Notice of Privacy Practices for Protected Health Information
 _________________________________________________________________
 
 
 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU
 MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO
 THIS INFORMATION. PLEASE READ IT CAREFULLY.
 
 _________________________________________________________________
 
 The office is permitted by federal privacy laws to make uses
 and disclosures of your health information for purposes
 of treatment, payment, and health care operations. Protected
 health information is the information we create and obtain in
 providing our services to you. Each time you visit a physician
 or healthcare provider, the provider makes a record of your visit.
 Typically, this record contains your health history, current
 symptoms, examination and test results, diagnoses, treatment, and
 a plan for future care or treatment. This information, often
 referred to as your medical record serves as:
 --basis for planning your care and treatment
 --means of communication among the many health professionals
 who contribute to your care.
 --legal document describing the care you received.
 --means by which you or a third-party payer can verify that you
 actually received the services billed for.
 -- a source of information for public health officials charged
 with improving the health of the regions they serve.
 --a tool to assess the appropriateness and quality of care you
 received.
 --a tool to improve the quality of healthcare and achieve
 better patient outcomes.
 
 Examples of uses of your health information for treatment purposes
 are:
 -- A nurse obtains treatment information about you and records
 it in a health record.
 --During the course of your treatment, the physician determines
 he/she will need to consult with another specialist in the
 area. He/she will share the information with such specialist
 and obtain his/her input.
 
 
 An example of use of your health information for payment purposes:
 --We submit a request for payment to your health insurance
 company.
 --The health insurance company requests information
 from us regarding medical care given. We will provide
 information to them about you and the care given.
 
 
 An example of use of your health information for health care
 operations:
 --The state licensing authority wants to review records to
 assure that we have acted consistent with state laws
 regarding your care. In doing so, it wants to take a sampling
 which includes review of your chart. At the licensing
 authority's request, we will provide it with a copy of your
 record.
 
 
 
 
 Your Rights Under the Federal Privacy Standard
 
 
 The health record we maintain and billing records are the physical
 property of the office. The information in it, however, belongs to
 you. You have a right to:
 --Request a restriction on uses and disclosures of your
 health information for treatment, payment, and health
 care operations. Health care operations consist of
 activities that are necessary to carry out the operations
 of the provider, such as quality assurance and peer
 review. The right to request restriction does not extend
 to uses or disclosures permitted or required under
 164.502(a)(2)(i)(disclosures to you), 164.510(a)(for
 facility directories, but not that you have the right to
 object to such uses), or 164.512(uses and disclosures not
 requiring a consent or an authorization). The latter
 uses and disclosures include, for example, those required
 by law, like mandatory communicable disease reporting.
 In those cases, you do not have a right to request
 restriction. Even in those cases in which you do have
 the right to request restriction, we do not have to agree
 to the restriction. If we do, however, we will adhere to
 it unless you request otherwise or we give you advance
 notice.
 
 
 You may also ask us to communicate with you by alternate
 means and, if the method of communication is reasonable
 we must grant the alternate communication request.
 
 
 -- Receive and keep a copy of this notice of information
 practices. Although we have posted a copy in prominent
 locations throughout the facility, if you access those
 copies, you nonetheless have a right to a hard copy on
 request. The law requires us to ask you to acknowledge
 receipt of your copy.
 
 
 --Inspect and copy your health information upon request.
 Again, this right is not absolute. In certain
 situations, such as if access would cause harm, we can
 deny access. You do not have a right of access to the
 following:
 --Psychotherapy notes. Such notes comprise those
 that are recorded in any medium by a healthcare
 provider who is a mental health professional
 documenting or analyzing a conversation during
 a private counseling session or a group, joint,
 or family counseling session and that are
 separated from the rest of your medical record.
 --Information compiled in reasonable anticipation
 of or for use in civil, criminal, or
 administrative actions or proceedings.
 --Any of your health information that is subject
 to the Clinical Laboratory Improvement Amendments
 of 1988 (CLIA), 42 U.S.C. 263a., the extent that
 the provision of access to the individual would be
 prohibited by law.
 --Information was obtained from someone other than
 a healthcare provider under a promise of
 confidentiality and the access requested would
 be reasonably likely to reveal the source of the
 information.
 
 
 In other situations, the provider may deny you access but, if
 he/she does, the provider must provide you with a review of the
 decision denying access. These reviewable grounds for denial
 include:
 --When a licensed healthcare professional has
 determined, in the exercise of professional
 judgment, that the access is reasonably
 likely to endanger the life or physical
 safety of the individual or person.
 --When the PHI makes reference to another
 person (other than a healthcare provider)
 and a licensed healthcare provider has
 determined, in the exercise of professional
 judgment, that the access is reasonably
 likely to cause substantial harm to such
 other person.
 --The request is made by the individual's
 personal representative and a licensed
 healthcare professional has determined,
 in the exercise of professional judgment,
 that the provision of access to such
 personal representative is reasonably
 likely to cause substantial harm to the
 individual or another person.
 For these reviewable grounds, another licensed professional
 must review the decision of the provider denying access within 60
 days. If we deny you access, we will explain why and what your
 rights are, including how to seek review.
 If we grant access, we will tell you what, if anything, you
 have to do to get access. We reserve the right to charge a
 reasonable, cost-based fee for making copies.
 
 
 Request amendment/correction of your health information
 
 We do not have to grant the request if:
 --We did not create the record. If, as in the case of a
 consultation report from another provider, we did not
 create the record, we cannot know whether it is accurate
 or not. Thus, in such cases, you must seek amendment/
 correction from the party creating the record. If they
 amend or correct the record, we will put the corrected
 record in our records.
 --The records are not available to you as discussed
 immediately above.
 --The record is accurate and complete.
 
 
 If we deny your request for amendment/correction, we will
 notify you why, how you can attach a statement of disagreement to
 your records (which we may rebut), and how you can complain to our
 complaint official or to the Department of Health and Human
 Services. If we grant the request, we will make the correction and
 distribute the correction to those who need it and those you
 identify to us that you want to receive the corrected information.
 Obtain an accounting of non-routine uses and disclosures
 other than for treatment, payment, and health care
 operations, or of protected health information about them.
 
 
 We do not need to provide an accounting for:
 --For disclosures to you.
 --For disclosures authorized by you.
 --For disclosures of limited data sets (partially
 de-identified data used for research, public health,
 or health care operations).
 --For the facility directory or to persons involved
 in your care or for other notification purposes as
 provided in 164.510(uses and disclosures requiring an
 opportunity for the individual to agree or to object,
 including notification to family members, personal
 representatives, or other persons responsible for the
 care of the individual, of the individual's location,
 general condition, or death).
 --For national security or intelligence purposes under
 164.512(k)(2) (disclosures not requiring consent,
 authorization, or an opportunity to object.
 --To correctional institutions or law enforcement
 officials under 164.512(k)(5) (disclosures not
 requiring consent, authorization, or an opportunity
 to object).
 --That occurred before April 14, 2003.
 
 
 We must provide the accounting within 60 days. The accounting
 must include:
 --Date of each disclosure.
 --Name and address of the organization or person who
 received the protected health information.
 --Brief description of the information disclosed.
 --Brief statement of the purpose of the disclosure
 that reasonably informs you of the basis for the
 disclosure or, in lieu of such statement, a copy
 of your written authorization, or a copy of the
 written request for disclosure.
 The first account in any 12 month period is free. Thereafter, we
 reserve the right to charge a reasonable, cost-based fee.
 
 
 Revoke your consent or authorization to use or disclose
 health information except to the extent that we have already
 taken action in reliance on the consent or authorization.
 
 
 Our Responsibilities Under the Federal Privacy Standard
 
 
 In additional to providing you your rights, as detailed above,
 the privacy standard requires us to:
 --Maintain the privacy of your health information, including
 implementing reasonable and appropriate physical,
 administrative, and technical safeguards to protect the
 information.
 --Provide you with this notice as to our legal duties and
 privacy practices with respect to individually
 identifiable health information we collect and maintain about you.
 --Abide by the terms of this notice.
 --Train our personnel concerning privacy and confidentiality.
 --Implement a sanction policy to discipline those who breach
 privacy/confidentiality or our policies with regard thereto.
 --Mitigate (lessen the harm of) any breach of
 privacy/confidentiality.
 
 
 WE RESERVE THE RIGHT TO CHANGE OUR PRACTICES AND
 TO MAKE THE NEW PROVISIONS EFFECTIVE FOR ALL
 INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION WE
 MAINTAIN. SHOULD WE CHANGE OUR INFORMATION
 PRACTICES, WE WILL MAIL A REVISED NOTICE TO THE
 ADDRESS YOU HAVE SUPPLIED US.
 
 We will not use or disclose your health information without your
 [consent or] authorization, except as described in this notice or
 otherwise required by law.
 
 
 How to Get More Information or to Report a Problem.
 If you have questions and/or would like additional information,
 you may contact Donna Stuteville, privacy officer at 913-432-3732.
 
 
 EXAMPLES OF DISCLOSURES FOR TREATMENT,
 PAYMENT, AND HEALTH OPERATIONS
 
 
 Treatment: With the regulatory consent granted by the Department
 of Health and Human Services we may use or disclose your health
 information for treatment.
 Example: A physician, nurse, or other member of your healthcare
 team will record information in your record to diagnose your
 condition and determine the best course of treatment for you.
 The primary caregiver will give treatment orders and document
 what he or she
 expects other members of the healthcare team to do to treat you. Those
 other members will then document the actions they took and their
 observations. In that way, the primary
 caregiver will know how you are responding to treatment.
 We will also provide your physician, other healthcare
 professionals, or a subsequent healthcare provider with copies
 of your records to assist them in treating you once we are no
 longer treating you.
 
 
 Payment: With the regulatory consent granted by the Department
 of Health and Human Services we may use or disclose your health
 information for payment.
 Example: We may send a bill to you or to a third-party payer,
 such as a health insurer. The information on or accompanying
 the bill may include information that identifies you, your
 diagnosis, treatment received, and supplies used.
 
 
 Health Operations: With the regulatory consent granted by the
 Department of Health and Human Services we may use or disclose
 your health information for health operations (see definition above).
 Example: Members of the medical staff, the risk or quality
 improvement manager, or members of the quality assurance team may
 use information in your health record to assess the care and the
 outcomes in your cases and the competence of the care-givers. We
 will use
 this information in an effort to continually improve the
 quality and effectiveness of the healthcare and services we
 provide.
 
 
 Use and Disclosures Other than for Treatment, Payment, or Health
 Care Operations
 
 
 Business Associates: We provide some services through contracts
 with business associates. Examples include certain diagnostic
 tests. When we use these services, we may disclose your health
 information to the business associate so that they can perform the
 function(s) we have contracted with them to do and bill you or your
 third-party payer for services rendered. To protect your health
 information, however, we require the business associate to
 appropriately safeguard your information.
 
 
 Notification: We may use or disclose information to notify or
 assist in notifying a family member, personal representative, or
 another person responsible for your care, your location, and
 general condition.
 
 
 Communication with family: Unless you object, health
 professionals, using their best judgment, may disclose to a
 family member, other relative, close personal friend or any other
 person you identify, health information relevant to that person's
 involvement in your care or payment related to your care.
 
 
 Research: We may disclose information to researchers when their
 research has been approved by an institutional review board that
 has reviewed the research proposal and established protocols to
 ensure the privacy of your health information.
 Funeral directors: We may disclose health information to funeral
 directors consistent with applicable law to enable them to carry
 out their duties.
 
 
 Marketing/continuity of care: We may contact you to provide
 appointment reminders or information about treatment alternatives
 or other health-related benefits and services that may be of
 interest to you.
 
 
 Food and Drug Administration (FDA): We may disclose to the FDA
 health information relative to adverse effects with respect to
 food, drugs, supplements, product or product defects, or post
 marketing surveillance information to enable product recalls,
 repairs, or replacement.
 
 
 Workers compensation: We may disclose health information to the
 extent authorized by and to the extent necessary to comply with
 laws relating to workers compensation or other similar programs
 established by law.
 
 
 Public health: As required by law, we may disclose your health
 information to public health or legal authorities charged with
 preventing or controlling disease, injury, or disability.
 
 
 Correctional institution: Should you be an inmate of a
 correctional institution, we may disclose to the institution or
 agents thereof health information necessary for your health and
 the health and safety of other individuals.
 
 
 Law enforcement: We may disclose health information purposes as
 required by law or in response to a valid subpoena.
 Health oversight agencies and public health authorities: If a
 member of our work force or a business associate believes in good
 faith that we have engaged in unlawful conduct or otherwise
 violated professional or clinical standards and are potentially
 endangering one or more patients, workers or the public, they
 may disclose your health information to health oversight agencies
 and/or public health authorities, such as the department of
 health.
 
 
 The Federal Department of Health and Human Services (DHHS) as
 necessary for them to determine our compliance with those
 standards.
 
 
 Complaints. Patients may file a formal complaint regarding the
 privacy practices of a covered provider. Such complaints can be
 made directly to the covered provider or to HHS' Office for Civil
 Rights (OCR), which is charged with investigating complaints and
 enforcing the privacy regulation at http://www.hhs.gov/ocr/hipaa
 or by calling (866) 627-7748.
 
 
 Effective Date: April 14, 2003
 Name of entity: Sunflower Medical Group, PA