Pittsburgh Oculoplastic Associates, Ltd.

NOTICE OF PRIVACY PRACTICES FOR PROTECTED HEALTH IIIFORMATION

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED

AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION

PLEASE REVIEW IT CAREFULLY

About Our Policy:

lf you have questions or wish to receive additional information about the matters covered by this Notice of Privacy Practices ("Notice"),

please contact the Privacy Officer for Pittsburgh Oculoplastic Associates, Ltd. ("POA"), Daniel Buerger, MD at347t Fifth Ave, Suite 1115;

Pgh, PA 15213 or call 4t2-681,-4220.

This Notice is provided to you in compliance with the requirements of the Health lnsurance Portability and Accountability Act of 1996,

the Health lnformation Technology for Economic and Clinical Health Act, Title Xlllof the American Recovery and Reinvestment Act of

2009 (the "HITECH Act") and associated regulations, as may be amended (collectively referred to as "HlPAA") describing POA's legal

duties and privacy practices with respect to your Protected Health lnformation ("PHl").

POA is required to abide by the terms of this Notice currently in effect, and may need to revise the Notice from time to time. Any

requiredrevisionsofthisNoticewill beeffectiveforall PHlthatPOAmaintains. AcurrentcopyoftheNoticewill bepostedineach

office and you may request a paper or electronic copy of it.

PHlconsists of all individually identifiable information which is created or received by POA and which relates to your past, present or

future physical or mental health condition, the provision of health care to you, or the past, present or future payment for health care

provided to you.

USE AND DISCTOSURE OF PH! FOR WHICH YOUR CONSENT OR AUTHORIZATION IS NOT REqUIRED

HIPAA permits POA to use or disclose your PHI in certain circumstances, which are described below, without your authorization.

However, Pennsylvania law may not permit the same disclosures. POA will comply with whichever law is stricter.

1-. TREATMENT: POA may use and disclose your PHI to provide, coordinate or manage your health care and related services,

including consulting with other health care providers about your health care or referring you to another health care provider

for treatment. For example, POA may discuss your health information with a specialist to whom you have been referred to

ensure that the specialist has the necessary information he or she needs to diagnose and/or treat you. Further, POA may

contact you to remlnd you of a scheduled appointment.

2. PAYMENT: POA may use and disclose your PHl, as needed, to obtain payment for the health care it provides to you. For

example, POA may disclose to a third-party payer the treatment you are going to receive to ensure that the payer will cover

that treatment. Additionally, POA may disclose to a third party payer or grant funding service, as necessary, the type of

services you received to reimbursement for your treatment.

3. HEALTH CARE OPERATIONS: POA may use or disclose your PHI in order to carry out its administrative functions. These

activities include, but are not limited to, quality assessment and improvement activities, reviewing the competence or

qualification of health care professionals, conducting training programs in which students provide treatment under the

supervision of one of POA's health care professionals, business planning and development, business management and general

administrativeactivities. Forexample,POAmaydiscloseyourPHl toaccreditationagenciesreviewingthetypesofservices

provided.

4. REQURED BY [AW: POA may use or disclose your PHI to the extent that such use or disclosure is required by law.

PUBLIC HEALTH: POA may disclose your PHI to a public health authority, employer or appropriate governmental authority

authorized to receive such information for the purpose of: (a) preventing or controlling disease, injury, or disability; reporting

disease or injury; conducting public health surveillance, public health investigations and public health interventions; or at the

direction of a public health authority, to an official of a foreign government agency in collaboration with a public health

authority; or reporting child abuse or neglect; (b) activities related to the quality, safety or effectiveness or activities or

products regulated by the Food and Drug Administration; (c) notifying a person who may have been exposed to a

communicable disease or may otherwise be at risk of spreading a disease or condition.

ABUSE, NEGTECT OR DOMESTIC VIOLENCE: POA may disclose your PHI to a government authority authorized to receive

reports of abuse, neglect or domestic violence if it reasonably believes that you are a vlctim of abuse, neglect or domestic

violence. Any such disclosure will be made: 1) to the extent it is required by law; 2) to the extent that the disclosure is

authorized by statute or regulation and POA believes the disclosure is necessary to prevent serious harm to you or other

potential victims; or 3) if you agree to the disclosure.

HEALTH OVERSIGHT ACTIVITIES: POA may disclose your PHI to a health oversight agency for any oversight activities authorized

by law, including audits; investigations; inspections; licensure or disciplinary actions; civil, criminal or administrative actions or

proceedings; or other activities necessary for the oversight of the health care system, government benefit programs,

compliance with government regulatory program standards or applicable laws.

JUDICIAL and ADMtNISTRATIVE PROCEEDING: POA may disclose your PHI in the course of any judicial or administrative

proceeding in response to an order of a court or administrative tribunal, or in response to a subpoena, discovery request, or

other lawful process upon receipt of "satisfactory assurance" that you have received notice ofthe request.

tAW ENFORCEMENT PURPOSES: POA may disclose limited PHI about you for law enforcement purposes to a law enforcement

official: (a) in compliance with a court order, a court-ordered warrant, a subpoena or summons issued by a judicial officer or an

administrative request: (b) in response to a request for information for the purposes of identifying or locating a suspect,

fugitive, material witness or missing person; (c) in response to a request about an individual that is suspected to be a victim of a

crime, if, under limited circumstances, POA is not able to obtain your consen| (d) if the information relates to a death POA

believes may have resulted from criminal conduct; (e) if the information constitutes evidence of criminal conductthat occurred

on the premises of POA; (f) in certain emergency circumstances, to alert law enforcement of the commission and nature of a

crime, the location and victims of the crime and the identity, or description and location of the perpetrator of the crime.

CORONERS, MEDICAI EXAMINERS and FUNERAL DIRECTORS: POA may disclose your PHI to a coroner or medical examiner for

thepurposeofidentification,determiningacauseofdeathorotherdutiesauthorizedbylaw. POAmaydiscloseyourPHltoa

funeral director, consistent with all applicable laws, in order to allow the funeral director to carry out his or her duties.

RESEARCH: POA may use or disclose your PHlfor research purposes, provided that an institutional review board authorized by

law or a privacy board waives the authorization requirement and provided that the researcher makes certain representations

regarding the use and protection of the PHl.

SERIOUS THREAT TO HEALTH OR SAFETY: POA may disclose your PHl, in a manner which is consistent with applicable laws and

ethical standards, lf the disclosure is necessary to prevent or lessen a serious threat to health or safety of a person or the

public, or the information is necessary to apprehend an individual.

SPECIALIZED GOVERNMENT FUNCTIONS: POA may also disclose your PHl, (a) if you are a member of the United States or

foreign Armed Forces, for activities that are deemed necessary by appropriate military command authorities to assure the

proper execution a military mission; (b) to authorized federal officials for the conduct of lawful intelligence, counterintelligence

and other national security activities authorized by law; (c) to authorized federal officials for the provision of

protective services to the President, foreign heads of state, or other people authorized by law and to conduct investigations

authorized by law; or (d) to a correctional institution or law enforcement official having lawful custody of you under certain

circumstances.

WORKERS'COMPENSATION: POA may disclose your PHI as authorized by, and in compliance with, laws relating to workers'

compensation and other similar programs established by law.

USE AND DISCLOSURES TO WHICH YOU MAY OBJECT

If you do not object to the following uses or disclosures of your PHl, POA may: 1) disclose to a family member, other relative, a

close personal friend, or other person identified by you the information relevant to their involvement in your care or payment

related to your care;2) notify others, or assist in the notification, of your location, general condition, or death; or 3) disclose

your PHI to assist in disaster relief efforts,

10.

tt.

L2,

13.

t4.

15.

Pittsburgh OculoplasticAssociates, Ltd. 3471Fifth Ave, Suite 1115, Pgh, PA 752t3 472-68L-4220

rb.

OTHER USES AND DISCLOSURES OF PHI

Any use or disclosure of your PHI that is not listed herein will be made only with your written authorization. You have the right

to revoke such authorization at any time, provided that the revocation is in writing, except to the extent that: 1) POA has taken

action in reliance on the prior authorization; or 2) If the authorization was obtained as a condition of obtaining insurance

coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

YOUR RIGHTS REGARDING YOUR PHI

RESTRICTION OF USE AND DISCTOSURE: You have the right to request that PoA restrict the PHI it uses and discloses in

carrying out treatment, payment and health care operations. You also have the right to request that POA restrict the PHI it

discloses to a family member, other relative or any other person identified by you, which is relevant to such person's

involvement in your treatment or payment for your treatment. By law, POA is not obligated to agree to any restriction that you

request. lf POA agrees to a restriction, however, it may only disclose your PHI in accordance with that restriction, unless the

information is needed to provide emergency healthcare to you. lf you wish to request a restriction on the use and disclosure of

your PHl, please send a written request to the Privacy Officer which specifically sets forth: 1) that you are requesting a

restriction on the use or the disclosure of your PHI;2) what PHI you wish to restrict; and 3) to whom you wish the restrictions

to apply (e.g. your spouse). POA will not ask why you are requesting the restriction. The Privacy Officer will review your

request and notify you whether or not POA will agree to your request to restrict disclosure of your PHI to a health plan, if the

disclosure is for payment, or health care operations and the disclosure pertains to a health care item or service for which you

have paid out of pocket in full.

AUTHORIZATION REQUIRED: Most uses and disclosures of PHI for marketing and the sale of PHI require your authorization' ln

addition, disclosure of psychotherapy notes is prohibited without your authorization, except as allowed by law.

FUNDRAISING: POA may contact you for purposes of fundraising to support its programs. You have the option to opt-out of

this type of communication.

CONFIDENTIAL COMMUNICATIONS; You have the right to receive confidential communications of your PHl. You may request

that you receive communications of your PHI from POA in alternative means or at alternative locations. POA will accommodate

all reasonable requests, but certain conditions may be imposed.

20a. TorequestthatPOAmakecommunicationsofyourPHl byalternativemeansoratalternativelocations,pleasesenda

written request to the Privacy Officer setting forth the alternative means by which you wish to receive communications or the

alternative location at which you wish to receive such communications. POA will not ask why you are making such a request'

ACCESS TO PHI: You have the right to inspect and obtain a copy of your PHI maintained by POA. Under HIPAA, you do not

have the right to inspect or copy information compiled in reasonable anticipation of, or for use in, a civil, criminal or

admlnistrative action or proceeding, or information that POA is otherwise prohibited by law from disclosing.

21a. lfyouwishtoinspectorobtainacopyofyourPHl,pleasesendawrittenrequesttothePrivacyOfficer. lfyourequesta

copyofyourPHl,POAmaychargeafeeforthecostof copyingandmailingtheinformation. Youmayalsorequestthatacopy

of your PHI be transmitted to your electronically.

21b. HIPAApermltsPOAtodenyyourrequesttoinspectorobtainacopyofyourPHlforcertainlimitedreasons. lfaccessis

denied,youmaybeentitledtoareviewofthatdenial. lfyoureceiveanaccessdenial andwantareview,pleasecontactthe

Privacy Officer. The Privacy Officer will designate a licensed health care professional to review your request. This revlewing

health care professional will not have participated in the original decision to deny your request. POA will comply with the

decision of the reviewing health care professional.

AMEDING PHI: You have the right to request that POA amend your PHl. To request that an amendment be made to your PHl,

please send a written request to the Privacy Officer. Your written request must provide a reason that supports the request

amendment. POA may deny your request if it does not contain a reason that supports the requested amendment.

Additionally, POA may deny your request to have your PHI amended if it determines that; 1) the information was not created

by POA and amendment may be made elsewhere; 2) the information is not part of a medical or billing record; 3) the

information is not available for your inspection; or 4) the information is accurate and complete.

NOTIFICATION OF BREACH: POA will notify you following a breach of your PHI as required by law.

ACCOUNTTNG OF DISCLOSURE OF YOUR PHI: You have the right to request a listing of certain disclosure of your PHI made by

POA during the period of up to six years prior to the date on which you make your request. Any accounting you request will

not include: 1) disclosures made to carry out treatment, payment or health care operations; 2) disclosures made to you; 3)

dlsclosures made pursuant to an authorization given by you; 4) disclosures made to other people involved in your care or made

for notification purposes; 5) disclosures made for national security or intelligence purposes; 6) disclosures made to correctional

77.

18.

19.

20.

2t.

22.

23.

24.

Pittsburgh Oculoplastic Associates, Ltd. 3471 Fifth Ave, Suite 1115, Pgh, PA 15273 4t2-681-4220

institutions or law enforcement officials; or 7) disclosures made prior to April 14, 2003. The right to receive an accounting is

subject to certain other exceptions, restrictions and limitations set forth in applicable statutes and regulations.

24a.TorequestanaccountingofthedisclosuresofyourPHl,pleasesendawrittenrequesttothePrivacyOfficer. Yourwritten

request must set forth the period for which you wish to receive an accounting. POA will provide one free accounting during

each twelve month period. lf you request additional accountings during the same twelve month period, you may be charged

for all costs incurred in preparing and providing that accounting. POA will inform you of the fee for each accounting in advance

and will allow you to modify or withdraw your request in order to reduce or avoid the fee.

25. OBTAINING A COPY OF THIS NOTICE: You have the right to request and receive a paper or electronic copy of this Notice at any

time.

COMPLAlNTS

26. lf you believe that your privacy rights have been violated, you may file a complaint with POA or with the Secretary of Health

and Human Services. To file a complaint with POA, please contact the Privacy Officer at the address listed on the front page of

this notice. All complaints must be submitted in writing. POA will not retaliate against you for filing a complaint.

Pittsburgh Oculoplastic Associates, Ltd. 3471 Fifth Ave, Suite 1115, Pgh, PA L5213 412-681-4220