PARTNERS HEALTHCARE NOTICE FOR USE AND SHARING OF PROTECTED HEALTH INFORMATION THIS NOTICE APPLIES TO ALL PARTNERS HEALTHCARE MEMBER ORGANIZATIONS DESCRIBED BELOW AND ON PAGES 7 & 8.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

We at Partners HealthCare pledge to give you the highest quality health care and to have a relationship with you that is built on trust. This trust includes our commitment to respect the privacy and confidentiality of your health information.

The word "Partners" in this Notice includes Partners HealthCare System Inc. and all of the organizations listed at the end of this notice. This Notice also applies to private doctors who are on the medical staff of these organizations if they see you at a Partners site (they will give you their own Notice if they see you in their private office). This Notice is being given to you because federal law gives you the right to be told ahead of time about:

• How Partners will handle your medical information
• Partners' legal duties related to your medical information
• Your rights with regard to your medical information.

Please note that treatment at McLean Hospital and/or at certain designated Substance Abuse Facilities provides you with additional protections, as noted in bold and Italics throughout this Notice.

A. HOW WE MAY USE AND DISCLOSE (SHARE) YOUR PROTECTED HEALTH INFORMATION
When you need health care, you give information about yourself and your health to doctors, nurses, and other health care workers and staff. This information, along with the record of the care you receive, is "protected health information" (or "health information"). The information in your medical record is kept in paper form and/or in an electronic form on the computer. Partners uses your health information within its system, and shares your health information outside its system in order to give you excellent medical care. Partners uses and shares your health information for other reasons that can include medical research and training new health care workers.

Partners may share your health information with outside health care providers for purposes such as treatment or research. This Notice tells you how Partners uses and shares your health information for these and other purposes. It also tells you when we need to get your specific permission to do so.

1. Treatment, Payment, and Health Care Operations

Except where prohibited by Massachusetts state or federal laws (see section 4), Partners may legally use and share your health information for treatment, payment, and health care operations. We do not need to ask for your specific permission to do these things, as explained below:

Treatment
Partners health care providers will use and share your health information to provide and manage your health care and related services. For example, your primary care doctor may refer you to a specialist such as a radiologist or surgeon. The specialist may tell you that you need to be admitted to the hospital for treatment or surgery. All of the doctors in this example, whether they are in the Partners system or not, will share medical information about you. This is to coordinate your care before, during and after you go into the hospital. Partners will share information with other third parties, such as home health agencies, visiting nurses, rehabilitation hospitals, and ambulance companies. It will also share information with those who treated you before you went into the hospital and with those who will treat you in the future. This helps to make sure that everyone caring for you has the information they need.

McLean Hospital and dedicated Substance Abuse Facilities and/or providers will not share information with other Partners entities and/or health care providers without an authorization signed by you to release information.

Payment
Partners will use and share your health information to bill and collect payment for the health care services it gives to you. For example, if you have health insurance, your health care provider will share your medical information with the insurance company or government agency (for example, Medicare or Medicaid). The insurance company uses the information to tell if you are eligible for benefits or if the services you received were medically needed.

Health Care Operations
Partners may use and share your health information for activities that are known as health care operations. These are activities that are needed to operate its facilities and carry out its mission. Some of the information is shared with outside parties who perform these health care operations or other services on behalf of Partners ("business associates"). These business associates must also take steps to keep your health information private. Examples of activities that make up health care operations include:

• Monitoring the quality of care and making improvements where needed.
• Making sure health care providers are qualified to do their jobs.
• Reviewing medical records for completeness and accuracy.
• Meeting standards set by regulating agencies; such as, Joint Commission
• Teaching health professionals.
• Using outside business services; such as, transcription, storage, auditing, legal or other consulting services.
• Storing your health information on computers.
• Managing and analyzing medical information.

Partners may use your health information to contact you:

• At the address and telephone numbers you give to us (including leaving messages at the telephone numbers): about scheduled or cancelled appointments, registration/insurance updates, billing or payment matters, pre-procedure assessment or test results.
• With information about patient care issues, treatment choices and follow up care instructions.
• With other health-related benefits and services that may be of interest to you.
• For fundraising to support the Partners system and its missions of excellence, provided, however, that such information is limited to demographic information only, such as name, address, phone number, age, or gender.

2. Uses and Disclosures (Sharing) of Your Health Information for Other Purposes

Partners may legally use and/or share your health information with others for the following purposes without your specific permission:

• For research that is approved by a Partners Research Committee or its designee when written permission is not required by federal or state law. This also may include preparing for research or telling you about research studies in which you might be interested.
• As required by state and federal laws and regulations.
• For public health activities, including required reports to the state public health and child protection authorities, and to agencies such as cancer registries and the federal Food and Drug Administration.
• With regard to elder victims of abuse and neglect and in some instances to disabled victims of abuse or neglect.
• For health oversight activities.
• For legal and administrative proceedings.
• For law enforcement purposes under specific conditions such as reporting when someone is the victim of a crime.
• With regard to people who have died, to coroners, medical examiners and funeral directors.
• For organ, eye or tissue donation at death.
• To avert a serious threat to health or safety.
• For specialized government operations.
• As authorized by and as necessary to comply with workers compensation laws.
• For permissible public health, health care operations, and research purposes when limited identifiable information is used or shared.

3. Uses and Disclosures (Sharing) You May Ask be Limited, or Request Not Be Made

Patient Directories
If you are admitted to the hospital, your name, room location, general condition, and religion may be listed in that hospital's directory (information desk). This will be shared with members of your family, friends, members of the clergy, and to others who ask for you by name. You may ask to have your name taken off the directory list. You may also ask to restrict the information that is given out about you. If you are in an emergency situation and are not able to make your wishes known, we will put this information in the directory if we think it is in your best interest. We will not put the information in the directory if you have been admitted to the hospital before and asked that it not be shared.

McLean Hospital does not have a patient directory and will not give out any information regarding your care. Dedicated Mental Health and/or Substance Abuse Facilities also will not release any directory information without your specific authorization.

Disclosures to Family, Friends or Others

• Partners may share relevant health information about you with a family member or other person close to you if they are involved in your care or payment for your care.
• Partners may use or share your health information to notify a family member or other person responsible for you of your location, general medical condition or death.
• If you are present and are able to make health care decisions, we will try to find out if you want us to share this information with your family members or others. If you are in an emergency situation and not able to make your wishes known, we will use our best judgment to decide whether to share information. If it is thought to be in your best interest, we will only share information that others really need to know.
• Partners also may use or share your health information with a public or private agency assisting in disaster relief. This is to coordinate efforts to notify someone on your behalf. If we can reasonably do so while trying to respond to the emergency, we will try to obtain your permission before sharing this information.

McLean Hospital and dedicated Substance Abuse Facilities/Providers will not give out any information to family or friends without an authorization signed by you.

4. Uses or Disclosures (Sharing) of Information that Require Your Written Permission (Authorization)

Using and/or disclosing health information for most purposes other than treatment, payment, or health care operations (for example, for many, but not all, research and marketing purposes) requires your specific authorization. Furthermore, certain information that may be contained in your medical record is considered by state and Federal law to be highly confidential, including, for example, HIV testing or test results, certain clinical therapy documentation and certain genetic information; therefore, this type of information gets additional protection from disclosure, often requiring your written authorization even before disclosure for treatment, payment or health care operations. There are some limited exceptions to these rules when your permission is not necessary before the use/disclosure can occur (including, by way of example, but not limited to, disclosure for research purposes when the Partners Research Committee that oversees the research determines that written permission is not required by federal or state law, and clinical therapy documentation used for oversight or legal defense of the therapist).
If you are asked to and give written permission for the use and/or disclosure of your health information, you may withdraw such consent at any time in writing or, in certain limited cases, orally, except to the extent that the providers have already acted upon your previously provided consent.

B. YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION AND HOW TO EXERCISE THEM
The Right to Ask for Limits on the Use and Sharing of Your Health Information.
You have the right to ask for restrictions on the use and sharing of your health information for treatment, payment, or health care operations. You can also ask for restrictions on using this information to notify you about appointments, etc. Partners is not required to agree to your request. If we do, we must put the restriction in writing and abide by it except if you need to be treated in an emergency. You may not ask us to restrict uses and sharing of information that we are legally required to make.

The Right to Ask that Your Health Information be Communicated to you in a Confidential Manner.

You have the right to ask for your health information to be sent to you in different ways. For example, you may ask that Partners not contact you with appointment reminders by telephone, or only call at your work or cell telephone number rather than home.
When we request an address and telephone number(s) to contact you, it is your responsibility to give us telephone number(s) and an address that will allow us to carry out our needs to reach you and care for you. We may request that the method and location where you wish to be contacted be in writing and that you contact us with any changes to this information. Partners must agree to any reasonable request and cannot ask you to explain the reason for your request. Partners can require you to give information as to how a payment will be handled, and what address a bill should be mailed to.

The Right to Look at and Get a Copy of Your Health Information.

You have the right to look at and get a copy of your health information that Partners keeps of your medical treatment and bills. You must ask for this in writing. We will respond within thirty (30) days from receipt of your request. If you ask for a copy of your records, you will be charged a fee. If your request is denied, we will explain the reasons in writing and tell you which rights you have, if any, to a review of the denial. We may offer to give you a summary or explanation of the information you requested as long as you agree in advance to this and to any fees that it might cost. If you ask for information that we do not have, but we know where it is, we must tell you where to direct your request. Certain information (for example, Psychotherapy Notes) may be withheld from you in certain circumstances.

The Right to Change Your Health Information.

You have the right to ask us to change your health information related to your treatment and bills if you think that there has been a mistake or that information is missing.

• You must make your request in writing and give the reason for why you want the change.
• We have 60 days to respond to your request.
• If we are not able to act on the request within the 60 days, we will notify you that we are extending the response time by 30 days.
• If we extend the response time, we will explain the delay to you in writing and give you a new date of when to expect a response.
• We may deny your request.
• If we deny your request, we must give you a written statement with the reasons for the denial, and what other steps are available to you.
• If we grant the request, we will ask you to tell us the persons you want to receive the changes. You need to agree to have us notify them along with any others who received the information before corrections were made, and who may have relied on the incorrect information to give you treatment.

The Right to Receive An Accounting of Disclosures (Record of When Your Health Information was Shared without Your Written Permission / Authorization).

You have the right to get a record of the times that your health information has been shared. You must make your request in writing. You may request this as far back as six years, beginning April 14, 2003. The listing you get will include the date, name, and address (if known) of the person or organization receiving your information. It will also include a brief description of the information given, and a brief statement of why the information was shared
.
The following exceptions apply:

• This does not include sharing your medical information for the purpose of treatment, payment, or health care operations.
• It also does not include:
  • Sharing your medical information if your gave permission in writing (signed an authorization form)
  • Sharing information in facility directories
  • Sharing information with persons involved in your care
  • Using your information to communicate with you about your health condition
  • Sharing information for national security or intelligence purposes or to correctional institutions or law enforcement officials who have custody of you
  • Sharing information that occurred before April 14, 2003.
• We have 60 days to respond to your request. If we have not been able to act on the request within the 60 days, we will notify you that we are extending the response time by 30 days.
• If we do extend the response time, we will explain the delay to you in writing and give you a new date of when to expect a response.
• Your first request for a record in any 12-month period is free.
• We will charge a fee for any other requests in that period.
• We will notify you of the fee before we do the work. This will give you a chance to stop the request if you do not wish to pay the fee.

The Right to Ask for a Paper Copy of this Notice.

You may ask for a paper copy of this Notice from the contact listed at the end of this Notice. You can ask for a paper copy even if you agreed to receive the Notice by email.

C. OUR DUTIES WITH RESPECT TO YOUR HEALTH INFORMATION
Partners is required by law to keep your health information private. We are required to give people notice of our legal duties and privacy practices with respect to your health information.

Partners must abide by the terms of the Notice currently in effect. Partners reserves the right to change its privacy practices and the terms of this Notice at any time. Partners reserves the right to make the new Notice provisions effective for all protected health information that it maintains. If it does so, the Glue 6 updated Notice will be posted on the Partners web site and in all Partners registration areas for public viewing. You may request a copy of the current Notice at any time by calling any of the people listed at the end of this notice, or you may view it on our web site at www.partners.org.

D. HOW TO COMPLAIN IF YOU BELIEVE YOUR PRIVACY RIGHTS HAVE BEEN VIOLATED
If you think that we may have violated your privacy rights or you disagree with any action we have taken with regard to your health information, we want you, your family, or your guardian to speak with us. If you present a complaint, your care will not be affected in any way. It is the goal of Partners HealthCare to give you the best care while respecting your privacy.

You may file a complaint by contacting a representative at any of the Partners sites that are listed at the end of this Notice. You may also send a written complaint to the U.S. Department of Health and Human Services, J.F.K. Federal Building - Room 1875, Boston, MA 02203, Voice phone 617-565-1340, or email to OCRComplaint@hhs.gov. We will take no retaliatory action against you if you file a complaint about our privacy practices.

E. PERSON TO CONTACT FOR INFORMATION OR WITH A COMPLAINT
If you have any questions about this Notice or any complaints, please contact a representative at any of the Partners sites that are listed at the end of this Notice.

F. EFFECTIVE DATE OF THIS NOTICE
This Notice is effective as of August 11, 2008.