NOTICE OF PRIVACY PRACTICES

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective Date: March 8, 2012

Federal privacy regulations implemented by the government under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) went into effect April 14, 2003. These regulations require our office to maintain the privacy of your medical information and provide you with a Privacy Notice. This Notice describes how your personal medical information may be used and/or disclosed by MedExpress Urgent Care to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law. It also describes how you can obtain access and control of this information. The privacy regulations also require our office to obtain your acknowledgement of receipt of this notice. Please take this privacy notice home with you for your records. If you have any questions, please feel free to ask a MedExpress employee.

PROTECTED HEALTH INFORMATION (PHI):

PHI refers to any patient information relating to treatment, diagnosis, or payment that identifies a person.

USES AND DISCLOSURES OF PHI:

MedExpress uses PHI when employees within the organization share, examine, or analyze a patient's medical information. MedExpress discloses PHI upon the release, transfer, or granting of access of PHI to other external persons or facilities. Except for the following circumstances, MedExpress will not release your PHI without your written authorization.

Treatment:

MedExpress will use and/or disclose your PHI to provide medical services, coordinate medical care, and/or help manage your health care and other medical services. MedExpress may also disclose PHI to external persons or facilities that will be involved in your medical care.

Payment:

Your PHI will be used and/or disclosed, as needed, to help obtain payment for your services. These uses are often required to obtain payment from third parties. Many services require prior authorization, and your PHI may be disclosed to obtain insurance authorization for such services before they are rendered.

Health Care Operations:

Your PHI may be used and/or disclosed, as needed, to aid in the everyday administration of MedExpress. In order to provide you and your family with quality care, MedExpress may use your PHI for quality control reviews, internal investigations, performance reviews, training of new employees, and for other health-related activities. MedExpress may also use and/or disclose your PHI to provide information to you.

Continuation of Treatment:

MedExpress may use and/or disclose your PHI to ensure continuation of care by checking on your progress or notifying you of received test results.

Treatment Options:

MedExpress may use and/or disclose your PHI to inform you of various treatment options or programs that may be of benefit to your care.

Medical Benefit Services:

MedExpress may use and/or disclose your PHI to inform you of various medical benefit services in the community that may be of use to you.

Business Associates:

Certain aspects and components of our services may be performed through contracts with outside persons or organizations, such as auditing, billing, legal services, etc. At times, it may be necessary for us to provide your PHI to one or more of these outside persons or organizations who assist us with our Health Care Operations. In all cases, these business associates are required to appropriately safeguard the privacy of your information.

OTHER PERMITTED/ REQUIRED USES & DISCLOSURES:

MedExpress may use and/or disclose your PHI in the following situations without your authorization:

• Requirements of federal, state, or local law
• Public safety issues that require notification to the proper public health authorities
• Issues of national security or military activity
• Health oversight agencies
• Court-ordered legal proceedings
• Law enforcement
• Correctional institutions at which a patient may be an inmate
• Approved research projects
• Coroners, organ donation services, and funeral directors
• Workers compensation
• Change in ownership of MedExpress Urgent Care
• The Food & Drug Administration

PERMITTED USES & DISCLOSURES THAT MAY BE USED WITH YOUR AUTHORIZATION & OPPORTUNITY TO OBJECT:

MedExpress may use and/or disclose your PHI with your authorization in certain situations. You have the opportunity to authorize or object to the use and/or disclosure of all, or part, of your PHI in the following situations:

Emergencies:

If an emergent situation exists where it is impossible to obtain your consent for PHI uses and/or disclosures, MedExpress will make every effort to obtain consent once the emergent situation is resolved.

Marketing:

MedExpress will not use and/or disclose your PHI to any outside marketing agencies without your written authorization. If the marketing is to result in direct or indirect payment to MedExpress by a third party, we will state this on the authorization form you sign.

Sign-In Sheets:

MedExpress utilizes a sign-in sheet to help employees determine who is to be seen and in what order they will be seen. Once your information is retrieved by a MedExpress employee, your PHI will be removed from the sign-in sheet. If you object to leaving your PHI on the sign-in sheet, please inform a MedExpress employee.

Other Persons Involved in Your Care:

MedExpress may disclose your PHI to notify a family member or another responsible person of your care or condition. You will be given the opportunity to agree or object to the disclosure of this PHI before we will communicate with other persons involved in your care.

Your Authorization:

If you authorize MedExpress to use or disclose protected health information about you, you may revoke that permission in writing at any time and we will no longer use or disclose PHI about you for the reasons covered by your authorization. Please understand that we are unable to take back any uses or disclosures we have already made with your permission and that we are required to retain our records of the medical treatment or other services we have provided to you.

YOUR RIGHTS REGARDING YOUR PHI:

You have the right to inspect and obtain a copy of your PHI in your designated record set.

This designated record set includes any records that MedExpress Urgent Care may have about you that are used for making medical treatment decisions. Under federal law, you may not inspect a copy of psychotherapy notes, information being used in anticipation of legal proceedings, or PHI that is otherwise prohibited. In addition, you have a right to access your PHI in electronic format, where it is available.

You have the right to request restrictions be placed on certain uses and/or disclosures of your PHI.

You may ask us not to use and/or disclose part of your PHI for treatment, payment, or health care operations. You may also request that any part of your PHI not be disclosed to any of your family members. You must state the specific restriction request, and to whom it applies. Please submit these requests in writing to the Center Manager. MedExpress has the right not to agree with your request in most circumstances. However, you have the right to require restrictions on disclosures of your PHI to a health plan where you paid out of pocket, in full, for items or services and MedExpress is required to honor this request.

You have the right to receive confidential communications from us by alternative means or at an alternative location.

Please notify the Center Manager in writing of this request.

You have the right to request a listing of certain disclosures MedExpress Urgent Care has made of your PHI.

Please request an accounting list from the Center Manager.

You have the right to request amendments be made to your PHI.

Please submit requests to the Center Manager.

You have a right to receive a copy of this Privacy Notice.

Please request a copy from the Center Manager.

MedExpress has the right to change the terms of this notice.

MedExpress will inform you of any changes made to this Privacy Notice. MedExpress will post a copy of the current Privacy Notice on the MedExpress website, www.medexpress.com. The Privacy Notice will state the effective date in the top left corner.

You have a right to be notified of certain Breaches.

In the event of any Breach of unsecured PHI, MedExpress will fully comply with all legal requirements for breach notification, which will include notification to you of any impact a Breach may have had on you and/or your family members(s) and will inform you of the actions MedExpress has undertaken to minimize any impact the Breach may or could have on you and/or your family member(s).

Please contact the Center Manager or Privacy Officer at 304-225-2500 if you have questions or need assistance regarding your medical records or the MedExpress privacy policy.

If you feel your rights have been violated and/or that MedExpress has not followed this Privacy Notice, you may file a complaint. Please contact the Center Manager or Privacy Officer at 304-225-2500. In addition, you may file a complaint with the Secretary of the Department of Health and Human Services. You will not be retaliated against for making a complaint.