NOTICE OF PRIVACY PRACTICES
Effective Date April 14, 2003

UNIVERSITY OF PENNSYLVANIA SCHOOL OF DENTAL MEDICINE

THIS NOTICE DESCRIBES HOW DENTAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOU WILL BE ASKED TO ACKNOWLEDGE THAT YOU HAVE RECEIVED OUR NOTICE OF PRIVACY PRACTICES.

We understand that information about you and your health is very personal and therefore, we will strive to protect your privacy as required by law. We will only use and disclose your personal health information as allowed by applicable law.

We are committed to excellence in the provision of state-of-the-art health care services through the practice of patient care, education, and research. Therefore, as described below, your health information will be used to provide you care and may be used to educate health care professionals and for research. We train our staff and workforce to be sensitive about privacy and to respect the confidentiality of your personal health information.

We are required by law to maintain the privacy of our patients' personal health information and to provide patients with notice of our legal duties and privacy practices with respect to your personal health information. We are required to abide by the terms of this Notice of Privacy Practices so long as it remains in effect. We reserve the right to change the terms of this Notice of Privacy Practices as necessary and to make the new Notice of Privacy Practices effective for all personal health information maintained by us. You may receive a copy of any revised notice at any SDM registration area or on the Internet at http://www.dental.upenn.edu/npp/ or a copy may be obtained by mailing a request to:
Chief Privacy Officer; School of Dental Medicine; University of Pennsylvania; 240 South 40th Street; Philadelphia PA 19104.

The terms of this Notice of Privacy Practices apply to:

• All departments and units of the School of Dental Medicine (SDM), including the Dental Care Network (DCN).
• All employees, staff and other SDM personnel.
• Any healthcare professional we authorize to enter information into your dental chart.
• Any member of a volunteer group we allow to help you while you are in the SDM.

This Notice of Privacy Practices does not apply to care you receive in dentists' private offices.

USES AND DISCLOSURES OF YOUR PERSONAL HEALTH INFORMATION

The following categories detail the various ways in which we may use or disclose your personal health information. For each category of uses or disclosures we will give you illustrative examples. It should be noted that while not every use or disclosure will be listed, each of the ways we are permitted to use or disclose information will fall into one of the following categories.

Your Authorization. Except as outlined below, we will not use or disclose your personal health information for any purpose unless you have signed a form authorizing the use or disclosure. This form will describe what information will be disclosed, to whom, for what purpose, and when. You have the right to revoke that authorization in writing, except to the extent we have already relied upon it.

For Treatment. We may use dental information about you to provide you with dental treatment or services. We may disclose dental information about you to dentists, technicians, dental students, or other SDM personnel who are involved in taking care of you at the SDM. For example, a dentist treating you may need to know if you have diabetes because diabetes may slow the healing process. Different departments of the SDM also may share dental information about you in order to coordinate the care you need, such as prescriptions, lab work and x-rays. We also may disclose dental information about you to people outside the SDM who may be involved in your dental care after you leave the SDM, such as family members or others we use to provide services that are part of your care.

For Payment. We may use and disclose dental information about you so that the treatment and services you receive at the SDM may be billed to and payment may be collected from you, an insurance company or a third party. For example, we may need to give your dental plan information about treatment you received at the SDM so your health plan will pay us or reimburse you for the treatment. We may also tell your dental plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

For Healthcare Operations. We may use and disclose dental information about you for SDM operations. These uses and disclosures are necessary to run the SDM and make sure that all of our patients receive quality care. For example, we may use dental information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine dental information about many SDM patients to decide what additional services the SDM should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to dentists, technicians, dental students, and other SDM personnel for review and learning purposes. We may also combine the dental information we have with information from other clinics to compare how we are doing and see where we can make improvements in the care and services we offer. We will remove information that identifies you from this set of dental information so others may use it to study healthcare and healthcare delivery without learning who the specific patients are.

Appointment Reminders. We may use and disclose dental information to contact you as a reminder that you have an appointment for treatment or dental care at the SDM. The reminder may be by mail or as a telephone message.

Treatment Alternatives. We may use and disclose dental information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-Related Benefits and Services. We may use and disclose dental information to tell you about health-related benefits or services that may be of interest to you.

Fundraising Activities. We may use dental information about you to contact you in an effort to raise money for the SDM and its operations. We may disclose dental information to a foundation related to the SDM so that the foundation may contact you in raising money for the SDM. We only would release contact information, such as your name, address and phone number and the dates you received treatment or services at the SDM. If you do not want the SDM to contact you for fundraising efforts, you must notify the Patient Advocate in writing who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu..

Individuals Involved in Your Care or Payment for Your Care. We will only disclose information to a patient's guardian, representative with power of attorney, and to people the patient invites to physically accompany him or her. Information will be disclosed to this patient representative in the presence of the patient. In certain emergency situations it may not be possible to have the patient present, in which case the SDM may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the patient, and if so, disclose only information directly relevant to the person's involvement with the patient's health care or related payment.

Research. We may use and disclose your personal health information as permitted or required by law, for research, subject to your explicit authorization, and/or oversight by the University of Pennsylvania Institutional Review Boards, committees charged with protecting the privacy rights and safety of human subject research, or a similar committee. In all cases where your specific authorization has not been obtained, your privacy will be protected by confidentiality requirements evaluated by such committee. This is necessary to investigate cutting-edge health care through improved treatments, medications and outcomes research. For example, you may be approached by your dentist to ask if you would be interested in participating in a clinical trial of a new drug for your condition. Or, your health information may be used with the approval of the committee charged with protecting the rights of research subjects, described above, to conduct outcomes research to see if a particular procedure is effective.

Business Associates. Certain aspects and components of our services are performed through contracts with outside persons or organizations, such as auditing, accreditation, legal services, etc. At times it may be necessary for us to provide certain of your personal health information to one or more of these outside persons or organizations who assist us with our payment/billing activities and health care operations. In such cases, we require these business associates to appropriately safeguard the privacy of your information.

Other Uses and Disclosures. We are permitted or required by law to make certain other uses and disclosures of your personal health information without your consent or authorization. Subject to conditions specified by law:

• We may release your personal health information for any purpose required by law;
• We may release your personal health information for public health activities, such as required reporting of disease, injury, and birth and death, and for required public health investigations;
• We may release your personal health information to certain governmental agencies if we suspect child abuse or neglect; we may also release your personal health information to certain governmental agencies if we believe you to be a victim of abuse, neglect, or domestic violence;
• We may release your personal health information to entities regulated by the Food and Drug Administration if necessary to report adverse, product defects, or to participate in product recalls;
• We may release your personal health information to your employer when we have provided health care to you at the request of your employer for purposes related to occupational health and safety; in most cases you will receive notice that information is disclosed to your employer;
• We may release your personal health information if required by law to a government oversight agency conducting audits, investigations, inspections and related oversight functions;
• We may use or disclose your personal health information in emergency circumstances, such as to prevent a serious and imminent threat to a person or the public;
• We may release your personal health information if required to do so by a court or administrative order, subpoena or discovery request; in most cases you will have notice of such release;
• We may release your personal health information to law enforcement officials to identify or locate suspects, fugitives or witnesses, or victims of crime, or for other allowable law enforcement purposes;
• We may release your personal health information to coroners, medical examiners, and/or funeral directors;
• We may release your personal health information if necessary to arrange an organ or tissue donation from you or a transplant for you;
• We may release your personal health information if you are a member of the military for activities set out by certain military command authorities as required by armed forces services; we may also release your personal health information if necessary for national security, intelligence, or protective services activities; and
• We may release your personal health information if necessary for purposes related to your workers' compensation benefits.

Confidentiality of Alcohol and Drug Abuse Patient Records, HIV-Related Information, and Mental Health Records. The confidentiality of alcohol and drug abuse patient records, HIV-related information, and mental health records maintained by us is specifically protected by state and/or Federal law and regulations. Generally, we may not disclose such information unless you consent in writing, the disclosure is allowed by a court order, or in limited and regulated other circumstances.

RIGHTS THAT YOU HAVE

Access to Your Personal Health Information. Generally, you have the right to access, inspect, and/or copy personal health information that we maintain about you. Requests for access must be made in writing and be signed by you or your representative. We will charge you for a copy of your medical records in accordance with a schedule of fees established by applicable state law. You may obtain an access request form from the SDM Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu..

Amendments to Your Personal Health Information. You have the right to request that personal health information that we maintain about you be amended or corrected. We are not obligated to make all requested amendments but will give each request careful consideration. All amendment requests, in order to be considered by us, must be in writing, signed by you or your representative, and must state the reasons for the amendment/correction request. If an amendment or correction you request is made by us, we may also notify others who work with us and have copies of the uncorrected record if we believe that such notification is necessary. Please note that even if we accept your request, we may not delete any information already documented in your medical record. You may obtain an amendment request form from the SDM Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu.

Accounting for Disclosures of Your Personal Health Information. You have the right to receive an accounting of certain disclosures made by us of your personal health information after April 14, 2003 except for disclosures made for purposes of treatment, payment, and healthcare operations or for certain other limited exceptions. Requests must be made in writing and signed by you or your representative. Accounting request forms are available from the SDM Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu.. The first accounting in any 12-month period is free; you will be charged a fee for each subsequent accounting you request within the same 12-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Restrictions on Use and Disclosure of Your Personal Health Information. You have the right to request restrictions on certain of our uses and disclosures of your personal health information for treatment, payment, or health care operations. For example, you may request that we do not share your health information with a certain family member. A restriction request form can be obtained from the SDM Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu. We are not required to agree to your restriction request but will attempt to accommodate reasonable requests when appropriate and we retain the right to terminate an agreed-to restriction if we believe such termination is appropriate. In the event we have terminated an agreed upon restriction, we will notify you of such termination.

Confidential Communications. You have the right to request communications regarding your personal health information from us by alternative means or at alternative locations and we will accommodate reasonable requests by you. To request confidential communications, you must fill out the Request to Receive Confidential Communication by Alternative Means or at Alternative Locations Form and submit it to the Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu.

Paper Copy of Notice. As a patient you retain the right to obtain a paper copy of this Notice of Privacy Practices, even if you have requested such copy by e-mail or other electronic means. You may also obtain a copy of this notice via the Internet at http://www.dental.upenn.edu/npp/

ADDITIONAL INFORMATION

Complaints. If you believe your privacy rights have been violated, you may file a complaint with the SDM Patient Advocate who may be contacted at 215-573-4742 or through email at pat_adv@pobox.upenn.edu. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services in Washington D.C. All complaints must be made in writing and in no way will affect the quality of care you receive from us.

For further information. If you have questions or need further assistance regarding this Notice of Privacy Practices, you may contact the Chief Privacy Officer who may be contacted at 215-898-5343 or sdm_cpo@pobox.upenn.edu.