THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This is your Notice of Privacy Practices from opSolutions. The Notice refers to opSolutions by using the terms “us”, “we,” or “our.”

We are required by law to maintain the privacy of Personal Health Information. We are required to provide this Notice of Privacy Practices to you by the privacy regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).

This notice describes how we protect the Personal Health Information we have about you that relates to your medical information or Personal Health Information. Personal Health Information is medical and other information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. (The HIPAA law uses the term “protected health information” where we use “Personal Health Information.”)

This Notice of Privacy Practices describes how we may use and disclose to others your Personal Health Information to carry out payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control of your Personal Health Information.

We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice at any time. The new notice will be effective for all Personal Health Information that we maintain at that time. This notice may also be revised if there is a material change to the uses or disclosures of Personal Health Information, your rights, our legal duties, or other privacy practices stated in this notice. Within 60 days of a material revision to this notice we will provide you with a copy of the revised notice. Additionally, upon your request, we will provide you with any revised Notice of Privacy Practices if you call us us at 210.614.5500 and request that a revised copy be sent to you in the mail.

How We May Use and Disclose Personal Health Information About You

The common reasons for which we may use and disclose your Personal Health Information are to process and review your requests for coverage and payments for benefits or in connection with other health related benefits or services in which you may be interested. The following describes these and other uses and disclosures and includes some examples.

• For Treatment. We may use and disclose Personal Health Information to treat you. For example, you may be asked to undergo laboratory tests per your physician’s orders (such as blood or urine tests), and we will report the results back to your physician to be used in your treatment. Many of the people who work for us may use or disclose your Personal Health Information to treat you or to assist others in your treatment. Additionally, we may disclose your Personal Health Information to others who may assist in your care, such as your physician, therapists or medical equipment suppliers.
• For Payment. We may use or disclose information for billing, claims management, collection activities, and obtaining payment under a contract for reinsurance and related healthcare data processing. For example, we may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment. We may also use and disclose your Personal Health Information to obtain payment from third parties that may be responsible for such costs, such as family members. Also, we may use your Personal Health Information to bill you directly for services and items.
• For Healthcare Operation. We may use and disclose Personal Health Information about you for our health plan and insurance operations. For example we may use Personal Health Information to conduct quality assessment and improvement activities. We may also use or disclose Personal Health Information to review the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, training of non-healthcare professionals, accreditation, certification, licensing, or credentialing activities. We may also use or disclose Personal Health Information for purposes of underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for healthcare provided that if we receive Personal Health Information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with us, we may not use or disclose such Personal Health Information for any other purpose, except as may be required by law. We may also use or disclose Personal Health Information to conduct or arrange for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs. We may also use or disclose Personal Health Information for business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating an entity. We may also use and disclose Personal Health Information for the business management and general administrative activities of our entity (to the extent that such activities relate to functions that are covered under the federal HIPAA privacy laws).
• For Treatment Alternatives. We may use and disclose Personal Health Information to tell you about or to recommend possible treatment options or alternatives that may be of interest to you.
• For Health-related Benefits and Services. We may use and disclose Personal Health Information to tell you about health-related benefits and services that may be of interest to you.
• Other Purposes for Which the Law Requires Us to Use or Disclose Personal Health Medical Information Without Your Written Authorization. The law requires that we disclose your Personal Health Information to you if you so request. This Notice provides the procedures we both must follow for us to disclose your Personal Health Information to you. The law also requires us to disclose Personal Health Information when required by the Secretary of the U. S. Department of Health and Human Services to investigate or determine our compliance with the requirements of the HIPAA privacy regulation.
• Other Purposes for which the Law Allows Us to Use or Disclose Medical Information Without Your Written Authorization.
  • We may disclose Personal Health Information to another healthcare provider, a healthcare clearinghouse, or a health plan for the payment activities of the entity that receives the information.
  • We may disclose your Personal Health Information to another healthcare provider, a clearinghouse or a health plan for the healthcare operations activities of the entity that receives the information, if (1) each entity either has now or had in the past a relationship with you, (2) the Personal Health Information pertains to such relationship, and (3) the disclosure is for any of the following purposes: conducting certain quality assessment and improvement activities; reviewing the competence or qualifications of healthcare professionals; evaluating practitioner and provider performance; evaluating health plan performance; conducting certain training programs; accreditation; certification; licensing; credentialing activities; or healthcare fraud and abuse detection or compliance.
  • We may use or disclose your Personal Health Information that is incident to an allowable use or disclosure if we have complied with the minimum necessary requirements and we have in place the appropriate administrative, technical, and physical safeguards, i.e. information and physical security safeguards, to protect the privacy of protected health information.
  • We will use and disclose medical information about you when required to do so by law. Our use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. Examples of such required uses and disclosures are notifying public health authorities regarding public health activities including certain communicable diseases. Additionally, if required by law, or you agree, we would disclose Personal Health Information to the appropriate government authority if we think you have been the victim of abuse, neglect, or domestic violence. We may disclose Personal Health Information to a governmental agency or regulator with healthcare oversight responsibilities. We may also disclose Personal Health Information to a coroner or medical examiner to assist in identifying a deceased person or to determine the cause of death. We may disclose Personal Health Information to funeral directors as necessary to carry out their duties. We may also disclose Personal Health Information about you for workers’ compensation or similar programs.
  • We may disclose Personal Health Information is response to a request by a law enforcement official made via a court order, subpoena, warrant, summons or similar process. We may also disclose Personal Health Information to federal officials for national security and military activities authorized by law. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your Personal Health Information to the correctional institution or law enforcement official as authorized by law.
  • If you or your estate is involved in a lawsuit or dispute, we may disclose Personal Health Information about you in response to a court or administrative order. We may also disclose Personal Health Information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the case, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
  • If you are an organ donor, we may disclose Personal Health Information about you to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation. We also have the authority to comply with HIPAA and other federal laws and regulations to use and disclose Personal Health Information for research purposes.
  • We may use and disclose Personal Health Information about you when necessary to prevent a serious threat to your health or safety or to the health and safety of another person or to the public. We may also disclose Personal Health Information about you to governmental agencies involved in disaster relief as well as to private disaster relief agencies to allow them to carry out their responsibilities in specific disaster situations.
  • We may disclose Personal Health Information about you with third parties called Business Associates that perform various services (e.g., administrative, legal, actuarial, accounting, consulting or data services) for us. Whenever an arrangement between a Business Associate and us would involve the use or disclosure of your Personal Health Information, we will have a written contract protecting the privacy of Personal Health Information.
  • We may use or disclose a portion of your Personal Health Information, called a Limited Data Set, only for the purposes of research, public health, or health care operations. We may use Personal Health Information to create a Limited Data Set or if we enter into a Data Use Agreement with a Business Associate we may disclose Personal Health Information to such Business Associate for the purpose of creating a Limited Data Set.
  • Other uses and disclosures of Personal Health Information not covered by this notice and permitted by the laws that apply to us will be made only with your written authorization or that of your legal representative. If we are authorized to use or disclose Personal Health Information about you, you or your legally authorized representative may revoke such authorization, in writing, at any time, except to the extent that we have taken action relying on your authorization or if the authorization was obtained as a condition of obtaining your coverage with us. You should understand that we would not be able to take back any disclosures we may have made with authorization.

Your Rights Regarding Personal Health Information We Maintain About You and How You May Exercise These Rights. You have the following rights with respect to your Personal Health Information that we maintain:

Your Right to Request Restrictions on Certain Uses and Disclosures of Personal Health Information

• You may request that we restrict uses or disclosures of your Personal Health Information to carry out treatment, payment or healthcare operations.
• You may request that we restrict disclosures of your Personal Health Information to any person you identify for involvement in your care and for notification purposes, as applicable, regarding your location, general condition or death.
• We are not required to agree to your request for a restriction on uses or disclosures of your Personal Health Information to carry out treatment, payment or healthcare operations.
• If we agree to a restriction on uses or disclosures of your Personal Health Information to carry out treatment, payment, or healthcare operations, then we may not use or disclose Personal Health Information in violation of such restriction. However, if you are in need of emergency treatment and the restricted Personal Health Information is needed to provide the emergency treatment, we may disclose such information to a healthcare provider to provide such emergency treatment to you and we will request that such healthcare provider not further use or disclose your information.
• If we agree to a restriction, such restriction would not prevent uses or disclosures as follows: required by the U.S. Department of Health and Human Services to investigate or determine our compliance with the HIPAA privacy regulation; required by law; for public health activities; about victims of abuse, neglect, or domestic violence; for health oversight activities; for judicial and administrative proceedings; for law enforcement purposes; about decedents; for cadaveric organ, eye or tissue donation purposes; for research purposes; to avert a serious threat to health or safety; for specialized government functions; or for workers’ compensation.
• If we agree to a restriction, we may terminate that agreement if: you agree to or request the termination in writing; you orally agree to the termination and the oral agreement is documented by us; or we inform you that we are terminating our agreement to a restriction, except that such termination is only effective with respect to Personal Health Information created or received after we have so informed you.

Your Right to Receive Confidential Communications of Personal Health Information

• We will accommodate any reasonable request you might make to receive communications of Personal Health Information from us by alternative means or at alternative locations, if you clearly inform us in writing that the disclosure of all or part of that Personal Health Information could endanger you.
• We require that you make a request for a confidential communication in writing and specify how or where you wish to be contacted.
• We may condition the provision of a reasonable accommodation on when appropriate, information as to how payment, if any, will be handled; and specification of an alternative address or other method of contact.
• You do not need to explain to us why you are requesting confidential communications.

Your Right to Inspect and to Copy Personal Health Information

• Right of Access – Except for conditions regarding “Unreviewable Grounds for Denial of Access” and “Reviewable Grounds for Denial of Access” listed below, you have the right of access to inspect and to obtain a copy of your Personal Health Information that we maintain in a Designated Record Set, for as long as the Personal Health Information is maintained in the Designated Record Set, except for psychotherapy notes or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. We require you to make requests for access in writing.
• Unreviewable Grounds for Denial of Access – We may deny you access to your Personal Health Information without providing you an opportunity for review, in the following circumstances:
  • The Personal Health Information is not something to which you have a right of access.
  • The Personal Health Information is contained in records that are subject to the federal Privacy Act and your access to it may be denied, if the denial of access under the Privacy Act would meet the requirements of that law.
  • The Personal Health Information was obtained from someone other than a healthcare provider under a promise of confidentiality and the access you requested would be reasonably likely to reveal the source of the information.
• Reviewable Grounds for Denial of Access – We may deny you access to your Personal Health Information, provided that we give you the right to have such denials reviewed (as required by the Review of a Denial of Access procedures listed below) in the following circumstances:
  • A licensed healthcare professional determines that the access you requested is reasonably likely to endanger the life or physical safety of you or another person;
  • The Personal Health Information makes reference to another person (unless such other person is a healthcare provider) and a licensed healthcare professional determines that the access you requested is reasonably likely to cause substantial harm to such other person; or
  • The request for access is made by your personal representative and a licensed healthcare professional determines that the provision of access to such personal representative is reasonably likely to cause substantial harm to your or to another person.
• Review of a Denial of Access – If we deny you access to your Personal Health Information on a ground that qualifies as a Reviewable Ground for Denial of Access, you have the right to have the denial reviewed by a licensed healthcare professional who is designated by us to act as a reviewing official and who did not participate in the original decision to deny access. We will promptly provide written notice to you or to your personal representative (as applicable) of the determination of the designated reviewing official and we will carry out the designated reviewing official’s determination.
• We Will Respond Promptly to Your Request for Access to Personal Health Information under the following conditions:
  • If you request access to Personal Health Information that is not maintained by us or is not accessible to us on-site, we will, no later than 60 days from the receipt of your request, take one of the following actions:
  • If we grant your request we will inform you of our acceptance of your request and we will provide you the access requested in accordance with the Provision of Access requirements listed below.
  • If we deny your request we will provide you with a written denial in accordance with the Denial of Access requirements listed below.
  • If we are unable to meet these requirements within the 60 day time period, we may have an additional 30 days (a total of 90 days) to either accept or deny your request for access if during the first 60 day period we provide you with a written statement of the reasons for the delay and the date by which we will complete our action on your request for access.
  • If you request access to Personal Health Information that is maintained by us or is accessible to us on-site, we will act on such a request no later than 30 days after receiving your request as follows:
  • If we grant your request for access we will inform you of our acceptance of your request and provide the access requested in accordance with the Provision of Access requirements listed below.
  • If we deny your request we will provide you with a written denial in accordance with the Denial of Access requirements listed below.
  • If we are unable to meet these requirements within the 30 day time period, we may take up to an additional 30 days (a total of 60 days) for such actions by, within the first 30 day period, providing you with a written statement of the reasons for our delay and the date by which we will complete our action on your request for access to your Personal Health Information.
• Provision of Access – If we provide you access to your Personal Health Information, we will do so by adhering to the following requirements:
  • Providing the Access Requested. We will provide the access requested by you of the Personal Health Information we maintain about you in Designated Record Sets.
  • Form of Access Requested.
    • We will provide you with access to the Personal Health Information in the form you request, in a hard copy form or another form upon which we both agree.
    • We may provide you with a summary of the Personal Health Information requested, in lieu of providing you access to your Personal Health Information or we may provide an explanation of the Personal Health Information to which access has been provided, if you agree in advance to such a summary or explanation and you agree in advance to the fees imposed, if any, by us for such summary or explanation.
  • Manner of Access. We will arrange with you for a convenient time and place for you to inspect or to obtain a copy of your Personal Health Information, or we will mail a copy of the Personal Health Information at your request.
  • Fees. If you request a copy of your Personal Health Information or agree to a summary or explanation of such information, we may impose a reasonable, cost-based fee.
• Denial of Access – If we deny you access, in whole or in part, to your Personal Health Information, we will do so only by adhering to the following requirements:
  • To the extent possible, we will give you access to any other of your Personal Health Information requested, after excluding the Personal Health Information as to which we have a ground to deny you access.
  • Provide you with a timely, written denial.
  • If we do not maintain the Personal Health Information that is the subject of your request for access, and we know where the requested information is maintained, we will inform you where to direct your request for access.

Your Right to Amend Personal Health Information We Maintain About You

• Right to Amend – You have the right to have us amend Personal Health Information or a Record about you maintained in a Designated Record Set for as long as we maintain the Personal Health Information in the Designated Record Set.
• Denial of Amendment – We may deny your request for amendment of Personal Health Information or a Record about you maintained in a Designated Record Set, if we determine that the Personal Health Information or Record that is the subject of the request:
  • Was not created by us, unless you provide us with a reasonable basis to believe that the originator of Personal Health Information is no longer available to act on the requested amendment;
  • Is not part of the Designated Record Set;
  • Would not be available for inspection under the rights that the HIPPA privacy regulation gives to individuals to access Personal Health Information; or
  • Is accurate and complete.
• Requests for Amendment and Timely Action –
  • You may request that we amend your Personal Health Information that we maintain in a Designated Record Set. You must make such requests for amendments in writing and provide us with a reason that supports your proposed amendment.
  • We will act on your request for an amendment no later than 60 days after receiving your request as follow:
    • If we grant your requested amendment we will make the amendment, inform you and inform certain others.
    • If we deny your requested amendment we will provide you with a timely written denial that uses plain language and contains the basis for the denial of an amendment. The denial notice will also include other information regarding future disclosures of your Personal Health Information and how you may disagree with or complain about our denial of your amendment.
  • If we are unable to act on your request to amend your Personal Health Information that we maintain in a Designated Record Set, within 60 days after receiving your request, we may take up to an additional 30 days to act on your request, by, within 60 days after receiving your request for an amendment, providing you with a written statement of the reasons for our delay in acting on your request and the date by which we will complete our action on your request.
• Actions on Notices of Amendment. When we are informed by a healthcare provider, a healthcare clearinghouse or another health plan of an amendment to your Personal Health Information then we will amend your Personal Health Information that we maintain in a Designated Record Sets by, at a minimum, identifying the Records in the Designated Record Set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.

Your Right to Receive an Accounting of Our Disclosures of Your Personal Health Information

• Right to an Accounting of Disclosures of Personal Health Information. You have the right to receive an accounting of Disclosures of Personal Health Information made by us in the 6 years before the date of your request for the accounting.
• Disclosures NOT required to be listed in the Accounting. The following are disclosures to which you do not have a right to an accounting and we will not include a listing of such disclosures to you.
  • Disclosures made to carry out our payment activities and purposes.
  • Disclosures made to carry out our healthcare operations activities and purposes.
  • Disclosures made by us for the treatment activities of a healthcare provider.
  • Disclosures made by us to a healthcare provider, a healthcare clearinghouse, or another health plan for the payment activities of the entity that receives the information.
  • Disclosures made by us to a healthcare provider, a healthcare clearinghouse, or another health plan for certain healthcare operations activities of the entity that receives the information, if we and the entity receiving the information either has or had a relationship with you, the Personal Health Information pertains to such relationship, and the disclosure is for certain limited purposes.
  • Disclosures of your Personal Health Information made to you.
  • Disclosures made incident to a use or disclosure otherwise permitted or required by the HIPAA privacy regulation.
  • Disclosures made pursuant to your authorization.
  • Disclosures made pursuant to the HIPAA privacy regulation regarding those disclosures made to persons involved in your care or other notification purposes.
  • Disclosures made for national security or intelligence purposes to authorized federal officials for the conduct of lawful national security activities.
  • Certain disclosures made to correctional institutions or law enforcement officials having lawful custody of you or other Personal Health Information about you.
  • Disclosures that are part of a Limited Data Set under the HIPAA privacy standards and implementation specifications regarding Limited Data Sets and Data Use Agreements.
  • Disclosures that occurred before April 14, 2003.
• Under certain circumstances we are required to temporarily suspend your right to receive an accounting of the disclosures we made to a health oversight agency or law enforcement official.
• You have the right to request from us an Accounting of Disclosures for a period of time less than 6 years from the date of your request.
• Unless the disclosure is one that we are not required to list in the accounting, or you have requested a time period of less than 6 years, the written Accounting of Disclosures will include disclosures of your
• Personal Health Information that occurred during the 6 years before the date of your request for an Accounting, including disclosures to or by our Business Associates.
• Provision of the Accounting of Disclosures of Your Personal Health Information – Within 60 days after receiving your request for an Accounting of Disclosures of your Personal Health Information, we will provide you with such an accounting. If we are unable to provide an accounting of disclosures within the 60 day period, we may take an additional 30 days on which to provide the accounting by providing you, within 60 days after receiving your request for an accounting, a written statement of the reasons for our delay and the date by which we will provide to you an Accounting of Disclosures of your Personal Health Information.
• Fees for an Accounting – The first accounting of disclosures that you request within any 12 month period will be provided to you by us at no charge. For any additional accountings of disclosures that you make within a 12 month period we will charge you a reasonable, cost-based fee. We will notify you in advance of this fee, and you will have the opportunity to withdraw or modify your request for a subsequent accounting of disclosures of your Personal Health Information in order to avoid or reduce the fee.

Your Right to Receive a Paper Copy of This Notice. You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically. At least once every three (3) years, we will notify all individuals covered by our plan of the availability our Notice of Privacy Practices and how to obtain the notice.

Your Right to File a Complaint. If you think that we have violated your privacy rights, you have the right to file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, please contact: Privacy Officer, opSolutions, 7271 Wurzbach Suite128, San Antonio, TX 78240. All complaints must be submitted to us in writing. We will not penalize you nor will we retaliate against you for filing a complaint.

Contact Information. For further information about matters covered by this notice please contact Privacy Officer at 210-614-5500.

Effective Date. This notice was published and becomes effective on August 1, 2013

Omnibus Final Rule

Final modifications to the HIPAA Privacy, Security, and Enforcement Rules mandated by the Health Information technology for Economic and Clinical Health (HITECH) Act, are as follows:

• You have the right to be notified of a data breach.
• You have the right to ask for a copy of your electronic medical record in an electronic form.
• You have the right to opt out of fundraising communications from opSolutions, and opSolutions cannot sell your health information without your permission.
• Certain uses of your medical data, such as use of patient information in marketing, require prior disclosure and your authorization. Uses and disclosures not described in this notice will be made only with your authorization.
• If you pay in cash in full (out of pocket) for your treatment, you can instruct opSolutions not to share information about your treatment with your health plan.