UNIVERSITY OF SOUTHERN CALIFORNIA NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

What is this Notice and Why Is It Important?

By law, the University of Southern California (USC)¹, which includes USC's employed physicians, nurses and other clinical personnel, is required to protect the privacy of your identifiable medical and other health information (protected health information).

USC also is required by law to give you this notice to tell you how USC may use and give out ("disclose") your protected health information held by USC and its health care practitioners. USC must follow the terms of this notice when using or disclosing your protected health information. USC is required to obtain your permission before using or disclosing your protected health information, except as described below. This notice is effective as of April 14, 2003.

How USC May Use Your Protected Health Information

USC generally is required to obtain your written authorization ("permission") before using your protected heaith information. This section explains those situations where, under federal law, USC may use or disclose your protected health information without your permission.

USC does not need to obtain your written permission to use your protected health information for the

following purposes:

• Treatment: We use and disclose your protected health information to provide health care services to you. This includes uses and disclosures to:

• treat your illness or injury, or

" contact you to provide appointment reminders, or

• give you information about treatment alternatives or other health related benefits and services that may interest you.

• Payment: We may use and disclose your protected health information to obtain payment for health care services that we or others provide to you. This includes uses and disclosures to:

• submit and obtain payment from your health insurer, HMO, or other company that pays the cost of some or all of your health care (payor), or

• verify that your payor will pay for your health care.

• Health Care Operations: We may use and disclose your protected health information for our

health care operations, such as internal administration and planning that improve the quality and cost effectiveness of the care that we provide you. This also include uses and disclosures to:

• evaluate the quality and competence of our health care providers, nurses and other health care workers,

• train students, residents and fellows, or

' For purposes of ttie HIPAA Privacy Rule. USC is defined as those components/units that provide clinical services within the School of Pharmacy, the School of Dentistry and Hie Independent Health Professions (e.g.. Physical Therapy. Occupational Therapy. Nursing) as well as USC Care Medical Group. Inc.. the USC-affiliated faculty practice plan corporations at the Keck School of Medicine, the USC-affiliated faculty practice plan corporations for Physical Therapy and Occupational Therapy, research that involves clinical treatment, and those units that support the clinical functions, such as the Office of the General Counsel and the Office of Audit and Compliance.

• identify health-related services and products that may be beneficial to your health and then contact you about the services and products.

We may also disclose your protected hea!th information to third parties to assist us in these activities, but only if they agree in writing to maintain the confidentiality of your health information. We may also disclose your protected health information to your other health care providers, to enable them to conduct their own quality reviews, compliance activities and other health care operations. USC works together with its hospita! partners to provide you with integrated care, and shares information for joint activities, including quality assurance, compliance, and patient education. If you are treated by us at a hospital, the hospital may provide you with a joint notice that will give you more information about USC's privacy practices at that location.

In addition, USC may use and disclose your protected health information under the following circumstances:

• Relatives, Caregivers and Personal Representatives: Under appropriate circumstances, including emergencies, we may disclose your protected health information to relatives, caregivers or personal representatives who are with you or appear on your behalf (for example, to pick up a prescription). We may also need to notify such persons of your location in our facility and general condition. If you object to such disclosures, please notify your USC health care provider.

• Public Health Activities: We may disclose your protected health information for the following public health activities:

" To report to public health authorities for the purpose of preventing or controlling disease, injury or disability;

• To report information to the U.S. Food and Drug Administration (FDA) about products

and services under its jurisdiction; or " To alert a person who may have been exposed to a communicable disease or may

otherwise be at risk of contracting or spreading a disease;

• Victims of Abuse, Neglect or Domestic Violence: If we reasonably believe that you are a victim of abuse, neglect or domestic violence, we may disclose your protected health information as required by law to a social services or other governmental agency authorized by law to receive such reports.

• Health Oversight Activities: We may disclose your protected health information to a health oversight agency that is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid (for example, for fraud and abuse investigations).

• Specialized Government Functions: We may use and disclose your protected health information to units of the government with special functions, such as the U.S. military, under certain circumstances required by law.

• Coroners or Medical Examiners: We may disclose protected health information to a coroner

or a medical examiner as required by law.

• Organ and Tissue Donation: We may disclose protected health information to organizations that assist with organ, eye or tissue donation, banking or transplant.

• Health or Safety: We may disclose protected health information to prevent a serious threat

to your health and safety or the health and safety of the public or another person.

• Research: We may disclose protected health information without your authorization for certain research purposes. For example, in limited circumstances, we may disclose your information to researchers preparing a research protocol or if our Institutional Review Board committee (which is charged with ensuring the protection of human subjects in research) determines that an authorization is not necessary. We also may provide limited health information about you (not including your name, address, or other direct identifiers) for research, public health or health care operations, but only if the recipient of such information signs an agreement to protect the information and not use it to identify you.

• Development Activities: We may contact you to request a contribution to support important USC activities. In connection with any fundraising, we may disclose to our fundraising staff only demographic information about you (for example, your name, address and phone number) and dates on which we provided health care to you, without your written permission. We will not disclose your diagnosis or treatment, however, unless we have your written authorization to do so. We also may share demographic information about you with closely related foundations that assist us in our development activities, such as Doheny Eye Institute.

• Marketing Activities: We may provide you with marketing materials in a face-to-face encounter, without obtaining your authorization. We are also permitted to give you a promotional gift of nominal value, if we so choose, without obtaining your authorization. We will ask your permission before we use your health information for any other marketing

activities.

• Workers' Compensation: We may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs or as required under laws relating to workplace injury and illness.

• As Required by Law: We may disclose protected health information when required to do so by any other law not already referred to in the preceding categories.

FOR ANY PURPOSE OTHER THAN THE ONES DESCRIBED ABOVE, WE MAY ONLY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION WHEN YOU GIVE US YOUR WRITTEN AUTHORIZATION.

Your Rights Regarding Your Health Information

Right to Request Access to Your Health Information: You may request access to your medical record file and billing records maintained by us in order to inspect and request copies of the records. All requests for access must be made in writing. Under limited circumstances, we may deny you access to your records. If you would like access to your records, please obtain a record request form from your health care provider. If you request copies, we will charge you a reasonable fee for copies. We also will charge you for our postage costs, if you request that we mail the copies to you. If you

are a parent or legal guardian of a minor, certain portions of the minor's medical record may not be accessible to you under California law.

Right to Request Amendments to Your Health Information: You have the right to request that we amend your health information maintained in your medical record file or billing records. If you wish to amend your records, please obtain an amendment request form from your health care provider. All requests for amendments must be in writing. We will comply with your request unless we believe that the information that would be amended is already accurate and complete or other special circumstances apply.

Right to Revoke Your Authorization: You may revoke (take back) any written authorization obtained by us for use and disclosure of your protected health information, except to the extent that we have taken action in reliance upon it. Your revocation must be in writing and sent to the USC Privacy Office or to whomever is indicated on your authorization.

Right to An Accounting of Disclosures of Your Health Information: Upon written request, you

may obtain an accounting of certain disclosures of health information made by us (other than for treatment, payment or health care operations and for any disclosures made pursuant to your authorization.) The period of your request cannot exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. If you request an accounting more than once during a twelve (12) month period, we will charge you a reasonable fee.

Right to Request how Information is Provided to You: You may request, and we will try to accommodate, any reasonable written request for you to receive protected health information by alternative means of communication or at a different address or location.

Right to Request Restrictions on the use of your Health Information: You may request that we restrict the use or disclosure of your protected health information. All requests for such restrictions must be made in writing. While we will consider a request for additional restrictions carefully, we are not required to agree to a requested restriction and it is USC's general policy not to agree to such

restrictions.

Right to Change Terms of this Notice

We may change the terms of this notice at any time. If we change this notice, we may make the new notice terms effective for all protected health information that we hold, including any information created or received prior to issuing the new notice. If we change this notice, we will post the revised notice in our practice areas and on ourwebsite at ivww.usc.edu/compliance. You may also obtain any revised notice by contacting the USC Privacy Office.

Further Information: Complaints

If you would like additional information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to protected health information, you may contact our Privacy Office. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, the Privacy Office will provide you with the current address for the Director. We will not retaliate against you if you file a complaint with us or the Director.

USC Privacy Office

You may contact the USC Privacy Office at: 3500 Figueroa, #105, Los Angeles, CA 90089-8007,

(213) 740-8258 or complian@usc.edu.