Notice of Privacy Practices This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), O2 DIAGNOSTICS is required by law to maintain the privacy of health information that identifies you, called protected health information (PHI), and to provide you with notice of our legal duties and privacy practices regarding PHI. O2 Diagnostics is committed to the protection of your PHI and will make reasonable efforts to ensure the confidentiality of your PHI, as required by statute and regulation. We take this commitment seriously and will work with you to comply with your right to receive certain information under HIPAA. O2 Diagnostics Use and Disclosure of PHI As permitted under HIPAA, the following categories explain the types of uses and disclosures of PHI that O2 Diagnostics may make. Some of the uses and disclosures described may be limited or restricted by state laws or other legal requirements. Please contact our Privacy Officer, using the contact information provided at the end of this notice, for specific information regarding your state. For treatment - O2 Diagnostics may use or disclose PHI for treatment purposes, including disclosure to physicians, nurses, medical students, and other health care professionals who provide you with health care services or are involved in your care, such as providing your physician with your laboratory test results. For payment - O2 Diagnostics may use or disclose PHI to bill and collect payment for laboratory services we provide. For example, O2 Diagnostics may provide PHI to your health plan to receive payment for the health care services provided to you. For health care operations - O2 Diagnostics may use or disclose PHI for health care operations purposes. These uses and disclosures are necessary, for example, to evaluate the quality of our laboratory testing. Treatment alternatives and/or health-benefits and services - O2 Diagnostics may use and disclose PHI to tell you about treatment options or alternatives or health-related benefits and services that may be of interest to you. Individuals involved in your care or payment for your care - O2 Diagnostics may disclose PHI to a person who is involved in your care or helps pay for your care, such as a family member or friend. We also may notify your family about your location or general location or disclose such information to an entity assisting in disaster relief effort. As allowed by federal and state law, we may disclose the PHI of minors to their parents or legal guardians. Business associates - O2 Diagnostics may disclose PHI to our business associates to perform certain business functions or provide certain business services to O2 Diagnostics. All of our business associates are required to maintain the privacy and confidentiality of your PHI. Disclosure for judicial and administrative proceedings - Under certain circumstances, O2 Diagnostics may disclose your PHI in the course of a judicial or administrative proceeding, including in response to a court or administrative order. Subpoena, discovery request, or other lawful process. Law enforcement - O2 Diagnostics may disclose PHI for law enforcement purposes, including reporting in response to a court order, warrant, subpoena or summons, or similar process authorized by law. We may also disclose PHI when the information is needed: (1) for identification or location of a suspect, fugitive, material witness or missing person, (2) about a victim of a crime, (3) about an individual who has died, (4) in relation to criminal conduct on O2 Diagnostics premises, or (5) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime. As required by law - O2 Diagnostics must disclose your PHI if required to do so by international, federal, state, or local law. Public Health - O2 Diagnostics may disclose PHI for public health activities. These activities generally include: (1) disclosures to a public health authority to report, prevent or control disease, injury, or disability; (2) disclosures to report birth and deaths, or to report child abuse or neglect; (3) disclosures to a person subject to the jurisdiction of the Food and Drug Administration (FDA) for purposes related to the quality, safety or effectiveness of an FDA-regulated product or activity, including reporting reactions to medications or problems with products or notifying people of recalls of products they may be using; (4) disclosures to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and (5) disclosures to an employer about an employee to conduct medical surveillance in certain limited circumstances concerning workplace illness or injury. Disclosure about victims of abuse, neglect, or domestic violence - O2 Diagnostics may disclose PHI about an individual to a government authority, including social services, if we reasonably believe that an individual is a victim of abuse, neglect, or domestic violence. Health oversight activities - O2 Diagnostics may disclose PHI to a health care oversight agency for activities authorized by law such as audits, civil, administrative, or criminal investigations and proceedings/actions, inspections, licensure/disciplinary actions, or other activities necessary for appropriate oversight of the healthcare system, government benefit programs, and compliance with regulatory requirements and civil rights laws. Coroners, medical examiners, and funeral directors - O2 Diagnostics may disclose PHI to a coroner, medical examiner, or funeral director for the purpose of identifying a deceased person, determining cause of death, or other duty authorized by law. Personal Representative - O2 Diagnostics may disclose PHI to your personal representative, as established under applicable law, or to an administrator, executor, or other authorized individual associated with your estate. Organ or tissue procurement organizations - To facilitate organ, eye, or tissue donation and transplantation, O2 Diagnostics may use or disclose PHI to organ procurement organizations or other entities involved in organ, eye, or tissue donation/transplantation. Correctional institution - O2 Diagnostics may disclose the PHI of an inmate or other individual when requested by a correctional institution or law enforcement official for health, safety, and security purposes. Serious threat to health or safety - O2 Diagnostics may disclose PHI if necessary to prevent or lessen a serious and/or imminent threat to health or safety to a person or the public or for law enforcement authorities to identify or apprehend an individual. Research - O2 Diagnostics may use and disclose PHI for research purposes. We may permit researchers to look at records to identify patients who may be included in their research project or for other similar purposes, so long as the researchers do not remove or copy any of the PHI. Before we use or disclose PHI for any other research activity, one of the following will happen: 1)a special committee will determine that the research activity poses minimal risk to privacy and that there is an adequate plan to safeguard PHI; 2) if the PHI relates to deceased individuals, the researchers give us assurances that the PHI is necessary for the research and will be used only as part of the research; or 3) the researcher will be provided only with information that does not identify you directly. Government functions - In certain situations, O2 Diagnostics may disclose the PHI of military personnel and veterans, including Armed Forces personnel, as required by military command authorities. Additionally, we may disclose PHI to authorized officials for national security purposes, such as protecting the President of the United States, conducting intelligence, counter-intelligence and other national security activities authorized by law, and when requested by foreign military authorities. Workers' compensation - As authorized by applicable laws, O2 Diagnostics may use or disclose PHI to comply with workers' compensation or other similar programs established to provide work-related injury or illness benefits. Other Uses and Disclosures of PHI For purposes not described above, O2 Diagnostics will ask for your written authorization before using or disclosing your PHI. If you sign an authorization form, you may revoke it, in writing, at any time, except to the extent that action has been taken in reliance on the authorization. Patient Rights Regarding PHI Subject to certain exceptions, HIPAA establishes the following patient rights with respect to PHI: Right to Receive a Copy of the O2 Diagnostics Notice of Privacy Practices-You have a right to receive a copy of the O2 Diagnostics Notice of Privacy Practices at any time by calling us toll free at (888) 986-0121 and asking for the O2 Diagnostics HIPAA Privacy Officer, or by sending a written request to: HIPPA Privacy Officer, O2 Diagnostics, Incorporated 915 Poplar Springs Road Huntingdon, Tennessee 38344. This Notice will also be posted on the O2 Diagnostics Internet site at www.O2-Diagnostics.com. Right to Request Limits on Uses and Disclosures of your PHI-You have the right to request that we limit: 1) how we use and disclose your PHI for treatment, payment, and health care operations activities, or 2) our disclosure of PHI to individuals involved in your care or payment for your care. O2 Diagnostics will consider your request, but is not required to agree to it. If we agree to it, we will state the agreed restrictions in writing and will abide by them, except in emergency situations. Right to Request Confidential Communications-You have the right to request that O2 Diagnostics communicate with you about your PHI at an alternative address or by an alternative means. O2 Diagnostics will accommodate reasonable requests. Right to See and Receive Copies of Your PHI-You have the right to access and receive a copy of PHI that may be used to make decisions about your care or payment for your care. However, federal and state laws that regulate laboratories generally prohibit a lab from providing test results directly to a patient. Right to Receive a List of Disclosures Made-You have a right to receive a list of certain instances in which O2 Diagnostics disclosed your PHI. This list will not include certain disclosures of PHI such as those made for treatment, payment, health care operations or disclosures made based on your authorization. Unless a shorter period of time is requested, the list will include disclosures made in the past six years, but not prior to August 15, 2007. Right to Correct or Update your PHI-If you believe that your PHI contains a mistake, you may request, in writing, that O2 Diagnostics correct the information. If your request is denied, we will provide an explanation of the reasoning for our denial. How to exercise your rights To exercise any of your rights described in this notice (other than the right to receive a copy of O2 Diagnostics's Notice), you must send a written request to: HIPAA Privacy Officer, O2 Diagnostics 915 Poplar Springs Road Huntingdon, Tennessee 38344. No other person, staff member or laboratory site is authorized to accept a request to exercise your rights. How to Contact Us or File a Complaint If you have questions or comments regarding the O2 Diagnostics Notice of Privacy Practices, or have a complaint about our use or disclosure of your PHI or our privacy practices, please call us toll free at 888-986-0121 ask for O2 Diagnostics HIPAA Privacy Officer, or send a written request to: HIPAA Privacy Officer, O2 Diagnostics Incorporated, 915 Poplar Springs Road Huntingdon, Tennessee 38344.. You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. O2 Diagnostics will not take retaliatory action against you for filing a complaint about our privacy practices. Changes to the O2 Diagnostics Notice of Privacy Practices O2 Diagnostics reserves the right to make changes to this notice and to our privacy policies from time to time. Changes adopted will apply to any PHI we maintain about you. O2 Diagnostics is required to abide by the terms of our notice currently in effect. When changes are made, we will promptly update this notice and post the information on the O2 Diagnostics web site at www.O2-Diagnostics.com. Please review this site periodically to ensure that you are aware of any such updates. Revised: 8/15/2007