The terms of this Notice of Privacy Practices apply to Highland District Hospital operating as an organized health care arrangmenet (including all employees, volunteers, trainees, students, board members) and the members of its medical staff seeing and treating patients at Highland Distirct Hospital (including radiologists, emergency room physicians, pathologists, and licensed profressionals). The members of this organized health care arrangement work and practice at Highland District Hospital. All of the entities and persons listed will share protected health information (PHI) as necessary to carry out treatment, payment, and health care operations as permitted by law.NOTE: Physicians not employed by or under contract with Highland District Hospital are not part of the organized health care arrangement while managing and treating patients in their private offices including those located in the Outpatient Specialists Department of Highland District Hospital or in locations other than Highland District Hospital.We are required by law to maintain the privacy of our patients' PHI and to provide patients with notice of our legal duties and privacy practices with respect to your PHI and to notify you in the unlikely event of a breach or unauthorized disclosure of your PHI. We are required to abide by the terms of this Notice so long as it remains in effect. We reserve the right to change the terms of this Notice of Privacy Practices as necessary and to make the new Notice effective for all PHI maintained by us. You may receive a copy of any revised notices at any Patient Registration site or a copy may be obtained by mailing a request to the Privacy Officer, Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133. This notice is also available on Highland District Hospital's website at ww­ w.hdh.org.

USES AND DISCLOSURES OF YOUR PERSONAL HEALTH INFORMATIONYour Authorization. Except as outlined below, we will not use or disclose your PHI for any purpose unless you have signed a form authorizing the use or disclosure. You have the right to revoke that authorization in writing unless we have already taken any action in reliance on the authorization. There are certain uses and disclosures of your PHI for which we will always obtain a prior authorization and these include:Marketing communications unless the communication is made directly to you in person, is simply a promotional gift of nominal value, is a prescription refill reminder, general health or wellness information, or communication about health related products or services that we offer or that are directly related to your treatment.Sale of your health information unless for treatment or payment purposes or as required by law.Psychotherapy notes unless otherwise permitted or required by law.Uses and Disclosures for Treatment. We will use and disclose your PHI as necessary for your treatment. For example, doctors, nurses and other professionals involved in your care will use information in your medical record and information you provide about your symptoms and reactions to plan a course of treatment for you that may include procedures, medications, tests, etc. We may also release your PHI to another health care facility or professional not affiliated with our organization but who is or will be providing treatment to you. For example, if you will be receiving home health care after your hospital stay, we may release your PHI to that home health care agency to assist them in preparing a plan of care for you.Uses and Disclosures for Payment. We will use and disclose your PHI necessary for the payment purposes of those health professionals and facilities having treated or provided services to you. For example, we may forward information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you or use your information to prepare a bill to send to you or the person responsible for your payment.Uses and Disclosures for Health Care Operations.We will use and disclose your PHI as necessary and as permitted by law, for our health care operations, including clinical improvement, professional peer review, business management, accreditation and licensing, etc. For example, we may use and disclose your PHI for purposes of improving the clinical treatment and care of our patients. As part of our customer service we may occasionally send thank you notes, birthday cards or condolences. If you wish to be excluded (opt-out) from receiving thank you notes, birthday cards or condolences please notify the Privacy Officer, Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133. We may also disclose your PHI to another health care facility, health care professional, or health plan for activities including quality assurance and case management, but only if that facility, professional, or plan also has or had a patient relationship with you.

Our Facility Directory. We maintain a facility directory listing the name, room number/location, general condition and, if you desire, your religious affiliation. The information, excluding your religious affiliation, will be disclosed to anyone who requests it by asking for you by name unless you choose to have your information excluded (opt-out) from this directory. This information, including your religious affiliation, may also be provided to members of the clergy. You have the right during registration to have your information excluded from this directory and also to restrict what information is provided and/or to whom. We will be unable to direct card, flowers, phone calls or visitors if you choose to be excluded from the facility directory.

Family and Friends Involved In Your Care. With your approval, we may disclose your PHI to designated family, friends, and others involved in your care or in payment of your care to facilitate that person's involvement in caring for you or paying for your care. If you are unavailable, incapacitated, or facing an emergency medical situation, and we determine a limited disclosure may be in your best interest, we may share limited PHI with these individuals without your approval. We may also disclose limited PHI to a public or private entity authorized to assist in disaster relief efforts to locate a family member or other persons involved in some aspect of caring for you.

Business Associates. Certain aspects and components of

our services are performed through contracts with outside persons or organizations, such as auditing, accreditation, legal services, etc. Occasionally it may be necessary for us to provide certain PHI to one or more of these outside persons or organizations assisting us with our health care operations. We always require all business associates to appropriately safeguard the privacy of your information.

Fundraising. We may contact you to donate to a fundraising effort for or on our behalf. You have the right to "opt-out" of rece1v1ng fundraising materials or communications and may do so by sending your name and address to the Foundation Administrator, Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133 together with a statement indicating you do not wish to receive fundraising materials or communications from us.

Appointments and Services. We may contact you to provide appointment reminders or for test results. You have the right to request and we will accommodate reasonable requests by you to receive communications regarding your PHI from us by alternative means or at alternative locations. For example, you can request appointment reminders NOT to be left on voice mail or sent to a particular address. You may request such confidential communication in writing and may send your request to the Privacy Officer, Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133.

Health Products and Services. We may from time to time use your PHI to communicate with you about health products and services necessary for your treatment, to advise you of new products and services we offer, and to provide general health and wellness information.

Research. We may use and disclose your PHI for research purposes in limited circumstances. For example, a research organization may wish to compare outcomes of all patients receiving a particular drug and will need to review a series of medical records. If your specific authorization has not been obtained, your privacy will always be protected by strict confidentiality requirements applied by an Institutional Review Board or privacy board overseeing the research or by representations of the researchers limiting their use and disclosure of patient information.

Immunizations. We may disclose immunization records to a student's school if a parent or legal guardian (or the student if not a minor) agrees to such either orally or in writing.

Other Uses and Disclosures. We are permitted or required by law to make certain other uses and disclosures of your PHI without your consent or authorization. We may release your PHI for the following purposes:

as required by law;for public health activities, such as required reporting of disease, injury, and birth and death, and for required public health investigations;as required by law ifwe suspect child abuse or neglect; we may also release your PHI as required by law ifwe believe you to be a victim of abuse, neglect, or domestic violence; to the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls;to your employer upon their request to document health care services provided to you to determine workplace-relat­ ed illness or injury; in most cases you will receive notice that information is disclosed to your employer;if required by law to a government oversight agency conducting audits, investigations, or civil or criminal proceedings;if required to do so by subpoena or discovery request; in some cases you will have notice of such release;to law enforcement officials as required by law to report wounds and injuries and crimes;to coroners and/or funeral directors consistent with law;if necessary to arrange an organ or tissue donation from you or a transplant for you;certain research purposes when such research is approved by an ins.titutional review board with established rules toensure pnvacy; within limited instances if we suspect a serious threat to health or safety;

if you are a member of the military as required by armed forces services; we may also release your PHI if necessary for national security or intelligence activities; and to workers' compensation agencies if necessary for your workers' compensation benefit determination

Ohio law requires we obtain consent from you before disclosing the performance or results of an HIV test or diagnoses of AIDS or an AIDS-related condition; before disclosing information about drug or alcohol treatment you have received in a drug or alcohol treatment program and before disclosing information about mental health services you may have received. Contact the Privacy Officer for further information.

RIGHTS THAT YOU HAVE

Access to Your PHI. You have the right to copy and/or inspect much of the PHI we retain on your behalf. All requests access must be made in writing and signed by you or your representative. If you request a copy of the information we will charge you per OHIO REVISED CODE 3701.741. We will also charge for postage if you request a mailed copy. If you request a summary in lieu of copies you will be charged a summary preparation fee. You may obtain an access request form from the Medical Record Department at Highland District Hospital.

You have the right to obtain an electronic copy of your health information that exists in an electronic format and you may direct that the copy be transmitted directly to an entity or person designated by you, provided that any such designation is clear, conspicuous, and specific with complete name and mailing address or other identifying information. We will charge you a fee for our labor and supplies in preparing your copy of the electronic health information.

Amendments to Your PHI. You have the right to request in writing any PHI we maintain about you be amended or corrected. We are not obligated to make all requested amendments but will give each request careful consideration. All amendment requests must be in writing, signed by you or your representative, and must state the reasons for the amendment/correction request. If you request an amendment or correction, we may also notify others working with us and who have copies of the uncorrected record if we believe such notification is necessary. You may obtain an amendment request form from the Medical Record Department at Highland District Hospital. (Name, address, telephone number, insurance information changes will be made at your request without filing an amendment request form).

Accounting for Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures made by us of your PHI for six years prior to the date of your request. All requests must be made in writing and signed by you or your representative. Accounting request forms are available from the Privacy Officer at Highland District Hospital. The first accounting in any 12-month period is free; you will be charged a fee of $15.00 for each subsequent accounting you request within the same 12-month period.

When you request an accounting of disclosures of your electronic health record, the accounting will be for three years prior to the date of the request for the accounting and will include, in addition to all types of disclosures listed in the general policy, disclosures for treatment, payment and health care operations.

This applies to disclosures made by the organization from such a record on and after January 1, 2011.

Restrictions on Use and Disclosure of Your PHI. You have the right to request restrictions on certain uses and disclosures of your PHI for treatment, payment, or health care operations. A restriction request form may be obtained from the Privacy Officer at Highland District Hospital. We are not required to agree to your restriction request but will attempt to accommodate reasonable requests when appropriate. We retain the right to terminate an agreed-to restriction ifwe believe such termination is appropriate.

We will not accept a request from a custodial parent of a minor to restrict disclosure of PHI to the non-custodial parent of a minor unless a court document is produced that supports such a restriction. We will notify you of any termination of an agreed-to restriction on our part. You also have the right to terminate, in writing or orally, any agreed-to restriction by sending such termination notice to the Privacy Officer, Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133.

We will honor any request to restrict disclosures to your health plan if the information to be disclosed pertains solely to a health care item or service for Highland District Hospital has been paid in full.

Breach notification: In the unlikely event that there is a breach, or unauthorized release of your PHI, you will receive notice and information on steps you may take to protect yourself from harm.

Complaints. You may file a complaint with the Privacy Officer at Highland District Hospital either in person, in writing or by telephone at (937) 393-6100 if you believe your privacy rights have been violated. You may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services in Washington

D.C. within 180 days of a violation of your rights. There will be no retaliation for filing a complaint. Acknowledgment of Receipt of Notice. You will be asked to sign or initial an acknowledgment that you received this Notice of Privacy Practices.

FOR FURTHER INFORMATION

If you have questions or need further assistance regarding this Notice, you may contact the Privacy Officer at Highland District Hospital, 1275 North High Street, Hillsboro, Ohio 45133, and telephone number (937) 393-6100, e-mail priva­ cy@hdh.org.

As a patient, you retain the right to obtain a paper copy of this Notice of Privacy Practices, even if you have requested such copy by e-mail or other electronic means.

EFFECTIVE DATE

This Notice of Privacy Practices is effective September 23, 2013.

HIGHLAND

DISTRICT HOSPITAL