THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED, DISCLOSED AND SAFEGUARDED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. Our Responsibility

The confidentiality of your personal health information is very important to us. Your health information includes records that we create and obtain when we provide you care, such as a record of your symptoms, examination and test results, diagnoses, treatments and referrals for further care. It also includes bills, insurance claims, or other payment information that we maintain related to your care.

This Notice describes how we handle your health information and your rights regarding this information. Generally speaking, we are required to:

• Maintain the privacy of your health information as required by law;
• Provide you with this Notice of our duties and privacy practices regarding the health information about you that we collect and maintain; and
• Follow the terms of our Notice currently in effect.

II. Our Contact Information

After reviewing this Notice, if you need further information or want to contact us for any reason regarding the handling of your health information, please direct any communications to Dr. Fass

III. Uses and Disclosures of Information

Although under federal law we are permitted to use and disclose personal health information without your consent or authorization for purposes of treatment, payment, and health care operations, under New York State law and regulations, we will not release your personal health information to any third party except in the following circumstances:

1. With your express consent for treatment and payment

This consent may be in writing, oral or implied.

Examples:

• You send us a written request to send a copy of your records to another physician who may be providing treatment to you
• You ask us to call the pharmacy to renew your medication
• You ask us to submit a health insurance claim form to your insurance carrier or you seek treatment from us because we are a participating provider in your health plan

2. Pursuant to your written authorization, for other than treatment or payment purposes

Example:

• We receive a request for medical information from your potential employer

3. As otherwise permitted or required by federal or state law or regulation

Examples:

• In an emergency situation
• For child abuse and neglect reporting and investigation

4. For health care operations

In the course of providing treatment to you, we may need to share information with our employees, including students and trainees, and consultants to perform the operations of our medical office. We will share with our employees and business associates only the minimum amount of personal health information necessary for them to assist us.

Examples:

• To bill for our services
• To set up appointments with you

IV. Other Uses and Disclosures

In addition to uses and disclosures related to treatment, payment, and health care operations, we also may use and disclose your personal information without your express consent or authorization for the following additional purposes:

Abuse, Neglect, or Domestic Violence
As required or permitted by law, we may disclose health information about you to a state or federal agency to report suspected abuse, neglect, or domestic violence. If such a report is optional, we will use our professional judgment in deciding whether or not to make such a report. If feasible, we will inform you promptly that we have made such a disclosure.

Appointment Reminders and Other Health Services
We may use or disclose your health information to remind you about appointments or to inform you about treatment alternatives or other health-related benefits and services that may be of interest to you, such as case management or care coordination.

Business Associates
We may share health information about you with business associates who are performing services on our behalf. For example, we may contract with a company to do our billing. Our business associates are obligated to safeguard your health information. We will share with our business associates only the minimum amount of health information necessary for them to assist us.

Communicable Diseases
To the extent permitted or required by law, we may disclose information to a public health official or a person who may have been exposed to a communicable disease or who is otherwise at risk of spreading a disease or condition.

Communications with Family and Friends
We may disclose information about you to a person who is involved in your care or payment for your care, such as family members, relatives, or close personal friends. In addition, we may notify a family member, your personal representative, or other person responsible for your care, of your location, general condition, or death. Any such disclosure will be limited to information directly related to the person s involvement in your care. If you are available, we will provide you an opportunity to object before disclosing any such information. If you are unavailable because, for example, you are incapacitated or because of some other emergency circumstance, we will use our professional judgment to determine what is in your best interest regarding any such disclosure.

Coroners, Medical Examiners and Funeral Directors
In the event of your death, we may disclose health information about you to a coroner or medical examiner, for example, to assist in identification or determining cause of death. We may also disclose health information to funeral directors to enable them to carry out their duties.

Disaster Relief
We may disclose health information about you to government entities or private organizations (such as the Red Cross) to assist in disaster relief efforts. If you are available, we will provide you an opportunity to object before disclosing any such information. If you are unavailable because, for example, you are incapacitated, we will use our professional judgment to determine what is in your best interest and whether a disclosure may be necessary to ensure an adequate response to the emergency circumstances.

Food and Drug Administration (FDA)
We may disclose health information about you to the FDA, or to an entity regulated by the FDA, for example, in order to report an adverse event or a defect related to a drug or medical device.

Health Oversight
We may disclose health information about you for oversight activities that are authorized by federal or state law, for example, to facilitate auditing, inspection, or investigation related to our provision of health care, or to the health care system.

Judicial or Administrative Proceedings
We may disclose health information about you pursuant to a court order in connection with a judicial or administrative proceeding, in accordance with our legal obligations.

Law Enforcement
We may disclose health information about you to a law enforcement official for certain law enforcement purposes without your consent but only if you are incapacitated or in an emergency situation.

Minors
If you are an unemancipated minor under New York law, there may be circumstances in which we disclose health information about you to a parent, guardian, or other person acting in loco parentis, in accordance with our legal and ethical responsibilities.

Parents
If you are a parent of an unemancipated minor, and are acting as the minor s personal representative, we may disclose health information about your child to you under certain circumstances. For example, if we are legally required to obtain your consent as your child s personal representative in order for your child to receive care from us, we may disclose health information about your child to you. In some circumstances, we may not disclose health information about an unemancipated minor to you. For example, if your child is legally authorized to consent to treatment (without separate consent from you), consents to such treatment, and does not request that you be treated as his or her personal representative, we may not disclose health information about your child to you without your child s written authorization.

Personal Representative
If you are an adult or emancipated minor, we may disclose health information about you to a personal representative authorized to act on your behalf in making decisions about your health care.

Public Health Activities
As required or permitted by law, we may disclose health information about you to a public health authority, for example, to report disease, injury or vital events such as death.

Public Safety
Consistent with our legal and ethical obligations, we may disclose health information about you based on a good faith determination that such disclosure is necessary to prevent a serious and imminent threat to yourself, to identified individuals and the public, or in an emergency situation.

Required By Law
We may disclose health information about you as required by federal, state or other applicable law.

Specialized Government Functions
We may disclose health information about you for certain specialized government functions, as authorized by law and depending on the particular circumstances. Examples of specialized government functions include military activities, determination of veterans benefits and emergency situations involving the health, safety, and security of public officials.

Workers Compensation
We may disclose health information about you for purposes related to workers compensation, as required and authorized by law.

V. Your Health Information Rights

Under the law, you have certain rights regarding the health information that we collect and maintain about you. This includes the right to:

Request that we restrict certain uses and disclosures of your health information. We are not, however, required to agree to all requested restrictions, unless the requested restriction involves information to be sent to a health plan for payment or health care operations purposes and the disclosure relates to products or services that were paid for solely out-of-pocket and such disclosure is not otherwise required by law.

Request that we communicate with you by alternative means, such as making records available for pick-up, or mailing them to you at an alternative address, such as a P.O. Box. We will accommodate reasonable requests for such confidential communications.

Request to review, or to receive a copy of, the health information about you that is maintained in our files and used to make decisions about your treatment. We will respond to your request to inspect records within 10 days. We ordinarily will respond to requests to copy records within 30 days for on-site records and 60 days for off-site records. The standard fee for copying is $0.75 per page. If we maintain an electronic health record for you, you may request access to your health information in an electronic

format or have the information transmitted electronically to a designated recipient. If we are unable to satisfy your request, we may instead provide you with a summary of the information you requested. We will also tell you in writing the reason for the denial and your right, if any, to request a review of the decision and how to do so.

Request that we amend the health information about you that is maintained in our files. Your request must explain why you believe our records about you are incorrect, or otherwise require amendment. Ordinarily, we will respond to your request for an amendment within 60 days. If we are unable to satisfy your request, we will tell you in writing the reason for the denial and tell you how you may contest the decision, including your right to submit a statement (of reasonable length) disagreeing with the decision.

This statement will be added to your records.

Request a list of our disclosures of your health information. This list, known as an accounting of disclosures, will not include certain disclosures, such as routine disclosures made for payment, treatment or health care operations purposes or those made pursuant to a written authorization. However, if we maintain an electronic health record for you, you may be entitled to receive an accounting of routine disclosures of your health information. We will ordinarily respond to your request for an accounting of

disclosures within 60 days. We will provide you the accounting free of charge, however if you request more than one accounting in any 12 month period, we may impose a reasonable, cost-based fee for any subsequent request. Your request should indicate the period of time in which you are interested (for example, from May 1, 2003 to June 1, 2003 ). We will be unable to provide you an accounting for any disclosures made before April 14, 2003, or for a period of longer than six years.

Request a paper copy of this Notice.

In order to exercise any of your rights described above, you must submit your request in writing to our contact person (see section II above for information). If you have questions about your rights, please speak with our contact person, available in person or by phone, during normal office hours.

VI. Notice of Breach of Health Information

In the unlikely event that your health information is inadvertently acquired, accessed, used by or disclosed to an unauthorized person, we will provide you with written notice of such breach. The notice will be sent without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The notice will be written in plain language and will contain the following information: (i) a brief description of what happened, the date of the breach, if known, and the date of discovery; (ii) the type of PHI involved in the breach; (iii) any precautionary steps you should take; (iv) a description of what we are doing to investigate and mitigate the breach and prevent future breaches; and (v) how you may contact us to discuss the breach.

The written notice of breach will be sent by regular mail or by email if you have indicated that you prefer to receive communications from us by email. If the contact information we maintain for you is insufficient or out-of-date, we may attempt to provide notice to you by telephone or other permissible alternate method. We will also report the breach to the U.S. Department of Health and Human Services.

VII. To Request Information or File a Complaint

If you believe your privacy rights have been violated, you may file a written complaint by mailing it or delivering it to our contact person (see section II above). You may complain to the Secretary of Health and Human Services (HHS) by writing to Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F Washington, D.C. 20201; by calling 1-800-368-1019; or by sending an email to OCRprivacy@hhs.gov. We cannot, and will not, make you waive your right to file a complaint with HHS as a condition of receiving care from us, or penalize you for filing a complaint with HHS.

VIII. Revisions to this Notice of Privacy Practices

We reserve the right to amend the terms of this Notice. If this Notice is revised, the amended terms shall apply to all health information that we maintain, including information about you collected or obtained before the effective date of the revised Notice. We will post any revised Notice in the waiting areas of our office. You will also be able to obtain your own copy of the revised Notice by contacting us or asking for one at your next visit. If we revise or update the Notice with a material change, we will re-distribute the Notice to all patients. If the revision or update is non-material, we will provide the new Notice to all new patients at the first date of service and to all currents patients only upon request.

IX. Effective Date

This Notice will take effect on July 1, 2013.

(c) New York State Psychiatric Association, 2003, 2009