HIPAA NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Purpose

This notice is intended to inform you of the privacy practices followed by your employer’s Healthcare Flexible Spending Account Plan or Health Reimbursement Account if applicable. It also explains the Federal privacy rights a?orded to you and the members of your family as Plan Participants covered under a group health plan.

As a Plan sponsor your employer often needs access to health information in order to perform Plan Administrator functions. We want to assure the Plan Participants covered under our group health plan that we comply with Federal privacy laws and respect your right to privacy. We require all members of our workforce and third parties that are provided access to health information to comply with the privacy practices outlined below.

Uses and Disclosures of Health Information

Healthcare Operations. We use and disclose health information about you in order to perform Plan administration functions such as quality assurance activities, resolution of internal grievances, and evaluating plan performance. For example, we review claims experience in order to understand utilization and to make plan design changes that are intended to control health care costs.

Payment. We may also use or disclose identi?able health information about you without your written authorization in order to determine eligibility for bene?ts, seek reimbursement from a third party, or coordinate bene?ts with another health plan under which you are covered. For example, a healthcare provider that provided treatment to you will provide us with your health information. We use that information to determine whether those services are eligible for payment under our group health plan.

Treatment. Although the law allows use and disclosure of your health information for purposes of treatment, as a Plan sponsor we generally do not need to disclose your information for treatment purposes. Your physician or healthcare provider is required to provide you with an explanation of how they use and share your health information for purposes of treatment, payment, and healthcare operations.

Special Protections for Substance Use Disorder Records The con?dentiality of Substance Use Disorder (SUD) patient records maintained by this Organization is protected by federal law and regulations (42 CFR Part 2 and HIPAA). Generally, we may not disclose that you are a patient in a substance use program, or disclose any information identifying you as having a substance use disorder, unless:

• Written Consent: You consent in writing to the disclosure.

• Court Order: The disclosure is allowed by a court order meeting speci?c legal criteria.

• Emergency/Research: The disclosure is made to medical personnel in a medical emergency or to quali?ed personnel for research, audit, or program evaluation.

Use in Legal Proceedings: Federal law prohibits the use of your SUD records in any civil, criminal, administrative, or legislative proceedings against you, unless you provide speci?c written consent or a court order is issued that meets the requirements of 42 CFR Part 2.

Redisclosure: Once information from your SUD records is disclosed to a third party (other than another HIPAA-covered provider for treatment, payment, or health care operations), the information may no longer be protected by the same privacy laws and may be subject to further redisclosure by the recipient.

As permitted or required by law. We may also use or disclose your health information without your written authorization for other reasons as permitted by law. We are permitted by law to share information, subject to certain requirements, in order to communicate information on health-related bene?ts or services that may be of interest to you, respond to a court order, or provide information to further public health activities (e.g., preventing the spread of disease) without your written authorization. We are also permitted to share health information during a corporate restructuring such as an merger, sale, or acquisition. We will also disclose health information about you when required by law, for example, in order to prevent serious harm to you or others.

Pursuant to your Authorization. When required by law, we will ask for your written authorization before using or disclosing your identi?able health information. If you choose to sign an authorization to disclose information, you can later revoke that authorization to cease any future uses or disclosures.

Right to Inspect and Copy. In most cases, you have a right to inspect and copy the health information we maintain about you. If you request copies, we will charge you $0.05 (5 cents) for each page. Your request to inspect or review your health information must be submitted in writing to the person listed below.

Right to an Accounting of Disclosures. You have a right to receive a list of instances where we have disclosed health information about you for reasons other than treatment, payment, healthcare operations, or pursuant to your written authorization.

Right to Amend. If you believe that information within our records is incorrect or missing, you have a right to request that we correct the incorrect or missing information.

Right to Request Restrictions. You may request in writing that we not use or disclose information for treatment, payment, or other administrative purposes except when speci?cally authorized by you, when required by law, or in emergency circumstances. We will consider your request, but are not legally obligated to agree to those restrictions.

Right to Request Con?dential Communications. You have a right to receive con?dential communications containing your health information. We are required to accommodate reasonable requests. For example, you may ask that we contact you at your place of employment or send communications regarding treatment to an alternate address.

Right to Receive a Paper Copy of this Notice. If you have agreed to accept this notice electronically, you also have a right to obtain a paper copy of this notice from us upon request. To obtain a paper copy of this notice, please contact the person listed below.

Legal Information

The Company is required by law to protect the privacy of your information, provide this notice about information practices, and follow the information practices that are described in this notice.

We may change our policies at any time. Before we make a signi?cant change in our policies, we will provide you with a revised copy of this notice. You can also request a copy of our current notice at any time. For more information about our privacy practices, contact the person listed below:

North Texas Institute of Neurology, Rheumatology & Headache

5150 Warren Pkwy, bldg. 8

Frisco, TX 75034

Heather Kreter, COO

If you have any questions or complaints, please contact the Plan Administrator listed under the Article titled: "General Information About Our Plan".

Filing a Complaint

If you are concerned that we have violated your privacy rights, or you disagree with a decision we made about access to your records, you may contact the person listed above. You also may send a written complaint to the U.S. Department of Health and Human Services; O?ce of Civil Rights. The person listed above can provide you with the appropriate address upon request or you may visit www.hhs.gov/ocr for further information.