TABLE OF CONTENTS
----------------------------------------------------------------------------

A. We must protect your health information.

B. We may use and disclose your protected health information (PHI) as follows:

1. We may use and disclose your PHI to provide health care treatment to you.
2. We may use and disclose your PHI to get payment for services.
3. We may use and disclose your PHI for health care operations.
4. We may use and disclose PHI in other situations without your permission.
5. You can object to certain uses and disclosures.
6. We may contact you to remind you of an appointment.
7. We may contact you with information about treatment, services, products or health care providers.
8. We may contact you to raise money for our organization.

C. You have several rights regarding PHI.

1. You have the right to ask that we restrict the uses and disclosures of your PHI.
2. You have the right to ask for different ways to communicate with you.
3. You have the right to see and copy your PHI.
4. You have the right to ask for changes to your PHI.
5. You have the right to a list of certain people or organizations who have gotten your PHI from us.
6. You have a right to a copy of this Notice.

D. You may have additional rights under other laws.

E. You may file a complaint about our privacy practices.

F. Effective date of this Notice
----------------------------------------------------------------------------

A. WE MUST PROTECT HEALTH INFORMATION ABOUT YOU.

We must protect the privacy of your protected health information or "PHI" for short. This Notice tells the types of ways that we will use your PHI. It also explains the ways that we will share, or disclose, PHI about you. In addition, we may make other uses and disclosures that occur as a result of the permitted uses and disclosures described in this Notice.

We must follow this Notice. We may change this Notice. We may make the changes apply to all PHI that we already have if we:

• Post the new notice in our offices;
• Make copies of the new notice available if someone asks for it (either at our offices or through the Novant Health Privacy Official); and
• Post the new notice on our website: www.novanthealth.org

B. WE MAY USE AND DISCLOSE YOUR PHI WITHOUT YOUR PERMISSION IN CERTAIN SITUATIONS.

1. We may use and disclose your PHI to provide health care treatment to you.

We may use and disclose your PHI to provide, coordinate or manage your health care and related services. This may include sharing information with other health care providers about your treatment and coordinating and managing your health care with others. For example, we may use and disclose your PHI when you need medicine, lab work, a x-ray, or other health care services. We also may use and disclose your PHI when we send you to another health care provider.

EXAMPLE: A doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. Different facility departments may also need to share your PHI to coordinate services you may need. Such services include getting medicine, lab work, meals and x-rays. We may also disclose your PHI to people outside the hospital who may be involved in your medical care after you leave the facility. These people may include home health providers or others who may provide services to you.

2. We may use and disclose your PHI to obtain payment for services.

• Generally, we may use and give your PHI to others to bill and collect payment for services. Before we provide scheduled services, we may share information with your health plan(s) so that we can ask whether your plan or policy will pay for the service. We may also share PHI with:
• Billing departments;
• Collection departments or agencies;
• Insurance companies, health plans and their agents who provide coverage;
• Hospital departments that review your care to see if the care and the costs were appropriate;
• Government agencies to try to get you qualified for benefits;
• Consumer reporting agencies (such as credit bureaus); and
• Other departments, agencies and/or companies to obtain payment.

EXAMPLE: Let's say you have a broken leg. We may need to give your health plan(s) information about your condition, supplies used (such as plaster for your cast or crutches), and services you received (such as x-rays or surgery).The information is given to our billing department and your health plan so we can be paid or you can be reimbursed. We may also send the same information to our hospital department that reviews our care.

3. We may use and disclose your PHI for health care operations.

We may use and disclose PHI to perform business activities, which we call "health care operations". These "health care operations" allow us to improve the quality of care we provide and reduce health care costs. Examples of the way we may use or disclose your PHI for "health care operations" include:

• Reviewing and improving the quality, efficiency and cost of care that we provide to you and others. For example, we may use your PHI to develop ways to help our health care providers and staff in deciding what medical treatment should be given to others.
• Improving health care and lowering costs for groups of people who have similar health problems and to help manage and coordinate the care for these groups of people. We may use PHI to identify groups of people with similar health problems to give them information about treatment choices, classes, or new procedures.
• Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you.
• Training students, health care providers or other professionals (for example, billing clerks or assistants) to help them practice or improve their skills.
• Working with outside organizations that assess the quality of the care others and we provide. These organizations might include government agencies or accrediting bodies such as the Joint Commission on Accreditation of Healthcare Organizations.
• Working with outside organizations that evaluate, certify or license health care providers, staff or facilities in a given field or specialty. For example, we may use or disclose PHI so that one of our nurses may become certified as an expert in a certain field of nursing, such as pediatric nursing.
• Helping people who review our activities. For example, PHI may be seen by doctors reviewing the services provided to you, and by accountants, lawyers, and others who help us in following the law.
• Planning for our future and raising money for our organization.
• Managing our business and performing general administrative activities related to our organization and the services we provide.
• Solving problems or complaints within our organization.
• Reviewing activities and using or disclosing PHI in the event that we sell our business, property or give control of our business or property to someone else.
• Complying with this Notice and with the law.

4. We may use and disclose PHI in other situations without your permission.

We may use and/or disclose PHI about you without your permission. Those situations include when the use and/or disclosure:

• is required by law.
• is needed for public health activities.
• is about a victim of abuse, neglect or violence in the home.
• is for health oversight activities.
• is for legal proceedings.
• is for police or other law enforcement purposes.
• relates to a person who has died.
• relates to organ, eye or tissue donation.
• relates to medical research. In certain situations, we may share your PHI for medical research.
• is to prevent a serious threat to health or safety.
• relates to special government purposes.
• relates to someone who is in jail, prison or police custody.

5. You can object to certain uses and disclosures.

Unless you tell us not to, we may use or share your PHI as follows:

• We may share your name, your room number, and your condition in our patient directory with church or religious leaders and with people who ask for you by name. We also may share information about any church or other religious memberships with religious leaders
• We may share your PHI with a family member, friend or other person identified by you, information directly related to that person's involvement in your care or payment for your care. We also may share PHI needed to let these people know where you are, your general condition or your death.
• We may share your PHI with a public or private agency (for example, American Red Cross) for disaster relief purposes. Even if you ask us not to, we may share your PHI, if we need to for an emergency.

If you do not want us to use or disclose your PHI in the above situations, please tell the person who registered you or call the Novant Health Privacy Official. If you ask not to be included in the patient directory, you will not get any cards or flowers that are sent to the facility for you. Also, we will not tell callers or visitors that you are here.

6. We may contact you to remind you of an appointment.

We may use and/or disclose PHI to contact you to remind you about an appointment you have for treatment or medical care.

7. We may contact you with information about treatment, services, products or health care providers.

We may use and/or disclose PHI to manage or coordinate your healthcare. This may include telling you about treatments, services, products and/or other healthcare providers. We may also use and/or disclose PHI to give you gifts of a small value.

EXAMPLE: If you learn that you have diabetes, we may tell you about nutritional and other counseling services that may help you.

8. We may contact you to raise money for our organization.

We may use and/or disclose PHI about you, including disclosure to a foundation, to contact you to raise money. We will only share your name, address, telephone number, and the dates you received treatment or services at the hospital, unless you sign an authorization. If you do not want to be contacted in this way, you must write to the Novant Health Privacy Official.

** ANY OTHER USE OR DISCLOSURE OF PHI
ABOUT YOU REQUIRES YOUR WRITTEN PERMISSION**

In any situations other than those listed above, we will ask for your written permission before we use or disclose your PHI. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing. We will not disclose PHI about you after we receive your cancellation, except for disclosures that were made before we got your cancellation.

C. YOU HAVE SEVERAL RIGHTS REGARDING YOUR PHI.

1. You have the right to ask us to restrict the uses and disclosures of your PHI.

You have the right to ask that we restrict the use and disclosure of your PHI. You must ask us in writing. We do not have to agree to your request. Even if we agree to your request, in certain situations your restrictions may not be followed. You may ask for a restriction by filling out a form that you can get from the registration desk or your caregiver. We will write to you to tell you if your request was granted.

2. You have the right to ask for different ways to communicate with you

You have the right to ask how and where we contact you about PHI. For example, you may ask that we contact you at your work address or phone number instead of contacting you at home. If your request is reasonable, then we must do what you ask, if we can. In order for us to do this, you must give us information about how payment, if any, will be handled. You also must give us another address or other way to reach you.

3. You have the right to see and copy your PHI.

You have the right to see and get a copy of your PHI. You must ask us in writing by filling out a form that you may get from the Department of Health Information Systems or the registration desk. We may charge you a fee to do this. There are some situations where we do not have to do what you ask.

4. You have the right to ask for changes to your PHI

You have the right to ask us to make changes to your PHI. You must ask us in writing by filling out a form that you can get from the Department of Health Information Systems or the registration desk. You must tell us why you want us to make the change. We do not have to make the change.

5. You have the right to a list of certain people or organizations who have gotten your PHI from us.

If you ask in writing, you can get a list of certain of our disclosures of your PHI. You may ask for disclosures made in the last six (6) years. We cannot give you a list of any disclosures made before April 14, 2003. We must give you a list of only certain disclosures. If you ask for a list of disclosures more than once in 12 months, we can charge you a reasonable fee. You may ask for a listing of disclosures by filling out a form that you can get from the Department of Health Information Systems or the registration desk.

6. You have the right to a copy of this Notice.

You can get a copy of this Notice by asking the Novant Health Privacy Official. We will give you a copy of this Notice on the first day we treat you at our facility (in an emergency, we will give this Notice to you as soon as possible).

D. MAY HAVE ADDITIONAL RIGHTS UNDER OTHER LAWS.

In some cases, South Carolina or federal law may give your health information greater protection of privacy. We must follow both federal and state law. These laws may apply to our treatment of you:

• If you have a communicable disease (for example, tuberculosis, syphilis or HIV/AIDS), information about your disease will be kept confidential, and only will be shared without your written permission in limited situations. For example, we will get your permission to share this information for payment purposes. However, we do not need to get your permission to report information about your disease to State and local health officials or to prevent the spread of the disease. If you have HIV or Hepatitis B, your doctor does not need your permission to share your status with a lay healthcare giver who is, or will be, providing direct hands-on health care to you. Your doctor will tell you before and after s/he shares this information and with whom s/he shared the information.
• Some of our facilities and services may be supervised by a State agency, such as the South Carolina Department of Health and Environmental Control, that may inspect our operations and may review PHI.
• South Carolina law requires that information from certain kinds of neonatal testing may be released only to the parents or legal guardians of the child, the child's doctor, or the child when the child is 18 or older.
• Under South Carolina law, we must have your written permission in order to transfer or receive your prescription drug information. This requirement does not apply to:
• Sharing prescription drug orders to comply with federal and state laws about the practice of pharmacy;
• Communications with healthcare providers who provide, or have provided, medical or therapeutic treatment, pharmacy services, or medical or therapeutic consultation services to you;
• Information obtained from your request for information about a prescription drug or a device manufacturer or vendor;
• Information needed to recall a defective drug or device or any information needed to protect the health and safety of a person or the public;
• Information that must be released under state or federal law;
• Information needed to handle healthcare claims, if the recipient does not use or disclose the information;
• Information voluntarily disclosed by you to entities outside of the provider-patient relationship;
• Information used in clinical research that is monitored by an institutional review board;
• Information that does not identify you by name, or that is encoded, and is used for epidemiological studies, research, statistical analysis, medical outcomes, or pharmacoeconomic research;
• Information transferred as part of a sale of a business or medical practice;
• Information that is needed for a third party to perform quality assurances programs, medical record reviews and maintenance, internal audits, or other similar programs, if the third party makes no other use or disclosure of the information;
• Information given to a someone who, at your request, picks-up a prescription; and
• Information a health plan licensed by the South Carolina Department of Insurance needs to give a third party to perform case, utilization and disease management for health plan enrollees, if the third party makes no other use or disclosure of the information.
• We may also release information about you if we reasonably believe that the release is necessary to protect someone's life or health.
• South Carolina law generally requires that certain mental health providers, like psychologists, professional counselors and licensed master social workers, get your written permission before sharing your mental health information. Before sharing mental health information about you with others for payment or healthcare operations, we will ask that you sign a form giving us permission to share that information. There are some exceptions to this requirement. We can share this information when necessary to coordinate or promote your care or treatment. If we believe that there is an immediate threat to the health or safety of you, or of someone else, we may share information to prevent or reduce the harm. Sometimes the law makes us share information about you. For example, a court might order disclosure. We have to share information when we believe that a child or vulnerable adult is being abused or neglected. We also must share information if one of our doctors believes that you have a certain disease or are infected with HIV/AIDS and are not following safety measures.
• If you apply for or receive substance abuse services from us in a federally assisted alcohol and drug treatment program, federal law protects the confidentiality of your records. Generally, we may not say to person outside the program that you attend the program or disclose any information identifying you as an alcohol or drug abuser unless we get your written permission. There are some exceptions to this rule. We can share this information with our workers to coordinate your care and to agencies or individuals that help us serve you. We may share information with medical workers in an emergency. If we believe that a child is abused or neglected, we must report the abuse or neglect to the Department of Social Services or local law enforcement agency, and we may share substance abuse treatment information when making the report. We will disclose information to obey a court order. If you commit a crime, or threaten to commit a crime, on our property or against our workers, we may report this to the police. Any violation of these confidentiality rules is a crime. Suspected violations may be reported to appropriate authorities in accordance with federal regulations. (See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for federal laws and 42 C.F.R. Part 2 for federal regulations).
• Special Provisions for Persons under the age of 18: Under South Carolina law, any minor who has reached the age of 16 may consent to their own health care services and the permission of another person is not necessary unless it involves an operation. In general, a person under the age of 17 cannot get an abortion unless she has permission from a parent, guardian, grandparent, or a person who has been standing in loco parentis to the minor for at least sixty (60) days. The only way to get an abortion without this permission is if a court orders that the person under age 17 can make this decision for herself. If you meet the appropriate age requirements and you give permission for one of these services, you have all the rights stated in this Notice relating to that service. If you are under the age of 18 and you have been married, are a member of the armed services or have been "emancipated" by a judge, then you have the right to be treated as an adult for all purposes. This means that you have all the rights stated in this Notice for all services.

E. YOU MAY FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES.

If you think we have violated your privacy rights, or you want to complain to us about our privacy practices, you can contact the Novant Health Privacy Official.

You also may write to the United States Secretary of the Department of Health and Human Services.

If you file a complaint, we will not take any action against you or change our treatment of you in any way.

F. EFFECTIVE DATE OF THIS NOTICE

This Notice of Privacy Practices is effective on April 14, 2003.