THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Protected Health Information. While receiving care from our facility, information regarding your medical history, treatment, and payment for your health care may be originated and/or received by us. Information which can be used to identify you and which relates to your past, present or future medical condition, receipt of health care or payment for health care ("Protected Health Information").

How Your Information Is Maintained. Information may be maintained by the facility in a variety of ways. This may include paper documents, electronic documents, data tapes and images of various types as well as the use of email, secure messaging systems, electronic systems, the internet, cloud providers and participation in third-party networks such as the Iowa Health Information Network.

Our Responsibilities. Federal law imposes certain obligations and duties upon us as a covered health care provider with respect to your Protected Health Information. Specifically, we are required to:

• Provide you with notice of our legal duties and our facility's policies regarding the use and disclosure of your Protected Health Information;
• Maintain the confidentiality of your Protected Health Information in accordance with state and federal law;
• Honor your requested restrictions regarding the use and disclosure of your Protected Health Information unless under the law we are authorized or required to release your Protected Health Information without your authorization, in which case you will be notified within a reasonable period of time as allowed by law;
• Allow you to inspect and copy your Protected Health Information during our regular business hours;
• Act on your request to amend Protected Health Information within sixty (60) days and notify you of any delay which would require us to extend the deadline by the permitted thirty (30) day extension;
• Accommodate reasonable requests to communicate Protected Health Information by alternative means or methods; and Abide by the terms of this notice.

How Your Protected Health Information May be Used and Disclosed. Generally, your Protected Health Information may be used and disclosed by us only with your express written authorization. However, there are some exceptions to this general rule.

Treatment, Pavment. or Health Care Operations.

General Use. As part of our treatment, payment and operations we may also release information to business associates who may perform various treatment, payment or operation functions. If information is provided to another person or entity, such as another facility or physician from whom you seek treatment, that facility or physician may treat the information received as part of its protected information.

Treatment Purposes. We may use or disclose your Protected Health Information for treatment purposes. During your care at our facility, it may be necessary for various personnel involved in your care to have access to your Protected Health Information in order to provide you with quality care. For example, we may inform dietary personnel of any condition which requires you have a special diet.

Situations may also arise when it is necessary to disclose your Protected Health Information to health care providers outside our facility who may also be involved in your care or to facilitate referral to another provider or care facility. For example, we may inform your physician of medications you are currently taking or provide other information for continuity of care. In addition, if you are transferred from our facility to another provider, such as a hospital, we may provide the new provider with information it needs to provide treatment services.

Payment Purposes. Your Protected Health Information may also be used or disclosed for payment purposes . It is necessary for us to use or disclose Protected Health Information so that treatment and services provided by us may be billed and collected from you, your insurance company, or other third party payor. For example, we may disclose your Protected Health Information to your health insurance carrier to obtain prior approval for a service. We may also release your Protected Health Information to another health care provider or individual or entity covered by the HIPAA regulations who has a relationship with you for their payment activities. For example, we may disclose information to your health insurance carrier upon its request for additional information necessary for it to determine whether a service is covered.

Health Care Operations. Your Protected Health Information may also be used for health care operations, which are necessary to ensure our facility provides the highest quality of care. For example, your Protected Health Information may be used for quality assurance or risk management purposes or disclosed to our accountant for auditing purposes. We may at times remove information which could identify you from your record so as to prevent others from learning who the specific patients are. In addition, we may release your Protected Health Information to another individual or entity covered by the HIPAA privacy regulations that has a relationship with you for their fraud and abuse detection or compliance purposes, quality assessment and improvement activities, or review, evaluation or training of health care professionals or students. For example, we may disclose information to another health care provider involved in your care if the provider requests the information is necessary for its evaluation of one of its medical students. We may also release information to business associates who may perform various treatment, payment or operation functions.

Patient Directorv. Our facility maintains a patient directory. Unless you object, your name, location in the facility, general condition, and religious affiliation will be contained in the directory. The directory is disclosed to members of the clergy and except for religious affiliation, to other persons who specifically ask for the information by your name. You are not obligated, however, in any way, to consent to the inclusion of your information in the facility directory. Please notify facility personnel if you do not wish to be included in the directory or if you wish for information or disclosure to be limited in some way.

Notification and Communications to Individuals Involved in Your Care. Unless you have informed us otherwise, your Protected Health Information may be used or disclosed by us to notify or assist in notifying a family member or other person responsible for your care. In most cases, Protected Health Information disclosed for notification purposes will be limited to your name, location and general condition. In addition, unless you have informed us otherwise, Protected Health Information may be released to a family member, relative or close personal friend who is involved in your care to the extent necessary for them to participate in your care. In the event you wish for any of these uses or disclosures to be limited, please contact facility personnel.

Fundraising & Marketing Activities. We may use your Protected Health Information for the purpose of contacting you as part of a facility based fund-raising effort. Such contact could come from the facility, an affiliated organization such as a foundation or a business associate. Information used as part of this fundraising activity may include demographic information such as name, address, age, gender, date of birth, department of service, your treating physician, outcome information and your health insurance status. If you do not wish to be contacted for fundraising activities you may contact Kris Todd at 712.262.5931 to have your name removed from our fundraising list or you may do so by emailing us at stlukelh@stlukelh.com. You may receive information such as prescription or refill reminders from the facility; however, your information will not be provided to third-party marketers and the facility will not sell your information to others for use and marketing processes without your specific authorization.

Disaster Relief. In the event of a disaster we may provide information to public or private entities as needed to facilitate treatment, locate family members or careegivers, and to facilitate public health needs.

Psvchotherapv Notes. In the event psychotherapy notes are maintained as part of your health information, those notes will not be used or disclosed except in limited circumstances without your authorization. Such authorization is not needed and will not be obtained if such notes are used by the person who created them, in a reasonable training program for the facility, or as otherwise allowed by law .

Research Purposes. In some instances, your Protected Health Information may be used or disclosed for research purposes. All research projects which use Protected Health Information are subject to a special approval process which will, among other things, evaluate the precautions used to protect patient medical information. In many cases, information which identifies you as the patient will be removed.

Authorized bv Law. We may also use or disclosure your protected health information without your authorization as permitted or required by law. Examples include: public health activities, health oversight activities, judicial and administrative proceedings, abuse reporting, law enforcement, organ donation, medical examiners and coroners, and workers compensation processes. Information will only be used/disclosed without your authorization as permitted by the applicable state or federal law.

More Stringent Laws. Some of your Protected Health Information may be subject to other laws and regulations and afforded greater protection than what is outlined in this Notice. For instance, HIV/AIDS, substance abuse, mental health, information and genetic information are often given more protection. In the event your Protected Health Information is afforded greater protection under federal or state law, we will comply with the applicable law.

Other uses and disclosures of Protected Health Information not covered by this Notice or the laws that apply to us will be made only with your written permission. For example, we need your written authorization to disclose your entire medical record to a family member (other than personal representatives as allowed by law) although some information may be disclosed under limited circumstances without permission. We must also have your written authorization to disclose your Protected Health Information to an attorney who represents you. Disclosures that constitute a sale of your Protected Health Information or uses and disclosures for marketing purposes also require your written authorization. If you provide us permission to use or disclose Protected Health Information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose Protected Health Information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

Your Rights. Federal law grants you certain rights with respect to your Protected Health Information. Specifically, you have the right to:

Receive notice of our policies and procedures used to protect your Protected Health Information;

• Request that certain uses and disclosures of your Protected Health Information be restricted; provided. however, if we may release the information without your consent or authorization, we have the right to refuse your request;
• You may restrict disclosure to a health plan of your information where you have paid the full out of pocket costs for the services rendered. This restriction would apply only to those services where you had paid the full out of pocket costs, it would not apply to other information relating to treatment which was paid for by or submitted to an insurer;
• Access to your Protected Health Information; provided, however, the request must be in writing and may be denied in certain limited situations;
• Request that your Protected Health Information be amended;
• Obtain an accounting of certain disclosures by us of your Protected Health Information for the past six years;
• Revoke any prior authorizations or consents for use or disclosure of Protected Health Information, except to the extent that action has already been taken;
• Request communications of your Protected Health Information are done by alternative means or at alternative locations; and
• Notification of any breach of unsecured Protected Health Information relating to you and actions you may take in relationship to such a breach.

Important Contact Information. This notice has been provided to you as a summary of how we will use your Protected Health Information and your rights with respect to your Protected Health Information. If you have any questions or for more information regarding your Protected Health Information, please contact St. Luke Homes & Services, Inc.CEO/ Administrator; 1301 St. Luke Drive; Spencer, IA 51301; or call 712-262-5931.

If you believe your privacy rights have been violated, you may file a complaint with our office by contacting St. Luke Homes & Services, Inc. at 712.262.5931. You may also file a complaint with the Secretary of Health and Human Services. There will be no retaliation for the filing of a complaint. The following website: www.HHS.gov contains most reporting instructions general information regarding these matters.

Effective Date. This notice becomes effective on December 1, 2013. Please note, we reserve the right to revise this notice at any time. A current notice of our privacy practices may be obtained from St. Luke Homes and Services, Inc. front office or the social services office during business hours Monday through Friday, 8:00 a.m.to 4:30 p.m.