Our Pledge Regarding Your Health Information

We understand that information about you and your health is confidential. We are committed to protecting the privacy of this information. Each time you visit a Scripps Mercy Surgery Pavilion, we create a record of the care and services you receive. We need this record to provide you with quality care and to comply with certain legal requirements.

This notice applies to all of the records of your care generated by any of the Scripps Mercy Surgery Pavilion, whether made by health care personnel or your physician. This notice will tell you about the ways in which we may use and disclose health information about you, as well as certain obligations we have regarding the use and disclosure of health information. It also will describe your rights regarding your health information.

Our Responsibilities

Our primary responsibility is to safeguard your personal health information. We must give you this notice of our privacy practices, and follow the terms of the notice currently in effect.

Changes to this notice: We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. A copy of the notice currently in effect will be available at the registration area of this facility.

How We May Use and Disclose Health Information About You

The following categories describe different ways that we use your health information within Scripps Mercy Surgery Pavilion and disclose your health information to persons and entities outside of Scripps Mercy Surgery Pavilion. We have not listed every use or disclosure within the categories below, but all permitted uses and disclosures will fall within one of the following categories. In addition, there are some uses and disclosures that will require your specific authorization.

Treatment: We will use and disclose your protected health information to provide, coordinate or manage your health care and any related services. We may disclose health information about you to doctors, nurses, technicians, medical students, interns or other allied health personnel who are involved in taking care of your medical or pastoral needs during your visit with us. We may communicate information to another non-Scripps Mercy Surgery Pavilion care provider for the purposes of coordinating your continuing care.

Payment: We may use and disclose your information to bill for services provided by Scripps and to obtain payment from you, an insurance company; a third party or a collection agency. This may include the disclosure of health information to obtain prior authorization for treatment and procedures from your insurance plan.

Hearth Care Operations: Uses and disclosures of health information are necessary to operate our health care facility and to make sure all of our patients receive quality care. We may use and disclose relevant health information about you for health care operations. Examples include quality assurance activities, post-discharge telephone calls to follow-up on your health status, medical staff credentialing, administrative activities including Scripps Mercy Surgery Pavilion financial and business planning and development, customer service activities including patient satisfaction surveys investigation of complaints and certain marketing activities such as health education options for treatment and services.

Business Associates: Scripps Mercy Surgery Pavilion provides some services through contracts with business associates. Examples of business associates include accreditation agencies, management consultants, quality assurance reviewers and billing and collection services. We may disclose your health information to our business associates so they can perform the job we’ve asked them to do. To protect your health information, we require our business associates to sign a contract or written agreement that states they will appropriately safeguard your information.

Appointment Reminders: We may use and disclose health information to contact you as a reminder that you have an appointment for treatment or medical care at our health care facility These appointment reminders may be initiated by an automated voice message system.

Special Situations That Do Not Require Your Authorization

State or federal law permits the following disclosures of your health information without verbal or written permission from you.

Organ and Tissue Donation: We may release health information to organizations that handle organ, eye or tissue procurement or transplantation.

Research: We may disclose your protected health information to researchers when permitted by law. For example, when preparing research protocols when data is not removed from Scripps.

Military and Veterans: If you are a member of the armed forces, we may release health information about you as required by military command authorities. Worker’s Compensation: We may release health information about you for worker’s compensation or similar programs if you have a work-related injury. These programs provide benefits to you for your work-related injuries.

Ave.rting a Serious Threat to Health or Safety: We may use and disclose health information about you, when necessary, to prevent a serious threat to your health or safety or the health and safety of another person or the public. These disclosures would be made only to someone able to help prevent the threat.

Health Oversight Activities: We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws. Public

Health Activities: We may disclose health information about you for public health activities. These generally include the following: • To prevent or control disease, injury or disability • To report births and deaths • To report child and adult abuse or neglect • To report reactions to medications, problems with products or other adverse events • To notify people of recalls of products they may be using • To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition

Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may disclose health information about you in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute.

Law Enforcement: We may disclose health information if asked to do so by law enforcement officials for the following reasons: • In response to a court order, subpoena, warrant, summons or similar process • To identify or locate a suspect, fugitive, material witness or missing person • To identify the victim of a crime if, under certain circumstances, we are unable to obtain the person’s authorization • To release information about a death we believe may be the result of criminal conduct • Criminal conduct at our facility • Emergency circumstances, to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime

Coroners, Medical Examiners and Mortuaries: We may disclose health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death of a person. We may release health information about patients at our facility to mortuaries as necessary to carry out their duties.

National Security and Intelligence Activities: We may disclose health information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law. Inmates: If you are an inmate of a correctional institution or under custody of a law enforcement official, we may disclose health information about you to the correctional institution or the law enforcement official. This is necessary for the correctional institution to provide you with health care, to protect your health and safety and the health and safety of others or for the safety and security of the correctional institution.

Legal Requirements: We will disclose health information about you without your permission when required to do so by federal, state or local law.

Situations Requiring Your Verbal Agreement

Directory Information: We have a “directory” of information about currently hospitalized patients available to anyone who asks for a patient by name. The directory information includes four items: 1) patient name; 2) location; 3) general condition (e.g., serious, fair, good, etc.); and 4) religious affiliation (available to clergy only). This directory information allows visitors to find your room and florists to Deliver flowers to you. You will be asked to agree to have all or part of this information included in the directory each time you come to a Scripps Mercy Surgery Pavilion. If you refuse to have your information included in the directory, we will not be able to reveal your presence or your location in the hospital to your family or friends.

Individuals Involved in Your Care or Payment for Your Care: We may disclose health information about you to a family member or friend who is involved in your medical care, unless you tell us in advance not to do so. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort (such as the Red Cross) so that your family can be notified about your condition, status and location.

Situations Requiring Your Written Authorization

If there are reasons we need to use your information that have not been described in the sections above, we will obtain your written permission. This permission is described as an “authorization.” If you authorize us to use or disclose health information about you, you may revoke that authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose health information about you for the reasons stated in your written authorization. Please understand that we are unable to take back any disclosures we have already made with your permission, and we are required to retain our records of the care we provide to you. Listed below are some typical disclosures that require your authorization.

Special Categories of Treatment Information: In most cases, federal or state law requires your written authorization or the written authorization of your representative for disclosures of drug and alcohol abuse treatment, Human Immunodeficiency Virus (HIV) and Acquired Immune Deficiency Syndrome (AIDS) test results, and mental health treatment.

Research: When a research study involves your treatment, or in certain circumstances records research, we may disclose your health information to researchers only after you have signed a specific written authorization. In addition, an Institutional Review Board (IRB) will already have reviewed the research proposal, established appropriate protocols to ensure the privacy of your health information and approved the research. You do not have to sign the authorization, but if you refuse you cannot be part of the research study and may be denied research related treatment.

Marketing: Under most circumstances, we will obtain your authorization for Scripps Mercy Surgery Pavilion related marketing activities. Some exceptions are when we have a direct face-to-face communication, if we give you a gift that is of nominal value or if the marketing activity is to provide you with information about Scripps Mercy Surgery Pavilion treatment options or services. Fundraising: For fundraising purposes, we will obtain your authorization except for our own fundraising purposes for which we may use demographic information and dates you received service.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you. You may contact a health information representative where services were provided to obtain additional information and instructions for exercising the following rights.

Obtain a copy of our Notice of Privacy Practices.

Request a restriction on certain uses and disclosures of your information. This request must be in writing. If we agree to your request, we will comply unless the information is needed to provide you with emergency treatment. However, if our system capabilities will not allow us to comply with your request, we are not required to. We can only address requests for Scripps affiliated facilities. Your request will not extend to a physician’s private practice. Inspect and request a copy of your health record. Your request for inspection or copies must be in writing and directed to the Scripps entity where your services were provided. A reasonable fee for copies will be charged. We may deny your request under very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed by another health care professional chosen by someone on our health care team. We will abide by the outcome of that review. Request an amendment to your health record if you feel the information is incorrect or incomplete. Your request must be made in writing and it must include a reason that supports the request. We may deny your request if the information was not created by our health care team, if it is not part of the information kept by our facility, if it is not part of the information which you are permitted to inspect and copy, or if the information is accurate and complete as stated. Please note, if we accept your request for amendment, we are not required to Delete any information from your health record. Obtain an accounting of disclosures to others of your health information. The accounting will provide information about disclosures made for purposes other than treatment, payment, health care operations, disclosures excluded by law or those you have authorized. Request confidential communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we only contact you at work or by mail. We will accommodate all requests that are reasonable for our system capabilities. Your request must be in writing and specify the exact changes you are requesting. Revoke your authorization. You have the right to revoke your authorization for the use or disclosure of your health information except to the extent that action has already been taken. Complain about any aspect of our health information practices to us or to the United States Department of Health and Human Services. Complaints about this notice or how Scripps Mercy Surgery Pavilion handles your health information should be directed in writing to: Scripps Health Privacy Officer, 4275 Campus Point Court, San Diego, CA 92121. There will be no retaliation against you if you file a complaint with us. You also may submit a formal complaint in writing to the Secretary of the United States Department of Health and Human Services.

This notice applies to Scripps Mercy Surgery Pavilion. If you have questions about this notice, contact the Scripps Health Privacy Officer at 1-800-SCRIPPS (1-800-727-4777).