  ATTENTION

Notice of Privacy Practice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

The Mission of PRC-Saltillo is:

• Mission: Enable individuals with speech and language impairments to successfully communicate and interact in their environment.
• Method: Provide products and services that promote success for individuals who use AAC, their families and their support teams.
• Manner: Treat everyone with whom we interact with the highest respect.

PRC-Saltillo also is an employer and provider of health benefits. Through these activities PRC-Saltillo collects, uses, and discloses personal health information to carry out its mission. This information is private and confidential. There are policies and procedures in place to protect the information against unlawful use and disclosure. The notice also provides you with other important information, including how to contact us with questions about this notice or our privacy practices.

What is this notice?

This notice describes information we collect, how we use that information, and when and to whom we may disclose it.

What is "personal health information"?

Personal health information or "PHI" (also called "protected health information"), is current, past or future information created or received by PRC-Saltillo through its health care providers, health plans and contractors. It relates to the physical or mental condition of a patient or plan member, the provision of health care to that person, or payment for the provision of health care to that person. The term PHI does not generally include publicly available information, or information available or reported in a summarized or grouped manner.

What types of personal health information does PRC-Saltillo collect?

PRC-Saltillo collects PHI through interactions with your health care providers. It can be obtained through applications, interviews, surveys, and other forms. PHI may be obtained in writing, in person, by telephone, and electronically. The information we collect varies depending on who collects it and why, but generally includes information about your relationship and transactions with our affiliates, our agents, and us.

Examples include:

• PRC-Saltillo equipment. In order to process your equipment request, PRC-Saltillo may collect or create information such as your name, address, telephone number, social security number, date of birth, medical history, diagnosis, treatment, provider identification and treatment information, financial responsibility and payment information, and family and advocate contact information.
• Employee Plans. If you receive health care benefits through a PRC-Saltillo sponsored health benefits plan (an "Employee Plan") as an employee PRC-Saltillo or the employee's dependent (spouse/domestic partner or child), we may collect information such as name, address, telephone number, social security number, date of birth, and related information. The organizations that administer these plans – commercial health benefits plans, pharmacy benefits managers, and others – may collect and exchange additional information, such as medical diagnosis and treatment information, but our employee benefits office generally does not request copies of this information without your authorization.

How does PRC-Saltillo protect personal health information internally?

Access to PHI is restricted to only those employees who need it to provide services, products, or benefits to our patients, employees, health plan members, and their dependents. We maintain physical, technical, and procedural safeguards to protect PHI against unauthorized use and disclosure. We have a Privacy Officer who is responsible for developing, educating PRC-Saltillo personnel about, and overseeing the implementation and enforcement of policies and procedures designed to safeguard PHI against inappropriate use and disclosure consistent with the applicable law.

What personal health information does PRC-Saltillo and other health care providers, employers and health plans use or disclose to third parties, and for what purposes?

When necessary for a patient's care or treatment, the operation of an Employee Plan or for other related activities, we use PHI internally and disclose it to health care providers (doctors, dentists, psychologists, pharmacies, hospitals, and other caregivers), insurers, third party administrators, plan sponsors, and other payors (employers, health care provider organizations, and others who may be responsible for paying for or administering your health benefits); vendors, consultants, government authorities; and their respective agents. They are required by law to keep PHI confidential. PRC maintains a Minimum Necessary Disclosure Policy, which limits the disclosure of PHI to the minimum amount necessary to accomplish the stated purpose. Some examples of what we do with the information we collect and the reasons it might be disclosed to third parties are described below.

Treatment, Payment, and Health Care Operations

We may use or disclose PHI with or without your consent to provide health care services or administer our health benefits plans. Examples of these uses and disclosures include:

• Treatment. PRC-Saltillo uses and discloses PHI without specific consent to provide, coordinate, and manage health care for employees and the purchase of equipment by customers . These activities include coordination or management of health care by PRC-Saltillo with third parties.
• Payment. PRC-Saltillo uses and discloses PHI to obtain and provide reimbursement for the provision of health care to equipment purchasers and health plan members. Our Employee Plans also use and disclose PHI to obtain premiums or determine or fulfill their responsibilities for coverage and provision of benefits under the plans. Examples of these payment activities include: billing, claims management, collections activities, and administration of reinsurance, stop loss and excess loss insurance policies, as well as related data processing; making eligibility, coverage, medical necessity, and related determinations, coordinating benefits among various payors, recovering payments from third parties liable for coverage; risk adjustment; utilization review activities, and disclosures to consumer reporting agencies. We may use or disclose PHI in connection with payment activities with or without your consent.
• Health Care Operations. PRC-Saltillo uses and discloses PHI in connection with standard business operations, including quality assessment and improvement activities. Examples of these activities include contacting of health care providers and patients with information about treatment alternatives, and related functions; evaluations of health care providers (credentialing and peer review activities) and health plans; operation of educational programs; underwriting, premium rating and other activities relating to the creation, renewal or replacement of health benefits contracts; obtaining reinsurance, stop-loss and excess loss insurance; conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; business planning and development; and business management and general administrative activities, including data and information systems management, customer service, resolution of internal grievances, and sales, mergers, transfers, or consolidations with other providers or health plans or prospective providers or health plans.

Other Activities Permitted or Required by Law

We may use or disclose PHI for other important activities permitted or required by law, with or without your authorization. These include:

• Reminders. We may contact you to give you information about your device purchase.
• Required by Law. We may use or disclose PHI to the extent such use or disclosure is required by law and it complies with and is limited to the requirements of that law. We also use and disclose PHI for certain law enforcement purposes and in response to official subpoenas, court orders, discovery requests, and other legal process. In addition, we use and disclose PHI in connection with health oversight activities (e.g., government audits of our compliance with certain laws and regulations; oversight of government-funded health benefits programs, etc.).
• Plan Sponsor Communications. Our Employee Plans and Affiliated Health Plans may disclose PHI to the employer, union, government agency or other organization that pays for the costs of your coverage (the "plan sponsor") as follows: to carry out plan administration functions; in summary form to obtain premium bids from health plans or to modify, amend, or terminate plans; and enrollment and participation information. We will disclose PHI to a plan sponsor only upon receipt of certification by the plan sponsor that it will appropriately use and protect the information and honor your rights (as described in Section VIII below) to access, review and amend the information, and to receive an accounting of certain disclosures of the information. For example, the plan sponsor will not be permitted to use the information for the purpose of employment-related actions or decisions or in connection with any other benefit or employee benefit plan that it sponsors.
• Family and Friends. Under certain circumstances, we may disclose PHI to family members, advocates or others that you identify to the extent it is directly relevant to their involvement with your care or payment related to your care.

Our use and disclosure of PHI must comply not only with federal privacy regulations but also with applicable Ohio law. Ohio law provides different and sometimes more stringent protections to PHI than federal regulations. Examples of these protections include: (i) special protections for sensitive information, such as information about HIV/AIDS, treatment for psychiatric conditions or substance abuse problems, and certain genetic information; (ii) a bar against redisclosure of PHI collected by third party administrators of health plans for certain purposes; and (iii) a prohibition against making changes to medical records that would conceal or alter prior entries (even if inaccurate).

Why is it important that personal health information be used and disclosed as described above?

The activities described above are necessary to effectively provide equipment to customers and to operate, employee benefits and health plans.

What does a person need to do to request other disclosures of personal health information?

Many patients and health plan members ask us to disclose PHI to people in ways not described above. For example, an adult person with a disability may want us to make her records available to a neighbor who is helping her resolve a question about her care or payment for that care. Contact information to authorize us to disclose your personal health information to a person or organization or for reasons other than those described in Section V above is attached.

If you fill out a form and later change your mind about the special authorization, you may send a letter to us at the address listed on the form to let us know that you would like to revoke the special authorization. In any communication with us, please provide your name, address, patient or member identification number or Social Security number, and a telephone number where we can reach you in case we need to contact you about your request.

What other rights does a person have with respect to personal health information, and how can the person exercise those rights?

You have a right to ask us in writing to restrict use or disclosure of your PHI related to your treatment, related to your payment or related to routine health care facility operations. In addition, you may request PHI disclosure restrictions to family members, advocates or others involved in your care. We are not required to agree to such a restriction, but if we do agree, we will honor our agreement except in case of an emergency. Any restriction we agree to is not effective to prevent uses or disclosures of PHI (i) required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with federal privacy regulations adopted under the Health Insurance Portability and Accountability Act of 1996; (ii) for health facility directories (e.g., a roster of patients staying at a hospital); or (iii) for certain activities permitted or required by law (see Section V above).

You have a right to review and obtain a copy of existing PHI contained in (i) medical and billing records about you maintained by PRC-Saltillo ; (ii) enrollment, payment, claims adjudication and case or medical management record systems maintained by or for the Employee Plans and (iii) records used by or for PRC-Saltillo to make decisions about you. You must make your request in writing and this right is limited to existing records that are maintained, collected, used or disseminated by PRC. It does not apply to information we compile in reasonable anticipation of, or for use in, civil, criminal or administrative actions or proceedings. We may charge a fee for any copies you request.

You have a right to request that we amend the records described above for as long as we maintain them. You must make the request in writing and give us a reason for the amendment. We may deny your request if: (i) we determine that we did not create the record, unless the originator of the PHI is no longer available to act on the requested amendment; or (ii) if we believe that the existing records are accurate and complete. Note that an amendment may take several forms, for example, we may add an explanatory statement to a record rather than change it.

You have a right to receive an accounting of disclosures made by PRC-Saltillo to any third party in the six years prior to the date on which the accounting is requested. This right does not apply to certain disclosures, including, but not limited to, disclosures made for the purposes of treatment, payment, or health care operations; disclosures made to you or to others involved in your care; disclosures made with your authorization; disclosures made for national security or intelligence purposes or to correctional institutions, or law enforcement purposes; or disclosures made prior to April 14, 2003. You must make any request for an accounting in writing. We may charge a fee to fill more than one request in any given year.

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

What does PRC-Saltillo plan to do with personal health information about patients, employees, and health plan members who are no longer affiliated with PRC-Saltillo?

PRC-Saltillo does not necessarily destroy PHI when individuals terminate their relationships with us. The information is necessary and used for many of the purposes described in Section V, even after the person stops receiving treatment or benefits through PRC-Saltillo, or terminates employment with us. In many cases, the information is subject to legal retention requirements.However, the policies and procedures that protect all PHI against inappropriate use and disclosure apply regardless of the status of any individual whose information is maintained.

How is this notice distributed and updated?

PRC-Saltillo posts this notice on our internet site at http://www.prentrom.com/hipaa and distributes this notice:

• To individuals who have submitted equipment purchase requests upon the receipt of submission; or, upon contact with a PRC-Saltillo representative for purposes of evaluation, whichever is earlier; PRC-Saltillo also makes copies of the notice available and prominently posted at the plant.
• To employees, at the time they enroll in an Employee Plan.
• To customers, employees and their dependents, and health plan members upon request (see Section XII for contact information).

We reserve the right to change the terms of this notice. Any changes will be effective for all personal health information that we maintain.

What more do I need to know about my privacy rights?

PRC-Saltillo is required by law to maintain the privacy of personal health information and to provide individuals with notice of its legal duties and privacy practices with respect to that information. We are required to abide by the terms of the notice currently in effect.

What should I do if I want a paper copy of this notice, if I have questions about it, or if I think my privacy rights have been violated?

If you would like a paper copy of this notice, have questions about it, or believe its terms or any PRC-Saltillo privacy or confidentiality policy has been violated with respect to information about you, please let us know immediately. If you wish to file a complaint, you can write to us at the PRC-Saltillo Privacy Office listed below. You will not be penalized for filing a complaint.

PRC-Saltillo Privacy Officer
1022 Heyl Rd.
Wooster, OH 44691
800.262.1984

Please include your name, address, and a telephone number where we can contact you, and a brief description of your concern. If you prefer, you may lodge an anonymous complaint. You also may contact the Secretary of the Department of Health and Human Services at:

The U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
202.619.0257
Toll Free: 877.696.6775

Please provide as much information as possible so that the complaint can be properly investigated. PRC-Saltillo will not retaliate against a person who files a complaint with us or with the Secretary of the Department of Health and Human Services.