Meriter's Notice of Privacy Practices

A. The Privacy Rule allows Meriter to use or disclose protected health information about you for purposes of treatment, payment, and health care operations. Any uses or disclosures for payment or health care operations must be limited to the minimum necessary to accomplish the purpose of the use or disclosure.

• quality assessment and improvement activities;
• protocol development;
• care management;
• case coordination and related functions;
• competence and performance reviews;
• training, accreditation, certification, licensing, credentialing or other
  related activities;
• underwriting and other insurance related activities;
• medical review and auditing functions, including fraud and abuse detection
  and compliance programs;
• conducting or arranging for legal services;
• business planning and development;
• internal grievance resolution;
• business management and general administrative activities;
• creating "de-identified" health information;
• activities relating to improving health or reducing health care costs;
• fundraising for Meriter's benefit; and
• providing Meriter newsletters.

For example, Meriter may:

• use medical records to review its treatment and services and to evaluate the performance of its staff in caring for you;
• combine medical records about many Meriter patients to decide what additional services Meriter should offer, what services are not needed, and to study the safety and effectiveness of treatments;
• disclose information to doctors, nurses, and other Meriter personnel for training purposes;
• combine its medical records with medical records from other hospitals and health care providers to compare how it is doing and find ways to make improvements in its care and services it offers;
• remove information that identifies you from a set of medical records so that others may use it to study health care and health care delivery without learning who the specific patients are;
• use and disclose medical records to contact you as a reminder that you have an appointment;
• use and disclose medical records to tell you about or recommend possible treatment options or alternatives that may be of interest to you;
• use and disclose medical records to tell you about health-related benefits or services that may be of interest to you.

B. Meriter also may use and disclose limited protected health information about you for directory purposes, to persons involved in your care or payment of your care, and for fundraising purposes, subject to your right to object to these uses or disclosures.

1. Hospital and Facility Directory. Meriter may list certain information about you (your name, where you are in Meriter, a general description of your condition (e.g., fair, good, etc.) and your religious affiliation) in a Hospital or Facility directory while you are a patient. Meriter can disclose this information, except for your religious affiliation, to people who ask for you by name. Your religious affiliation may be given to members of the clergy even if they do not ask for you by name.

2. Persons Involved in Your Care or Payment for Your Care. Meriter may release protected health information about you to a family member, friend, or someone you designate who is involved in your care or payment of medical bills. Meriter may also tell your family or friends your condition and that you are in Meriter. Meriter may also disclose your health information to an entity authorized to assist in disaster relief so that those who care for you can receive information about your location or health status.

3. Fundraising Activities. Meriter may use contact information (name, address, telephone number, dates of service, age and gender) to contact you in the future to raise money for Meriter. We may also provide this name to our related foundation for the same purpose. The money raised will be used to expand and improve the services and programs we provide the community. If you do not wish to be contacted for fundraising efforts, you must notify in writing the Executive Director of Meriter Foundation, 202 S. Park Street, Madison, WI 53715.

Wisconsin law is more protective of certain information than the Privacy Rule. Accordingly, Meriter will not disclose your information relating to treatment for mental health, developmental disabilities, alcoholism, drug dependence, or information concerning the presence of HIV, antigen or non-antigenic products of HIV or an antibody to HIV, without in each case obtaining your authorization unless otherwise permitted or required by Wisconsin or federal law.

C. The Privacy Rule and Wisconsin law allow Meriter to use or disclose your protected health information/patient health care records without your authorization or informed consent for a number of functions and activities, described below.

1. As Required by Law. Meriter is permitted to disclose your protected health information when required to do so by federal, state or local law.

2. Public Health Risks. Meriter is permitted to disclose your protected health information for public health activities, including:

• to prevent or control disease, injury or disability, to report births and deaths, and for public health surveillance or interventions;
• to report child abuse or neglect;
• to the FDA, to report adverse events or product defects, to track products, to enable product recalls, or to conduct post-market surveillance as required by the FDA;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;

3. Victims of Abuse, Neglect, or Domestic Violence. The Privacy Rule authorizes Meriter to notify the appropriate government authority if Meriter believes a patient or resident has been the victim of abuse, neglect or domestic violence. Meriter will only make this disclosure if you agree, or when required or authorized by law.

4. Health Oversight Activities. Meriter is permitted to disclose protected health information to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary activities, and other similar proceedings. Meriter may not disclose the protected health information of a person who is the subject of an investigation that is not directly related to that person's receipt of health care or public benefits.

5. Judicial and Administrative Proceedings. The Privacy Rule allows Meriter to disclose confidential protected health information in response to a court or administrative order. Meriter may also disclose your protected health information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested. Wisconsin law may require a court order for the release of patient health care records in these circumstances, and may be considered more protective of your privacy than the Privacy Rule.

6. Law Enforcement. The Privacy Rule allows Meriter to disclose protected health information if asked to do so by a law enforcement official in the following circumstances:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, Meriter is unable to obtain the person's agreement;
• About a death Meriter believes may be the result of criminal conduct;
• About criminal conduct at Meriter; and
• In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Wisconsin law generally requires a court order for the release of patient health care records in these circumstances, and may be considered more protective of your privacy than the Privacy Rule. However, Wisconsin law does allow the release of confidential patient health care records when a crime occurs on the premises and a victim is threatened with bodily harm. Wisconsin law also requires that gunshot wounds or other suspicious wounds, including burns, that are reasonably believed to have occurred as the result of a crime must be reported to the local police or sheriff. The report must include the nature of the wound and the patient's name.

7. Coroners and Medical Examiners. Meriter may disclose protected health information to a coroner or medical examiner to identify a deceased person or determine the cause of death.

8. Organ and Tissue Donation. Meriter may disclose protected health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank to facilitate organ or tissue donation and transplantation.

9. Research. Under certain circumstances Meriter may use and disclose your protected health information for research purposes. However, Wisconsin law provides additional protections for information relating to treatment for mental health, developmental disabilities, alcoholism, drug dependence, or information concerning the presence of HIV, antigen or non-antigenic products of HIV or an antibody to HIV.

10. Serious Threat to Health or Safety. If there is a serious threat to your health and safety or the health and safety of the public or another person, Meriter may use and disclose your protected health information to someone able to help prevent the threat.

11. Specialized Government Functions. In certain circumstances, the Privacy Rule authorizes Meriter to use or disclose your protected health information to facilitate specified government functions.

• Military and Veterans. Meriter may disclose the protected health information of armed forces personnel as required by military command authorities for the proper execution of a military mission.
• National Security and Intelligence Activities. Meriter may disclose your protected health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
• Protective Services for the President and Others. Meriter may disclose your protected health information to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
• Medical Suitability Determinations. Meriter may disclose your protected health information to the Department of State for use in making medical suitability determinations.
• Inmates and Law Enforcement Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, Meriter may release the protected health information of inmates and others in law enforcement custody to the correctional institution or law enforcement official, where necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

12. Workers' Compensation. Meriter may release your protected health information for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.

1. Right to Request Restrictions. You have the right to request restrictions or limitations on Meriter's uses or disclosures of protected health information about you for treatment, payment or health care operations.

Meriter is not required to agree to your request. If Meriter does agree, it will comply with your request unless the information is needed to provide you emergency treatment. A request for restrictions should include (1) what information you want to limit; (2) whether you want to limit its use, disclosure or both; and (3) to whom you want the limits to apply.

2. Right to Request Confidential Communications. You have the right to request that Meriter communicate with you about medical matters through specific channels, that is, in a certain way or at a certain location. For example, you can ask that Meriter only contact you at work, or only at home, or only by mail. Meriter will not ask you the reason for your request, and will attempt to accommodate all reasonable requests.

3. Right to Inspect and Copy. You have the right to inspect and copy a designated set of your medical records. This designated set typically includes medical and billing records, but may not include psychotherapy notes.

Please note that a request to inspect your medical records means that you may examine them at a mutually convenient time or place. If you request a copy of the information, Meriter may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request. Meriter may deny your request to inspect and copy in certain circumstances. If you are denied access to your medical records, you may have the denial reviewed by a licensed health care professional chosen by Meriter. The person conducting the review will not be the person who denied your request. Meriter will comply with the outcome of the review.

4. Right to Amend. If, in your opinion, your medical records are incorrect or incomplete, you may request that Meriter amend your records. You have the right to request an amendment for as long as the information is kept by or for Meriter. A request to amend your medical records must give the reasons for the amendment. Meriter may deny your request for an amendment if it is not in writing or does not include a reason. Meriter may also deny your request for amendment if it covers medical records that:

• Were not created by Meriter, unless the person who actually created the information is no longer available to make the amendment;
• Are not part of the medical records kept by or for Meriter;
• Are not part of the information which you would be permitted to inspect and copy, as discussed above; or
• Are accurate and complete.

5. Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of your protected health information by Meriter.

A request for accounting of disclosures must specify a time period, which may not be longer than six years, and which may not include dates before April 14, 2003. A request for accounting of disclosures should indicate in what form you want the disclosure (for example, on paper). The first accounting within a 12-month period will be free; for additional accountings, Meriter may charge for its costs after notifying you of the cost involved and giving you the opportunity to withdraw or modify your request before any costs are incurred.

6. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice at any time, even if you previously agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please contact the Privacy Representative from the Meriter entity in which you are receiving services as listed on the attached addendum.

You also may obtain a copy of the current version of Meriter's Notice of Privacy Practices at its Web site, www.meriter.com.

7. Right to Complain. If you believe your privacy rights have been violated, you may file a complaint with Meriter and/or with the federal Department of Health and Human Services. Meriter will not retaliate against you for filing such a complaint.

Notice of Privacy Practices Addendum

3/7/2008