THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to Siouxland Hematology-Oncology Associates, June E. Nylen Cancer Center, Siouxland Imaging, P.C., and the Medical Staff when offering care at June E. Nylen Cancer Center or its satellite locations. For the purposes of this Notice, these entities will commonly be referred to as “Cancer Center.”

We at the Cancer Center are required by law to maintain the privacy of individually identifiable patient health information (this information is “protected health information” and is referred to herein as “PHI”). We are also required to provide patients with a Notice of Privacy Practices that explains how we will protect PHI and to abide by the terms of this Notice. In addition to following all applicable federal and state laws about protecting PHI, we at the Cancer Center regard the confidentiality of the care we provide as a sacred trust.

UNDERSTANDING HOW WE USE AND DISCLOSE PHI
Each time you visit the Cancer Center, a record of your visit is made. This record usually contains information about you, your symptoms, examination and test results, diagnoses, treatment, and a plan for future care. The PHI in your medical record helps your health care team to take care of you, as well as to help guide your future treatment, billing for services, etc. Your medical record also serves as a document of the care you have received. Understanding the PHI in your medical record and how it is used will help you to:

• Make sure that the information is accurate;
• Better understand who may have access to your PHI, and when and why such access is needed;
• Make informed decisions about giving permission for your PHI to be shared or disclosed to others.

We will only use or disclose your PHI as permitted or required by Federal and state laws and regulations, as described in this notice. Other disclosures will require your written permission.

1. DISCLOSURES FOR TREATMENT, PAYMENT, HEALTHCARE OPERATIONS
We may use or disclose your information for treatment, payment, and healthcare operations without your permission. However, if state or federal law requires us to obtain your written permission to use or disclose your health information for treatment, payment, or healthcare operations, we will do so.

We will use or disclose your PHI for treatment. The members of your health care team will communicate with one another personally and through the medical record to coordinate your care. We may provide your physician or other healthcare providers with copies of reports that may help determine your future treatment. We may use or disclose your PHI to remind you that you have appointment for care or to tell you about possible treatment options and other healthcare related services that may be of interest to you.

We will use or disclose your PHI for payment. We will send billing information to you or your insurance company. This may contain information that identifies you, as well as your diagnosis, services provided, and supplies used in the course of your care.

We will use or disclose your PHI for healthcare operations and internal business practices. We may use your PHI in our ongoing efforts to improve the quality and effectiveness of the healthcare services we provide. For example, we need to use some patients’ PHI for quality improvement activities, utilization review, professional review and performance evaluation, internal auditing, credentialing, accreditation, certification, and licensing activities, and for educational purposes. We provide information to state and national registries such as Tumor Registry, to support quality monitoring, licensure and the accreditation process. The Cancer Center also contracts with business associates to perform functions on its behalf, including Trinity Health and Iowa Health Systems, parent organizations who perform certain business functions for the Cancer Center. Whenever an arrangement between the Cancer Center and a business associate involves the use or disclosure of your PHI, the Cancer Center requires the business associate to uphold the Cancer Center’s policies on protecting PHI.

2. USE OR DISCLOSURE REQUIRED BY PUBLIC POLICY OR LAW
Disclosures Required by Law: The Cancer Center will disclose your PHI as required by federal, state or local laws without your authorization. For example, the Cancer Center may disclose information for law enforcement purposes, such as responding to a court order or subpoena, identifying a criminal suspect or a missing person, or providing information about a crime victim or criminal conduct. The Cancer Center will disclose PHI about you when required by federal, state or local law to make reports or other disclosures. The Cancer Center also will make disclosures for judicial and administrative proceedings such as lawsuits or other disputes in response to a court order or subpoena. The Cancer Center will disclose your medical information to government agencies concerning victims of abuse, neglect or domestic violence. The Cancer Center will report drug diversion and information related to fraudulent prescription activity to law enforcement and regulatory agencies. Specialized government functions will warrant the use and disclosure of PHI. These government functions will include military and veteran’s activities, national security and intelligence activities, and protective services for the President and others. The Cancer Center will make certain disclosures that are required in order to comply with workers’ compensation or similar programs. If you are an inmate of a correctional institution or under custody of a law enforcement officer, the Cancer Center will release your PHI to the correctional institution or law enforcement official.

Coroners, Medical Examiners, Funeral Directors: The Cancer Center may disclose your PHI to a coroner or medical examiner, if needed identify a deceased person or to determine a cause of death. The Cancer Center may also disclose your medical information to funeral directors as necessary to carry out their duties.

Organ Procurement: The Cancer Center may disclose PHI to an organ procurement organization or entity for organ, eye or tissue donation purposes.

Health or Safety: The Cancer Center will use and disclose PHI to avert a serious threat to health and safety of a person or the public. The Cancer Center will use and disclose PHI to Public Health Agencies for immunizations, communicable diseases, etc. The Cancer Center will use and disclose PHI for activities related to the quality, safety or effectiveness of FDA-regulated products or activities, including collecting and reporting adverse events, tracking and facilitating product recalls, etc. and post-marketing surveillance. Any patient receiving a medical device subject to FDA tracking requirements may refuse to disclose, or refuse permission to disclose, their name, address, telephone number and social security number, or other identifying information for the purpose of tracking.

More Stringent State and Federal Laws: The State laws of Iowa, Nebraska and South Dakota may be more stringent than HIPAA in several areas. State law is more stringent when the individual is entitled to greater access to records than under HIPAA and when under state law, the records are more protected from disclosure than under HIPAA. Certain federal laws also may be more stringent for disclosure than HIPAA provides and therefore the federal law would prevail. The Cancer Center will continue to abide by these more stringent state and federal laws.

3. OTHER STANDARD USES AND DISCLOSURES OF PHI
The Cancer Center uses and shares PHI in several other ways in the course of its operations. The Cancer Center can use or disclose your information for the following purposes unless you exercise your right to object or opt out:

Notification: We may use or disclose information to notify, or assist in notifying, a family member, personal representative, or another person responsible for your care about your location and general condition. However, the Cancer Center contacts a patient’s pastor or faith community only upon request.

Communication with family: We may disclose to a family member, other relative, close personal friend or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care, as appropriate. You have a right to request that your PHI not be shared with some or all of your family and friends.

Marketing: The Cancer Center is not permitted to provide your PHI to any other person or company for marketing to you of any products or services other than the Cancer Center’s products unless you have signed an authorization.

Fundraising Activities: The Cancer Center may use or disclose your demographic information (name, address, age, gender, insurance status, and dates of service) to a related foundation for fund raising activities, unless prohibited by law. Any communication sent to you will let you know how you may opt out of receiving similar communications in the future. We may contract with an outside company to conduct fundraising for the Cancer Center. This company will use your PHI only for the purposes of fundraising for the Cancer Center.

Information and Health Promotion Activities: The Cancer Center will use and disclose some of your PHI for certain health promotion activities. For example, your name and address will be used to send you newsletters or general communications. The Cancer Center may send you this information if it has determined that a product or service may help you. The communication will explain how the product or service relates to your health.

Research: The Cancer Center will use or disclose your PHI as part of research that includes providing you with treatment. For example, if you are part of a research study that includes treatment, you may be required to sign an authorization to allow researchers to use or disclose your PHI for the research study.

OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION
Any uses or disclosures that are not for treatment, payment, or healthcare operations and that are not permitted or required for public policy purposes or by law will be made only with your written authorization. Written authorizations will let you know why we are using or disclosing your PHI. You have the right to revoke an authorization at any time.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
Your records are the physical property of the Cancer Center, but you have the following rights concerning your PHI.

Right to Inspect and Copy: You have the right to access your PHI and to inspect and copy your PHI as long as we maintain it except for: psychotherapy notes, information that will be used in a civil, criminal or administrative action or proceeding, and where prohibited or protected by law. We will deny your request for access to your PHI without giving you an opportunity to review that decision if:

• You don’t have the right to inspect the information; or it is otherwise prohibited or protected by law;
• You are an inmate at a correctional institution and obtaining a copy of the information would risk the health, safety, security, custody or rehabilitation of you or other inmates;
• The disclosure of the information would threaten the safety of any officer, employee or other person at the correctional institution or who is responsible for transporting you;
• You are involved in a clinical research project and the Cancer Center created or obtained the PHI during that research. Your access to the information will be temporarily suspended for as long as the research is in progress;
• We obtained the information that you seek access to from someone other than a health care provider under a promise of confidentiality and your access request is likely to reveal the source of the information; or
• Under other limited circumstances. In these instances, however, we will allow the review of our decision by a health care professional that the Cancer Center has chosen. This person will not have been involved in the original decision to deny your request. You agree to pay a reasonable copying charge. You must make your requests to access and copy your PHI in writing. We will respond to your request within 30 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 60 days of its receipt. Right to Amend: You have the right to request an amendment to your PHI for as long as we maintain it. However, we will deny your request for amendment if:
• We did not create the information;
• The information is not part of the designated record set;
• The information would not be available for your inspection (due to its condition or nature); or
• The information is accurate and complete. If we deny your request for changes in your PHI, we will notify you in writing with the reason for the denial. We will also inform you of your right to submit a written statement disagreeing with the denial. You may ask us to include your request for amendment and the denial any time we disclose the information that you wanted changed. We may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal. You must make your request for amendment of your PHI in writing to the Cancer Center, including your reason to support the requested amendment. We will respond to your request within 60 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 90 days of its receipt.

Right to an Accounting: You have a right to receive an accounting of the disclosures of your PHI that we made, except for the following disclosures:

• To carry out treatment, payment or health care operations;
• To you or authorized by you in writing
• To persons involved in your care;
• For national security or intelligence purposes;
• To correctional institutions or law enforcement officials; or
• That occurred prior to April 14, 2003.

For each disclosure, you will receive: the date of the disclosure, the name of the receiving organization and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of the written request for the information, if there was one. You must make your request for an accounting of disclosures of your PHI in writing to the Cancer Center. You must include the time period of the accounting, which may not be longer than 6 years. We will respond to your request within 60 days from its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 90 days of its receipt. In any given 12-month period, we will provide you with an accounting of the disclosures of your PHI at no charge. Any additional requests for an accounting within that time period will be subject to a reasonable fee for preparing the accounting.

Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI to carry out treatment, payment or health care operations or to prohibit such disclosure. We will consider your request but are not required to agree to the requested restrictions. You also have the right to limit the release of PHI to family, friends, or in the hospital directory. For example, you may ask that your name not be used in the waiting room or that information about your expected discharge date not be shared with your family.

Right to Confidential Communications: You have the right to receive confidential communications of your PHI by alternative means or at alternative locations. For example, you may request that we only contact you at work or by mail.

Right to Receive a Copy of this Notice: You have the right to receive a paper copy of this Notice of Privacy Practices, upon request.

COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with the Cancer Center or with the Secretary of the Department of Health and Human Services. To file a complaint with the Cancer Center, please contact the Executive Director at 712.252.9301. All complaints must be submitted in writing. The Cancer Center assures you that there will be no retaliation for filing a complaint.

JOINT USE OF YOUR HEALTH INFORMATION
The medical staff and the Cancer Center participate together in an organized health care arrangement to deliver health care to you at the Cancer Center. Both the Cancer Center and its medical staff have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of health care services to you at the Cancer Center. Physicians and allied health care providers are members of the Cancer Center’s medical staff and will have access to and use your PHI for treatment, payment and health care operations purposes related to your care within the Cancer Center. We will disclose your PHI to the medical staff for payment, treatment and health care operations.

CHANGES TO THIS NOTICE
If our information practices change, we may change this Notice. If we do so, the change may be effective for information gathered both before and after the effective date of such change. However, before we change our practices, we will post a copy of our new notice at all the Cancer Center affiliates and on our website. The effective date of our Notice will always appear at the end of the Notice.

FOR MORE INFORMATION OR TO REPORT A PROBLEM
If you have questions or would like additional information, you may contact the Executive Director at 712.252.9301. You may also write to us at the address below: Executive Director, June E. Nylen Cancer Center, 230 Nebraska Street, Sioux City IA 51101.

Effective Date: April 14, 2003