Trust is very important to us and our Practice is strongly committed to protecting privacy. We have created the following Privacy Statement to give you an overview of the type of information we collect, how the information is used and how the information is safeguarded.

The practice makes its Notice available to any member of the public to enable prospective patients to evaluate the practice's privacy practices when making his or her decision regarding whether to seek treatment from the practice. The practice provides its Notice via e-mail to any patient or other individual who so requests the Notice.

Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have a right to adequate notice of the uses and disclosures of your protected health information ("PHI") (i.e., information that discloses your identity or leads to disclosure of your identity) that may be made by this medical practice. You are also entitled to notice of your rights and the duties of this practice with respect to your personal health information.

"We respect your right to privacy and understand that your medical information is personal to you. In order to provide medical services to you, we create paper and electronic records about your health and the care we provide. Your personal health information is confidential and this notice is intended to help you understand how our practice uses and discloses your personal health information and what rights you have with respect to your medical information.

Documentation of Provision of Notice: When a direct treatment patient receives the Notice from the practice, the practice asks the patient to sign its "Receipt of Notice of Privacy Practices" form. The form is filed with the patient's medical record. If the patient refuses to sign the form, it is noted in the medical record that the patient was given the Notice and refused to sign the form.

Effective Date and Changes to Notice: This Notice is effective April 13, 2003. The practice reserves the right to revise this Notice whenever there is a material change to the uses or disclosures, the individual's rights, the covered entity's legal duties, or other privacy practices stated in the Notice. Except when required by law, a material change to any term of the Notice will not be implemented prior to the effective date of the notice in which such material change is reflected.

If the Notice is revised, the practice makes the revised Notice available upon request beginning on the revision's effective date. The revised notice is posted in the practice's reception area and made available to all patients, including those who have received a previous Notice. Upon receipt of a revised Notice, a patient is asked to acknowledge receipt of the Notice.

Required by Law

Our practice has the following duties with respect to your personal health information: We are required by law to maintain the privacy of your personal health information. We must provide you with notice of our legal duties and privacy practices with respect to your personal health information. We must abide by the terms of the notice of privacy practices that is currently in effect.

How We May Use and Disclose Your Information

The following describes how our practice is permitted by law to share your personal health information with others in order to provide you with medical care. This notice does not describe every use or disclosure our practice makes; it is intended as a general overview.

Definitions.

Electronic Communications - Any form of email or facsimile communication as defined herein.
Electronic Mail System - Any computer software application that allows electronic mail to be communicated from one computing system to another.
Electronic Mail (email) - Any message, image form, attachment, data, or other communication sent, received, or stored within an electronic email system.
External Email - Email communications sent outside the NHTC & ICRC network (i.e. email communications to an address other than one with hsc.unt.edu).
Internal Email - Email communications exchanged within the NHTC & ICRC network (i.e. email communication to an address with hsc.unt.edu).
Facsimile (Fax) - An image or document that is transmitted in digitized electronic form over telephone/computer lines and reproduced in its original form on the receiving end.
Protected Health Information (PHI) - Individually identifiable health information transmitted or maintained in any form or medium, including oral, written, and electronic. Individually identifiable health information relates to an individual's health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual that is created or received by the health care provider. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual.
Treatment - The provision, coordination, or management of health care related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or for the referral of a patient for health care from one health care provider to another.

Medical Treatment: We may need to share the information about you in order to provide medical care to you. For example, we may share information with other physicians, nurses, sponsors, monitors, or healthcare professionals entering information into your medical records relating to your medical care and treatment. We may share information about you including x-rays, prescriptions, and requests for lab work.

Payment: We may need to disclose information about the treatment, procedures or care our practice provided to you in order to bill and receive payment for services we provided. We may share this information with you, an insurance company, or any third party responsible for payment. We may also need to disclose personal health information about you with you health plan and/or referring physician in order to obtain prior authorization for treatment, to determine whether payment for the treatment is covered by your plan or facilitate payment of a referring physician.

Healthcare Operations: In order to help us run our practices more efficiently and provide better patient care, we may use and disclose your personal health information to Business Associates who need to use or disclose your information to provide a service for our medical practice, such as our collection agencies, billing companies, hardware support, transcription's, pharmacies, answering service, or software vendors who provide assistance with data management on our behalf.

Provider: For purposes of this policy, the provider is the health care provider allowed by this policy to exchange PHI via electronic mail within the parameters of this policy.

Required by Law: We will disclose medical information related to you if required to do so by state, federal, or local law.

Public Health Activities/Risks: Your medical information may be disclosed to a public health authority that is authorized by law to collect or receive such information for public health activities. Certain disclosures may be made for public health activities in the following circumstances:
To prevent or control disease, injury or disability;
To report of births or deaths;
To report child abuse or neglect;
To report reactions to medications or product defects;
To notify individuals of product recalls;
To notify a person who may have been exposed to a communicable disease or at risk of contracting or spreading a disease or condition;
If our practice reasonably believes a person is the victim of abuse, neglect, or domestic violence, we may disclose personal health information to appropriate authority. We will only make this disclosure if you agree to the disclosure or we are required or authorized to so by law without your permission.

Appointment Reminders or treatment Alternatives: Our practice may use and disclose medical information about you to provide you with reminders that you are due for care or you have and upcoming appointment. (We will make every effort to communicate with you in the means that you have asked us to) Please make sure to complete the authorization of medical information communication and releases. We may also wish to provide you with information on treatment alternatives or other health related benefits that may be of interest to you. We may contact you by telephone, fax, or e-mail. We will make every effort to protect your privacy when leaving a message for you and try to reveal as little confidential information as possible (e.g., when leaving a message on your answering machine that may be heard by others).

Research:

Under certain circumstances, our practice may use or disclose your personal health information for research purposes. Our practice cannot use or disclose information about you without your written authorization, but we may if the authorization requirement has been waived by a Review Board who has assessed the effect of the research protocol on your privacy rights and interests and certified that there are adequate controls in place to protect your information from improper use and disclosure. Our practice may also disclose information about you in preparing to conduct research (e.g., to help them find patients who may be qualified to participate in a particular study), but your information will not leave our practice or storage facility. We will make all attempts to make your information non-identifiable, but we may not always be able to guarantee this. If however, the researcher will have access to information that will identify you, we will seek to obtain you permission (though we cannot guarantee this) (if you wish to participate in Research please complete the necessary form.) We will always obtain your specific authorization if required by law.

To Avert Serious Threat to Health or Safety: If our practice believes, in good faith, that a use or disclosure of your medical information is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, we may disclose your medical information.

Worker's Compensation: We may release information about you for your work-related illness or injury for workers' compensation or other related program.

Health Oversight Activities: Your personal health information may be disclosed to federal, state, or local authorities as part of an investigation or government activity authorized by the law. This may include audits, civil, administrative or criminal investigations, inspections, licensure or disciplinary actions or other activities necessary for the oversight of the health care system, government benefit programs and compliance with government regulatory programs or civil rights laws.

Law Enforcement: We may disclose your personal health information to law enforcement individuals if we are required to do so by law. We may also disclose medical information about you in compliance with a court order, warrant or subpoena or summons issued by the court. We will make best efforts to contact you about these types of requests so that you can obtain an order restricting or prohibiting disclosure of the information requested. We may also use such information to defend ourselves in actions or threatened actions that may be brought against our practice and physicians.

Coroners, Medical Examiners, and Funeral Directors: We may release personal health information to a coroner or medical examiner for the purposes of identification, determining cause of death or other duties as authorized by law. We may also release medical information to funeral directors as necessary to carry out their duties with respect to the deceased. The attending physician is required to sign the death certificate and provide the coroner with a copy of the decedent's protected health information.

Organ, Eye, Tissue Donation: If you are an organ donor, we may disclose your personal health information to organ procurement organizations, or other entities that facilitate tissue donations or transplantation.

Inmates: If you are an inmate of a correctional institution or within the custody of law enforcement officials, we may disclose medical information about you to allow the institution to provide you with medical care, to protect the health and safety of yourself and others, or for the safety and security of the correctional institution.

Other uses and disclosures will be made only with your written authorization and you may revoke your authorization at any time.

Uses and Disclosures Where We Will Obtain your Written Authorization: Emergency Situations: The practice uses and discloses protected health information as appropriate to provide treatment in emergency situations. In those instances where the practice has not previously provided its Notice of Privacy Practices to a patient who receives direct treatment in an emergency situation, the practice provides the Notice to the individual as soon as practicable following the provision of the emergency treatment. The practice obtains a written authorization from a patient or the patient's representative for the use or disclosure of protected health information for other than treatment, payment, or health care operations; however, the practice will not get an authorization for the use or disclosure of protected health information specifically allowed under the Privacy Rule in the absence of an authorization. The practice will provide a patient upon request a copy of any authorization initiated by the practice (as opposed to requested by the patient) and signed by the patient.

The practice does not condition treatment of a patient on the signing of an authorization, except disclosure necessary to determine payment of claim (excluding authorization for use or disclosure of psychotherapy notes); or provision of health care solely for purpose of creating protected health information for disclosure to a third party (e.g., pre-employment or life insurance physicals).

Psychotherapy notes: We may only disclose your psychotherapy notes for limited purposes such as carrying out treatment. For other purposes we will obtain your written consent. Marketing: For most marketing purposes we will obtain your written consent; exceptions include if the product or service is directly treatment related, discussed face-to-face or given as a promotional gift of nominal value.

Uses and Disclosures That You Can Agree or Object to: Others involved in your healthcare. Unless you object, we may disclose to a member of your family, a relative, a close friend, or any other person you identify, your protected health information that directly relates to that person's involvement in your health care. If you are unable to agree or object to such disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, we may use or disclose your protected health information in an emergency treatment situation. If this happens, you physician shall allow you to object to future disclosures as soon as reasonably practical after the delivery of treatment.

The practice does not use or disclose protected health information to an employer or health plan sponsor, for underwriting and related purposes, for facility directories, to brokers and agents, or for fundraising. If an individual wants the practice to release his or her protected health information to employers or health plan sponsors, for underwriting and related purposes, for facility directories, or to brokers and agents, then he or she can contact the practice and complete an appropriate written authorization.

Patient Rights:

You have the following rights with respect to your personal health information:

Right to Receive Personal Health Information Confidentially: You have the right to receive confidential communications of your personal health information by alternate means or at alternate locations. For example, if you would like for us only to communicate with you at home, and never at your workplace or to send information to you on your workplace e-mail, you may request this of our practice. You must make this request in writing but do not need to disclose the reason for your request. We will attempt to accommodate all reasonable requests. Please be specific as to how or where you wish us to communicate with you. Please ask the front office secretary for this form. Please ask the front office secretary for this form.

Right to Inspect and Copy: You have the right to inspect and copy your medical record that has been created to treat you and is used to make decisions about your care. This includes medical and billing records. Records related to your care may also be disclosed to an authorized person such as a parent or guardian upon proper proof of a legitimate legal relationship. The practice allows individuals to inspect and copy their protected health information, documents all requests, responds to those requests in a timely fashion, informs individuals of their appeal rights when a request is rejected in whole or in part. The practice reviews the request in a timely fashion and acts on a request for access generally within 30 days. The practice may have a single extension of 30 days, if needed to act on the request. Each request will be accepted or denied and the requestor notified in writing. If a request is denied, the requestor is informed if the denial is "reviewable" or not. The requestor has the right to have any denial reviewed by a licensed health care professional who is designated by the practice as a reviewing official and who did not participate in the original decision to deny. The practice informs the requestor of the decision of the reviewing official and adheres to the decision. You must submit your request in writing to inspect and copy your records. If you would like to copy your records our practice may charge you fees for the cost of copying records, mail or other minimal costs associated with your request. The practice will determine the appropriate charge for providing the requested records and inform the requestor in advance of providing the records. If the requestor agrees to pay the fee in advance, the records will be provided. Otherwise, the records will not be provided, unless the Privacy Officer determines that the charge is burdensome to the requestor. All payments MUST be sent to the attention of the Privacy Officer marked MEDICAL RECORDS PAYMENT to ensure proper documentation. Requests for the inspection and copying of records must be sent to the practice in writing. It should be marked "Attention: Privacy Officer." Please ask the front office secretary for this form.

Right to Amend: If you think there is information in your record that may be inaccurate or incomplete, you have the right to request an amendment or clarification of information in your record. Your request to make an amendment to your record must include the following and may be refused if the following elements are not met:

• Submit your request in writing
• Describe what you would like the amendment to say and your reasoning for why the change should be made.
• the amendment request must be dated signed by you and notarized.

The practice documents all requests, responds to those requests in a timely fashion, and informs individuals of their appeal rights when a request is denied in whole or in part.

Generally the practice will act on a request for amendment no later than 60 days after receipt of such a request. If the practice cannot act on the amendment within 60 days, the practice extends the time for such action by 30 days and, within the 60-day time limit, provides the requestor with a written statement of the reasons for the delay and the date by which the practice will complete action on the request. Only one such extension is allowed. The practice documents all requests, responds to those requests in a timely fashion, and informs individuals of their appeal rights when a request is denied in whole or in part. The practice allows a requestor to submit a written statement disagreeing with the denial of all or part of the initial request. The statement must include the basis of the disagreement. The practice limits the length of a statement of disagreement to one page.

Right to Restrict Uses and Disclosures: You have the right to request restrictions on how our practice makes certain uses and disclosures of your personal health information for treatment, payment or healthcare options. You may restrict how much information we may provide to family members regarding your treatment or payment for your care. You may restrict certain types of marketing materials related to your care or treatment. We are not required to agree to your request or we may not be able to comply with your request, but we will do all that we can to accommodate your request. If we agree to your request, we must comply. However, if the information is required to provide emergency treatment to you, we will not comply. Your request must be in writing and include the following:

• What information you would like to limit.
• Whether you want to limit our use, or disclosure or both
• To whom you want the limits to apply (e.g., disclosures to parents, children, spouse, etc. )

Please ask the front office secretary for this form.

Right to an Accounting for Disclosures of Protected Health Information: The practice tracks all disclosures of a patient's protected health information that occur for other than the purposes of treatment, payment, and health care operations, that are not made to the individual or to a person involved in the patient's care, that are not made as a result of a patient authorization, and that are not made for national security or intelligence purposes or to correctional institutions or law enforcement officials.

The practice allows an individual to request one accounting within a 12-month period free of charge. The practice charges a reasonable fee for more frequent accounting requests. The charge will be $15.00. An individual can request an accounting of disclosures for a period of up to six years prior to the date of the request. Requests for shorter accounting periods will be accepted. However, patients may only request an accounting of disclosures made on or after April 14, 2003.

The practice responds to all requests for an accounting of disclosures within 60 days of receipt of the request. If the practice intends to provide the accounting for disclosures and cannot do so within 60 days, the practice informs the requestor of such and provides a reason for the delay and the date the request is expected to be fulfilled. Only one 30-day extension is permitted.

A request for an accounting for disclosures must be made in writing and mailed or sent to the practice. It should be marked "Attention: Privacy Officer."

Individual Rights - Request Amendment to Protected Health Information: The practice allows an individual to request that the practice amend the protected health information maintained in the patient's medical record or the patient's billing record. The practice documents all requests, responds to those requests in a timely fashion, and informs individuals of their appeal rights when a request is denied in whole or in part.

The practice accommodates all reasonable requests to keep communications confidential. The practice determines the reasonableness based on the administrative difficulty of complying with the request.

A request for confidential communications: The request must be in writing, must specify an alternative address or other method of contact, and must provide information about how payment will be handled. The request must be addressed to the practice's privacy officer. No reason for the request needs to be stated.

The practice accommodates all reasonable requests. The reasonableness of a request is determined solely on the basis of the administrative difficulty of complying with the request. The practice will reject a request due to administrative difficulty: if no independently verifiable method of communication such as a mailing address or published telephone number is provided for communications, including billing; or if the requestor has not provided information as to how payment will be handled.

The practice will not refuse a request: if the requestor indicates that the communication will cause endangerment; or based on any perception of the merits of the requestor's request.

General Rules and Procedures: Electronic communications containing PHI must be treated with the same degree of privacy and confidentiality as the patient's medical record.

Uses or Disclosures: Prerequisites for Patient Electronic Communications. Both the patient and the provider MUST agree to communicate via electronic communications on non-emergent and non-urgent matters. The patient or authorized representative should complete the The Neurology & Headache Treatment Center and The Innovative Clinical Research Center Patient Electronic Communications Authorization Agreement before corresponding by electronic communication. If the The Neurology & Headache Treatment Center and The Innovative Clinical Research Center Patient Electronic Communications Authorization Agreement has not been signed allowing correspondence via electronic communication, NHTC & ICRC personnel should have the patient sign an agreement before any electronic communication is initiated. A copy of the signed The Neurology & Headache Treatment Center and The Innovative Clinical Research Center Patient Electronic Communications Authorization Agreement should be given to the patient and the original should be forwarded to the appropriate medical records custodian for filing in the patient's medical record.

All electronic communication between a provider or other NHTC & ICRC personnel and a patient should be in accordance with the The Neurology & Headache Treatment Center and The Innovative Clinical Research Center Patient Electronic Communications Authorization Agreement and the other requirements of this policy. It is the responsibility of each NHTC & ICRC faculty or staff member to make sure the patient has signed the The Neurology & Headache Treatment Center and The Innovative Clinical Research Center Patient Electronic Communications Authorization Agreement before corresponding with the patient by electronic communications.

External electronic communication messages containing PHI are only permitted to be sent to third parties when specifically authorized by the patient and if the electronic communication meets the other requirements of this policy.

Internal electronic communication Patient authorization is not required to exchange internal electronic communication that contains PHI as long as the internal electronic communication is for treatment, payment, or health care operations and complies with the other requirements of this policy.

Send external electronic communication: The authority to send external electronic communication which contains PHI to patients or outside health care providers is limited to credentialed providers, such as faculty members, nurse practitioners, physician assistants, etc. The credentialed provider may appropriately delegate electronically communicated PHI to clinic or office staff, such as emailing or faxing a clinical report to an outside physician or an office appointment to a patient if other requirements of this policy are met. Other staffs, such as billing staff, are allowed to email or fax PHI if authorized by the administrator, supervisor, or physicians.

Employees are allowed to send external electronic communications containing PHI to patients or outside health care providers if authorized by the administrator, supervisor, or physicians. Employees are allowed to send internal electronic communications containing PHI under the direction of the supervising members and if the other requirements of this policy are met.

Electronic communications should be considered the same as a formal letter to the patient.

Internal Policies: In accordance with internal policies physicians who use the Internet must ensure prior to providing treatment, including the issuing of prescriptions, that a proper physician-patient relationship is established that at a minimum includes the following:

1. Establishing that the person requesting the treatment is in fact who the person claims to be;
2. Establishing a diagnosis through the use of acceptable medical practices such as patient history, mental status examination, physical examination, and appropriate diagnostic and laboratory testing to establish diagnoses and identify underlying conditions and/or contraindications to treatment recommended/provided;
3. Discussing with the patient the diagnosis and the evidence for it, the risks and benefits of various treatment options; and
4. Ensuring the availability of the physician or coverage of the patient for appropriate follow-up care.

In general, electronic communications should be used to address administrative issues, relay follow-up information, and answer questions following a face-to-face evaluation and consultation. Initial evaluation, diagnosis and matters of a sensitive nature are not appropriate topics to be communicated through electronic communications. The health care provider should use discretion in corresponding with the patient through electronic communication for treatment.

The following are examples of topics which are appropriate for electronic communication: Prescriptions/refills, general medical advice after an initial face-to-face visit, follow-up on patient status after an office visit, clarification of orders and lab test results.

Examples of inappropriate topics include:

• Discussion of HIV status
• Mental Health problems
• Substance Abuse (Drug and Alcohol)
• Sexually-transmitted diseases
• any topic that contains "sensitive information"

Urgent and Emergent issues are not appropriate for electronic communication.
All PHI exchanged via electronic communication should be maintained in a private and confidential manner. When using any PHI in electronic communication NHTC & ICRC personnel shall limit the information exchanged to the minimum necessary to meet the requestor's needs and use de-identified health information whenever possible.

All physicians that use telemedicine medical services in their practices shall adopt protocols to prevent fraud and abuse through the use of telemedicine medical services. These standards must be consistent with those established by the state of Virginia.

Patients are free to e-mail their health care provider at any time. The health care provider or NHTC & ICRC personnel should respond to a patient's electronic communication within two to three business days, unless the individual is on leave and not in the office or in the clinic, in which case an automated "out of office" response should be placed on providers email box and a designated clinic staff member should respond to faxes, as appropriate.

If an action is taken based upon an electronic communication from a patient, the health care provider or NHTC & ICRC personnel should respond to the patient's electronic communication notifying them of the action taken.

Providers should ensure that language used in electronic communications with patients is clear, concise and professional. The following are guidelines for electronic communications:

• Include a clear and specific subject line starting with "CONFIDENTIAL"
  Example: "CONFIDENTIAL - prescription refill"
• Edit any quoted text down to the minimum needed
• Review the final draft before sending
• Evaluate how the recipient might react to the message
• Check spelling and grammar
• Refrain from using ALL CAPS in electronic communication as it is normally perceived as direction, stern emphasis, or dictatorial
• Use caution in the amount and type of information written in an electronic communication
• Assume the electronic communication is not secure, and information in electronic communication is always at risk
• When in doubt about the content of the electronic communication or the possible reaction of the recipient, call the patient rather than communicating by electronic communication.

A header should be attached on every electronic communication exchanged stating the following:

"TO MY PATIENTS: You must provide me with written authorization before I can communicate with you be electronic communication (e-mail or fax). If you have not signed an authorization form, please contact my office, and we will send you the form. Please note NHTC & ICRC cannot and does not guarantee the privacy or security of any message being sent over the Internet. Electronic communication is not necessarily confidential and should be used for routine matters only. If you have an Urgent or Emergent issue, please go to your nearest emergency department for evaluation or call 911. Electronic communication may not be read in a timely manner if I am out of the office."

In addition, a standard confidentiality statement must be included as a footer on all outgoing electronic Patient Health Information (PHI) communication, "The information in this electronic communication (email and/or fax) may be confidential. This electronic communication is intended to be reviewed only be the individual or organization named above. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any review, dissemination, or copying of this electronic communication and its attachments, if any, or the information contained herein is prohibited. If you have received this electronic communication in error, please immediately notify the sender by telephone or other appropriate means. If sent via computer, delete the communication from your system. Thank you."

All NHTC & ICRC originated facsimile transmissions MUST have a cover sheet that includes the confidentiality statement.

(1) Medical records must include copies of all patient-related electronic communications, including patient-physician e-mail, prescriptions, laboratory and test results, evaluations and consultations, records of past care and instructions.

(2) Notice of privacy practices related to the use of e-mail must be filed in the medical records.

A provider who sends or receives electronic communication messages, concerning the treatment of or health education for a patient, is responsible for printing a copy of the electronic communication message and forwarding same to the medical record custodian to file in the patient's medical record.

If NHTC & ICRC personnel receives unwanted electronic communication from a patient or a prospective patient and either does not have a NHTC & ICRC Electronic Communications Authorization Agreement in place or does not wish to communicate with the patient by electronic communication, the individual should respond to the individual with the following statement as appropriate:

"As a result of my concern for your well being, please contact my office to schedule an appointment to discuss any and all issues regarding the state of your health. Either I do not respond to electronic communications (email and/or fax) at this time or I believe an office visit is the appropriate method to address your concerns. You may reach my office at 703-212-0700.

All external disclosures of PHI should be in compliance with the NHTC & ICRC privacy practices and policies addressing use and disclosure of PHI, including accounting for disclosures. When disclosing PHI through electronic communication to a third party, the release must be documented and accounted for as outlined in NHTC & ICRC privacy practices and policies.

NHTC & ICRC personnel shall not compile patient email addresses for marketing or fundraising purposes or supply patient email addresses to any third party for advertising, solicitations, or any other use.

Responsibility: All supervisors, staff and physicians are responsible for complying with this policy. All supervisors are responsible for enforcing this policy. Individuals who violate this policy will be subject to the appropriate and applicable Disciplinary process, up to and including termination or dismissal.

The practice allows an individual to revoke an authorization at any time: The revocation must be in writing and must be sent to the attention of the practice's privacy officer; however, in any case the practice will be able to use or disclose the protected health information to the extent practice has taken action in reliance on the authorization.

Individual Rights - Waiver of Rights: The practice never requires an individual to waive any of his or her individual rights as a condition for the provision of treatment, except under very limited circumstances allowed under law.

WHAT INFORMATION IS SHARED WITH THIRD PARTIES?

Our Practice may disclose information you provide to us to, service providers and consultants who assist us in providing healthcare services to you via our Website. However, we will only share such personally identifiable information, as we deem necessary for them to carry out their obligations to our Practice.

We may also share aggregated demographic information with independent contractors, service providers, consultants, and other partners. This is not linked to any personal information that can identify any individual person. Our Practice may also disclose personal information it has collected if necessary to fulfill our service obligations or if we are required to do so by law, or if in our good faith judgment, such action is reasonably necessary to comply with legal process.

LINKING

Our Website may offer links to other Websites. Please be aware that we are not responsible for the privacy Practices of such linked Websites, including Websites of our partners. We encourage our users to be aware when they leave our Website to read the privacy statements of each and every Website that collects personally identifiable information. This privacy statement applies solely to information collected by our Website.

Right to copy of Notice: You have the right to obtain a copy of our notice of privacy practices upon request at any time. You may call us at 703.212.0700 for a copy or as the front office secretary for copy. [Please Note: You may receive a copy via mail or download a copy at our website: www.neuro-headache.com.]

Changes to this Notice: Our practice is required to abide by the terms of this notice, which is currently in effect. We reserve the right to change the terms of this notice and to make the notice provisions effective for all personal health information we already have about you and may obtain in the future. If we change our notice, we will post notice of this change thirty (30) days prior to making the change effective (e.g., in your office, or your medical practice website.) All revised notices will be promptly posted and made available to you in our waiting room. You may also request a current Notice when you visit our office. Changes to our notice will only be effective on the date that is reflected at the bottom of the last page on the revised notice.

Practice Contact: If you would like more information about this notice, please contact Patricia J. Mullins, Executive Director at 703.212.5918. If you have any complaints regarding our privacy practices, please address your complaint to Patricia J. Mullins, Executive Director, 4660 Kenmore Avenue, Suite 900, Alexandria, VA 22304 in writing and follow the designated complaint process below.

Complaints: If you believe your privacy rights may have been violated or you become aware of a privacy concern you would like to report to our practice, please follow this complaint process:

Send a written letter to the practice contact named above, including the following information:

• Name and address
• Social Security Number or Date of Birth of the patient (if you are the legal guardian.)
• Detailed description of the circumstances surrounding your complaint including dates, times, and any relevant information to help us understand your complaint.
• Contact Information
• Signature and Date

Please allow fourteen (14) business days for an answer from our practice regarding your complaint. If you are not satisfied with our response to your complaint, you may notify the Secretary of the Department of Health and Human Services.

Attention: Secretary Mike Leavitt The U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Washington, D.C. 20201 Telephone: 202.619.0257 Toll Free: 877.696.6775

Please note, all concerns or complaints regarding your personal health information are important to our practice. There will be no retaliation against you for filing a complaint with our office.

Electronic Notice: We are also required to post our Notice of Privacy Practices on our medical practice website. You can find this notice at www.neuro-headache.com.

DISCLAIMER

Unfortunately, no data protection method or combination of methods can be guaranteed 100 percent secure. We strive to protect personal information as described throughout this policy, but we cannot ensure or warrant our ability to do so. As a result, you use our content, products, and services at own risk. We will not be liable for disclosures of personal information due to errors in transmission or unauthorized acts of third parties.