THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE THOROUGHLY REVIEW THIS NOTICE OF PRIVACY PRACTICES CAREFULLY.

Orthopedic Institute, PLLC, an Arizona professional limited liability company (the “Clinic”), its affiliated and managed clinics, and Orthopedic Institute MSO, LLC, a Delaware limited liability company (the “Management Company”), its affiliated and managed surgery centers and clinics (Clinic and Management Company will be referred to herein as “Orthopedic Institute” and sometimes referred to herein as “we” or “us”), will follow and adhere to this HIPAA Notice of Privacy Practices (this “Notice”) at the service delivery locations listed at the end of this Notice. Orthopedic Institute covered entities participate in an “organized health care arrangement.” These covered entities are considered part of an organized system of health care and are clinically-integrated organizations participating in the organized health care arrangement. Orthopedic Institute organizations may share your health information, as necessary, for purposes including, but not limited to, treatment, payment or health care operations outlined in this Notice and related to the organized health care arrangement.

Orthopedic Institute is committed to protecting the privacy of your protected health information. In conducting our business, we create, collect, and maintain identifiable information about you as well as the medical treatment and healthcare items/services we provide (collectively, your “Information”). The Medical Practices, Ambulatory Surgery Centers, and the Management Company are all subject to, and must comply with the requirements of, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and other federal and state laws protecting the confidentiality, privacy, security, and availability of your Information. Orthopedic Institute is required by HIPAA to provide you with this Notice describing Orthopedic Institute’s legal duties and privacy practices. Orthopedic Institute may make amendments to this Notice from time to time, with or without prior notice. By law, Orthopedic Institute must follow the terms of the Notice in effect at the time.

This Notice explains how we may use and/or disclose your Information, which includes your medical history, symptoms, examination and test results, diagnoses and care plans, and other health-related information, for purposes such as treatment, payment, and health care operations and for other permissible purposes or as may be required of Orthopedic Institute by law. This Notice also describes your rights to review and control the use and disclosure of your Information. We will report any breaches of your unsecured Information as required by applicable law.

The terms of this Notice apply to any and all records containing your Information that are created collected, and/or maintained by Orthopedic Institute. Orthopedic Institute reserves the exclusive right to revise or amend this Notice at any time, for any reason, or no reason at all. Any revision or amendment of this Notice will be effective for all of your records that the applicable Orthopedic Institute entity created, collected, and/or maintained in the past and any of your records Orthopedic Institute may create, collect, and/or maintain in the future. A copy of our current Notice is posted in applicable reception areas and on www.orthopedicinstitute.com. You may request a copy of this Notice at any time. Orthopedic Institute will follow the terms of the Notice that is in effect at the time. The effective date of the Notice is (and will be) posted in the lower right-hand corner of the Notice.

Primary Uses & Disclosures. Orthopedic Institute may use and disclose your Information for purposes related to providing treatment, obtaining payment, and/or our health care operations, and there may be other incidental uses and/or disclosures of your Information. The following are examples of such uses and disclosures of your Information. Not every possible use and disclosure in a particular category is listed; however, all of the ways that Orthopedic Institute is permitted to use and disclose your Information without your written authorization will fall within one of the categories.

• Treatment. Orthopedic Institute may use and/or disclose your Information to provide, coordinate, and manage your health care and related services. This includes the use/disclosure of your Information for treatment purposes by/to health care providers within and outside of Orthopedic Institute, such as doctors, physicians, nurse practitioners, physician assistants, nurses, technicians, health care professionals, and/or other personnel involved in your care and treatment. For example, your Information may be provided to a doctor to whom you have been referred to ensure that the doctor has the information needed to diagnose and treat you. To the extent permitted by law, Orthopedic Institute may also disclose your Information to other persons who are involved in your health care, such as family members and friends, unless and until you have specifically instructed us not to do so.
• Payment. Orthopedic Institute may use and disclose your Information so that the health care and related services that you receive from Orthopedic Institute may be billed to, and payments may be collected from: you; an insurance company; another third-party payor; collection agency; or any other third-party. We may also tell your health plan about a treatment you are going to receive to obtain prior authorization and/or to determine whether your plan will cover the treatment. Orthopedic Institute may also disclose your Information to other health care providers and health plans for payment activities of those providers and plans. For example, Orthopedic Institute may provide your Information to a doctor who is not affiliated with Orthopedic Institute so that the doctor may bill you, your insurer, and/or any other third-party for services you received from that doctor.
• Health care Operations. Orthopedic Institute may use and disclose your Information, as needed, for certain administrative and operational purposes in the course of running our business. These uses and disclosures are necessary for our operations and to ensure that all patients receive high-quality health care. For example, Orthopedic Institute may use your Information to review our services and treatment and to evaluate our performance in caring for you. Orthopedic Institute may combine the health information of some or all patients to decide what additional services Orthopedic Institute should offer, what services may not be needed, and whether certain treatments are effective. Orthopedic Institute may also disclose your Information to doctors, physicians, nurse practitioners, physician assistants, nurses, technicians, health care professionals, and our personnel for review and learning purposes. Orthopedic Institute may also combine the information we have with information from other health care providers to compare how we are doing and see where we can make improvements in the care and services offered. Orthopedic Institute may remove information that identifies you (e.g., name, date of birth, address, social security number) from this set of health information so that others may use it to study health care and health care delivery without learning your identity. Orthopedic Institute may also disclose your Information to other individuals and organizations, including physicians, hospitals, healthcare clearinghouses, and/or health plans to assist with the health care operations activities of such individuals and organizations, as long as they have (or have had in the past) a treatment relationship with you. These are just some of the various uses and disclosures of your Information that we may engage in as part of its routine health care operations.
• Incidental Uses/Disclosures. There may be incidental uses and disclosures of your Information that cannot reasonably be prevented. For example, when your name is called in our waiting room, we cannot prevent other people in the waiting room from overhearing your name.
• Other Uses/Disclosures. Orthopedic Institute may contact you by phone, SMS, text message, mail or secure mail (unless you request otherwise) to schedule, or remind you of, an appointment, including by leaving you voice messages on your cell phone or in a message left with the person answering the phone. Orthopedic Institute may also use your Information to contact and tell you about health-related benefits, insurance updates, billing and payment information, treatment options or alternatives, and other services that may be of interest to you. You have the right to request no voicemail or specific communication methods.

Other Uses & Disclosures Allowed or Required by Law. Orthopedic Institute may disclose your Information in the following situations, as allowed or as required by law. These uses/disclosures of your Information generally do not require Orthopedic Institute to obtain your written authorization.

• Business Associates. Orthopedic Institute may disclose your Information to various third-party entities that provide certain services for Orthopedic Institute entities that involve access to your Information. Orthopedic Institute has a written contract with each of these business associates that contains terms requiring them and their subcontractors to protect the privacy and security of your Information in accordance with HIPAA.
• As Required By Law. Orthopedic Institute will use/disclose your Information when Orthopedic Institute is required to do so by federal, state or local law; however, Orthopedic Institute will limit the use/disclosure to the minimum amount required for Orthopedic Institute to comply with such legal requirement. When the law requires Orthopedic Institute to report abuse, neglect or domestic violence, or respond to judicial or administrative proceedings or to law enforcement officials, Orthopedic Institute will comply with any and all of the requirements set forth below concerning those activities.
• Legal Proceeding. Orthopedic Institute may disclose your Information in the course of judicial or administrative proceedings: (i) in response to an order of a court or administrative tribunal, to the extent such disclosure is authorized by such order; and (ii) in response to a subpoena, discovery request, or other lawful process that is not accompanied by an order of a court of administrative tribunal, but only if certain efforts have been made to inform you about the request or to obtain an order protecting the information being requested.
• Compliance. By law, Orthopedic Institute must make disclosures of your Information to the Secretary of the Department of Health and Human Services to enable the Secretary to evaluate Orthopedic Institute’s compliance with HIPAA.
• Law Enforcement. Orthopedic Institute may disclose your Information if requested by federal, state or local law enforcement, for law enforcement purposes, such as:

1. in response to a court order, subpoena, summons, or warrant;
2. to identify or locate a suspect, fugitive, material witness, or missing person;
3. to assist with the identification of a victim of a crime;
4. in connection with death that may be the result of criminal conduct;
5. to report criminal conduct at our facility; and/or
6. in emergencies to report a crime, the location or victim(s) of the crime, or the description, identity or location of the perpetrator.

• Proof of Immunization. Orthopedic Institute may disclose proof of immunization to a school that is required to have it before admitting a student if you have agreed to the disclosure on behalf of yourself or your dependent.
  • to report, prevent or control disease, injury or disability;
• Health Oversight. Orthopedic Institute may disclose your Information to a state or federal health oversight agency for activities authorized by law, such as investigations, inspections, and audits; licensure and disciplinary actions; civil, administrative, and criminal actions; and activities necessary for the government to oversee the health care system, government benefit programs, and compliance with civil rights laws.
• Public Health. We may disclose your Information for authorized state and federal public health activities, such as:

1. to report adverse reactions to medications;
2. to notify people of problems with, or recalls of, products;
3. to notify a person who may have been exposed to, or be at risk for contracting or spreading, a disease or condition.

Orthopedic Institute will make these disclosures only if you agree unless and until we are required or otherwise authorized by law to do so. If directed by a public health authority, Orthopedic Institute may disclose your Information to a foreign government agency collaborating with a public health authority.

• Abuse/Neglect. Orthopedic Institute may disclose your Information to a governmental entity/agency that is authorized by law to receive reports of child, elder, or dependent adult abuse or neglect or if Orthopedic Institute believes that you have been a victim of abuse, neglect or domestic violence. In this case, the disclosure will be made consistent with the requirements of applicable laws and due regard for the safety of the individual.
• Threats to Health or Safety. Orthopedic Institute may use and disclose your Information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any such disclosure, however, would only be to someone able to help prevent the threat and/or to identify victims of the threat.
• FDA. When required by the U.S. Food and Drug Administration (“FDA”), Orthopedic Institute may disclose your Information to a person or company for purposes relating to the quality, safety, or efficacy of FDA-regulated products or activities.
• Coroners, Medical Examiners, Funeral Directors. Orthopedic Institute may disclose your Information to a coroner or medical examiner for identification purposes, to determine a cause of death, or to perform other duties authorized by law. Orthopedic Institute may disclose your Information to a funeral director as needed to carry out his/her duties.
• Organ Donation. If you are an organ or tissue donor, Orthopedic Institute may use and disclose your Information for permitted cadaveric organ, eye, or tissue donation and transplantation, including disclosures to organizations involved in procuring, banking or transplanting donor organs and tissues.
• Facility Directories. Orthopedic Institute will use and disclose in our facility directory your name, the location at which you are receiving care, your condition (in general terms), and your religious affiliation. All of this information, except religious affiliation, will be disclosed to people who ask for you by name. If you do not want us to use or disclose such information or want some restrictions on what is placed in our facility directory or to who the information is disclosed, your request must be in writing, addressed to our Compliance Officer and state the specific restrictions requested. If you are not present or able to express your objection or request a restriction to such use or disclosure, then your physician may, using the physician’s professional judgment, determine whether the use or disclosure is in your best interest.
• Research. Orthopedic Institute may disclose your Information to researchers for research that has been approved by a privacy board or an institutional review board. Before Orthopedic Institute discloses your Information, the project will be approved through a formal review and approval process; however, Orthopedic Institute may disclose your Information to people preparing to conduct a research project (e.g., to help find participants), so long as the information that they review does not leave applicable premises. Orthopedic Institute will usually ask for your specific permission if the researcher will have access to your name, address, or other information that reveals your identity.
• Criminal Activity. Consistent with applicable federal and state laws, Orthopedic Institute may use and/or disclose your protected health information if Orthopedic Institute believes, in its sole and absolute discretion, the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Military and Veterans. If you are a member of the Armed Forces, Orthopedic Institute may use and disclose your Information: (i) for activities deemed reasonably necessary by the military; (ii) for purposes of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (iii) to a foreign military authority if you are a member of that foreign military, in accordance with HIPAA.
• National Security. Orthopedic Institute may disclose your Information to federal officials for intelligence, counter-intelligence, and national security activities authorized by law, including to protect the President and other government officials or foreign heads of state.
• Correctional Institutions. If you are an inmate or are under the custody of a law enforcement official, Orthopedic Institute may disclose to the correctional institution or law enforcement official your Information as necessary: (i) for the correctional institution to provide health care services to you; (ii) to protect your health and safety or that of others; or (iii) for the safety and security of the institution or official.
• Employers. Orthopedic Institute may disclose to your employer the Information obtained in providing medical services to you specifically at the request of your employer for purposes of conducting an evaluation relating to medical surveillance of the workplace or determining whether you have a work-related illness or injury when such services are necessary by the employer to comply with certain legal requirements.
• Workers’ Compensation. Orthopedic Institute may disclose your Information to comply with workers’ compensation laws. For example, to the extent your care is covered by workers’ compensation, Orthopedic Institute may make periodic reports to your employer about your condition. Orthopedic Institute is required by law to report cases of occupational injury or occupational illness to the employer or workers’ compensation insurer.
• Fundraising. Orthopedic Institute may use or disclose your demographic information, the dates that you received treatment, the department of service, your treating physician, outcome information and health insurance status to contact you for our fundraising activities. If you do not want to receive these materials, please notify our Compliance Officer and Orthopedic Institute will stop any further fundraising communications. Similarly, you should notify our Compliance Officer if you decide you want to start receiving these communications again.
• Change of Ownership. If any Orthopedic Institute entity is sold or merged with another organization, your Information will become the property of the new owner and be subject to the buyer’s HIPAA Notice of Privacy Practices. You will maintain the right to request that copies of your Information be transferred to another physician or medical group, and your rights with respect to your Information will remain the same.

Health Information Exchange. Orthopedic Institute participates in one or more electronic health information exchanges which permits Orthopedic Institute to electronically exchange medical information about you with other participating providers (for example, doctors, ambulatory surgery centers, health care providers) and health plans and their business associates. As permitted by law, a limited amount of your Information may be shared with the HIE in its capacity as a public health authority carrying out approved public health activities or as otherwise required by law, as discussed above.

Uses and Disclosures of Health Information Requiring Written Authorization. Any use/disclosure of your Information for purposes other than as generally described in this Notice will be made only with your prior written authorization. Any authorization you provide to us regarding the use/disclosure of your Information may be revoked by you, at any time, for any reason, or no reason at all, by giving Orthopedic Institute written notice of the revocation. Your revocation shall not apply to those uses and disclosures Orthopedic Institute previously made on your behalf pursuant to your authorization prior to the time Orthopedic Institute received your written revocation.

• Marketing. Orthopedic Institute may use/disclose your Information for marketing purposes only with your prior written consent and authorization unless the use is in the form of face-to-face communication made by us to you or involves a promotional gift of nominal value. The authorization will disclose whether Orthopedic Institute receives any compensation for any marketing activity you authorize, and Orthopedic Institute will stop any future marketing activity to the extent you revoke such authorization. Marketing uses/disclosures do not include activities such as us contacting you about health-related products or services offered by Orthopedic Institute, and/or managing or coordinating your care, and/or encouraging you to maintain a healthy lifestyle and/or reminding you to refill prescriptions.
• Sale of Your Information. Except in connection with the sale of an applicable Orthopedic Institute entity or its merger with another organization (see above), Orthopedic Institute may only sell your information to a third-party with your prior written authorization.

A valid authorization must contain a description of the information to be used, the name of the person(s) authorized to make the disclosure or use, the name of person(s) to whom Orthopedic Institute may make the requested use or disclosure, description or purpose, expiration date or event, signature and date. You may revoke an authorization at any time provided that the revocation is in writing. Your revocation will not be effective for uses and disclosures made in reliance on your prior authorization.

Breaches. If your unsecured Information is accessed, acquired, used or disclosed in a manner not permitted by law and that compromises its security or privacy, Orthopedic Institute will notify you within sixty (60) calendar days. Orthopedic Institute will report any breaches of unsecured Information in accordance with applicable federal and state law. In certain circumstances, Orthopedic Institute’s business associates may provide the notification to you.

Your Information Rights.

• Inspections and Copies. Subject to certain grounds for denial, you may ask to inspect and obtain copies of your Information that may be used to make decisions about your health care and treatment, including your medical records and billing records, but not including: (i) psychotherapy notes (if any); (ii) certain laboratory information restricted by federal law; and (iii) information compiled in reasonable anticipation of, or for use in, any civil, criminal, or administrative action or proceeding.

Any request for access to or copies of your Information must be submitted in writing to our Compliance Officer. Orthopedic Institute will respond to your request within thirty (30) calendar days. Orthopedic Institute may charge you a reasonable fee for the copying, mailing, labor and supplies associated with fulfilling your request. If Orthopedic Institute maintains the requested Information electronically, Orthopedic Institute will provide you with a copy in the electronic form and format that you request if Orthopedic Institute can readily produce such format. If Orthopedic Institute cannot readily produce the format you requested, Orthopedic Institute will produce your electronic Information in another readable electronic format as reasonably agreed to between you and us. If your request directs us to transmit the copy of your Information directly to another person, Orthopedic Institute will provide the copy to the person you designated; provided, your request is made in writing, signed by you, and identifies the designated person and where to send the copy of your Information.

Orthopedic Institute may deny your request to inspect and/or copy your Information in certain circumstances. For example, Orthopedic Institute may deny your request if it is determined that providing your Information could cause harm to you or another person. If your request is denied, you may, in some instances, have the right to have such denial reviewed. Orthopedic Institute will provide you with a written statement of the reasons for denial and, if you are allowed to have such denial reviewed, Orthopedic Institute will provide you with instructions for how to request a reconsideration.

• Confidential Communication. You may request that Orthopedic Institute send your Information to you by alternative means or at alternative locations. For example, you may request that Orthopedic Institute contact you at your work or by U.S. Mail. Orthopedic Institute will accommodate reasonable requests. You must submit your request in writing to our Compliance Officer. Your request must specify how and where you wish to be contacted. You must provide Orthopedic Institute with a mailing address where you can receive mail from Orthopedic Institute related to billing for Orthopedic Institute services. Orthopedic Institute reserves the right to contact you by any and all other means and at other locations if you fail to respond to any communication from us that requires a response.
• Restrictions. You may ask us to restrict the use/disclosure of any part of your Information to carry out treatment, payment or healthcare operations. You may also request that any part of your Information not be disclosed to family, relatives or friends who may be involved in your care or not to notify them of your location, general condition or death. Your request must be submitted in writing to our Compliance Officer, and must specifically describe clearly and concisely: (1) what information you want limited; (2) whether you want to limit our use or disclosure or both; and (3) to whom you want the limits to apply. Orthopedic Institute does not have the authority to bind anyone else to restrictions that you request and Orthopedic Institute agrees. Orthopedic Institute is not required or obligated to agree to your request unless the restriction involves the disclosure of your Information to a health plan for purposes of payment or health care operations and such Information pertains solely to a health care item or service for which you have paid for in full and out-of-pocket. If Orthopedic Institute agrees to the restriction, Orthopedic Institute will not use or disclose your Information in violation of that restriction, except in an emergency and as described herein. Orthopedic Institute may terminate any restriction by giving you written notice; provided, Orthopedic Institute’s termination shall only be effective with respect to information created or received after Orthopedic Institute has given you such written notice. Orthopedic Institute may not terminate a restriction that Orthopedic Institute is required by law to agree to concerning disclosures to health plans, as described above.
• Amendments. If you believe that the Information maintained by Orthopedic Institute is incorrect or incomplete, you may request Orthopedic Institute to amend such Information. Your request must be submitted in writing to Orthopedic Institute’s Compliance Officer. Orthopedic Institute may deny your request if it is not made in writing or does not include a valid reason to support your request. Orthopedic Institute may deny your request to amend information that: (i) is accurate and complete; (ii) was not created or generated by Orthopedic Institute, unless and until the person or entity that created such information is no longer available to make the amendment; (iii) is not part of the information kept by or for Orthopedic Institute; or (iv) is not part of the information which you are permitted to inspect or copy. If we deny your request, you may file a statement of disagreement that will become part of your record. If you file a statement of disagreement, we reserve the right to respond to your statement. You will receive a copy of any response we make and such response will also become part of your record.
• Accounting of Disclosures. You may request an accounting of certain disclosures of your Information that Orthopedic Institute has made (if any) during the six (6) years prior to the date of your request, except for disclosures: (i) to carry out treatment, payment or healthcare operations; (ii) made directly to you; (iii) incident to a use or disclosure otherwise permitted or required by law; (iv) pursuant to a written authorization; (v) to persons involved in your care or for notification purposes; (vi) for national security purposes; (vii) to correctional institutions or law enforcement officials having custody over you; or (viii) as part of a limited data set. Your request must be submitted in writing to Orthopedic Institute’s Compliance Officer. Your request must state a period that may not be longer than the six (6) years preceding the date of your request.

Your Right to a Copy of this Notice. You have the right to receive a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, please contact Orthopedic Institute’s Compliance Officer or ask for a copy during your next visit. You are also able to obtain a copy of this Notice by visiting www.orthopedicinstitute.com.

Your Right to File a Complaint. If you believe that your privacy rights have been violated, you may file a complaint with our Compliance Officer and/or the Secretary of the U.S. Department of Health and Human Services (DHHS). Complaints must be submitted in writing. To submit a complaint to Orthopedic Institute, send a letter describing your concerns to our Compliance Officer. DHHS provides information on its public website (www.hhs.gov) about how to file a complaint with the Secretary. We respect your privacy and we support efforts to protect the privacy and confidentiality of your Information. We will not retaliate against you for filing a complaint.

Compliance Officer Contact Information. If you have questions or concerns about this Notice and/or our privacy policies, contact our Compliance Officer by phone, facsimile, or regular mail address listed below. If you want to exercise any of your rights pursuant to this Notice, or if you wish to file a complaint, such request or complaint must be submitted in writing and delivered in person or faxed or mailed to our Compliance Officer at the contact information listed below.

Orthopedic Institute

455 N. Mesa Drive, Suite 7

Mesa, AZ 85201

Service Delivery Sites

This Notice applies to any and all of the locations, facilities, and service delivery sites associated with the following:

• Orthopedic Institute MSO, LLC
• Orthopedic Institute affiliated and managed Ambulatory Surgery Centers
• Orthopedic Institute affiliated and managed Medical Practices