NOTICE OF PRIVACY PRACTICES

Effective as of October 9, 2017

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your health information is personal, and we are committed to protecting it.

For purposes of this Notice, "DaVita" and the pronouns "we," "us" and "our" refer to all of the licensed dialysis facilities operated or managed by DaVita Inc. and/or the following subsidiaries, when such subsidiaries are acting as a covered entity under HIPAA: DaVita Rx, LLC, DVA Laboratory Services Inc., Total Renal Laboratories, Inc., RMS Lifeline Inc., Nephrology Practice Solutions, LLC, Nephrology Medical Associates of Georgia, LLC and DNP Management Company, LLC. These entities have been designated as a single affiliated covered entity for HIPAA Privacy Rule compliance purposes.

DaVita uses and discloses health information about you for treatment, to obtain payment for treatment, for administrative purposes, to evaluate the quality of care that you receive, and for other purposes permitted by HIPAA. DaVita is required by law to maintain the privacy of your health information and provide you a notice of our legal duties and privacy practices with respect to that information and to provide you with notice of a breach of your unsecured protected health information.

This Notice applies to all records involving your care that are created, and/or maintained by DaVita. Your health information is contained in a medical record that is the physical property of DaVita. DaVita is required to abide by the terms of this Notice.

DaVita reserves the right to change its privacy practices, as reflected in this Notice, to revise this Notice, and to make the new provisions effective for all protected health information it maintains. Revised Notices will be available in the clinic, on our website, or upon your request.

If you are a patient insured by the United States Department of Veteran Affairs, you may be entitled to rights and we may be subject to restrictions regarding the use and disclosure of your health information other than as set forth in this Notice. At all times, we will comply with the applicable requirements of the Department of Veteran Affairs regarding the use and disclosure of your health information.

How DaVita May Use or Disclose Your Health Information:

We may use or disclose your health information, in certain situations, without your consent or authorization. Below we describe examples of how we may use or disclose your health information as permitted under or required by federal law, including instances where we will obtain your authorization. Such uses or disclosures may be in oral, paper or electronic format.

For Treatment. DaVita may use and disclose your health information to provide you with medical treatment or services or to assist in the coordination, continuation or management of your care and any related services. This includes the coordination or management of your health care with a third party. For example, a health care provider, such as a physician, nurse or other person providing health services to you, will record information in your record that is related to your treatment. This may include interdisciplinary conferences with team members from DaVita and support care teams from other facilities involved in your care and treatment or other providers who may be able to provide information or insight in the development and coordination of your plan of care. This information is necessary for other health care providers to determine what treatment you should receive.

For Payment. DaVita may use and disclose your health information to others for purposes of obtaining payment for treatment and services that you receive. For example, a bill may be sent to you or to a third-party payer, such as an insurance company or health plan, for care, items or services provided to you. The information on the bill may contain information that identifies you, your diagnosis and treatment.

For Health Care Operations. DaVita may use and disclose health information about you for operational purposes. For example, your health information may be used by DaVita or disclosed to others in order to:

• Communicate with you about our clinic activities and locations;
• Evaluate the performance of our staff;
• Assess the quality of care and outcomes in your case and similar cases;
• Learn how to improve our facilities and services;
• Determine how to continually improve the quality and effectiveness of the health care we provide; and
• Train Residents, Medical Students, Nurses, Advanced Practitioners, Physician Assistants, Medical Assistants and other health care professional students or interns.

Health Information Exchange (HIE). DaVita - along with other health care providers - participate in HIEs which allow patient information to be shared electronically with other participants. HIEs give your participating health care providers immediate access to your pertinent medical information necessary for treatment, payment and health care operations. If you choose to participate in the HIE, your information will be available through the HIE to other providers in accordance with this Notice and the law. However, sensitive information will never be included. Sensitive information includes:

• Certain mental health, alcohol and substance abuse treatment information;
• HIV testing and information;
• Any other health information that requires patient consent in order to be disclosed according to contracts; and
• Any other health information that requires patient consent in order to be disclosed under Federal or State law.
• If you choose not to participate in the HIE, your Protected Health Information will continue to be used in accordance with this Notice of Privacy Practice and the law, but will not be made available through the HIE.

Communication. DaVita may use and disclose your information to provide appointment reminders, leave a message on your answering machine, or leave a message with an individual who answers the phone at your residence. We may, from time to time, contact you to provide information about treatment alternatives or other DaVita health-related benefits and services that may be of interest to you, including information on DaVita Rx (DaVita's pharmacy), DVA Laboratory Services Inc., Total Renal Laboratories, Inc., RMS Lifeline (DaVita's vascular access clinics) or Nephrology Practice Solutions (physician practices owned by DaVita). In order to better serve you, we may communicate with you about refill reminders and alternative products. We may also provide you with informational materials including information about DaVita and its subsidiaries. We may also, at times, send you informational material about a particular product or service that may be helpful for your treatment. Material may come from a third party.

Destruction of Records. DaVita complies with state and federal regulations in regards to the destruction of records, specifically:

• The health care record of a person who is less than 23 years of age may not be destroyed;
• The health care record of a person must be maintained for 5 years after it has been received or created, unless federal law requires that it be retained for a longer period of time; and
• The health care record of a person who has reached the age of 23 years may be destroyed after 5 years from the date the record was received or created, unless federal law requires that it be retained for a longer period of time.

Required or Permitted by Law. DaVita may use and disclose information about you as required or permitted by law. If a use or disclosure is required by law, the use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. If a use or disclosure is required by law, you will be notified of any such uses or disclosures. For example, DaVita may use and/or disclose information for the following purposes:

• For judicial and administrative proceedings pursuant to legal authority;
• To report information related to victims of abuse, neglect or domestic violence;
• To assist law enforcement officials in their law enforcement duties;
• To notify you, law enforcement and regulatory authorities, as necessary, of a breach involving your unsecured health information, and others as appropriate to help resolve the situation; or
• To health oversight agencies responsible for monitoring the health care system and government programs.

Public Health. Your health information may be used or disclosed for public health activities such as: (1) assisting public health authorities or other legal authorities to prevent or control disease, injury or disability; (2) reporting child abuse or neglect to a public health authority or other governmental authority that is authorized by law to receive such reports; (3) reporting information to a person subject to the jurisdiction of the Food and Drug Administration (FDA), for public health purposes related to the quality, safety or effectiveness of FDA-regulated products or activities such as collecting or reporting adverse events, dangerous products, and defects or problems with FDA-regulated products; (4) notifying a person who may be at risk of contracting or spreading a disease, if such disclosure is authorized by law; (5) reporting information to your employer, for the purposes of conducting an evaluation of medical surveillance of the workplace or for the purposes of evaluating whether you have a work-related illness or injury; or (6) disclosing proof of immunization to your school, or your child's school, if the school is required by law to have such proof prior to admitting you or your child. We will obtain and document your agreement to such immunization disclosures.

Individuals involved in your care. We may provide information about you to a family member, friend or other person involved in your health care or in payment for your health care. If you are deceased, we may disclose medical information about you to a family member or friend who was involved in your medical care prior to your death, limited to information relevant to that person's involvement, unless doing so would be inconsistent with written wishes you previously provided to us. In addition, upon admission to one of our facilities, we will ask you to complete a Permission to Discuss Health Information with Other Individuals formto help clarify for us which of your family members and/or friends are likely to be involved with your health care and/or payment for your health care. If we disclose information to a family member, relative or close personal friend, we will disclose only information that we believe is relevant to that person's involvement with your health care or payment related to your health care.

Clinical Trials and Other Research Activities. DaVita may use and disclose your health information for research purposes without an authorization from you when an institutional review board or privacy board has waived the authorization requirement. Under certain circumstances, your information may also be disclosed without your authorization to researchers preparing to conduct a research project, for research on decedents or to researchers pursuant to a written data use agreement.

Health and Safety. We may, consistent with applicable law and standards of ethical conduct, use or disclose health information about you if we believe that the use or disclosure is necessary to prevent or lessen a serious threat to the health or safety of a person or the public; provided that, if a disclosure is made, it must be to a person(s) reasonably able to prevent or lessen the threat. We may also use or disclose your health information if we believe that the use or disclosure is necessary for law enforcement authorities to identify or apprehend an individual who: (1) admits to participation in a violent crime that we reasonably believe caused serious physical harm to the victim, or (2) appears to have escaped from a correctional institution or lawful custody.

Notification and Disaster Relief. We may use or disclose your health information to notify or assist in notifying your family, a personal representative or another person responsible for your care of your location, condition or death. We may disclose your health information to disaster relief authorities so that your family can be notified of your location and condition.

Correctional Institutions. If you are an inmate or in the custody of law enforcement, we may disclose your health information to correctional institutions or law enforcement for such purposes as providing care, for the health and safety of yourself or others, for law enforcement at the correctional facility or for maintenance of safety, security and order at the facility in accordance with state and/or federal regulations.

Decedents. Health information may be disclosed to funeral directors, medical examiners or coroners to enable them to carry out their lawful duties. Once 50 years have passed after your death (or such other period as may be specified by law), we may use and disclose your health information without regard to the restrictions set forth in this Notice.

Organ/Tissue Donation. Your health information may be used or disclosed for cadaveric organ, eye or tissue donation and transplantation purposes.

Government Functions. We may disclose your health information for specialized government functions, such as military and veteran's activities, national security and intelligence activities and protection of public officials.

Workers' Compensation. Your health information may be used or disclosed in order to comply with laws and regulations related to Workers' Compensation.

Business Associates. We may contract with one or more third parties (our business associates) in the course of our business operations. We may disclose your health information to our business associates so that they can perform the job we have asked them to do. We require that our business associates sign a business associate agreement and agree to safeguard the privacy and security of your health information.

Authorizations for Other Uses and Disclosures:

While we may use or disclose your health information without your written authorization as explained above, there are other instances where we will obtain your written authorization. Except as otherwise provided in this Notice, we will not use or disclose your health information without your prior written authorization. You may revoke an authorization at any time, except to the extent DaVita has already relied on the authorization and taken action.

Examples of uses and disclosures that require your authorization are:

Psychotherapy Notes. If Psychotherapy Notes are created for your treatment, we must obtain your prior written authorization before using or disclosing them, except (1) if the creator of those notes needs to use or disclose them for treatment, (2) for use or disclosure in our own supervised training programs in mental health, or (3) for use or disclosure in connection with our defense of a proceeding brought by you. "Psychotherapy Notes" means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual's medical record. "Psychotherapy Notes" excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date.

Clinical Trials and Other Research Activities. While we may use or disclose your health information for certain research activities without your authorization (explained above), there are other activities which may require your authorization. When your specific treatment is part of a research study and the exceptions to authorization explained above do not apply, we may disclose your health information to researchers only after you have signed a written informed consent to participate in the research study and a written authorization to use and disclose your health information for research purposes. You do not have to sign the authorization in order to receive traditional services from DaVita. However, if you do not provide written authorization for us to disclose your health information to the researchers, you may become ineligible for the research study itself.

Marketing. If we use or disclose your health information for marketing purposes, we must first obtain your written authorization to do so, except if the communication is face-to-face by us to you or is a promotional gift of nominal value.

No Sale of Your Health Information. We will not sell your health information to a third party without your prior written authorization.

Patient Recognition. DaVita strives to celebrate and honor the lives of our patients through a variety of patient recognition activities, such as celebrating birthdays, anniversaries, graduation, weddings and other personal achievements, recognizing dialysis milestones and other health achievements, publishing newsletters, holding patient contests, posting patient photos and fun facts on the facility bulletin board or "Wall of Fame," acknowledging when a patient is hospitalized and memorializing patients who pass away ("Patient Recognition Activities"). We may also use your information to send you or your family greeting cards as part of our Patient Recognition Activities. Patient Recognition Activities are voluntary. You may participate in these Patient Recognition Activities by executing a written authorization.

Uses and Disclosures of Your Highly Confidential Information. Some federal and/or state laws require special privacy protections for certain highly confidential health information, relating to: (1) psychotherapy services; (2) mental health and developmental disabilities services;

(3) alcohol and drug abuse prevention, treatment and referral; (4) HIV/AIDS testing, diagnosis or treatment; (5) venereal disease(s); (6) genetic testing; (7) child abuse and neglect; (8) domestic abuse of an adult with a disability; and/or (9) sexual assault. Unless a use or disclosure is permitted or required by law, we will obtain your written consent or authorization prior to using or disclosing your highly confidential health information to third parties.

Media. From time-to-time, media events are hosted at our facilities. The purpose of these events is to raise awareness about chronic kidney disease and end-stage renal disease. At these events, there may be individuals from the media as well as DaVita's public relations and marketing teams. If your image, voice or statement is captured on film, we will obtain your written authorization prior to running any news article, press statement or other publication with your image, voice or statement. Your participation in these media events and authorization to disclose your likeness is completely voluntary.

Your Health Information Rights:

You have the following rights regarding your health information. To exercise any of the rights below, please contact your facility's Facility Administrator to obtain the proper forms.

You have the right to:

• Request a restriction on the uses and disclosures of your information for treatment, payment and health care operations or request a limit on the health information we disclose about you to someone involved in your care or the payment for your care, such as a family member or a friend:
  • If you have paid for a service or health care item out-of-pocket in full, and you ask us not to share that information with your health insurer for purposes of payment or our operations (not treatment), we will agree with your request unless a law requires us to share the information. For all other requests, we will consider your request. For these:
    • Your request must be in writing, and we will notify you of our decision in writing.
    • If we do agree to your request, we will comply with your request unless the
    • information is needed to provide you emergency treatment.
    • Except for restrictions that we must comply with relating to health plans, we may terminate our agreement to a restriction at any time by notifying you in writing, but our termination will only apply to information created or received after we sent you the notice of termination, unless you agree to make the termination retroactive.
• Obtain a paper copy of this Notice upon request and in a timely manner. You may obtain a paper copy of this Notice by contacting the Privacy Office at 855-472-9822. The Notice is also available in your facility and on our website.
• Inspect and obtain a copy of your health and billing records in a timely manner. You have the right to receive your clinical diagnostic laboratory test results directly from DVA Laboratory Services Inc. and Total Renal Laboratories, Inc. All requests to inspect or copy your health information or to access directly your clinical diagnostic laboratory test results must be in writing. The Facility Administrator, or their designee, can provide a form for you to use. In certain circumstances, we may deny your request for inspection or copying, but if we do, we will notify you in writing of the reason(s) for the denial and explain your right to have the denial reviewed. If the information is maintained electronically and if you request an electronic copy, we will provide you with an electronic copy in the form and format requested by you, if it is readily producible in that form and format (if it is not, then we will agree with you on a readable electronic form and format). You can direct us to transmit the copy directly to another person if you submit a signed written request that identifies the person to whom you want the copy sent and where to send it. If you request copies, we may charge a reasonable cost-based fee for the labor involved in copying the information, the supplies for creating the paper copy or the cost of the portable media, postage, and providing a summary of your records, if you request a summary.
• Request an amendment to your health information. You may request that your health record be amended if you believe that the health information we have about you is incomplete or incorrect. Requests to amend your health information must be in writing. The Facility Administrator, or their designee, can provide a form for you to use. We may deny your request and if we do, we will notify you in writing of the reason for the denial and your right to submit a statement disagreeing with the denial.
• Request confidential communications. You have the right to ask DaVita to communicate health information to you using alternative means or at alternative locations. Such requests must be in writing. The Facility Administrator, or their designee, can provide a form for you to use. We will accommodate reasonable requests and will notify you if we are unable to agree to your request. We may condition our agreement on information as to how payment will be handled and specification of an alternate address or other method of contact.
• Receive an accounting of disclosures of your health information. You have the right to obtain a list of instances in which DaVita has disclosed your health information except in certain instances. These instances include: disclosures for treatment, payment and health care operations; disclosures made to you; disclosures incident to a use or disclosure permitted or required by the Federal HIPAA Privacy Rule; disclosures authorized by you; disclosures to persons involved in your care or to disaster relief authorities; disclosures for national security and intelligence purposes; disclosures to correctional institutions or law enforcement officials; disclosures that are part of a limited data set; and disclosures occurring more than six years prior to the date of your request. Your request must be in writing. The Facility Administrator, or their designee, can provide a form for you to use. The first disclosure list in a year is free; if you request additional lists in any year we may charge you a fee.

Complaints

You may complain to DaVita and to the Department of Health and Human Services if you believe your privacy rights have been violated. You will not be retaliated against for filing a complaint.

Non-Retaliation

DaVita will not retaliate against you for requesting access to your medical records, Notice of Privacy Practices or any other HIPAA-related documents. Further, DaVita will not retaliate against you for filing or making us aware of any HIPAA complaints or grievances.

Contact Information

If you have any questions or complaints about this notice or our privacy practices, please contact: DaVita Inc.

Privacy Office
2000 16th St.
Denver, CO 80202

Phone: (855) 472-9822

View the Privacy Practice Notice in a PDF (240KB) (PDF)