THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Patient First (“PF”) is committed to the privacy of your personally identifiable health information and will use strict privacy standards to protect it from unauthorized use or disclosure. This Notice informs you of PF’s privacy practices and of certain rights available to you under applicable federal and state law.

Overview of Policies. PF is required by law to implement policies designed to ensure the privacy of your personally identifiable health information that is transmitted or maintained by PF. This Notice refers to such information as Protected Health Information, or “PHI.” In addition, PF is required to make this Notice available to you to inform you about:

• Our policies regarding use and disclosure of your PHI; and
   
• Your privacy rights and other rights with respect to your PHI, including the right to file complaints with PF or with the Secretary of the United States Department of Health and Human Services (the “Secretary”).

If you have any questions regarding this Notice or our privacy practices, please contact PF’s Privacy Officer either (i) in writing at the following address: 5000 Cox Road, Suite 100, Glen Allen, VA 23060, or (ii) by telephone: (804) 968-5700.

Effective Date. The effective date of this Notice and of the policies described below is April 14, 2003 (the “Effective Date”). PF’s use or disclosure of your PHI from and after the Effective Date will be governed by the policies described in this Notice.

1. Use and Disclosure of Protected Health Information
    
   1. Required Uses and Disclosures. PF is required to disclose your PHI as follows:
       
      1. PF must permit you to inspect and copy your PHI (with certain exceptions) upon request.
          
      2. PF is required to disclose your PHI upon request to the Secretary in connection with the Secretary’s investigation of PF’s compliance with federal privacy regulations.
          
   2. Uses and Disclosures That Are Permitted Without Your Consent or Authorization. PF is permitted to use and disclose your PHI without obtaining your consent or authorization in connection with certain treatment and payment activities, health care operations, and other limited activities described below. This section describes how PF will use or disclose your PHI under such circumstances.
       
      1. Treatment. Treatment is the provision, coordination or management of health care and related services. PF may use and disclose your PHI in connection with its own treatment-related activities, such as direct medical treatment and activities related to continuity and coordination of care and referrals among PF and other health care professionals providing you with treatment or consulting in your care. PF may also disclose your PHI to other health care professionals who are providing you with medical services for their use in providing you with such services. For example, PF may disclose your PHI to physicians who provide you with medical treatment in furtherance of such treatment.
          
      2. Payment. Payment includes, but is not limited to, the preparation and submission of claims and other actions required to secure payment for health care services provided by PF (such as billing, claims management, collection activities, reviews for medical necessity and/or appropriateness of care, utilization review and pre-authorization of services). PF may use and disclose your PHI in connection with its own payment-related activities. For example, PF may use your PHI to prepare and submit claims for reimbursement by Medicare, Medicaid, and other third-party payors.
          
      3. Health Care Operations. Health Care Operations include most of PF’s business operations relating to health care or related services. They include (a) quality review and improvement programs; (b) reviewing qualifications and competence of health care providers; (c) case management activities; (d) legal services and auditing; and (e) certain other general business and administrative functions. Subject to Maryland law, PF may use and disclose your PHI as needed for its Health Care Operations and for certain operations of other health care providers, health plans and other covered entities. For example, PF may use PHI as part of its quality review process to confirm that PF and its associated health care providers are providing you with the highest quality of care.
          
      4. Treatment Alternatives; Related Benefits and Services. PF may use your PHI to contact you with appointment reminders and to inform you of (i) possible treatment options or alternatives or (ii) health-related benefits or services that may be of interest to you.
          
   3. Uses and disclosures to which you have the prior right to agree or disagree. PF is permitted to release your PHI to a close friend, family member or other individual who is involved in your medical care, or who helps pay for your care, if (i) the PHI is directly relevant to the person’s involvement with your care, (ii) you have either agreed to the disclosure or have been given an opportunity to object and have not objected, and (iii) the record was not developed primarily in connection with the provision of mental health services. PF is not required to give you the opportunity to agree or object to disclosure if your condition prevents you from doing so and PF determines that disclosure is in your best interests. PF may also disclose PHI to notify your family members, personal representative(s) or other person(s) responsible for your care of your location or condition. If you object to the use and disclosure of your PHI as described in this Section C, please notify PF’s Privacy Officer in writing at the address set forth above.
       
   4. Uses and disclosures for which PF is not required to secure your consent or authorization or provide you with the opportunity to object. PF may use or disclose your PHI without your consent or authorization, and without giving you the opportunity to object, as follows:
       
      1. When the use or disclosure is required by law.
          
      2. When permitted for purposes of public health activities, including reports to public health authorities authorized by law to collect or receive information for the purpose of preventing or controlling disease. PF is also permitted to use or disclose PHI if you have been exposed to a communicable disease or are at risk of spreading a disease or condition, if authorized by law.
          
      3. When required or authorized by law to report information about abuse, neglect or domestic violence to public authorities, if PF reasonably believes that you may be a victim of abuse, neglect or domestic violence. PF will promptly inform you that such a disclosure has been or will be made unless that notice would cause a risk of serious harm or such notice would be provided to your personal representative and PF believes your personal representative may be responsible for the abuse, neglect or domestic violence giving rise to the report.
          
      4. PF may disclose your PHI to a public health oversight agency for health oversight activities authorized by law. This includes uses or disclosures in civil, administrative or criminal investigations; inspections; licensure and disciplinary actions; and other activities necessary for appropriate oversight of the health care system or government benefit programs (such as Medicare and Medicaid).
          
      5. PF may disclose your PHI in the course of any judicial or administrative proceeding, as required or authorized by applicable law. For example, your PHI may be disclosed in response to a subpoena or discovery request, subject to certain conditions. One of these conditions is that, if the subpoena or discovery request is not accompanied by a court order, written assurances must be given to PF that you have received a copy of the subpoena or that service of the subpoena has been waived by the court.
          
      6. When required for law enforcement purposes, as set forth in federal privacy regulations (for example, to report certain types of wounds). PF may also release certain PHI (i) upon request to law enforcement officials for the purpose of identifying or locating a suspect, material witness or missing person, (ii) about an individual who is or is suspected to be a victim of a crime, if the individual agrees to the disclosure or PF is unable to obtain the individual's agreement because of emergency circumstances and certain other conditions are met, and (iii) to report certain crimes.
          
      7. To a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death or performing other duties, as authorized by law.
          
      8. When consistent with Maryland law, if PF believes in good faith that the use or disclosure of PHI is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person reasonably able to prevent or lessen the threat, including the target of the threat.
          
      9. In compliance with workers' compensation or other similar programs established by law.
          
      10. In a manner that is otherwise consistent with state and federal law.
           
   5. Uses and disclosures that require your written authorization. Except as otherwise indicated in this Notice, PF will use and disclose your PHI only with your written authorization. Uses and disclosures requiring written authorization may include, for example, the use or disclosure of PHI for marketing purposes. In addition, PF is generally required to obtain your written authorization before using or disclosing psychotherapy notes about you. Psychotherapy notes are separately-filed notes about your conversations with your mental health professional during a counseling session. They do not include summary information about your mental health treatment. If you authorize PF to use or disclose your PHI in a manner described in this paragraph, your authorization will be valid for not more than one (1) year and you will have the right to revoke that authorization, in writing, at any time. If you revoke your authorization, PF will thereafter refrain from using or disclosing your PHI in the manner described in the authorization.
       
2. Your Rights Regarding Protected Health Information

   You have certain rights regarding PHI held or maintained by PF. This section summarizes those rights.
    

   1. Right to Request Restrictions on Use and Disclosure. You have the right to request restrictions (in addition to those described in this Notice) on our use and disclosure of PHI under Sections I.B and I.C, above. PF is not required to agree with your request. If we do agree, we will comply with your request unless the use or disclosure of the PHI in question is required to provide you with emergency treatment. If you wish to request a restriction or limitation on our use or disclosure of PHI under this paragraph, you must make your request in writing to PF’s Privacy Officer at the address set forth above. Upon receiving your request, we will notify you if we agree to your requested limitations.
       
   2. Right to Receive Confidential Communications. You have the right to request that you receive communications of PHI from PF in a certain way or at a certain location. For example, you may request that PF communicate with you only at work or by mail. To request confidential communications, please submit your request in writing to PF’s Privacy Officer at the address set forth above. You are not required to provide a reason for your request, and PF will accommodate all reasonable requests. Please be sure to specify how and where you wish to be contacted.
       
   3. Right to Inspect and Copy Medical Information. Subject to certain limitations, you have the right to inspect and obtain a copy of your PHI. This includes most PHI maintained by PF, except for information compiled by PF in anticipation of legal proceedings. In addition, federal and Maryland law may limit your access to mental health records and psychotherapy notes. If your medical record includes such records and we are required for this reason to deny your request for access, we will advise you at that time of your additional rights under state and federal law. Otherwise, if you wish to inspect and copy your PHI, you must submit a written request to PF’s Privacy Officer at the address set forth above. You may also request a copy of your medical record at any PF center. PF may charge a reasonable fee to cover the cost of providing you with a copy of your PHI. PF is also permitted to deny your request to inspect and copy PHI under certain other limited circumstances. If we deny your request, you may (under most circumstances) request that the denial be reviewed by a licensed health care professional. PF will respond to all requests for access to PHI under this paragraph within thirty (30) days by (i) providing the requested access and/or copies of the requested information; (ii) notifying you in writing of our denial of your request and the reasons for our denial; or (iii) notifying you in writing that we are not able to respond within 30 days and of the date on which you may expect a response.
       
   4. Right to Amend PHI. You have the right to request that PF amend PHI if you believe that such information is inaccurate or incomplete, but you are not entitled to have any information deleted from your PHI. Your request must be in writing and directed to PF’s Privacy Officer at the address set forth above. Your request must contain your reason for believing that such information is inaccurate or incomplete. PF may deny your request for amendment if it determines that the information at issue is accurate and complete or that it: (1) was not created by PF, unless you submit evidence providing a reasonable basis to believe that the originator of the PHI is not available to make the amendment; (2) is not part of the medical information maintained by PF; or (3) is not part of the PHI that you have the right to inspect and copy (as described in Section II.C, above).
      
      PF will respond to all requests under this paragraph within sixty (60) days by either (a) agreeing to make the requested amendment(s); (b) notifying you in writing of the denial of your request and the reasons for denial; or (c) notifying you in writing that we are not able to respond within 60 days and of the date on which you may expect a response. If PF denies your request, you have (i) the right to submit a written statement disagreeing with our denial, which will become part of your PHI, and (ii) certain additional rights. Your additional rights and the manner in which a statement of disagreement should be submitted will be described in greater detail in PF’s denial of your request.
       
   5. Right to an Accounting of PF’s Use and Disclosure of Your PHI. You have the right to request an “accounting,” or list, of all disclosures by PF of your PHI other than disclosures that are (i) described in Sections I.A(1), I.B, I.C or I.E of this Notice; (ii) made for national security or intelligence purposes; or (iii) made to law enforcement officials. PF will also maintain copies of any authorizations that you provide under Section I.E., together with a record of our reliance on them. Your request for an accounting must be submitted in writing to PF’s Privacy Officer at the address set forth above. We are not required to list disclosures occurring before April 14, 2003, or more than six (6) years prior to the date of your request. PF will respond to all requests under this paragraph within sixty (60) days by either (a) providing you with the requested accounting, or (b) notifying you in writing our inability to respond within 60 days and of the date on which you may expect a response. If you request more than one accounting within a twelve (12) month period, we will impose a fee to cover our costs in providing the requested information.
       
   6. Right to Paper Copy. You have the right to receive a paper copy of this Notice by submitting a written request to PF’s Privacy Officer or requesting a copy at any PF center. If you desire to receive this Notice electronically, you may do so at our web site: http://www.patientfirst.com/
       
3. Other Requirements with respect to PHI
    
   1. Minimum Necessary Standard. When using or disclosing PHI or when requesting PHI from another covered entity, PF is required to make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish its intended purpose, taking into account practical and technological limitations. However, the “minimum necessary” standard described in this paragraph does not apply to: (i) disclosures to or requests by a health care provider for treatment purposes; (ii) disclosures made to or authorized by you; (iii) disclosures to the U.S. Department of Health and Human Services; or (iv) uses or disclosures that are required by law or for PF to comply with the law.
       
   2. Personal Representatives. You may generally exercise your rights through a personal representative, who will be required to produce evidence of his/her authority to act on your behalf before being given access to your PHI or allowed to take any action for you. Proof of such authority may take one of the following forms: (1) a power of attorney for health care purposes, notarized by a notary public; (2) a court order appointing the person as your conservator or guardian; (3) valid identification of an individual who is the parent of a minor child; or (4) any other form permitted by Maryland law.
      
      PF retains the discretion to deny access to PHI to a personal representative in order to protect any person who depends on others to exercise his or her rights and who may be subject to abuse or neglect.
       
   3. De-identified Information. This Notice does not apply to de-identified information, which is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.
       
4. Changes to this Notice PF is required by law to maintain the privacy of your PHI and to make this Notice available to you. For so long as this Notice remains in effect, PF is required by law to comply with the terms of this Notice.
   
   However, we reserve the right to change this Notice at any time and in any manner that is permitted under applicable law and to make the new Notice provisions effective for all of your PHI that we possess on the date of such amendment or thereafter receive or generate. If we change the contents of this Notice, we will promptly post a copy of the revised Notice in a clear and prominent location at our centers and make copies of the revised Notice available. In addition, you may always request a copy of the current Notice at any time, as described above.
    
5. Complaints You have the right to file a complaint with PF or with the Secretary if you believe that your privacy rights have been violated. If you wish to file a complaint with PF, please contact PF’s Privacy Officer in writing at 5000 Cox Road, Suite 100, Glen Allen, VA 23060. All complaints must be submitted in writing. PF will not penalize or discriminate against you in any manner if you choose to file a complaint.
   
   Form #:153 Rev. 6/3/06