Notice of Privacy Practices

Effective September 23, 2013

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

In this Notice of Privacy Practices (“Notice”), the words “we” and “us” mean NxStage Kidney Care and its designees, and the terms “information” or “health information” include any information we maintain that reasonably can be used to identify you and that relates to your physical or mental health condition, the provision of health care to you, or the payment for such health care.

We are legally required to maintain the privacy of your health information. We are also required to provide you with a copy of this Notice, which describes how we may use and disclose health information about you and your rights and our obligations regarding the use and disclosure of that information. By law, we must abide by the terms of this Notice.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

Required Uses and Disclosures

• To You or Your Personal Representative. We may use or disclose your health information to you or someone who has the legal right to act for you (i.e. your personal representative) in order to administer your rights as described in this Notice.
• Secretary of HHS. We may disclose your health information to the Secretary of Health and Human Services (HHS) or any employee of HHS as part of an investigation to determine our compliance with HIPAA.

Permitted Uses and Disclosures

Federal law allows us to use and disclose your health information for the purposes of treatment, payment and health care operations without your authorization.

• For Treatment. We may use your health information to provide or coordinate your health care services or products. For example, we may disclose your health information to physicians or hospitals to help them provide care to you.
• For Payment. We may use or disclose your health information to bill any applicable payors or programs for health care services or products provided to you. For example, we may disclose health information to your health plan to determine whether your plan will cover certain health care services or products, unless you have requested that we not bill your health plan, as discussed under “Right to Request Restrictions” below.
• For Health Care Operations. We may use or disclose your health information as necessary to operate and manage our business activities. For example, we may use your health information to perform quality assessment and improvement activities.

Federal law also allows us to use and disclose your health information for the following purposes, without your authorization, subject to all applicable legal requirements and limitations:

• As Required by Law. We may use or disclose your health information as required by federal, state or local law.
• Friends and Family Involved in Your Care. We may disclose your health information to a person involved in your care or who helps to pay for you care, such as a family member or friend, when you are incapacitated or in an emergency, or when you agree or fail to object when given the opportunity. If you are unable or unavailable to object, we will use our best judgment to decide if the disclosure is in your best interests.
• Business Associates. We may disclose your health information to our vendors (known as business associates) as part of a contracted agreement to perform services for NxStage Kidney Care. Our business associates are required under their contracts with us and by law to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract or as permitted by federal privacy laws.
• Research. We may use or disclose your health information in limited circumstances for research purposes without your authorization. The research must meet federal privacy law requirements, including obtaining approval through a special review process.
• Public Health Activities. We may use or disclose your health information for public health activities, such as disclosing your health information to the U.S. Food and Drug Administration to report or track adverse events or product defects.
• Abuse, Neglect, or Domestic Violence. We may use or disclose your health information to certain government authorities authorized by law to receive such information in cases of abuse, neglect, or domestic violence, if you agree or when required or authorized by law.
• Health Oversight Agencies. We may disclose your health information to a government health oversight agency for activities authorized by law (for example, audits, investigations, inspections and licensure).
• Judicial or Administrative Proceedings. We may use or disclose your health information in response to a court or administrative order, search warrant, subpoena, discovery request, or other lawful process.
• For Law Enforcement Purposes. We may use or disclose certain of your health information to law enforcement officials for law enforcement purposes, such as providing limited information to identify or locate a suspect or missing person, report a crime, or provide information about a crime victim.
• To Prevent a Serious Threat to Health or Safety. We may use or disclose your health information, if we believe in good faith that such a disclosure is necessary, to prevent a serious threat to the health and safety of you, another person, or the public. This includes disclosing your health information to public health agencies or law enforcement.
• Coroner, Medical Examiner, Funeral Director. We may use or disclose your health information to a coroner, medical examiner or funeral director as necessary for them to carry out their duties regarding a deceased person, or as otherwise authorized by law.
• Organ Procurement. We may disclose your health information to organizations that handle organ procurement or transplantation, or to an organ donation bank, in limited circumstances.
• Military and Authorized Federal Officials. We may disclose your health information as required to appropriate military authorities or authorized federal officials for intelligence and national security activities.
• Workers’ Compensation. We may use or disclose your health information as authorized by or as required to comply with workers’ compensation laws or similar programs established by law that govern job-related injuries or illness.
• Limited Data Sets. We may use or disclose limited components of your health information in a “limited data set,” from which certain identifiers like names and contact information have been removed. We must enter into an agreement with the information’s recipient, and the purpose of the use or disclosure must be limited to research, public health, or our health care operations.

We will not make any of the following uses or disclosures of your health information without first obtaining your authorization: (1) making communications about products or services that encourage you or other recipients to purchase or use the products or services (i.e., marketing communications), or (2) disclosing your health information in exchange for payment or other benefit (i.e., sale of PHI), except in limited situations permitted by federal law. In addition, except for the uses and disclosures described and limited as set forth in this Notice, we will not otherwise use or disclose your health information without your written authorization.

If you give us authorization to use or disclose your health information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose health information about you for the reasons covered by your written authorization, but we cannot take back any uses or disclosures already made with your permission.

YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU

You have the following rights regarding health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and request a copy of certain of your health information, such as medical and billing records that we use to make decisions about your care. This right applies to both paper and electronic information. If you request access to electronic information, you have a right to receive an electronic copy of your health information. You also have a right to designate another person to receive your health information, after clearly identifying this person to us, and we will send your health information directly to him or her. In some cases, you may also receive a summary of your health information.

You must submit a written request to inspect and/or copy your health information. Mail your request to the address listed at the end of this Notice. If you request a copy of the information, we may charge a reasonable cost-based fee for costs of labor to create and copy the information and prepare an explanation or summary, supplies (e.g., paper, USB flash drive), and postage. We may deny your request to inspect and/or copy in certain limited circumstances. If you are denied access to your health information, you may ask that the denial be reviewed. If such a review is required by law, we will select a licensed health care professional to review your request and our denial. The person conducting the review will not be the person who denied your request, and we will comply with the outcome of the review.

Right to Amend. If you believe certain of the health information we have about you is incorrect or incomplete, you may ask to amend the information. You must submit a written request to amend your health information and provide the reasons for the requested amendment. Mail your request to the address listed at the end of this Notice. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request for certain reasons, including if you ask us to amend information that:

• We did not create, under certain circumstances;
• Is not part of the health information that we keep and use to make decisions about your care;
• You would not be permitted to inspect and copy the information; or
• Is accurate and complete.

Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of your health information we have made for up to six years prior to the date of your request. This right does not include disclosures to you, disclosures authorized by you in writing, disclosures for treatment, payment, and health care operations, or other disclosures for which federal law does not require us to provide an accounting. To obtain a list of disclosures, mail your request to the address listed at the end of this Notice. Your request must state a time period, which may not begin more than six years prior to the date of the request.

Right to Request Restrictions. You have the right to request a restriction or limitation on (1) how we use or disclose your health information for treatment, payment, or health care operations; (2) the health information we disclose to someone who is involved in your care or the payment for your care, like a family member or friend; or (3) the health information we send to health plans in certain circumstances, provided the health information concerns only a health care item or service for which you paid in full out-of-pocket.

We are not required to agree to your request, unless it is to restrict certain disclosures of health information by us to a health plan concerning a health care item or service for which you paid in full out-of-pocket. For other requests that we are not required to agree to, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction, mail your request to the address listed at the end of this Notice.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work and/or by mail. We will not ask you the reason for your request. We will accommodate all reasonable requests. You must submit your request in writing, and your request must specify how or where you wish to be contacted. Mail your request to the address listed at the end of this Notice.

Right to be Notified in Event of Breach. You have a right to be notified if we, or our business associate, experience a breach that affects your unsecured health information. In such an event, we will provide notice of the breach of your health information in accordance with federal privacy laws.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. Even if you have agreed to receive it electronically, you are still entitled to a paper copy. To obtain such a copy, mail your request to the address listed at the end of this Notice.

OTHER APPLICABLE LAWS

This Notice is provided to you as a requirement of HIPAA. There are other federal and state privacy laws that may apply and limit our ability to use and disclose your health information beyond what we are allowed to do under HIPAA. Below is a list of the categories of health information that are subject to these more restrictive laws and a summary of those laws. These laws have been taken into consideration in developing our policies of how we will use and disclose your health information. If a use or disclosure of health information described above in this Notice is prohibited or materially limited by another federal or state law that applies to us, it is our intent to meet the more stringent federal or state law requirements, including laws related to:

• Alcohol and Drug Abuse. We are allowed to use and disclose alcohol and drug abuse information without your permission under certain limited circumstances, and/or disclose only to specific recipients.
• HIV/AIDS. Restrictions apply to the use and/or retention of HIV/AIDS information.
• Mental Health. We are allowed to use and disclose mental health information without your permission under certain limited circumstances, and/or disclose only to specific recipients.
• Sexually Transmitted Diseases and Reproductive Health. Restrictions apply to the use and/or retention of information concerning sexually transmitted diseases and reproductive health.
• Abuse or Neglect. Restrictions apply to the use and/or retention of information concerning abuse or neglect.

CHANGES TO THIS NOTICE

We reserve the right to change the terms of this Notice, and to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the revised Notice at our facility and on our website at www.nxstagekidneycare.com. A copy of the revised Notice will also be available at our facility. The Notice will contain an effective date at the top of the first page.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with us at the address listed at the end of this Notice. You may also file a complaint with the Secretary of the Department of Health and Human Services. You will not be penalized for filing a complaint.

CONTACT INFORMATION

If you have any questions about this Notice, wish to file a complaint, or wish to exercise any of your rights described in the section “Your Rights Regarding Health Information About You,” please contact us at:

NxStage Columbus, LLC
5665 Woerner Temple Road
Dublin, OH 43016
Attention: Center Director