Page 1 of 6 Notice of Privacy Practices for KU…

Page 1 of 6


                     Notice of Privacy Practices for KU Medical Center
    THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
            DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
                           PLEASE REVIEW IT CAREFULLY.

This page is a summary of your privacy rights. Please read pages 2-6 for our complete Notice of Privacy
Practices. To learn more about your rights, you may call the Patient Relations office. The number is (913)
588-1290.

This Notice describes the KU Medical Center privacy practices. The KU Medical Center includes:
        University of Kansas Hospital and its affiliates,
        University of Kansas Medical Center,
        Kansas University Physicians, Inc., and
        KU HealthPartners, Inc.

We may use or disclose (share) medical information with each other for treatment, payment and day-to-
day operations.

                                        Our Commitment To You

KU Medical Center strives to protect your medical information. The law requires us to keep your medical
information private. We must give you this Notice about our privacy practices and follow these practices.

                        How We May Use and Share Your Medical Information

We may use or share your medical information for:
      Treatment (such as sending medical information to your referring doctor),
      Payment (such as billing your insurance), and
      Health Care Operations (such as teaching students or measuring our performance).

In some cases, we may use or share your medical information without your permission. We may give out
information about you for public health purposes; reports of abuse, neglect, or domestic violence; health
oversight audits or inspections; research studies; funeral arrangements; organ donations; government
programs; workers' compensation; and emergency situations. We may share patient information when
required by law, such as in response to a request from police or in response to court orders.

We may contact you to remind you about appointments, to tell you about different treatment options and
services, or for fundraising programs. If you are a patient in the hospital, we will put your name in our
patient directory unless you object. We may share your medical information with a family member or
friend who helps with your care.

                          Your Rights Concerning Your Medical Information

You have the right to look at and to get a copy of your medical information. KU Medical Center may
charge a fee for this service. You may ask us to change any medical information that you think is wrong
or incomplete. You may have a list of certain disclosures we have made about you. You may ask us to
communicate with you in special ways. You may ask for restrictions on the information we share about
you. If you think your privacy rights have been violated, you have the right to complain to us and to the
federal government. You have the right to a paper copy of this Notice.

We reserve the right to make changes to this Notice. We will post a current Notice in the locations where
you receive services.
Page 2 of 6


                                      Notice of Privacy Practices
                                                                                     Effective: October 1, 2004

    THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
            DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
                           PLEASE REVIEW IT CAREFULLY.

You may call the Patient Relations office if you have questions about this Notice. The number is (913)
588-1290.

                                        Who Will Follow This Notice

The KU Medical Center is made up of the health care providers listed below. To serve you better, we give
you this Notice about our privacy practices and your privacy rights. The Health Insurance Portability and
Accountability Act of 1996 (HIPAA) guarantees your privacy rights. Each provider will follow the terms of
this Notice. This Notice applies to our various sites of service. If you ask, we will give you a list of our sites
that are subject to this Notice.

The KU Medical Center includes:
       University of Kansas Hospital (its affiliates, including: Mid-America Cardiology, Inc.; Mid-America
       Cardiothoracic Surgeons, Inc.; Ambulatory Surgery Center, LLC; and Jayhawk Primary Care,
       Inc.),
       University of Kansas Medical Center,
       Kansas University Physicians, Inc., and
       KU HealthPartners, Inc.

These providers include their employees, staff, trainees, volunteer groups and other health care workers.

We may share medical information with each other for treatment, payment and operational purposes. The
law allows us to do so to provide efficient health care services.

                                            Important Disclaimer

The above providers are giving you this joint Notice. Each provider in this joint Notice is its own
health care provider. Each provider is individually responsible for its own activities. This includes
complying with privacy laws and all health care services it provides. We are not providing health
care services mutually or on each other's behalf. We may share health information as allowed by
law.

                                Our Pledge Regarding Medical Information

We know that your medical information is personal. We will protect your medical information. We create a
record of the care and services you receive at KU Medical Center. We need this record to give you
complete and comprehensive care. We also need this record to comply with the law. This Notice applies
to records we create for your care at KU Medical Center.

This Notice tells you about the ways that we may use and share your medical information. It also
describes your rights.

We are required by law to:
       make sure that medical information that identifies you is kept private,
       give you this Notice of our legal duties and privacy practices concerning your medical information,
       and
       follow the terms of this Notice currently in effect.
Page 3 of 6

                        How We May Use and Share Your Medical Information

We may use and share your medical information as listed below. Not every possible use or disclosure will
be listed. However, all of the ways we may use and share information falls into one of these areas.

        For Treatment. We may use your medical information to give you medical care. We may share
        your medical information with doctors, nurses, technicians, students or other KU Medical Center
        workers. For example, departments may share your medical information to plan your care. This
        may include prescriptions, lab work, and x-rays. We may share your medical information with
        people not at KU Medical Center. This may include referring physicians and home health care
        nurses who are treating you.

        For Payment. We may use and share your medical information with your insurance plan or
        others who help pay for your care. For example, we may tell your health plan about a treatment
        you are going to receive. We do this to find out if your plan will pay for the treatment.

        For Health Care Operations. We may use and share your medical information for our
        operations. These uses and disclosures help us run our programs and make sure our patients
        receive quality care. For example, we may use medical information to review our treatment and
        services. We may use medical information to measure the performance of our staff and how they
        care for you. We may share medical information with doctors, nurses, technicians, students, and
        other health care workers for teaching purposes.

        Business Associates. We may contract with outside businesses to provide some services for
        us. For example, we may use the services of transcription or collection agencies. Under such
        contracts, we may share your medical information with them to do the job we have asked them to
        do. These contracts require businesses to protect the medical information we share with them.

        Appointment Reminders. We may contact you to remind you about your appointment for
        medical care.

        Treatment Alternatives. We may use and share medical information to tell you about different
        types of treatment available to you. We may use and share medical information to tell you about
        other benefits and services related to your health.

        Hospital Directory. We may include limited information about you in the hospital directory while
        you are a patient in the hospital. This information may include your name, location in the hospital,
        general condition (fair, stable, etc.), and religion. We may share the directory information, except
        for religion, with people who ask for you by name. We provide this service so your family, friends
        and others close to you can visit you and generally know how you are doing. If you do not want
        people to know that you are in the hospital, we will not share this information. You must let the
        Admitting Department know that you do not want this information to be shared. Call the Admitting
        Department at (913) 588-7431 if you do not want this information to be shared.

        People Involved In Your Care. Unless you ask us not to, we may share your medical
        information with a family member or friend who helps with your medical care. We may share your
        medical information with a group helping with disaster relief efforts. We do this so your family can
        be told about your location and condition. If you are not present or able to say no, we may use
        our judgment to decide if sharing your information is in your best interest.

        Research. As an academic medical center, we may use and share your medical information for
        research. We will only use and share information for research if we get your consent, or if a
        review committee that meets Federal standards says we do not need your consent.

        As Required By Law. We will share your medical information when required to do so by federal,
        state or local law.
Page 4 of 6


       Fundraising Activities. We may use your information to contact you for efforts to raise funds for
       KU Medical Center. We may share your information with foundations related to KU Medical
       Center. Such foundations may contact you to raise funds. For example, you may get invitations to
       fundraising events. You may get annual reports and other types of mailings for programs to raise
       funds. We only share contact information. Contact information is your name, address, phone
       number and the dates you had treatment or services. You may call KU Endowment at (913) 588-
       5249 if you do not want us to contact you for KU Medical Center fundraising purposes.

       To Prevent A Serious Threat To Health Or Safety. We may use and share your medical
       information to prevent a serious threat to your health and safety and that of others. We will only
       share your medical information with persons who can help prevent the threat.

                         How We May Use and Share Your Medical Information
                                        Special Situations

       Organ and Tissue Donation. We may share medical information with groups that handle and
       monitor organ donations and transplants.

       Military. If you are in the U.S. or foreign armed services, we may share your medical information
       as required by the proper military authorities.

       Workers' Compensation. We may share your medical information for workers' compensation or
       programs like it. We may do this to the extent required by law.

       Public Health Risks. We may share your medical information for public health activities. We may
       do so as required by law. For example, we may share your medical information:
           to prevent or control disease, injury or disability;
           to report births and deaths;
           to report child abuse or neglect;
           to report reactions to medicines or problems with products;
           to tell you about product recalls;
           to tell you if you have been exposed to a disease or may be at risk for catching or spreading
           a disease or condition; and
           to tell the proper government department if we believe a patient has been the victim of abuse,
           neglect or domestic violence. We will only share this information when ordered or required
           by law.

       Health Oversight Activities and Registries. We may share your medical information with
       government agencies that oversee health care. We may do so for activities approved by law. For
       example, these activities include: audits, investigations, inspections and licensure surveys. The
       government uses these activities to monitor the health care system. It also monitors the outbreak
       of disease, government programs, compliance with civil rights laws, and patient outcomes. We
       may share medical information with government registries.

       Lawsuits and Disputes. If you are in a lawsuit or a dispute, we may share your medical
       information in response to a court order, legal demand or other lawful process.
Page 5 of 6

        Law Enforcement. We may share medical information if asked to do so by a law enforcement
        official:
             to report certain types of wounds;
             to respond to a court order, subpoena, warrant, summons or similar process;
             to identify or locate a suspect, fugitive, material witness, or missing person;
             about the victim of a crime, if under certain limited circumstances, we are unable to obtain the
             victim's agreement;
             about a death we believe may be caused by a crime;
             about suspected crimes on our premises; and
             in emergency circumstances to report a crime; the location of the crime or victims; or the
             identity, description or location of the person who may have committed the crime.

        Coroners, Medical Examiners and Funeral Directors. We may share medical information with
        a coroner or medical examiner. For example, we may do this to identify a deceased person or to
        determine the cause of death. We may share medical information with funeral directors as
        necessary to carry out their duties.

        National Security. We may share your medical information with the proper federal officials for
        national security reasons.

                          Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you:

        Right To Inspect and To Receive Copies. You have the right to look at and to receive copies of
        the medical information used to make decisions about your care. Usually, this includes medical
        and billing records. It does not include some records such as psychotherapy notes.

        To look at and to receive copies of medical information used to make decisions about you, you
        must submit your request in writing. We may charge a fee for the costs of processing your
        request. Call Release of Information at (913) 588-2454 to get more details.
        In some limited cases, we may say no to your request, such as a request for psychotherapy
        notes. You may ask that such a decision be reviewed. To ask for a review, contact Patient
        Relations at (913)588-1290.

        Right To Amend. If you think that medical information we have about you is wrong or
        incomplete, you have the right to ask for an amendment to your record. To ask for a change to
        your record, you must make your request in writing and submit it to the Director of Medical
        Records; 3901 Rainbow Blvd.; Kansas City, KS 66160. Also, you must give a reason that
        supports your request.

        We may say no to your request for an amendment to your record. We may do this if it is not in
        writing or does not include a reason to support the request. We also may say no to your request
        if you ask us to amend information that:
             we did not create, unless the person or entity that created the information is no longer
             available to make the amendment;
             is not part of the records used to make decisions about you;
             is not part of the information which you are permitted to inspect and to receive a copy; or
             is accurate and complete.
Page 6 of 6

        Right To an Accounting of Disclosures. You have the right to get a list of the disclosures we
        made of your medical information. This list will not include all disclosures that we made. For
        example, this list will not include disclosures that we made for treatment, payment or health care
        operations. It will not include disclosures made before April 14, 2003, or disclosures you
        specifically approved.

        To ask for this list you must submit your request in writing on the approved form. We will give the
        form to you upon request.

        Right To Request Restrictions. You have the right to ask for a restriction or limitation on the
        medical information we use or share for treatment, payment or health care operations. You also
        have the right to ask for a limit on the medical information we share with someone who is involved
        in your care or in the payment for your care. Such a person may be a family member or friend.
        We do not have to agree to your request. If we do agree, we will fulfill your request unless the
        information is needed to provide you with emergency treatment.

        To ask for restrictions, you must make your request in writing on a form that we will give you upon
        request. You must tell us:
            what information you want to limit,
            how you want us to limit the information, and
            to whom you want the limits to apply.

        Right To Request Confidential Communications. You have the right to ask us to
        communicate with you about medical matters in a certain way or at certain places. You must
        make your request in writing on a form that we will give you upon request. We will fulfill all
        reasonable requests.

        Right To a Paper Copy of This Notice. You may ask us to give you a copy of this Notice at any
        time. Even if you have agreed to get this Notice electronically, you still have a right to a paper
        copy of this Notice.

                                        Revisions To This Notice

We may update this Notice to show any changes in our privacy practices. We reserve the right to make
the updated Notice effective for medical information we already have about you. It also will be effective for
any information we receive in the future. We will post a copy of the current Notice in the places where you
receive services. The effective date of this Notice is on the first page, in the top, right-hand corner.

                                                Complaints

If you think your privacy rights have been violated, you may file a complaint with KU Medical Center or
with the Secretary of the Department of Health and Human Services. If you want to file a complaint with
KU Medical Center, contact the Privacy Officials of KU Medical Center through the office of Patient
Relations at (913) 588-1290. You will not be penalized for filing a complaint.

                                   Other Uses of Medical Information

Other uses and disclosures of medical information not covered by this Notice or by other laws that apply
to us will be made only with your written permission. If you give your permission to use or share your
medical information, you may cancel that permission, in writing, at any time. If you cancel your
permission, we will no longer use or share your medical information for the reasons covered by your
written permission. We cannot take back any disclosures we have already made with your permission.
We are required to keep records of the care that we provided to you.

                                                    END