THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN CET ACCESS TO THE INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our practice is dedicated to maintaining the privacy of your protected health information (PHI). "PHI" means any health information about you that identifies you directly, or could be used to, identify you. In conducting our practice, we will create records regarding you and the treatment and services we provide to you. We are required by law to maintain the confidentiality of your PHI. We also are required by law to provide you with this notice of our legal duties and the privacy practices that we maintain in our practice concerning your PHI. By federal and state law, we must follow the terms of the notice of privacy practices that we have in effect at the time.

We realize that these laws are complicated, but we must provide you with the following important information:

• How we may use and disclose your PHI
• What privacy rights you have regarding your PHI
• What obligations we have to maintain your PHI
• Whom you may contact if you have questions or if you believe your privacy rights have been violated

This Notice refers to the Associated Urologist, SC, Dr. Alan M. Rogin and Dr. Daniel S. Merrick by using the terms "us", "we", "our", or "the practice."

Amendments to the Notice. The terms of this notice apply to all records containing your PHI that are created or retained by our practice. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this notice will be effective for all of your records that our practice has created or maintained in the past, and for any of your records that we may create or maintain in the future. Our practice will post a copy of our current Notice in our offices in a visible location at all times, and you may request a copy of our most current Notice at any time.

Your acknowledgement of the Notice. When you receive the Notice from the practice, we will ask you to, sign our "Receipt of Notice of Privacy Practices" form. The form is filed with your medical record. If you refuse to sign the form, it is noted in the medical record that you were given the Notice and refused to sign the form.

Our Obligations Regarding Your PHI. We will make reasonable efforts to assure that PHI is only used by and disclosed to persons who have a right to the PHI and to verify the identity of those using or receiving your protected health Information. The PHI requested, used, or disclosed by the practice for any purpose will be the minimum amount of PHI necessary for that purpose.

Uses and Disclosures - Not Reguiring Your Authorization

Treatment, Payment, and Health Care Operations. Our practice uses and discloses PHI for payment, treatment, and health care operations. Treatment includes those activities related to providing services to you for the purposes of diagnosis and treatment. Treatment also includes releasing inforrnation to other health care providers involved in your care. Payment relates to all activities associated with getting reimbursed for services provided, including submission of claims to insurance companies and any additional information requested by the insurance companies so they can determine if they should pay the claim. Health care operations include a number of areas, including quality assurance and peer review activities.

Business Associates. We may also disclose PHI to a third party (business associate) who helps the practice receive payment for health care or assist with our operations, or who provides management, financial, legal or other services. As part of out contract for these services, we may disclose your medical Information to our business associates so that they can perform the job we have asked them to do. To protect your PHI, we require our business associates to safeguard your information.

Disclosure to Those Involved in Your Care. For a patient who is unable to make his/her own health care decisions (such as most minors, and mentally disabled persons), we will allow a person authorized to make health care decisions to act as the patient's personal representative.

We will disclose PHI to those involved in your care when you approve or, when you are not present or not able to approve, when such disclosure is deemed appropriate in our professional judgment.

When you are not present, we will determine whether the disclosure of your PHI is authorized by law and if so, disclose only the information relevant to the person's involvement with your health care.

We do not disclose PHI to a suspected abuser, if, in our professional judgment, there is reason to believe that such a disclosure could cause you serious harm.

Uses and Disclosures Required or Permitted by Law. The law requires us to disclose your health information in some cases:

For Public Health Activities. We report, information to public health officials. This includes reporting of communicable diseases and other conditions, sexually transmitted diseases, lead poisoning, Reyes Syndrome, and mandated reports of injury, medical conditions or procedures, or food-borne illness, including but not limited to adverse reactions to immunizations, cancer, adverse pregnancy outcomes, death, birth.

For Abuse, Neglect, and Domestic Violence. We report information as required by law to agencies which investigate, reports of child abuse, elder abuse, abuse of residents of long term care facilities, and abuse of the disabled. Where the law permits, but does not require reporting, we may report information to government agencies when you agree to this, or when the disclosure is necessary to prevent serlous harm to you or other potential victims.

For Health Oversight Activities. We may disclose your health information as required by law for such health oversight activities as audits, investigations, licensure issues, hospital peer review, managed care peer review, or Medicaid or Medicare peer review.

For Judlcial and Administrative Proceedings. We may disclose medical information about you as required by law in response to an order of a court or administrative tribunal. We also may disclose medical information in response to a subpoena, discovery request, or other legal process, but only if we receive assurances that efforts have been made to tell you about the request or to obtain an order protecting the information to be disclosed.

For Law Enforcement Purposes. We may disclose medical information about you to a law enforcement official for law enforcement purposes: as required by law, in response to a court, grand jury, or administrative order, warrant or subpoena; to identify or locate a suspect, fugitive, material witness or missing person; or to alert them to an actual or suspected victim of a crime if that person agrees to the disclosure. If we are unable to obtain that person's agreement, the information may still be disclosed in limited circumstances. We may also disclose PH to alert law enforcement officials to a death if we suspect the death may have resulted from criminal conduct or about crimes that occur at our office. We may also disclose PHI in emergency. circumstances to report a crime.

For Decedents. We may disclose health information to a coroner or medical examiner and funeral directors as required by law. The attending physician is required to sign the death certificate and provide the coroner with a copy of the decedent's PHI.

For Organ, Eye or Tissue Donations. We may provide PHI to organ procurement organizations to facilitate organ, eye, or tissue donations.

To Avert a Serious Threat to Health or Safety. We may disclose PHI to public health and other authorities as required by law to avert a serious threat to health or safety.

For Specialized Government Functions. If you are a member of the armed forces, we may disclose medical information about you for activities deemed necessary by military command authorities. We may also disclose PHI for veterans activities, national security and intelligence activities, and other activities as required by law.

For Workers' Compensation. We may disclose medical information about you as heeded to comply with the workers' compensation and similar laws that provide benefits for work-related injury or illness.

In Emergency Situations. We may also use and disclose your PHI as appropriate to provide treatment in emergency situatlons. In those instances where we have not previously provided you with the Notice of Privacy Practices and you need treatment in an emergency situation, we will provide the Notice to you as soon as practicable following the provision of the emergency treatment.

For Information on Our Products and Services. We tell our patients about products and services that describe a health-related product or service provided, by us or we may encourage our patients to purchase or use a product or service for treatment. We may also tell our patients about products and services to direct or recommend alternative treatments, therapies, health care providers, or settings of care that might benefit our patients. These activities are not considered marketing and are permitted by law.

In addition, we will not contact you with appointment reminders. We will not contact you with information about treatment alternatives or other heathirelated benefits and services that may be of interest to you.

Uses and Disclosures - Requlring Your Authorization

General. Except as described above, we may not make any other uses or disclosures of your PHI without your authorization or your personal representative's authorization. For example, you will need to authorize the practice to disclose your PHI to your employer or for a life insurance application.

Authorization for Specific Situations. In Illinois, with certain exceptions, a specific written authorization is required to disclose or release of mental health treatment, alcoholism treatment, drug abuse treatment, or HIV/Acquired Immune Deficiency Syndrome (AIDS) Information.

There are also special rules for the release of information about genetic testing, artificial insemination, sexual assault, and disclosure of records related to professional disciplinary proceedings of the Medical Disciplinary Board.

Revocation of Your Authorization. You may revoke an authorization at any time. The revocation must be in writing and must be sent to the attention of the practice's privacy officer. To the extent practice has taken action in reliance on the authorization, we will be able to use or disclose the PHI.

Restriction of Disclosures. You have the right to request that we restrict the uses or disclosures of medical information about you to carry out treatment, payment, or health care operations. You also have the right to request that we restrict the uses or disclosures we make to: (a) a family member, other relative, a close personal friend or any other person identified by you or (b) public or private entitles for disaster relief efforts.

You may request a restriction at any time. The request must be in writing and should be marked "Attention: Privacy Officer." You need to tell us: (a) what information you want to limit;, (b) whether you want to limit use or disclosure or both; and, (c) to whom you want the limits to apply (for example, disclosures to your spouse).

We are not required to agree to any requested restriction. However, if we do agree, we will follow that restriction unless the information is needed to provide emergency treatment. Even if we agree to a restriction, either you or we can later terminate the restriction.

Confidential Communications. You have the right to request that we communicate with you in a special way. Normally, we may contact you by either telephone or by mail, at either your home or workplace. At either location, we may leave messages, for you on the answering machine or voice mail notifying you of our attempt to contact you. We will not leave messages that disclose your protected health information, such as lab results.

A request for confidential communications must be in writing and must specify an alternative address or other method of contact. As appropriate, we may also require that you provide information about how payment will be handled. The request must be in writing and should be marked "Attention: Privacy Officer." No reason for the request needs to be stated.

The practice accommodates all reasonable requests. The practice will reject a request if no independently verifiable method of communication such as a mailing address or published telephone number is provided for communications, including billing; or if you have not provided information as to how payment will be handled.

The practice will not refuse a request if you indicate that the communication will cause endangerment to you.

Inspection and Copying PHI. You have the right to inspect and obtain a copy of your records. The practice documents all requests, responds to those, requests in a timely fashion, and informs patients of their appeal rights when a request is rejected in whole or in part. We may charge a reasonable fee for the copying of records.

We will review your request in a timely fashion and will act on a request for access generally within 30 days (or 60 days if we have to retrieve your records from storage). The practice may have a single extension of 30 days if needed to act on the request.

Each request will, be accepted or denied and you will be notified in writing. A request may be denied in certain situations such as the requested information includes psychotherapy notes, the information was compiled in anticipation of, or use in a civil, criminal, or administration action or proceeding, or information was obtained from someone other than a healthcare provider under a promise of confidentiality, and disclosure would reveal the source of the information.

If we deny your request, we will inform you of the basis for the denial, whether and how you may have our denial reviewed, and how you may register your complaint. Any review of our denial will be done by a licensed health care, professional designated by us, who was not directly involved in the denial. We will comply with the outcome of that review.

The practice charges reasonable fees based on actual cost of fulfilling the request. The practice will determine the appropriate charge for providing the requested records and inform you in advance of providing the records. If you agree to pay the fee in advance, the records will be provided. Otherwise, the records will not be provided, unless the Privacy Officer determines that the charge is burdensome to you.

Illinois law prohibits charges that exceed the following: $20.48 handling fee plus 77 cents each for pages 1-25, 51 cents each for pages 26-50; and 26 cents each for pages 51 to end; plus actual expenses related to the copying of x-rays, CAT scans, and similar records. The practice limits charges for records to the amounts allowed under Illinois law.

Requests for the inspection of records or obtaining copies of records must be sent to the practice in writing. It should be marked "Attention: Privacy Officer."

Amendment to Your PHI. You have the right to request that we amend the PHI maintained in medical record or billing record. We will document all requests, respond to those requests in a timely fashion, and inform patients of their appeal rights when a request is denied in whole or in part.

If the practice accepts the request, in whole or in part, to amend the PHI in your medical record, we will make the requested amendment by, at a minimum, identifying the portion of the medical record or billing record being amended and inserting the amendment into the record. The practice will not, under any circumstances, delete or destroy any portion of the medical record. The practice will simply amend the medical record by the addition of notes.

Generally we will act on a request for amendment no later than 60 days after receipt of the request. If we cannot act on the amendment within 60 days, we may extend the time for such action by 30 days and, within the 60-day time limit, provide you with a written statement of the reasons for the delay and the date by which we will complete action on the request. Only one such extension is allowed.

If we deny the request, in whole or in part, we will provide you with a written denial in a timely fashion. We allow you to submit a written statement disagreeing with the denial of all or part of tha initial request. The statement must include the basis of the disagreement. The practice limits the length of a statement of disagreement to one page.

The practice may deny a request to amend your PHI if the information was not created by the practice, unless you provide a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment; the amendment relates to information that is not part of the medical or billing records; the information would not be available for inspection; or the information is accurate and complete.

We accept requests to amend the PHI maintained by the practice. The requests must be in writing and should be marked "Attention: Privacy Officer."

Accounting for Disclosures of PHI. You have the right to receive an accounting of the disclosures of your PHI. We track all disclosures of your PHI (a) for purposes other than treatment, payment, and health care operations, (b) that are not made to you or to a person involved in care, (c) that are not made as a result of your authorization, and (d) that are not made for national security or intelligence purposes or to correctional institutions or law enforcement officials.

If you want to request an accounting for disclosures, you must provide your request in writing and mall or send it to the practice. It should be marked "Attention: Privacy Officer." You can request an accounting of disclosures for a period of up to six years prior to the date of the request. However, you may only request an accounting of disclosures made on or after April 14, 2003.

We will respond to al requests for an accounting of disclosures within 60 days of receipt of the request. If we intend to provide the accounting for disclosures and cannot do so within 60 days, we will inform you and provide a reason for the delay and the date the request is expected to be fullfilled. Only one 3-day extensiion is permitted.

Paper Copy of our Notice. You may obtain a paper copy of our Notice at any time.

Waiver of Rights. We do not require you to waive any of your rights as a condition for the provision of treatment, except under very limited circumstances allowed under law.

The practice has a privacy officer that serves as the contact person for all issues related to the Privacy Rule. The privacy officer is Daniel S. Merrick, M.D. If you have any questions about this Notice, please contact Joann Kettaneh at 773-878-7555 or 5140 North California Ave., Suite 775, Chicago, IL 60625.

You may file a complaint with us and/or with the United States Secretary of Health and Human Services if you believe we have violated your privacy rights. Complaints to both must be in writing, must describe the acts or omissions that are the subject of the complaint, and must be filed within 180 days of the time you became aware or should have become aware of the violation. We will not retallate against you if you file a complaint.

Complaints must be addressed to the attention of the practice's privacy officer at, the practice's address. The practice investigates each complaint and may, at its discretion, reply to you or your agent.

Complaints to the Secretary of the Department of Health and Human Services must be addressed in care of: Office for Civil Rights, U.S. Department of Health and Human Services, 233 N. Michigan Avenue, Suite 240, Chicago, Illinois 60601. Your complaint may be sent by FAX (312) 886-1807 or you may communicate by TDD (312) 353-5693.