At Upham's Corner Health Committee, Inc. (hereafter referred to as "UCHC" and encompassing all components) we understand that you expect quality care from us and we want to assure you that we are committed to treating and using health information about you responsibly and in a confidential manner. The law requires UCHC to keep health information private. UCHC is also required by law to notify patients of our legal duties and privacy practices used to keep health information private. This Notice of Information Practices describes the personal information we collect and how and when we use that information. It also describes your rights as they relate to your health information.

UCHC is a participating community health center of Boston HealthNet and is part of an integrated health care delivery system comprised of Partners HealthCare System (Partners), Children's Hospital and Boston Medical Center (BMC). UCHC shares medical information with Partners, Children's Hospital and BMC for treatment, payment and health care operations purposes, as described in this Notice.

Understanding Your Personal Health Record Information

Examples of How UCHC May Use or Disclose Your Information

Uses and Disclosures that Require Your Authorization

YOUR RIGHTS Under the Federal HIPAA Privacy Standards

OUR RESPONSIBILITIES Under the Federal HIPAA Privacy Standards

How to Report a Problem.

Understanding Your Personal Health Record Information

Each time you visit UCHC, your provider makes a record of your visit. Typically, this record contains your health history, current symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment.

This information, often referred to as your medical record, serves as a:

• Basis for planning your care and treatment.
• Means of communication among the many health professionals who contribute to your care.
• Legal document describing the care you received.
• Means by which you or a third-party payer can verify that you actually received the services that we billed for.
• A source of data for medical research (without patient identifiers)
• A source of information for public health officials charged with improving the health of the regions they serve.
• A tool to assess the appropriateness and quality of care you received.

Understanding what is in your health records and how your health information is used helps you to:

• Ensure its accuracy and completeness.
• Understand who, what, where, why, and how others may access your health information.
• Make informed decision about authorizing disclosures to others.
• Better understand the health information rights detailed in this pamphlet.

Examples of How UCHC May Use or Disclose Your Information

Use means sharing health information inside UCHC. Disclosure means release of health information outside UCHC. We may use and disclose health information in the following ways without getting specific permission.

Treatment
Your primary doctor, optometrist, dentist, nurse practitioner, physician assistant, nurse or health care student involved in taking care of you at UCHC may use your health information to provide, coordinate or manage your health care and related services.
Example: A physician, nurse, or other member of your healthcare team will record information in your record to diagnose your condition and determine the best course of treatment for you. The primary care giver will give treatment orders and document what he or she expects other members of the healthcare team to do to treat you. Those other members will then document the actions they took and their observations. In that way, the primary caregiver will know how you are responding to treatment.

Payment
UCHC may use your health information to get paid for the health care services we have provided to you.
Example: We may send a bill to you, or to a third-party payer, such as your health insurance company. The information on or accompanying the bill may include information that identifies you, your diagnosis, treatment received, and supplies used.

Healthcare Operations
Healthcare operations are activities that all health care facilities, including UCHC, perform to make sure you are receiving appropriate and quality care and that UCHC is running properly.
Example: Members of the medical staff or quality improvement professionals may use information in your health record to assess the care and outcomes in your cases and the competence of the caregivers. We will use this information in an effort to continually improve the quality and effectiveness of the healthcare and services we provide.

Appointment Reminders & Other Care Issues
We may contact you (by telephone or by postcard or other mail) to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Fund-raising
We may contact you, typically by mail, as part of a fund-raising effort. You have the right to request not to receive subsequent fund-raising materials.

For the following uses and disclosures of health information we must provide you with the opportunity to agree or object.

Communication with family
Unless you object, health professionals, using their best judgment, may disclose to a family member, other relative, close personal friend or any other person you identify, health information relevant to that person's involvement in your care or payment related to your care.

Notification
To notify your family or other person responsible for your care of your location or general condition.

Disaster Relief Purposes
To authorized public or private entities to assist in disaster relief efforts.

Patient Directory
Unless you notify us that you object, we will use your name, UCHC account number and location in the facility for directory purposes. If it is determined that it is in your best interest, this information may be provided to our staff or others to help expedite your treatment or to inform other persons who ask for you by name.

UCHC may use or disclose your protected health information in some cases without your authorization. The following list describes the ways this may happen. Not every use or disclosure in a category will be listed, but we provide a brief description in certain cases.

Public Health: As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, disability, or death.

Food and Drug Administration (FDA): We may disclose to the FDA health information relative to adverse effects/events with respect to food, drugs, supplements, product or product defects, or post marketing surveillance information to enable product recalls, repairs or replacement.

Health Oversight Agencies: We may disclose health information to authorities so they can monitor, investigate, inspect, discipline or license those who work in the health care system or for audits intended to oversee government benefit programs.

As Required by Law: Sometimes, we may disclose health information for purposes as required by law to persons such as law enforcement officials, court officials or government agencies.

® Example: Reports of suspected child, elder or other abuse or neglect made under state law to appropriate state or local authorities is not protected. Law authorizes disclosure of the minimum necessary amount of information for such purposes.

® Example: We may disclose health information in response to a valid subpoena or court or administrative order.

® Example: We may disclose health information upon request by an authorized law enforcement official to respond to a warrant, to identify suspects, or to report a crime on UCHC property.

® Example: We may disclose health information to authorized agencies in order to prevent a serious threat to health or safety.

Worker's Compensation: We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to worker's compensation or other similar programs established by law.

Correctional Institutions: Should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof health information necessary for your health and the health and safety of other individuals.

Research: On occasion, and only after a special approval process, UCHC may use or disclose health information to help conduct research. Most of the time you will be asked for authorization to participate in the research study. On rare occasions, and after UCHC staff performs special review and approval, we may participate in a research study where the requirement to obtain authorization is waived. In these occasional cases, UCHC staff will abide by established protocols to ensure the privacy of your health information. Such research might try to determine whether a certain treatment is effective in curing an illness.

Coroners and Medical Examiners: We are required by law to disclose certain information when requested by such persons to identify, determine cause of death or for the performance of other related duties.

Funeral Directors: We are required by law to disclose certain information when requested by funeral directors in order to carry out their duties.

Department of Health and Human Services (DHHS): Under the HIPAA privacy standards, we are required to disclose any health information that DHHS requests as necessary for them to determine our compliance with those standards. Your information may be requested.

*Please note that before we disclose your health information to any of the above-mentioned individuals or entities, we will verify their legal authority to receive such information. Additionally, please feel assured that whether we disclose your information orally, over the telephone or in person, or in writing, via U.S. Postal Service, E-mail or facsimile transmittal, we have policies and procedures in place to ensure that the intended recipient receives the information in a confidential and private manner.

Uses and Disclosures that Require Your Authorization

Other uses or disclosures of your record will be made only with your written authorization. Specific disclosures requiring written authorization in Massachusetts include drug and alcohol treatment records, mental health records, records of sexually transmitted diseases (STDs) and HIV/AIDS and genetic testing information. You may withdraw an authorization at any time; however, we are not able to take back disclosures that we have already made with your authorization. All withdrawals must be made in writing.

YOUR RIGHTS Under the Federal HIPAA Privacy Standards

Although your health records are the physical property of the Upham's Corner Health Committee, you have certain rights with regard to the information contained therein.

You have the right to:

• Request that we communicate with you by alternative means or at an alternative location. If the requested method of communication is reasonable, we must grant the alternate communication request. UCHC reserves the right to require you to make such a request in writing and to provide an accurate address to which we can send billing correspondence.
• Request that uses and disclosures of your health information for UCHC to carry out treatment, payment and health care operations be restricted. "Health care operations" is defined as activities that are necessary to carry out the operations of a health care facility, an example of such activities would be quality assurance audits and provider peer chart reviews. All requests must be made in writing.

  If we grant the requested restriction, we will adhere to it unless you request otherwise or we give you advance notice. We do not, however, have to agree to a requested restriction.

  Obtain a copy of this notice of information practices and provide us with a signed receipt of receiving this notice. Although we have posted a copy in prominent locations throughout our facilities and on our website, you have the right to a paper copy upon request.

• Inspect and copy your health information upon written request as provided by 45 CFR 164.524. In certain situations, such as if access would cause harm, we can deny access. In other limited situations, your provider may deny your request for access. If this is the case, you have the right to request that a different UCHC provider review the denial.

  ® If we deny your request for access, we will give you written notification and explain the reason for the denial and what your rights are, including how to seek review. If you exercise your right to a review, UCHC must process this request and notify you of the review decision, in writing, within 60 days from the date the review was requested.

  ® If we grant access, we will notify you and explain what, if anything, you have to do to get access.

We reserve the right to charge a reasonable, cost-based fee for making copies.

• Request in writing that UCHC amend your health information. We are not required to agree to your request. We may deny your request if:
1. We did not create the record. If, as in the case of a consultation report from another provider, we did not create the record, we cannot know whether it is accurate or not. Thus, in such cases you must seek amendment from the provider who created the record. If they amend the information, we will put the amended information in our records.
2. The records are not available to you according to state or federal law.
3. The record is accurate and complete.

® If we deny your amendment request, we will notify you in writing and provide an explanation for the denial. We will also explain how you can attach a statement of disagreement to your record (which we may rebut), and how you can file a complaint.

® If we grant your amendment request, the amendment will become part of your permanent record and we will identify within our system those who will need the amended information and distribute it accordingly. If there are others you feel need a copy of the amended information, and such persons are outside our system, we will provide it to them with your direction and authorization.

• Obtain an accounting of certain disclosures of your protected health information. The accounting right does not apply to disclosures that you have authorized or to disclosures for treatment, payment, and healthcare operations.

  In order to exercise this right, you must complete the UCHC Request for an Accounting of Disclosures Report form. We must provide you with the accounting report within 60 days.

  The first accounting in any 12 month period is free. Thereafter, we reserve the right to charge a reasonable, cost based fee.

  * Please note that you are only entitled by law to an accounting of disclosures that were made after April 14, 2003.

• Revoke (cancel) your consent or authorization to use or disclose protected health information (PHI) except to the extent that we have already taken action in reliance on the consent or authorization.

How to Exercise These Rights (listed above) or Get More Information

To learn how to exercise your rights or for more information about matters listed in this Notice of Information Practices, please contact:
UCHC Privacy Officer
Address: Upham's Corner Health Committee, Inc. / 500 Columbia Road, Dorchester, MA 02125
Telephone Number: (617) - 287 - 8000 x8131

OUR RESPONSIBILITIES Under the Federal HIPAA Privacy Standards

In addition to providing you your rights, as detailed above, the federal HIPAA privacy standard requires us to:

• Maintain the privacy of your health information, including implementing reasonable and appropriate physical, administrative, and technical safeguards to protect the information.
• Provide you with this notice as to our legal duties and privacy practices with respect to individually identifiable health information we collect and maintain about you.
• Abide by the terms of this notice.
• Train our staff on privacy and confidentiality laws as well as the UCHC procedures in place to comply with such laws.
• Investigate and mitigate (lessen the harm of) any breach of privacy/confidentiality of which we become aware.

We will not use or disclose your health information without your consent or authorization, except as described in this notice or otherwise required by law.

How to Report a Problem.

If you believe your privacy rights have been violated, please contact the Privacy Officer at Upham's Corner Health Committee, Administration Department, 500 Columbia Road, Dorchester, MA 02125, (617)-287-8000 x8131.

If you feel that we have not adequately addressed your concerns, you may contact the Privacy Officer at the above address or contact the Secretary of the Department of Health and Human Services by calling (202) 619-0257 or 877-696-6775.
You will not be penalized for filing a complaint.

Note About the Destruction of Clinic Medical Records: Massachusetts General Law-chapter 111, section 70 includes a requirement for the amount of time a clinic, licensed by the Department of Public Health (DPH), must keep medical records of patients who no longer receive care at that clinic. After the stated time period, the clinic is allowed to destroy the medical records in order to make room for records of current and new patients. This law states that a clinic may destroy a record 20 years after the final treatment of the patient and after notifying DPH that the record(s) will be destroyed. It is the policy of UCHC to maintain medical records of all patients in accordance with applicable law. Periodically, medical record data is reviewed to determine which records meet the criteria for destruction. UCHC will only destroy records of patients who have not been treated by the health center in over 20 years; and, will do so only after notifying DPH of UCHC's intent to destroy (following the notification process established by DPH). [This policy is only applicable to records of departments covered by the 'clinic license'.]

EFFECTIVE DATE: August 2009