Notice of Privacy Practices

Effective: July 1, 2009, Last Updated: May 19, 2017

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

If you have any questions about this Notice, please contact the RIQI Privacy Officer at (888) 858−4815.

This Notice of Privacy Practices describes how RIQI may use and disclose your protected health information in CurrentCare to carry out treatment, payment or health care operations and for other
purposes that are permitted or required by law. It also describes your right to access your protected health
information. “Protected health information” is information about you, including demographic information,
that
may identify you and that relates to your past, present or future physical or mental health condition
and related health care services.

We are required to abide by the terms of this Notice. We may change the terms of our Notice of
Privacy Practices at any
time. The new Notice will be effective for all protected health information
that we administer at that time. Upon your request, we will provide you with any revised Notice of
Privacy Practices by calling the office and requesting that a revised copy be sent to you in the
mail. A copy of the current Notice will be prominently displayed in our office at all times and on the
RIQI website riqi.org and the CurrentCare website CurrentCareri.org.

1.
Uses and Disclosures of Protected Health Information

Uses and Disclosures of Protected Health Information
Prior to disclosing your protected health information to health care providers or a health plan, RIQI will
obtain your authorization through your CurrentCare enrollment/authorization form.

Treatment: We will use and disclose your protected health information to healthcare providers who
provide, coordinate, or manage your health care and any related treatment now or in the future. This
includes providers whom you have authorized on your CurrentCare enrollment/authorization form to have
access to your protected health information, including in an emergency or unanticipated event.

Health Care Operations: We may use or disclose your protected health information in the administration
and general operation of CurrentCare. These activities include, but are not limited to, quality assessment
activities, security and privacy assessments and other administrative activities.

We may use or disclose your protected health information to individual or group health plans, as permitted
by law, if such use or disclosure is necessary for the health plan to carry out care management of its plan
members or for quality performance measure reporting.

We may use or disclose your protected health information with third party “business as
sociates” that
perform various activities for RIQI (e.g., software company or other consultants). Whenever an
arrangement between us and a business associate involves the use or disclosure of your protected health
information, we will have a written contract that contains terms that will protect the privacy of your
protected health information. If our business associate discloses your health information to a subcontractor
or vendor, the business associate will have a written contract to ensure that the subcontractor or vendor
also protects the privacy of the information.

Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization

Other uses and disclosures of your protected health information will be made only with your authorization,
unless otherwise permitted or required by law. You may revoke your authorization at any time.

Uses and disclosures of any protected health information for marketing purposes require your written
authorization if we will receive direct or indirect remuneration not reasonably related to our costs of making
the communication.

Uses and disclosures that constitute the sale of protected health information require your written
authorization. The sale of protected health information does not include a
disclosure for public health
purposes, for research where we will only receive remuneration for our costs to prepare and transmit the
health information, for treatment and payment purposes, for the sale, transfer, merger, or consolidation of
all or part of RIQI, for our business associates or its subcontractors to perform health care functions on our
behalf or for other purposes as required or permitted by law.

Psychotherapy notes will only be used and disclosed with your written authorization.

Federal
law and regulation protects your substance use disorder information from disclosure without your
consent, unless otherwise permitted or required by law.

Other kinds of information, such as HIV/AIDs-related information, mental/behavioral health information,
sexually transmitted disease information, and genetic information, are also considered sensitive such that state
or federal laws may provide special protections for them. Therefore, some parts of this general Notice of
Privacy Practices may not apply
to these types of information. If you have questions or concerns about the
ways these types of information may be used or disclosed, please speak with your health care provider or
contact the RIQI Privacy Officer.

Other Permitted and Required Uses and Di
sclosures that May Be Made Without Your Consent or
Authorization

Required By Law: We may use or disclose your protected health information to the extent that the use or
disclosure is required by law. The use or disclosure will be made in compliance with
the law.

Public Health: We may disclose your protected health information for public health activities to a public
health authority that is permitted by law to collect or receive the information.

Legal Proceedings: We may disclose protected health information in response to a court order.

2.
Your Rights

You have the right to obtain a copy of your confidential healthcare information. If you would like to
receive an electronic copy of your health information, we will provide you a copy in the electronic form
and format as requested as long as we can readily produce such information in the form requested.
Otherwise, we will cooperate with you to provide a readable electronic form and format as agreed.

You have the right to receive a disclosure report of disclosures made, if any, of your protected health
information.
This right applies to disclosures for treatment and operations as described in this Notice of
Privacy Practices. You also have the right to receive a separate List of Disclosures of your substance use
disorder information pursuant to 42 CFR Part 2 substance use disorder confidentiality regulations.The
maximum time frame that can be requested for substance use disorder disclosures is two years prior
to the date of your request.

You have the
right to have your physician amend your protected health information.
This means you
may request an amendment of protected health information about you that your health care provider
maintains. CurrentCare will include any amendments made by your health
care provider to your CurrentCare
record after it is received from your health care provider.

You have the right to request that your protected health information be disclosed to a family member or
other person authorized by you, to assist in the coordination of your care.
You have the right to request that your protected health information
be disclosed to health care providers
who are not participants in CurrentCare.

You have the right to be notified if there is a probable compromise of your unsecured protected health
information within sixty (60) days of the discovery of the breach. The notice will include a description
of what happened, including the date, the type of information involved in the breach, steps you should
take to protect yourself from potential harm, a brief description of the investigation into the breach,
mitigation of harm to you and protection against further breaches and contact procedures to answer
your questions.

You have the right to terminate your participation in CurrentCare at any time.

3.
Complaints

You may contact the RIQI Security or Privacy Officers at (888) 858−4815 for further information about
the complaint process.

You can complain to us or to the Rhode Island Department of Health or the Secretary of Health and Human
Services if you believe your privacy rights have been violated. You may file a complaint with us by notifying
our Privacy Officer of your complaint. We will not retaliate against you for filing a complaint.

You have the right to obtain a paper or electronic copy of this Notice from us. We may change our
privacy policies from time to time. If we do, we will revise this notice and post any revised notice on
our website.

We reserve the right to change this notice at any time and to make the revised or changed notice
effective in the future. We will notify you of any changes.