HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed to carry out treatment, payment, or health care operations, and how you can access this information. Please review it carefully.

1. Our Responsibilities

Emafini Mountain Lodge, Inc. ("Emafini," "we," or "us") is required by law to maintain the privacy and security of your protected health information (PHI). We are required to provide you with this Notice of Privacy Practices, to follow the terms of the notice currently in effect, and to notify you in the event of a breach of your unsecured PHI. We will not use or disclose your health information without your written authorization, except as described in this notice or as required by law.

2. How We May Use and Disclose Your Health Information

For Treatment

We may use and disclose your health information to provide, coordinate, or manage your care and related services. This includes sharing information with clinicians, counselors, residential staff, and other professionals involved in your treatment at Emafini, as well as with outside providers to whom you are referred for continuing care.

For Payment

We may use and disclose your health information so that the treatment and services you receive may be billed to and paid for by you, an insurance company, or a third party. For example, we may need to give your health plan information about services you received so they will pay for them.

For Health Care Operations

We may use and disclose your health information for our health care operations — the business activities that support our program and ensure quality of care. These include quality assessment, staff training, licensing and accreditation activities, and internal administrative functions.

Other Permitted and Required Uses

We may also use or disclose your health information in the following situations:

• To you: We must disclose your health information to you as described in the "Your Rights" section below.
• Family and friends: We may share your information with family members, friends, or others involved in your care or payment for your care, when you do not object or in an emergency situation where we use our professional judgment.
• Public health and safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public, as permitted by law.
• Law enforcement and legal proceedings: As required by law, in response to a court order or subpoena, or to report certain information about injuries, crimes, or victims of crime.
• Health oversight: To a health oversight agency for activities authorized by law, such as audits, investigations, and inspections necessary for licensure, accreditation, and compliance.
• Coroners, medical examiners, and funeral directors: To identify a deceased person or determine cause of death, as authorized by law.
• Organ and tissue donation: If you are an organ donor, we may release information to organizations that handle organ procurement or tissue donation.
• Research: Under certain conditions, for research purposes that have been approved by an institutional review board or privacy board.
• Workers' compensation: As authorized by and to the extent necessary to comply with laws relating to workers' compensation.
• As required by law: We will disclose health information when required to do so by federal, state, or local law.

3. Uses Requiring Your Written Authorization

The following uses and disclosures of your health information will be made only with your explicit written authorization:

• Uses and disclosures of psychotherapy notes (if we maintain them).
• Uses and disclosures of your health information for marketing purposes.
• Disclosures that constitute a sale of your health information.

Any other uses and disclosures not described in this notice will be made only with your written authorization. If you provide authorization, you may revoke it at any time by submitting a written request to the contact listed below, except to the extent we have already acted on it.

4. Your Rights

Under HIPAA, you have the following rights regarding your health information:

• Right to inspect and copy: You may request to see or obtain a copy of your health information in a designated record set. We may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies.
• Right to amend: If you believe your health information is incorrect or incomplete, you may request an amendment. We may deny your request under certain circumstances and will provide a written explanation.
• Right to an accounting of disclosures: You may request a list of certain disclosures we have made of your health information, excluding those for treatment, payment, health care operations, and certain other exceptions.
• Right to request restrictions: You may ask us to limit what we use or disclose about you for treatment, payment, or health care operations. We are not required to agree to most requests, except as required by law for out-of-pocket payments paid in full.
• Right to request confidential communications: You may ask us to communicate with you in a certain way or at a certain location (for example, by mail to a specific address). We will accommodate reasonable requests.
• Right to a paper copy of this notice: You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Right to breach notification: We will notify you in writing following a breach of your unsecured health information, as required by law.

To exercise any of these rights, please submit your request in writing to the contact listed below.

5. Our Responsibilities (Continued)

• We are required by law to maintain the privacy and security of your PHI.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties of confidentiality described in this notice and the notice currently in effect.
• We will not use or disclose your health information without your written authorization, except as described in this notice or as required by law.

6. Changes to This Notice

We reserve the right to change the terms of this notice and to make the new notice terms effective for all health information we maintain. The current notice will be posted in our facility and on our website, and will include the effective date. You may request a copy of the current notice at any time.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.

• To file a complaint with us, contact the person listed below.
• To file a complaint with the federal government, write to: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201, or visit hhs.gov/ocr.

8. Contact Information

For more information about this notice, to exercise any of your rights, or to file a complaint, please contact:

• Emafini Mountain Lodge, Inc.
• Floyd, Virginia
• Email: info@emafinimountainlodge.com

Please note: This Notice of Privacy Practices is provided as a general description of how we handle protected health information. It is not a contract and does not replace any specific authorization you may be asked to sign.