Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

ABOUT THIS NOTICE

We understand that information about you and your health care is personal and confidential and we are committed to protecting that information. Your health information is protected by state and federal laws and
regulations. This notice describes how we may use and disclose your protected health information (“PHI”). It also describes your rights and certain obligations we have regarding the use and disclosure of your PHI. This notice applies only to records we create in providing services to you.

YOUR HEALTH INFORMATION RIGHTS

Although your health record is the physical property of KOC, you have the following rights regarding health
information we maintain about you:

Request a restriction on certain uses and disclosures of your PHI for treatment, payment or health care operations. You also have the right to request restrictions on certain disclosures to persons, such as family members involved with your care or payment for your care. We are not required to agree to your request (with the exception of a request for restriction described in the section below on “Out of Pocket Payments”), but if we agree, we will comply with your request unless the information is needed to provide you with emergency treatment;
Request a restriction related to “out of pocket” payments. You have the right to ask us to restrict the use and disclosure of your PHI to a health plan for payment or health care operations purposes if the information you wish to restrict pertains solely to a health care item or service for which you have paid
us “out of pocket” in full, in which case we will honor your request;
Obtain a copy of this Notice of Privacy Practices upon request. You may request a paper copy of this notice, in person, at any of the facilities listed above. You may also obtain a copy of this notice from the KOC website at www.KOCortho.com.
Inspect and/or request in writing a copy of your PHI that is maintained in a designated record set in paper or electronic format as provided by law. We may charge a reasonable fee for the cost of labor, supplies and postage for paper or electronic copies. You may also access health information in your medical record through our patient portal;
Request that we amend your PHI as provided by law;
Obtain an accounting of certain disclosures of your PHI as provided by law;
Request communications of your PHI by alternative means or at alternative locations. We will accommodate reasonable requests; and
Revoke in writing your authorization to use or disclose your PHI except to the extent that action has already been taken in reliance on your authorization.

You may exercise your rights set forth in this notice by contacting KOC’s Privacy Officer during normal business hours (contact information provided at the end of this notice).

OUR RESPONSIBILITIES

In addition to the responsibilities set forth above, we are also required to:

Maintain the privacy of your PHI;
Provide you with a notice as to our legal duties and privacy practices with respect to PHI we maintain about you;
Abide by the terms of this notice;
Notify you if we cannot accommodate a requested restriction or request;
Notify you if we discover a breach of unsecured PHI

We reserve the right to change our privacy practices and to make any new provisions effective for all protected health information that we maintain. If our practices change, we will revise our notice. You may request copies of the revised notice in person or from our website at www.KOCortho.com.

HOW WE USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

Generally, we may not use or disclose your PHI without your written authorization. However, in certain circumstances, we are permitted to use your PHI without authorization. The following categories describe different ways that we may use and disclose your PHI without your written authorization. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose your PHI without your written authorization will fall within one of these categories.

For Treatment. We may use and disclose PHI to give you medical treatment or services and to manage and coordinate your medical care. For example, we may disclose health information about you to physicians, nurses, technicians or other medical personnel who are involved with your care. In some cases, the sharing of your PHI with other health care providers and hospitals involved in your care may be done electronically through an electronic health information exchange (“HIE”).

For Payment. We may use and disclose PHI about you so that the treatment and services you receive from us may be billed to and payment collected from you, an insurance company or a third party. For example, we may need to give your health plan information about your treatment in order for your health plan to pay for that treatment.

For Health Care Operations. We may use and disclose PHI about you for operations of our health care practice. These uses and disclosures are necessary to run our practice and make sure that all of our patients receive quality care. For example, we may use PHI for quality assessment and improvement and general business management activities.

WE MAY USE OR DISCLOSE YOUR HEALTH INFORMATION AS OTHERWISE ALLOWED BY LAW

The following categories describe different ways that we may use and disclose your PHI other than treatment, payment or health care operations without your written authorization. Under certain circumstances, we have noted when your authorization is required. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information for other than treatment, payment or health care operations without your written authorization should fall within one of these categories, with noted exceptions:

Appointment Reminders, Treatment Alternatives and Health-Related Benefits and Services: We may contact you to remind you that you have an appointment for medical care, or to contact you about possible treatment options or alternatives or health related benefits and services that may be of interest to you.

Business Associates: We provide some services through business associates. Examples include transcription and copy services. We require business associates to take appropriate measures to safeguard your PHI.

Workers’ Compensation: We may use and disclose your PHI, as necessary, for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

Abuse, Neglect or Domestic Violence: We may notify government authorities if we believe a patient is a victim of abuse, neglect or domestic violence. We will make this disclosure only when specifically authorized or required by law, or when the patient agrees to the disclosure.

Military: If you are a member of the Armed Forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authorities.

Judicial or Administrative Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding as allowed or required by law, with your consent, or as directed by a proper court order or administrative tribunal, provided that only the PHI released is expressly authorized by such order, or in response to a subpoena, discovery request, or other lawful process. We may also use or disclose your PHI to defend ourselves if you sue us.

Law Enforcement: We may disclose your PHI to a law enforcement official if the information is (1) in response to a court order, subpoena, summons or similar process; (2) to identify or locate a suspect, fugitive, material witness or missing person; (3) about the victim of a crime; (4) about a death we believe may be the result of criminal conduct; (5) about criminal conduct on our premises; (6) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime or (7) wound or physical injury reporting, as required by law.

Research: We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

Coroners, Medical Examiners and Funeral Directors: We may disclose your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release your PHI to a funeral director as necessary to carry out their duties.

Cadaveric Organ, Eye or Tissue Donation: Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

Health Oversight Activities: We may disclose your PHI to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative or criminal investigations or proceedings; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight.

Public Health and Immunization Records: Consistent with applicable law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability, or with parental or guardian agreement, immunization records to schools.

Food and Drug Administration (FDA): We may disclose your PHI to the FDA (1) relative to adverse events with respect to food or dietary supplements, product defects or problems, including problems with the use or labeling of a product or biological product deviations; (2) to track FDA-regulated products; (3) to enable
product recalls, repairs or replacement or look back; or (4) to conduct post marketing surveillance.

Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose PHI to the correctional institution or law enforcement official if the disclosure is necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

National Security and Intelligence Activities: We may release health information about you to authorized federal officials for intelligence, counterintelligence and other national activities authorized by law. We may release your PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or for the conduct of special investigations to the extent permitted by law.

To Avert a Serious Threat to Health or Safety: Consistent with applicable law, we may use and disclose your PHI if we believe it is necessary to prevent a serious and imminent threat to your health and safety or that of the public. Any disclosure, however, would only be to someone able to help prevent or lessen the threat.
Required by Law: We may use or disclose your PHI when required to do so by federal, state or local law.

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION PERMITTED WITHOUT AUTHORIZATION BUT WITH AN OPPORTUNITY FOR THE INDIVIDUAL TO OBJECT

We may disclose your PHI to a friend or family member who is involved in your medical care or payment for care. We may also disclose PHI about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. You may object to these disclosures. If you do not
object to these disclosures, or we determine in the exercise of our professional judgment that it is in your best interest for us to disclose information that is directly relevant to the person’s involvement with your care, we may disclose your PHI.

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION WHICH YOU AUTHORIZE

Other than the uses and disclosures described above, we will not use or disclose your protected health information without your written authorization. We require your written authorization in order to use or disclose your protected health information for:

Psychotherapy notes-authorization must be obtained for any use or disclosure of psychotherapy notes except to carry out Treatment, Payment or Operations or to defend ourselves in a legal action brought by the subject of the notes.
Marketing, except if the communication is in the form of a face-to-face communication made by us to you, or a promotional gift of nominal value that we provide to you, and
Any sale of your protected health information.

TO REQUEST INFORMATION OR FILE A COMPLAINT

If you have questions, would like additional information or want to report a problem regarding the handling of your information, you may contact:

KOC Compliance Hotline: (865)231-9468
Email: compliance@KOCortho.com
Privacy Officer: Jennifer Pearson Taylor
Compliance Manager: Amy Hardy

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. There will be no retaliation against you for filing a complaint.

To file a complaint with us, please submit to our Privacy Officer at the address listed above. All complaints must be made in writing.