Notice of Privacy Practices — HIPAA

1. Notice summary

When it comes to your health information, you have certain rights.
This notice explains those rights and some of our responsibilities
to protect your medical information.

You have the right to:

• Obtain an electronic or paper copy of your medical record.
• Ask us to correct your medical record.
• Request confidential communications.
• Ask us to limit certain uses or disclosures.
• Obtain a list of certain disclosures.
• Obtain a copy of this notice.
• Choose someone to act for you.
• File a complaint if you believe your rights were violated.

In certain situations, you may choose how we use or share information to:

• Tell family and friends involved in your care.
• Help in a disaster-relief situation.
• Contact you about services related to your care.
• Raise funds, when applicable.

We may use and share your information to:

• Treat you.
• Run our organization.
• Bill and obtain payment for your services.
• Help with public health and safety issues.
• Perform certain permitted research activities.
• Comply with the law.
• Respond to organ and tissue donation requests.
• Work with a medical examiner or funeral director.
• Address workers’ compensation and certain government requests.
• Respond to lawsuits and legal actions.

2. Who this notice applies to

This notice applies to Estrella Medical Centers, its locations, professionals,
employees, clinical and administrative personnel, and persons or entities participating
in the covered activities described in this notice, as applicable.

Covered locations and workforce members may share medical information with one another
for treatment, payment, and health care operations to the extent permitted by law.

This notice does not replace the website Privacy Policy. Information collected through
general website forms is described separately in our
Privacy Policy.

3. Your rights

Obtain an electronic or paper copy of your medical record

You may ask to see or obtain an electronic or paper copy of your medical record and other
health information we maintain about you. Ask us how to submit the request.

We will usually provide a copy or summary of your health information within 30 days of your
request. We may charge a reasonable, cost-based fee when permitted by law.

Ask us to correct your medical record

You may ask us to correct health information that you believe is incorrect or incomplete.
Ask us how to submit the request.

We may deny the request in certain circumstances, but we will explain the reason in writing,
usually within 60 days of the request.

Request confidential communications

You may ask us to contact you in a specific way, such as by home telephone, mobile telephone,
or mail, or to send correspondence to a different address.

We will agree to all reasonable requests.

Ask us to limit what we use or share

You may ask us not to use or share certain health information for treatment, payment, or health
care operations. We are not required to agree to every request and may deny a request, for example,
when it could affect your care.

If we agree to a restriction, we may still share the information when it is needed to provide
emergency treatment.

If you pay in full out of pocket for a health care service or item, you may ask us not to share
that information with your health plan for payment or health care operations. We will agree unless
a law requires us to share the information.

Obtain a list of certain disclosures

You may request a list, also called an accounting of disclosures, of certain times we shared your
health information during the six years before the date of your request, including who received it and why.

The list will not include certain disclosures, such as disclosures for treatment, payment, and
health care operations, or other disclosures excluded by law.

We will provide one accounting each year at no charge. We may charge a reasonable, cost-based fee
if you request another within the same 12-month period.

Obtain a copy of this notice

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
We will provide it promptly.

Choose someone to act for you

If a person has legal authority to act for you, such as through a medical power of attorney,
guardianship, or other valid representation, that person may exercise your rights and make choices
about your health information.

We will verify that the person has the appropriate authority before taking action.

File a complaint

You may file a complaint with Estrella Medical Centers if you believe we violated your rights.
Contact information appears at the end of this notice.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
We will not retaliate against you for filing a complaint.

4. Your choices

For certain health information, you may tell us your preferences about what we share. Tell us clearly
what you want us to do, and we will follow your instructions when permitted by law.

Family, friends, and persons involved in your care

You may tell us whether you want us to share information with family, friends, or other persons involved
in your care or payment for your care.

If you are unable to state your preference, such as when you are unconscious, we may share information
when we reasonably believe it is in your best interest and the law permits it.

Disaster relief

We may share limited information with disaster-relief organizations to help notify family members or
other persons responsible for your care when appropriate.

Marketing and sale of information

We will not use or share your medical information for marketing or sell your medical information without
your written authorization, unless a specific exception permitted by law applies.

Fundraising

We may contact you about fundraising activities when applicable. You may tell us not to contact you again
for this purpose.

5. How we use and share your medical information

The law permits or requires us to use and share medical information for certain activities. We apply
the safeguards and limitations required by law.

In certain circumstances, we will use or share only the minimum amount of information reasonably necessary
to accomplish the relevant purpose.

6. Treatment

We may use and share your medical information with other professionals involved in your treatment.

For example, a professional treating you may share information with another professional to coordinate
services, medications, tests, referrals, or follow-up.

7. Health care operations

We may use and share medical information to run our organization, improve care, evaluate quality,
train personnel, and communicate with you when necessary.

For example, we may use medical information to review service quality, coordinate personnel, or manage
administrative and compliance activities.

8. Billing and payment

We may use and share your medical information to bill and obtain payment from health plans or other
responsible entities.

For example, we may provide information to your health plan so it can process or pay for services you received.

9. Other permitted or required uses and disclosures

Public health and safety

We may share medical information for certain situations, including:

• Preventing disease.
• Assisting with product recalls.
• Reporting adverse reactions to medications.
• Reporting suspected abuse, neglect, or domestic violence.
• Preventing or reducing a serious threat to health or safety.

Research

We may use or share information for certain health research when the applicable legal requirements have been satisfied.

Compliance with the law

We will share information when state or federal law requires it, including with the Department of Health and
Human Services when it needs to verify our compliance with federal privacy law.

Organ and tissue donation

We may share medical information with organ procurement organizations when appropriate.

Medical examiners, coroners, and funeral directors

We may share information with a coroner, medical examiner, or funeral director when a person dies and the law permits it.

Workers’ compensation, law enforcement, and government requests

We may use or share medical information:

• For workers’ compensation claims.
• For certain permitted law-enforcement purposes.
• With health oversight agencies for activities authorized by law.
• For special government functions authorized by law.

Lawsuits and legal actions

We may share medical information in response to a court or administrative order and, under certain conditions,
in response to a subpoena.

10. Substance use disorder records — 42 CFR Part 2

To the extent we maintain or receive patient records relating to substance use disorder that are subject to
42 CFR Part 2, those records receive additional protections.

These protections apply in addition to the general protections provided by HIPAA.

11. Uses and disclosures requiring authorization

We will not use or share your medical information in a manner other than as described in this notice unless
you authorize us in writing or the law permits or requires it.

If you give us written authorization, you may revoke it at any time by submitting a written request.
Revocation will not affect actions we already took in reliance on the authorization.

Written authorization is generally required for:

• Most uses and disclosures for marketing.
• The sale of protected health information.
• Other uses or disclosures not described in this notice.

12. Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice.
• We must provide you with a copy of this notice when required.
• We will not use or share your information other than as described here unless you authorize us in writing or the law permits or requires it.
• We will not retaliate against you for filing a complaint.

13. Changes to the terms of this notice

We may change the terms of this notice. Changes may apply to all medical information we maintain about you,
including information created or received before the change.

The revised notice will be available upon request, in our offices, and on this website.

14. Complaints, questions, and contact

You may contact our Privacy Officer to request information, exercise your rights, or file a complaint.

File a complaint with HHS

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

Contact Estrella Medical Centers