Fundraising Activities: Mercy may use or disclose your demographic information(name, address, age, gender, insurance status, and dates of service) to a related founda-tion for fund raising activities, unless prohibited by law. Any communication sent to youwill let you know how you may opt out of receiving similar communications in thefuture. We may contract with an outside company to conduct fundraising for MercyMedical Center. This company will use your PHI only for the purposes of fundraisingfor Mercy Medical Center.

Information and Health Promotion Activities: Mercy will use and disclose some of yourPHI for certain health promotion activities. For example, your name and address will beused to send you newsletters or general communications. Mercy may send you thisinformation if it has determined that a product or service may help you. The communi-cation will explain how the product or service relates to your health.

Research: Mercy will use or disclose your PHI as part of research that includes provid-ing you with treatment. For example, if you are part of a research study that includestreatment, you may be required to sign an authorization to allow researchers to use ordisclose your PHI for the research study.

OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATIONAny uses or disclosures that are not for treatment, payment, or healthcare operations andthat are not permitted or required for public policy purposes or by law will be made onlywith your written authorization. Written authorizations will let you know why we areusing or disclosing your PHI. You have the right to revoke an authorization at any time.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATIONYour records are the physical property of Mercy Medical Center, but you have the fol-lowing rights concerning your PHI. Right to Inspect and Copy: You have the right to access your PHI and to inspect andcopy your PHI as long as we maintain it except for: psychotherapy notes, informationthat will be used in a civil, criminal or administrative action or proceeding, and whereprohibited or protected by law. We will deny your request for access to your PHI with-out giving you an opportunity to review that decision if:

· You don't have the right to inspect the information; or it is otherwise prohibited orprotected by law;

· You are an inmate at a correctional institution and obtaining a copy of the information would risk the health, safety, security, custody or rehabilitation of youor other inmates;

· The disclosure of the information would threaten the safety of any officer,employee or other person at the correctional institution or who is responsible for transporting you;

· You are involved in a clinical research project and Mercy created or obtained the PHI during that research. Your access to the information will be temporarily suspended for as long as the research is in progress;

· We obtained the information that you seek access to from someone other than a health care provider under a promise of confidentiality and your access request is likely to reveal the source of the information; or

· Under other limited circumstances. In these instances, however, we will allow thereview of our decision by a health care professional that Mercy has chosen. This person will not have been involved in the original decision to deny your request.

D. Health or Safety: Mercy will use and disclose PHI to avert a serious threat to healthand safety of a person or the public. Mercy will use and disclose PHI to PublicHealth Agencies for immunizations, communicable diseases, etc. Mercy will use anddisclose PHI for activities related to the quality, safety or effectiveness of FDA-regu-lated products or activities, including collecting and reporting adverse events, track-ing and facilitating product recalls, etc. and post-marketing surveillance. Any patientreceiving a medical device subject to FDA tracking requirements may refuse to dis-close, or refuse permission to disclose, their name, address, telephone number andsocial security number, or other identifying information for the purpose of tracking.

E. More Stringent State and Federal Laws: The State laws of Iowa, Nebraska andSouth Dakota may be more stringent than HIPAA in several areas. State law is morestringent when the individual is entitled to greater access to records than underHIPAA and when under state law, the records are more protected from disclosurethan under HIPAA. Certain federal laws also may be more stringent for disclosurethan HIPAA provides and therefore the federal law would prevail. Mercy will contin-ue to abide by these more stringent state and federal laws.

3. OTHER STANDARD USES AND DISCLOSURES OF PHI

Mercy uses and shares PHI in several other ways in the course of its operations.Mercy can use or disclose your information for the following purposes unless youexercise your right to object or opt out:

Notification: We may use or disclose information to notify, or assist in notifying, a familymember, personal representative, or another person responsible for your care about yourlocation and general condition. However, Mercy contacts a patient's pastor or faith com-munity only upon request.

Communication with family: We may disclose to a family member, other relative, closepersonal friend or any other person you identify, health information relevant to that per-son's involvement in your care or payment related to your care, as appropriate. You havea right to request that your PHI not be shared with some or all of your family and friends.

Hospital Directory: We maintain a directory of patients currently in the hospital. Thedirectory includes each patient's name, location in the hospital, general condition (e.g.,fair, stable, critical, etc.) and religious affiliation. The directory is provided as a service topatients so that family, friends, and pastors of patients can be aware of their presence inthe hospital and general condition. The directory information, except for religious affilia-tion, will be disclosed to people who ask for you by name, including members of thenews media.

Directory information including your religious affiliation will be given to a member of theclergy, such as a priest or rabbi, even if they don't ask for you by name. A list of patientsby religion is made available to local pastors and ministers in a secured location.

You have the right to request that your name not be included in the Directory. If you askto opt out of the directory, we cannot inform visitors or callers of your presence, location,or general condition. If you are admitted for mental health or chemical dependency rea-sons, you will automatically be excluded from the directory.

Marketing: Mercy is not permitted to provide your PHI to any other person or companyfor marketing to you of any products or services other than Mercy's products unless youhave signed an authorization.

We will use or disclose your PHI for payment.We will send billing information to you or your insurance company. This may containinformation that identifies you, as well as your diagnosis, services provided, and supplies used in the course of your care.

We will use or disclose your PHI for healthcare operations and internal businesspractices.We may use your PHI in our ongoing efforts to improve the quality and effectiveness ofthe healthcare services we provide. For example, we need to use some patients' PHI forquality improvement activities, utilization review, professional review and performanceevaluation, internal auditing, credentialing, accreditation, certification, and licensingactivities, and for educational purposes. We provide information to state and nationalregistries such as Tumor Registry, Myocardial Infarction Registry, and the Trauma reg-istry to support quality monitoring, licensure and the accreditation process. As a mem-ber of Trinity Health, a Catholic healthcare system with facilities in seven states, wealso share PHI for system-wide utilization review and quality assessment activities.

Mercy also contracts with business associates to perform functions on its behalf,including Trinity Health, its parent who performs certain business functions for Mercy.Whenever an arrangement between Mercy and a business associate involves the use ordisclosure of your PHI, Mercy requires the business associate to uphold Mercy's policieson protecting PHI.

2. USE OR DISCLOSURE REQUIRED BY PUBLIC POLICY OR LAW

A. Disclosures Required by Law: Mercy will disclose your PHI as required by federal, state or local laws without your authorization. For example, Mercy maydisclose information for law enforcement purposes, such as responding to a courtorder or subpoena, identifying a criminal suspect or a missing person, or providinginformation about a crime victim or criminal conduct.

Mercy Medical Center will disclose PHI about you when required by federal, stateor local law to make reports or other disclosures. Mercy also will make disclosuresfor judicial and administrative proceedings such as lawsuits or other disputes inresponse to a court order or subpoena. Mercy will disclose your medical informa-tion to government agencies concerning victims of abuse, neglect or domestic violence. Mercy will report drug diversion and information related to fraudulentprescription activity to law enforcement and regulatory agencies. Specialized gov-ernment functions will warrant the use and disclosure of PHI. These governmentfunctions will include military and veteran's activities, national security and intelli-gence activities, and protective services for the President and others. Mercy willmake certain disclosures that are required in order to comply with workers' com-pensation or similar programs. If you are an inmate of a correctional institution orunder custody of a law enforcement officer, Mercy will release your PHI to the cor-rectional institution or law enforcement official.

B. Coroners, Medical Examiners, Funeral Directors: Mercy may disclose yourPHI to a coroner or medical examiner, if needed identify a deceased person or todetermine a cause of death. Mercy may also disclose your medical information tofuneral directors as necessary to carry out their duties.

C. Organ Procurement: Mercy may disclose PHI to an organ procurement organiza-tion or entity for organ, eye or tissue donation purposes.