to restrict disclosures to family members or to others who are involved in your health care or payment for your health care. We may also have policies on dependent access that may authorize certain restrictions. Please note that while we will try to honor your request and will permit requests consistent with its policies, we are not required to agree to any restriction.
• You have the right to ask to receive confidential communications of information in a different manner or at a different place (for example, by sending information to a P.O. Box instead of your home address).
• You have the right to see and obtain a copy of health information that may be used to make decisions about you such as claims and case or medical management records. You also may receive a summary of this health information. You must make a written request to inspect and copy your health information. In certain limited circumstances, we may deny your request to inspect and copy your health information.
• You have the right to ask to amend information we maintain about you if you believe that health information about you is wrong or incomplete. If we deny your request, you may have a statement of your disagreement added to your health information.
• You have the right to receive an accounting of disclosures of your information as provided by the state and federal regulations.

• You have the right to a paper copy of this notice. You may ask for a copy of this notice at any time. even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at our website, www.sjchs.org under the Employee Access Section.

EXERCISING YOUR RIGHTS

• Contacting your Health Plan. If you have any questions about this notice or want to exercise any of your rights, please call the phone number on your ID card.
• Filing a Complaint. If you believe your privacy rights have been violated, you may file a complaint with us at the following address:

United Healthcare St. Joseph’s/Candler Health System, Inc.

Customer Service – Privacy Unit Privacy Official

P.O. Box 740815 5353 Reynolds Street

Atlanta, Georgia 30374-0815 Savannah, Georgia 31405

You may also notify the Secretary of the U.S. Department of Health and Human Services of your complaint. We will not take any action against you for filing a complaint.