It has long been the mission of Central Avenue Pediatrics to provide you and your family with the highest quality healthcare and health related services. We are committed to making every effort to protect the privacy and confidentiality of your family’s health information. In keeping with recently enacted federal legislation, we are pleased to present you our Notice of Privacy Practice. We believe this notice will help you understand our obligations and commitments relative to your privacy as well as your rights over medical information. As always, we welcome any suggestions or comments you might have on this or any other part of our practice.

HIPAA (Health Insurance Portability and Accountability Act) Privacy Regulation is a federal regulation that requires that we provide detailed notice in writing of our privacy practices and policies. We do realize this document is long and we have provided a contact number at the end of the notice should you have questions in regards to our privacy practices.

This Notice describes the ways that Central Avenue Pediatrics and its fully owned entities may use and disclose health information (medical record) about our patients. The Health Insurance Portability and Accountability Act requires that healthcare organizations protect the privacy of health information that identifies a patient or where the information can reasonably be used to identify a patient. Under the regulation this information is called "protected health information" and we shall refer to this as "PHI." This Notice additionally describes your rights under the regulation and our obligations regarding the use and disclosure of PHI. As a healthcare provider the law requires us to:

• Maintain the privacy of PHI about our patients;
• Give our patients of their legal guardians this Notice of our legal duties and privacy practice with respect to PHI; and
• Comply with the terms of our Notice of Privacy Practices that is currently in effect.

We reserve the right to make changes to this Notice and to make such changes effective for all PHI we may already have about our patients. If and when this Notice is changed, we will post a copy in our office in a prominent location as well as on our website. We will also provide you with a copy of the revised Notice upon your request made to our Privacy Official.

Under the regulation we may use and disclose health information for Treatment, Payment, and Heath Care Operations.

The following categories describe the different ways we may use and disclose PHI for treatment, payment, or health care operations. The examples in each category are not all-inclusive and do not constitute a complete list of all uses and disclosures for that category.

Treatment: We may use and disclose PHI about our patients to provide health care services, coordinate health care services with others or manage our patients’ health care and related services. We may consult with other health care providers (physicians, nurse practitioners, laboratory facilities, hospitals, etc.) regarding treatment and coordinate and manage our patients’ healthcare with others. For example, we may use and disclose PHI when a patient needs a prescription, lab work, an x-ray or other health care services. Additionally, we may use or disclose PHI when we refer you to another health care provider. For example, when we refer you to another health care provider, we may disclose PHI to your new physician regarding your current treatment, such as allergies or current medications.

Other areas under treatment include disclosure of PHI about our patients for treatment from another health care provider. For example, we may send a report from us to a physician that we refer you to so that the other physician may properly perform treatment. We are not required under certain circumstances to obtain a written authorization from our patients to carry out treatment of patient care.

Payment: Billing insurance companies to receive payment of behalf of the patient are a benefit to the patient. To carry out this benefit to the patient we may use and disclose PHI so that we can bill and collect payment for the treatment and services provided. This may include providing information about treatment or services with your health plan before the service(s) is received. For example, we may ask for payment authorization from your health plan before we provide care or services. To help you fully understand your out-of-pocket expense, we may use or disclose PHI to determine if your health plan will cover the case of care and services provided. We may use and disclose PHI for billing, claims management, and collection activities. We may disclose PHI to insurance companies or third party administrators providing you with additional coverage. We may disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us.

We may disclose PHI to another health care provider or to a company or health plan required to comply with the HIPAA Privacy Rule for the payment activities of that health care provider, company, or health plan. For example, we may use an outside lab to process your specimens and that entity may require PHI to appropriately bill the service to your health plan.

Health Care Operations: Health care providers may use and disclose PHI in performing business activities that are referred to as health care operations. Health care operations allow us to improve the quality of care we provide and to reduce health care cost. Health care operations may include the following:

We may use PHI about our patients’ to:

• Identify ways to improve the quality, efficiency and cost of care that we provide to our patients.
• Review and evaluate the skills, qualifications and performance of health care providers taking care of patients.
• Cooperate with outside organizations that assess the quality of care that we provide.
• Provide training programs for medical students, health care providers, or non-health care professionals (example: we may use visit notes to assist billing personnel on how to code the service) to help them improve their skills.
• Cooperate with outside organizations that evaluate, certify, or license health care providers or staff.

• We may use PHI to identify groups of patients with similar health problems to give them information about treatment alternatives, special programs or educational classes.

• We may use PHI about our patients to cooperate with organizations that review our activity. For example, physicians, accountants, lawyers and others who assist us in complying with the law and managing our business may review your PHI.
• Assist Central Avenue Pediatrics in making strategic planning decisions.
• Grievance resolution within our organization.
• Business planning and development.
• Business management and general administrative activities of our practice.
• We may use PHI about our patients to "de-identify" information that is not identifiable to any individual. This means all identifying information about you is removed.

• We may contact you to remind you of appointments and to provide you with information about treatment alternatives or other health related benefits that may be of an interest to you.

As Required by Law – We may use and disclose PHI as required by federal, state, or local law. Any disclosure is limited to the requirements of the law.

Public Health Activities – Federal and state law requires disclosures of PHI to public health authorities or their designee to carry out certain activities related to public health, including:

• Prevent or control disease, injury, or disability;
• Report disease, injury, birth, or death;
• Report child abuse or neglect;
• Notify a person who may have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease;
• Report reaction to medication or problems with products or devices related by the Food and Drug Administration that relates to quality, safety, or effectiveness of FDA-regulated products; or
• Report to employers, under limited circumstances, information related to workplace injuries or illness, or workplace medical surveillance.

Abuse, Neglect, or Domestic Violence – We may disclose PHI in certain cases to proper government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse or neglect.

Oversight Activities – We may disclose PHI to a health oversight agency for activities that includes audits, investigations, inspections, licensure and disciplinary activities and other activities conducted to monitor the health care system, government health care programs, and compliance with certain laws.

Lawsuit and Other Legal Proceedings – We may use or disclose when required by a court or in response to subpoenas, discovery requests, or other legal process when efforts have been made to advise you of the request or to obtain an order protecting the information requested.

Law Enforcement – Under certain circumstances we may disclose PHI to law enforcement officials for the following purposes:

• Under certain limited circumstances, about a suspected crime victim if we are unable to obtain a person’s agreement because of incapacity or emergency;
• To alert law enforcement of death that we suspect was the result of criminal conduct;
• When required by law;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About a crime or suspected crime committed at our office.

Coroners, Medical Examiners, Funeral Directors – We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death. We may also disclose to funeral directors, as authorized by law, so they may carry out their jobs.

Organ and Tissue Donation – If a patient is an organ donor, we may use and disclose PHI to organizations that help procure, locate, and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.

Research – We may use and disclose PHI about our patients for research purposes under certain limited circumstance.

Avert a Serious Threat to Health or Safety – We may use or disclose PHI in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public. Disclosure can only be made to person who is able to help prevent the threat.

Special Government Functions – Under certain circumstances we may disclose PHI:

• For certain military and veteran activities, including determination of eligibility for veterans for veterans benefits and where deemed necessary by military command authorities.
• To help provide protective services for the president and others.
• For the health and safety of inmates and others at correctional institutions or other law enforcement custodial situations for the general safety and health related to corrections facilities.

Required by HIPAA Privacy Rule – We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule.

Workers’ Compensation – We may disclose PHI as authorized by workers’ compensation laws or other similar programs that provide benefits for work-related injuries or illness.

Under federal law, patients or their legal guardians have the following rights regarding PHI:

Right to Inspect and Copy – You have the right to inspect and copy medical information that may be used to make decisions about patient care. Usually, this includes medical and billing records, but DOES NOT include psychotherapy notes. To inspect and copy medical information that may be used to make decisions about treatment and care, you must submit your request in writing to Central Avenue Pediatrics, Attention of Practice Administrator. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

In very limited circumstances we may deny your request to inspect and copy information. If you are denied access to medical information, you may request that the denial be reviewed. Central Avenue Pediatrics has a procedure in place where another licensed health care professional will review your request and the denial. The person conducting the review shall not be the person who denied your request. We will comply with the outcome of the review.

Right to Amend – If you believe that medical information we have about you or your child(ren) is incorrect or incomplete, you may ask us to amend the information. To request an amendment, your request must be made in writing and submitted to Central Avenue Pediatrics, Release of Information Department. You must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may additionally deny your request if you ask us to amend information that:

• We did not create;
• Is not part of the medical information kept by Central Avenue Pediatrics;
• Is not part of the information which you would be permitted to inspect and copy; or
• The information that you requested amended is accurate and complete.

Right to An Accounting of Disclosures – You have the right to request an "accounting of disclosures." This is a list of the disclosures we made of medical information about you or your child(ren). We are not required to account for disclosures for treatment, payment, health care operations, disclosures to you, or disclosures made through a written authorization.

To request this list, you must submit your request in writing to Central Avenue Pediatrics, Attention of the Practice Administrator. Your request must state the time period, which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions – You have the right to request a restriction or limitation on the medical information we use or disclose about you or your child(ren) for treatment, payment of health care operations. You have the right to request a limit on the medical information we disclose to someone who is involved in your care or the payment for your care, like a family member or friend.

We are not required to agree to your request. If we do agree to your restriction, we will comply with your request unless the information is needed to provide emergency treatment.

To request a restriction, you must make your request in writing to Central Avenue Pediatrics, Attention of Practice Administrator. In your request, you must tell us what information you want to limit, whether you want to limit our use, disclosure or both, and to whom you want the limits to apply.

Note: Central Avenue Pediatrics shall respond to your written request for a restriction in writing no later than sixty days upon request. Only restrictions to which a written response has been given shall apply.

Right to Request Confidential Communication – You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. Example, you can ask that we only contact you by mail.

To request confidential communications, you must take your request in writing to Central Avenue Pediatrics, Attention of Practice Administrator. We will not ask the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Note: Central Avenue Pediatrics shall notify you in writing if we determine your request not reasonable.

The designated Privacy Officer for Central Avenue Pediatrics is Mrs. Marcia Schiffer, Practice Administrator. Please feel free to contact her with any questions or concerns regarding this policy. She can be reached at (914) 472-4300.

If you believe your privacy rights have been violated, please contact our Privacy Officer at the number listed above. Every reasonable attempt will be made to investigate and resolve the complaint. In certain circumstances, our Privacy Officer may request that you submit your complaint in writing. Additionally, you may file a complaint with the Secretary of the Department of Health and Human Services.

Central Avenue Pediatrics has a non-retaliation, non-retribution policy for reporting or complaints. No individual filing a complaint shall be penalized.

Uses and disclosures not covered by this Notice shall be made only with your written permission. If you provide us permission to use or disclose medical information about you or your child(ren), you may revoke that permission in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already make with your permission and that we are required to retain our records of the care that we provide to our patients.