We are required by law to protect the privacy of your health care and identifying information. This may be information about health care services that we provide to you or payment for health care provided to you. It may also be information about your past, present, or future health care condition.

We are also required by law to provide you with this Notice of Privacy Practices explaining our legal duties and privacy practices with respect to health care information. We are legally bound to follow the terms of this Notice. In other words, we are only allowed to use and disclose health care information in the manner that we have described in this Notice.

We may change the terms of this Notice in the future. We reserve the right to make changes and to make the new Notice effective for all health care information that we maintain. If we make changes to the Notice, we will:

• Post the new Notice in our waiting area.
• Have copies of the new Notice available upon request (you may also contact our Privacy Officer at 828 437-6268 to obtain a copy of the current Notice.)

The rest of this Notice will:

• Discuss how we may use and disclose health care information about you
• Explain your rights with respect to health care information about you
• Describe how and where you may file a privacy-related complaint

If, at any time, you have questions about information in this Notice or about our privacy policies, procedures or practices, you may contact our Privacy Officer at 828 437-6268.

WHAT IS A MEDICAL/SERVICE RECORD?
WHAT INFORMATION IS IN THE MEDICAL RECORD?

Each time you receive a service from, or speak to a representative of Repay, Inc. a record of that contact will be maintained. The information is collected and maintained in what is referred to as your Medical or Service Record. Your Record contains information about your mental health history, developmental disabilities history, substance abuse history, your physical health (as appropriate), current symptoms, assessments, test results (if appropriate), diagnosis, treatment, medications, legal history (as appropriate), demographic information, financial information, family history (as appropriate), your progress, and a plan for your current and future treatment. The information contained in your Medical Record serves the following purposes:

• It is the basis for the planning of your care and treatment.
• It is a way for the various professionals involved in your care to communicate.
• It is a legal document describing the care that you have received.
• It is a means by which you or an insurance payer can verify that you actually received the services billed.
• It is a tool to assess the appropriateness and quality of care that you received.
• It is a source of information for state mental health officer who are charged with improving mental health care across the state; and
• It is a tool to improve the quality of care and achieve better client outcomes.

• Insure the accuracy and completeness of the information
• Understand who, what, where, why, and how others may have access to your mental health information;
• Make informed decisions about authorizing (or giving permission) disclosure of your information to others; and
• Better understand your health information rights that are detailed below

WE MAY USE AND DISCLOSE HEALTH CARE INFORMATION ABOUT YOU IN SEVERAL CIRCUMSTANCES

We use and disclose health care information. This section of our Notice explains in some detail how we may use and disclose health care information about you in order to provide health care, obtain payment for that health care, and operate our business efficiently. This section then briefly mentions several other circumstances in which we may use or disclose health care information about you. For more information about any of these uses or disclosures, or about any of our privacy policies, procedures or practices, you may contact our Privacy Officer at 828 437-6268.

1. Treatment
We may use and disclose health care information about you to provide health care treatment to you. In other words, we may use and disclose health care information about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others.

Example: Jane is a client at Repay, Inc. The receptionist may use health care information about Jane when setting up an appointment. The counselor will likely use health care information about Jane when reviewing Jane’s health care condition. If, after reviewing, the counselor concludes that Jane should be referred for additional services, the counselor may disclose health care information about Jane to the mental health specialist to assist the specialist in providing appropriate care to Jane.

We may use and/or disclose health care information about you in order to inform you of or recommend new treatment or different methods for treating a health care condition that you have or to inform you of other health related benefits and services that may be of interest to you.

Example: Jane is a client at Repay, Inc. and she has been diagnosed with schizophrenia. Repay, Inc. has developed an educational program to help clients manage their lifestyle. Repay, Inc. sends Jane a flyer with information about the program.

We may also use and/or disclose health care information about you to send you reminders about your appointment.

2. Payment
We may use and disclose health care information about you to obtain payment for health care services that you received. This means that, within Repay, Inc. we may use health care information about you to arrange for payment (such as preparing billing and managing accounts). We also may disclose health care information about you to others (such as insurers, collection agencies, and or client reporting agencies) except as mandated by state and Federal regulations. In some instances, we may disclose health care information about you to an insurance plan before you receive certain health care services because, for example, we may want to know whether the insurance plan will pay for a particular service.

Example: Jane is a client at Repay, Inc. and has insurance (private, Medicaid, Medicare, etc.) Repay, Inc. billing clerk will use health care information about Jane when he prepares a bill for the services provided at the. Health care information about Jane will be disclosed to her insurance company when the billing clerk sends the bill.

Example: After Jane has reported increasing needs; the counselor referred Jane to another service. The other service recommended both individual and group sessions. The mental health billing clerk may contact Jane’s insurance company before the specialist begins these services to determine whether the plan would pay for the services and/ or the number of sessions allowed by the insurance company.

3. Health care operations
We may use and disclose health care information about you in performing a variety of business activities that we call "health care operations." These "health care operations" activities allow us to improve the quality of care we provide and reduce health care costs. For example, we may use or disclose health care information about you in performing the following activities:

• Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you
• Providing training programs for students, trainees, health care providers or non-health care professionals to help them practice or improve their skills.
• Cooperating with outside organizations that evaluate, certify, or license health care providers, staff, or facilities in a particular field or specialty.
• Reviewing and improving the quality, efficiency and cost of care that we provide to you and our other clients.
• Improving health care and lowering costs for groups of people who have similar health problems and helping manage and coordinate the care for these groups of people.
• Cooperating with outside organizations that assess the quality of the care others and we provide, including government agencies and private organizations.
• Planning for our organization’s future operations.
• Resolving complaints, grievances, and appeals within our organization and/or contract agencies.
• Reviewing our activities and using or disclosing health care information in the event that control of our organization significantly changes.
• Working with others (such as lawyers, accountants, or other providers) who assist us to comply with this Notice and other applicable laws.

Example: Jane was diagnosed with depression. Repay, Inc. used Jane’s health care information- as well as health care information from all other Repay, Inc. clients diagnosed with depression- to develop an educational program to help clients recognize the early symptoms of depression. (Note: The educational program would not identify any specific clients without their permission.)

Example: Jane complained that she did not receive appropriate health care. Repay, Inc. reviewed Jane’s record to evaluate the quality of the care provided to Jane. Repay, Inc. also discussed Jane’s care with their attorney.

4. Persons Involved in Your Care
We may disclose health care information about you to a relative, close personal friend or any other person you identify if that person is involved in your care and the information is relevant to your care except as mandated by state and federal regulations. If the client is a minor, we may disclose health care information about the minor to a parent, guardian or other person responsible for the minor except in limited circumstances. For more information on the privacy of minor’s information, contact our Privacy Officer at 828 437-6268

We may also use or disclose health care information about you to a relative, another person involved in your care or possibly a disaster relief organization (such as the Red Cross) if we need to notify someone about your location or condition.

You may ask us at any time not to disclose health care information about you to persons involved in your care. We will agree to your request and not disclose the information except in certain limited circumstances (such as emergencies) or if the client is a minor. If the client is a minor, we may or may not be able to agree with your request.

Example: Jane’s husband regularly comes to Repay, Inc. with Jane for her appointments. When the counselor is discussing a new service plan with Jane, Jane invites her husband to come into the private room. The counselor discusses the service plan with Jane and Jane’s husband.

5. Required by law
We will use and disclose health care information about you whenever we are required by law to do so. There are many state and federal laws that require us to use and disclose health care information. For example, state law requires us to report gunshot wounds and other injuries to the police and to report known or suspected child or elder abuse or neglect - to the Department of Social Services. We will comply with those state laws and with other applicable laws.

6. National priority uses and disclosures
When permitted by law, we may use or disclose health care information about you without your permission for various activities that are recognized as "national priorities." In other words, the government has determined that under certain circumstances (described below), it is so important to disclose health care information that it is acceptable to disclose it without the individual’s permission. We will only disclose health care information about you in the following circumstances when we are permitted to do so by law. For more information on these types of disclosures, contact our Privacy Officer at 828 437-6268.

• Threat to health or safety: We may use or disclose health care information about you if we believe it is necessary to prevent or lessen a serious threat to health or safety.
• Public health activities: We may use or disclose health care information about you for public health activities. Public health activities require the use of health care information for various activities, including, but not limited to, activities related to investigating diseases, reporting child abuse and neglect, monitoring drugs or devices regulated by the Food and Drug Administration, and monitoring work-related illnesses or injuries. For example, if you have been exposed to a communicable disease (such as a sexually transmitted disease), we may report it to the State and take other actions to prevent the spread of disease.
• Abuse, neglect or domestic violence: We may disclose health care information about you to a governmental authority (such as the Department of Social Services) if you are an adult and we reasonably believe that you may be a victim of abuse, neglect or domestic violence.
• Health oversight activities: We may disclose health care information about you to a health oversight agency-which is basically an agency responsible for overseeing the health care system or certain governmental programs. For example, a government agency may request information from us while they are investigating possible insurance fraud.
• Court proceedings: We may disclose health care information about you to a court or an officer of the court (such as an attorney) with an appropriate order from a judge. For example, we would disclose health care information about you to a court if a judge orders us to do so.
• Law Enforcement: We may disclose health care information about you to law enforcement official for specific law enforcement purposes. For example, we may disclose limited health care information about you to the police officer if the officer needs the information to help find or identify a missing person.
• Coroners and others: We may disclose health care information about you to a coroner, medical examiner, or funeral director or to organizations that help with organ, eye, and tissue transplants.
• Worker’s compensation: We may disclose health care information about you in order to comply with workers’ compensation law.
• Research organizations: We may use or disclose health care information about you to research organizations if the organization has satisfied certain conditions about protecting the privacy of health care information.
• Certain government functions: We may use or disclose health care information about you for certain government functions, including but not limited to military and veteran’s activities and national security and intelligence activities. We may also use or disclose health care information about you to a correctional institution in some circumstances.

7. Authorization
Other than the uses and disclosures described above, we will not use or disclose health care information about you without the "authorization" - or signed permission on an authorization for release of information - of you or your legally responsible person. In some instances, we may wish to use or disclose health care information about you and we may contact you to ask you to sign an authorization form. In other words, you may contact us to ask us to disclose health care information and we will ask you to sign an authorization form.

If you sign a written authorization allowing us to disclose health care information about you, you may later revoke or cancel this authorization except for information that has been released or in very limited circumstances related to obtaining insurance coverage. This revocation must be in writing. If you would like to revoke your authorization, you may write us a letter revoking your authorization or fill out an Authorization Revocation Form. Forms are available from the facility where you are seen or from our Privacy Officer. If you revoke your authorization, we will follow your instructions except to the extent that we have already relied upon your authorization and taken some action.

YOU HAVE RIGHTS WITH RESPECT TO HEALTH CARE INFORMATION ABOUT YOU

This section of the Notice will briefly mention each of these rights. If you would like to know more about your rights, please contact our Privacy Officer at 828 437-6268.

1. Right to a copy of this Notice
You have a right to have a paper copy of our Notice of Privacy Practices at any time. In addition, a copy of this Notice will always be posted in our waiting areas. If you would like to have a copy of our Notice, ask the receptionist for a copy or contact our Privacy Officer at 828 437-6268.

2. Right of access to inspect and copy
You have the right to inspect (which means see or review) and to receive a copy of health care information about you that we maintain in certain groups of records. If you would like to inspect or receive a copy of health care information about you, you must provide us with a request in writing. You may write us a letter requesting access or fill out a "Request for Access" Form. Forms are available in every Repay, Inc. facility or from the Privacy Officer. Our agency must act on this request no later than 30 days after receipt of the request.

We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing. We will also inform you in writing if you have the right to have our decision reviewed by another person.

If you would like a copy of the information, we may charge you a fee to cover the costs of the copy. The minimum fee is ten dollars ($10). The maximum fee for each request shall be seventy-five ($.75) per page for the first 25 pages, fifty cents ($.50) per page for pages 26 through 100, and twenty-five cents ($.25) for each page in excess of 100 pages.

3. Right to have health care information amended
You have the right to have us amend (which means correct or add) health care information about you that we maintain in certain groups of records. If you believe that we have information that is either inaccurate or incomplete, we may amend the information to indicate the problem and notify others who have copies of the inaccurate or incomplete information. If you would like us to amend information, you must provide us with a request in writing. You may write us a letter requesting an amendment or fill out an "Amendment Request" Form. Amendment Request Forms are available in every Repay, Inc. facility or from the Privacy Officer. Our agency must act on this request no later than 60 days after receipt of the request.

We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing. You will have the opportunity to send us a statement explaining why you disagree with our decision to deny your Amendment Request and we will share your statement whenever we disclose the information in the future.

4. Right to an accounting of disclosures we have made
You have the right to receive an accounting (which means a detailed listing) of disclosures (disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the health information) that we have made for the previous six (6) years (beginning April 14, 2003). If you would like to receive an accounting, you may send us a letter requesting an accounting, fill out a "Request for an Accounting of Disclosures" Form, or contact our Privacy Officer. Forms are available in every Repay, Inc. facility or from the Privacy Officer. Our agency must act on this request no later than 60 days after receipt of the request.

The accounting will not include several types of disclosures, including disclosures for treatment, payment, or health care operations. The accounting will not include disclosures made prior to April 14, 2003.

If you request an accounting more than once every twelve (12 months), we may charge you a fee to cover the costs of preparing the accounting. The minimum fee is ten dollars ($10). The maximum fee for each request shall be seventy-five ($.75) per page for the first 25 pages, fifty cents ($.50) per page for pages 26 through 100, and twenty-five cents ($.25) for each page in excess of 100 pages.

5. Right to request restrictions on uses and disclosures
You have the right to request that we limit the use and disclosures of health care information about you for treatment, payment, and health operations.

We are not required to agree to your request.

If we do not agree to your request, we must follow your restrictions (except if the information is necessary for emergency treatment). You may cancel the restrictions at any time. In addition, we may cancel a restriction at any time as long as we notify you of the cancellation and continue to apply the restriction to information collected before the cancellation.

6. Right to request an alternative method of contact
You have the right to be contacted at a different location or by a different method. For example, you may prefer to have all written information mailed to your work address rather than your home address.

We will agree to any reasonable request for alternative methods of contact. If you would like to request an alternative method of contact, you must provide us with a request in writing. You may write us a letter or fill out a "Request for Alternative Contact" Form. Forms are available in all Repay, Inc. facilities and from the Privacy Officer.

YOU MAY FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES

If you believe that your privacy rights have been violated or if you are dissatisfied with our privacy policies or procedures, you may file a complaint either with us or with the Federal government. We will not take any action against you or change our treatment of you in any way if you file a complaint.

To file a written complaint with the mental health, developmental disability, or substance abuse agency, you may bring your complaint to your worker, his/her supervisor, the Privacy Officer, the Area Director or you may mail it to the following address:

REPAY, INC.
NEED ADDRESS
MORGANTON, NC 28655
828 437-6268

To file a complaint with the Federal government, you may send your complaint to the following address.

DHHS Regional Manager, Office of Civil Rights
US Department of Health and Human Services Government Center
J.F. Kennedy Federal Building - Room 1875
Boston, Massachusetts 02203
Voice phone: 617 565-1340
FAX 617 565-3809
TDD 617 565-1343