HIPAA NOTICE OF PRIVACY PRACTICES

In this Notice, “FMCNA” and the pronouns “we,” “us” and “our” refer to subsidiaries and affiliates of Fresenius Medical Care Holdings, Inc. d/b/a Fresenius Medical Care North America, when they are acting as a covered entity as defined by HIPAA. FMCNA’s covered entities have been designated as a single affiliated covered entity for purposes of HIPAA.

The HIPAA privacy practices in this Notice are followed by our employees and other workforce members who provide health care in our facilities or who access information in your medical or billing records. This Notice may not apply to independent facilities or health care providers who are not employed by FMCNA but provide services to you in FMCNA facilities. Please refer to their Notices of Privacy Practices.

In some cases, an FMCNA affiliate may issue its own Notice that describes its privacy practices. Should there be a difference between this FMCNA Notice and any affiliate’s notice, the terms of the affiliate’s notice will apply to that affiliate.

This Notice also does not apply to health information that is not subject to HIPAA although it may be protected by other federal or state laws. For example:

• Health information maintained by our affiliates that are not acting as covered entities or business associates, such as information collected for certain medical products, post-market surveillance or research studies.
• Employers and health information contained in our employment files.
• Health information that has been “de-identified” in accordance with HIPAA so that it does not identify you.

Medical information that identifies you is known as Protected Health Information (PHI). PHI includes demographic, clinical, and financial information that relates to treatment or payment for treatment.

We are required by law to:

• Make sure that your PHI is kept private;
• Give you this Notice of our legal duties and privacy practices;
• Follow the terms of the Notice that is currently in effect;
• Use or share your information only as described in this Notice, unless we obtain your consent; and
• Notify you if there is a breach of your unsecured PHI.

This section describes how we may use your PHI for treatment, payment and health care operations purposes without your written authorization.

Treatment

We may use and disclose your PHI to provide treatment and other services to you. For example, we may consult with other health care providers to coordinate your care. We may recommend alternative treatments, therapies, health care providers, or settings of care, or describe a health-related product or service. We may also contact you as a reminder that you have an appointment.

Payment

We may use or disclose your PHI to obtain payment for our services. For example, we may disclose your PHI to Medicare, Medicaid, your health insurer, HMO, or other company or program that arranges or pays the cost of your health care. We may also share PHI with your other health care providers if they need this information to receive payment for services they provide to you.

Health Care Operations

We may use or disclose your PHI for our health care operations, which include internal administration and planning and activities that improve the quality and cost effectiveness of care. For example, we may use your PHI to evaluate the quality and competence of our staff and other health care professionals.

Disclosure to Relatives, Close Friends and Other Caregivers

We may use or disclose your PHI to a family member, other relative, close friend or other person identified by you if we: 1) obtain your agreement; 2) provide you with the opportunity to object and you do not object; or 3) reasonably infer that you do not object to the disclosure.

If you are not present or are unable to agree (for example, if we receive a telephone call from a family member or other caregiver), we may exercise our professional judgment to determine whether a disclosure is in your best interests. If we disclose information under these circumstances, we will disclose only information that is relevant to the person’s involvement with your care.

Health Information Exchanges

A Health Information Exchange (HIE) allows doctors, nurses, pharmacists, other health care providers or authorized users to access and share medical information electronically to improve the speed, quality, safety and cost of patient care. We may participate in a HIE through which we may receive or disclose your health information, as permitted by law.

Research

As part of our efforts to improve treatments, we conduct and participate in clinical trials and research activities. We may use and disclose your PHI for research purposes without your authorization if an institutional review board (IRB) or privacy board has waived the authorization requirement. Under certain circumstances, your PHI may also be disclosed without your authorization to researchers preparing to conduct a research project, for research on decedents, or as part of a data set that omits your name and other information that can directly identify you.

As Required by Law

We will disclose your PHI if we are required to do so by federal, state, or local law.

Public Health Activities

We may disclose your PHI to public health authorities to prevent or control disease, injury or disability, such as reporting immunizations or exposure to contagious diseases. We may also alert a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.

We may also disclose your PHI to government agencies as required to report child abuse and neglect, or if we reasonably believe that you are a victim of abuse, neglect, or domestic violence.

In addition, we may report information about medical devices and medications to the manufacturer or the U.S. Food and Drug Administration, such as to report adverse events, product defects or participate in product recalls.

Threat to Health and Safety

We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. For example, we may give your PHI to an entity assisting in a disaster relief effort.

Health Oversight Activities

We may disclose your PHI to an agency that oversees the health care system and is responsible for ensuring compliance with the rules of government health programs, such as Medicare or Medicaid.

De-Identification

We may use your health information to create “de-identified” information that is not identifiable to any individual, in accordance with HIPAA. We may also disclose your health information to a business associate for the purpose of creating de-identified information, regardless of whether we will use the de-identified information.

Employment or Workers’ Compensation

We may disclose your PHI to comply with laws relating to workers’ compensation or other similar programs that provide benefits for work-related injuries or illness. In limited circumstances, we may disclose PHI to your employer for purposes of workplace medical surveillance, if your employer provides notice to you and requires this information to comply with the Occupational, Safety & Health Administration (OSHA) rules or similar state laws.

Lawsuits, Disputes, and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, warrant, discovery request or other lawful due process.

Law Enforcement Officials

We may disclose your PHI to the police or other law enforcement officials as required by law or to comply with a court order.

Military Service Members

If you are a member of the United States or foreign armed forces, we may disclose your PHI as required by law.

Correctional Institution

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose PHI to the institution or officials as permitted by law so that the institution may provide you with health care, protect your health and safety, and protect the health and safety of others.

Organ and Tissue Donation

We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, organ banking or transplantation.

Coroners, Medical Examiners and Funeral Directors

We may release PHI to a coroner or medical examiner to identify a deceased person or to determine the cause of death. We may also release PHI to funeral directors as necessary to carry out their duties.

This Section 4 describes how we may use your PHI only if we have your written authorization. If you give us authorization, you may revoke it, in writing, at any time. However, your revocation will not affect any actions that we took in reliance on your authorization before it was revoked.

Marketing and Sale of PHI

We will not sell your PHI without your authorization, or use your PHI for marketing purposes, as those terms are defined by HIPAA, unless permitted by law. However, we may communicate with you about alternative treatments, therapies, health care providers, settings of care, products or services provided by other organizations or individuals, if that information is relevant to your treatment or to help coordinate your health care. We also may tell you about their products or services when we see you in person.

We also may communicate with you about our health-related products or services that may be of interest to you. For example, we may inform you about health care programs we offer.

Psychotherapy Notes

Except in limited circumstances, we will not use or disclose any psychotherapy notes about you without your written authorization.

Highly Confidential Information

Federal and applicable state law may require special privacy protections for certain health information about you, for example, information relating to HIV testing, mental/behavioral health, and genetic information. If required by law, we will obtain your authorization before disclosing this information.

How to Exercise Your Rights

You may exercise your rights by making a request in writing to the facility manager where you receive treatment or to the FMCNA Privacy Officer at the address found at the end of this Notice. You may obtain request forms at your facility or from the Privacy Officer.

Right to Inspect and Copy

You may ask to see or get a copy of your medical and billing records. If you request copies, we may charge you a reasonable fee. We will inform you if we cannot fulfill your request.

Right to Request Restrictions

You may ask us not to use or disclose certain PHI for treatment, payment and health care operations. You may also ask us to not share information with individuals who are involved in your care or payment for care, for example, a family member or friend.

We are not required to agree to your requests, and we may say “no” if it would affect your care or if we are legally required to share the information. However, we will agree to a request to restrict disclosure to a health plan for an item or service for which you (or someone on your behalf other than the health plan) have paid out-of-pocket in full, and the disclosure is not required by law.

Right to Request Confidential Communications

You have the right to ask us to communicate with you about your PHI in a certain way or at a certain location. For example, you may ask us to contact you at a home or office phone number, or to send mail to a different address. We will say “yes” to all reasonable requests.

Right to Amend

If you think that information in your medical or billing records is incorrect or incomplete, you may ask us to amend that information. We are not required to agree to your request, and we may say “no” if the information is accurate and complete. We may also say “no” if we do not maintain the information or in certain other circumstances.

Right to an Accounting of Disclosures

You may ask us for a list (accounting) of disclosures of your PHI during the past six years. We will include all disclosures required by HIPAA. These do not include disclosures for treatment, payment, and health care operations, and certain other disclosures (such as those you asked us to make). We will provide one accounting a year for free, but may charge a reasonable, cost-based fee for additional requests you make within twelve months.

Personal Representatives

If someone is your legally authorized personal representative as defined by state law, then that person can exercise your rights. We will ask the person to provide evidence or documentation of their authority before we take any action.

Right to a Paper Copy of This Notice

You may ask for a paper copy of this Notice at any time.

We may change the terms of this Notice at any time, and the changes will apply to all PHI we have about you. The new Notice will be available upon request, in our office, and on our website.

If you want further information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to your PHI, you may contact our Privacy Officer at:

    Fresenius Medical Care North America
    Attn: FMCNA Privacy Officer
    920 Winter Street
    Waltham, MA 02451-1457 1-800-662-1237 ext. 1007100 Privacy@fmc-na.com

You may also file a written complaint with the Office for Civil Rights of the U.S. Department of Health and Human Services at:
    200 Independence Avenue, S.W. Washington, D.C. 20201
    1-877-696-6775
    www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.