Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Castle Ventures, Inc. is committed to protecting the confidentiality of its clients’ medical information. This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your medical information and your rights concerning your medical information. This Notice is provided to you pursuant to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

OUR RESPONSIBILITIES

We are required to (i) maintain the privacy and security of your medical information as required by law; (ii) provide you with this Notice stating our legal duties and privacy practices with respect to your medical information; (iii) abide by the terms of this Notice; and (iv) notify you following a breach of your medical information that is not secured in accordance with certain security standards. We will not use or share your medical information other than as described here unless you tell us we can, in writing. If you tell us we can, you may change your mind at any time. Please let our Privacy Officer know, in writing, if you change your mind.

We can change the terms of this Notice and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our website.

To request a copy of the Notice, please contact our Privacy Officer at compliance@rightathome.net.

YOUR CHOICES

For certain medical information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in situations described below, please contact our Privacy Officer. Tell us what you want us to do and we will follow your instructions.

You have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation
• Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In the following cases, we never share your information unless you give us written permission:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

USES AND DISCLOSURES WITHOUT YOUR AUTHORIZATION

The following categories describe different ways that we use and disclose medical information. For each category of uses or disclosures, we will explain what we mean and try to give an example. All of the ways we are permitted to use and disclose medical information fall within one of the following categories.

Care: We may use and disclose your medical information to provide, coordinate and/or manage your care or other related services. For example, we may disclose medical information about you to your primary care doctor or another provider who is involved in your care.

Payment: We may use and disclose your medical information as needed to bill or obtain payment for the care and services provided. For example, we may contact your health plan to determine whether it will authorize payment for our services or to determine the amount of your co-payment or co-insurance.

Healthcare Operations: We may use or disclose your medical information in order to carry out our general business activities or certain business activities. These activities may include training and education; quality assessment/improvement activities; risk management; claims management; legal consultation; licensing; and other business planning activities. For example, we may use your medical information to evaluate the quality of care we are providing.

Family and Friends: We may disclose your medical information to a family member or friend who is involved in your medical care or to someone who helps pay for your care. We may also use or disclose your medical information to notify a family member, or other person responsible for your care, about your location and general condition.

Third Parties: We may disclose your medical information to third parties that perform services on our behalf. If we disclose your information to these third parties, we will have an agreement with them to safeguard your information. Examples of these third parties may include accreditation agencies, management consultants, quality assurance reviewers, collection agencies, transcription services, etc.

Required by Law: We may use or disclose your medical information to the extent the use or disclosure is required by law. Any such use or disclosure will be made in compliance with the law and will be limited to what is required by the law.

Public Health Activities: We may disclose your medical information for public health activities. These activities generally include the following:

• To prevent or control disease, injury or disability
• To report child abuse or neglect
• To report reactions to medications or problems with products
• To notify people of recalls of products they may be using
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
• To notify the appropriate government authority if we believe you have been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when otherwise required by law to the make the disclosure.

Health Oversight Activities: We may disclose your medical information to a health oversight agency for activities authorized by law. These oversight activities may include audits; investigations, proceedings or actions; inspections; disciplinary actions; or other activities necessary for appropriate oversight of the health care system, government programs and compliance with applicable laws.

Law Enforcement: We may disclose your medical information to law enforcement in very limited circumstances, such as to identify or locate suspects, fugitives, witnesses or victims of a crime, to report deaths from a crime, and to report crimes that occur on our premises.

Judicial and Administrative Proceedings: We may disclose information about you in response to an order of a court or administrative tribunal as expressly authorized by such order.

To Avert a Serious Threat to Health or Safety: We may use or disclose your medical information when necessary to prevent a serious and imminent threat to your health or safety or the health and safety of the public or another person.

Disaster Relief Efforts: We may use or disclose your medical information to an authorized public or private entity to assist in disaster relief efforts. You may have the opportunity to object unless it would impede our ability to respond to emergency circumstances.

Coroners, Medical Examiners and Funeral Directors: We may disclose medical information consistent with applicable law to coroners, medical examiners and funeral directors only to the extent necessary to assist them in carrying out their duties.

Organ and Tissue Donation: We may disclose medical information consistent with applicable law to organizations that handle organ, eye or tissue donation or transplantation, only to the extent necessary to help facilitate organ or tissue donation or transplantation.

Research: Under certain circumstances, we may use and disclose information about you for research purposes. All research projects are subject to a special approval process through an appropriate committee.

Workers’ Compensation: We may disclose your medical information as authorized by law to comply with workers’ compensation laws and other similar programs established by law.

Military, Veterans, National Security and Other Government Purposes: If you are a member of the armed forces, we may release your medical information as required by military command authorities or to the Department of Veterans Affairs. We may also disclose your medical information to authorized federal officials for intelligence and national security purposes to the extent authorized by law.

Correctional Institutions: If you are or become an inmate of a correctional institution or are in the custody of a law enforcement official, we may disclose to the institution or law enforcement official information necessary for the provision of health services to you, your health and safety, the health and safety of other individuals and law enforcement on the premises of the institution and the administration and maintenance of the safety, security and good order of the institution.

OTHER USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION

If we wish to use or disclose your medical information for a purpose not set forth in this Notice, we will seek your authorization. Specific examples of uses and disclosures of medical information requiring your authorization include: (i) most uses and disclosures of your medical information for marketing purposes; (ii) disclosures of your medical information that constitute the sale of your medical information; and (iii) most uses and disclosures of psychotherapy notes (private notes of a mental health professional kept separately from a medical record). You may revoke an authorization in writing at any time, except to the extent that we have already taken action in reliance on your authorization.

YOUR MEDICAL INFORMATION RIGHTS

Inspect and/or obtain a copy of your medical record. You have the right to inspect and/or obtain an electronic or paper copy of your medical record. To request to inspect and/or obtain a copy of your medical record, you must submit a written request to our Privacy Officer. If you request a copy of your medical record, we may charge you a reasonable, cost-based fee.

Request a restriction on certain uses and disclosures of your medical information. You have the right to ask us not to use or share certain medical information for purposes of care, payment or healthcare operations. We are not required to agree to your request and may choose to say no if it would affect your care. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say yes, unless a law requires that we share that information. If we agree to a restriction, we will not use or disclose your medical information in violation of that restriction unless it is needed to provide emergency care. To request a restriction, you must submit a written request to our Privacy Officer.

Request confidential communications. You have the right to request that we communicate with you in a certain way or at a certain location. For example, you can ask that we only contact you at work or by postal mail. To request a confidential communication of your medical information, you must submit a written request to our Privacy Officer stating how or when you would like to be contacted. We will not require you to provide an explanation for your request. We will agree to all reasonable requests.

Request a correction or amendment to your medical information. If you believe that any information in your medical record is incorrect or if you believe important information is missing, you may request that we amend the existing information. To request such an amendment, you must submit a written request to our Privacy Officer.

Request an accounting of certain disclosures. You have the right to receive a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all disclosures in the list, except those made for (1) treatment, payment, or health care operations and (2) certain other disclosures (such as the ones you asked us to make). To request an accounting, you must submit a written request to our Privacy Officer. We will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Obtain a paper copy of this Notice. You have the right to obtain a paper copy of this Notice upon request, even if you agreed to accept this Notice electronically. To obtain a paper copy of this Notice, please contact our Privacy Officer and we will provide a copy promptly.

Choose someone to act on your behalf. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we act.

STATE LAW

We will not use or share your information if state law prohibits it. Some states have laws that are stricter than the federal privacy regulations, such as laws protecting HIV/AIDS information or mental health information. If a state law applies to us and is stricter or places limits on the ways we can use or share your health information, we will follow the state law. If you would like to know more about any applicable state laws, please ask our Privacy Officer.

QUESTIONS, CONCERNS OR COMPLAINTS

If you have any questions or want more information about this Notice or how to exercise your medical information rights, you may contact our Privacy Officer by mail at: 6700 Mercy Rd., Ste 400, Omaha, NE 68106.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Office for Civil Rights: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201 or OCRComplaint@hhs.gov. We will not retaliate against you for filing a complaint.

Effective: August 14, 2024