Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET THIS INFORMATION. PLEASE READ IT CAREFULLY.

This notice applies to Cone Health, an organized health care arrangement comprised of The Moses H. Cone Memorial Hospital Operating Corporation, Alamance Regional Medical Center, Inc. and other affiliated providers under common control with them, including without limitation Moses Cone Medical Services, Inc., Moses Cone Physician Services, Inc., Moses Cone Affiliated Physicians, Inc., and ARMC Physicians Care, Inc. (collectively, “Cone Health”). If applicable, the participants will share health information with others as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement. If you have any questions about this notice, please contact the Cone Health Compliance and Privacy Helpline at 1-855-809-3042 or submit a report at www.conehealth.ethicspoint.com.

The Purpose of This Notice

We are committed to protecting health information about you. We are required by law to make sure that health information that identifies you is kept private, make available to you this notice of our legal duties and privacy practices at Cone Health (hereafter referred to as the “health system”) with respect to health information about you, and follow the terms of the notice that is currently in effect.

Who Will Follow This Notice

This notice describes the practices of the health system at all its locations and the practices of:

• Any independent healthcare professional who is on our Medical Staff and allowed to enter information into your health system medical record.

• All practices, departments and units of the health system.

• Any member of a volunteer group we allow to help you while you are in the health system.

• All employees and staff.

• All students and trainees at the health system.

All these people, entities, sites and locations follow the terms of this notice. Also, these people, entities, sites and locations may share health information with each other to treat you, to be paid for treating you, or for health system operations purposes and the purposes described in this notice. The independent health care professionals who give care at the health system and who have agreed to follow the terms of this Notice may not be employees or agents of the health system, and the health system is not responsible for how they treat patients.

This notice applies to all of the records of your care and billing for care that are created at the health system, whether the records are made by health system personnel, your independent personal doctor, or other independent health care personnel. Your personal doctor or other independent health care personnel treating you may have different policies or notices about confidentiality and sharing of your health information that they use in their offices or other locations outside the health system.

How We May Use and Share Medical Information About You

The following categories describe different ways that we use and share health information. For each category of uses or sharing, we will explain what we mean and try to give some examples, but not every use or disclosure is listed. Where specific state or federal law requires your consent to share information, we will ask for your consent at admission, by acknowledgment of this Notice, or at a later time.

• For Treatment. We may use and share health information about you among the persons in the health system involved in your care to provide you with needed health treatment, items or services, such as prescriptions, lab work and surgery. We may use and share health information to tell you about different ways to treat you. We also may share health information about you to people outside the health system who may be involved in your medical care before or after you leave the health system, such as family members, other health care facilities, labs, home health agencies, or medical equipment companies.

• For Payment. We may need to use and share health information about you so that the treatment and services you get at the health system may be billed by the health system or other independent providers and payment may be collected from you, an insurance company or health plan, or a third party. For example, we may need to give your insurance company or health plan information about surgery you received at the health system so your insurance company or health plan will pay us or pay you back for the surgery. We also may share information about you with another health care provider, such as a receiving facility or your personal doctor, so that they can be paid for treating you.

• For Health Care Operations. Our staff and business associates may use and share health information about you for health system operations. These uses and sharing of information are needed to run the health system and make sure that all of our patients receive good quality care. For example, we may use health information to review our treatment and services and to evaluate the qualifications and performance of our staff and medical staff in caring for you. We also may combine health information about many health system patients to decide what other services the health system should offer, what services are not needed, and whether certain new treatments work. We also may share information with health system personnel, doctors and students for teaching purposes. We also may combine the health information we have about you and other patients with health information from other health systems to compare how we are doing and learn how we can make our care and services better. We may remove information that identifies you from this set of health information so others may use it to study health care and health care delivery without learning who you are. We may share your information with another health care provider for its health care operations if you also have received care from that provider.

• Treatment Alternatives. We may use and share health information to tell you about or recommend different ways to treat you.

• Triad HealthCare Network (THN). Cone Health is a participant in Triad HealthCare Network, LLC (“ACO”), which is an accountable health care organization made up of participating providers known as “ACO participants”. Through the ACO, our patient information is combined with that of other ACO participants so the ACO can perform certain functions on our behalves, such as care coordination and joint utilization and quality assurance activities. The ACO participants have also created an organized system of health care through the ACO that allows us to use and disclose patient information in our respective records systems for permitted treatment, payment, and health care operations purposes.

• Data Sharing. Cone Health may use and share health information with others for your healthcare treatment. For example, we may share your health information with your treating physician, other departments within Cone Health, or home health providers who provide care after you leave Cone Health. Your health information may be available to other healthcare providers through Care Everywhere, the NC HealthConnex, or other health information exchanges. If you do not want your electronic medical record to be available to other providers through Care Everywhere, contact Cone Health’s Health Information Management office to opt out of Care Everywhere. If you choose to opt out of Care Everywhere, other providers involved in your care will not be able to electronically obtain your full health information. Cone Health will be able to retrieve your health information from other providers, even if you opt out of Care Everywhere. You must contact other providers directly if you do not want those providers to share your information. Cone Health makes certain health information about you available through the North Carolina health information exchange, NC HealthConnex. You may prevent your health information from being available through NC HealthConnex by requesting to opt out. You can opt out online at https://hiea.nc.gov/patients.

• Fundraising Activities. We may use health information about you to contact you in an effort to raise money for the health system and its operations. Specifically, we may use information such as the unit or department from which you received services to target our fundraising efforts. For example, if we are raising money for women’s health services, we may send fundraising materials to people who have received women’s health care services from us in the past. We also may share health information with a business partner or a foundation related to the health system so that the business partner or foundation may contact you to raise money for the health system. We may only release limited information about you, such as your name, address and phone number, age and date of birth, gender, your physician, the part of the health system where you received your care, and the dates you received treatment or services at the health system. If you do not want the health system to contact you for all or certain types of fundraising efforts, you must notify the Office of Institutional Advancement at OptOutFundraising@conehealth.com, indicate your choice on the fundraising mailing you received or request the fundraising restriction during registration at a Cone Health registration area. If you have not done so already, we will ask you each time we contact you for fundraising efforts if you would like to opt out of receiving future fundraising communications. If you do opt out of future fundraising communications, we will not use or share your information for fundraising purposes, but we still may send you general fundraising communications that we send to the community that are not based on information from your treatment or stay at the health system. Your decision about whether or not to receive these communications from us will not affect your ability to get treatment at the health system. If you decide to opt out of some or all future fundraising communications, you may tell us later that you would like to receive these communications again.

• The Directory. Unless you object, we may include certain limited information about you in the health system directory while you are a patient at the health system. This information may include your name, location in the health system, your general condition (e.g., good, fair, serious, critical, etc.), and your religion. The directory information, except for your religion, may be given to people who ask for you by name or made available in press releases to the media. We can also share your religious affiliation with clergy affiliated with your faith, regardless of whether they ask for you by name. If you choose not to be listed in the directory, we will not be able to let your family, friends, clergy, or florists know that you are present at the health system. To opt out of being included in the directory, please inform the registration staff member during your registration at a Cone Health site.

• Individuals Involved in Your Care or Payment for Your Care. Unless you object, we may share health information about you with a friend or family member who is involved in your medical care. We also may share information with someone who helps pay for some or all of your care, such as other family members who are also insured under your insurance policy. We may share health information about you with a business assisting in a disaster relief effort so that your family can be told about your condition, status and location. You can object to the sharing of this information by telling us that you do not want any or all people involved in your care to get this information. If you are not present or cannot agree or object, we will decide whether it is in your best interest to share needed information with someone who is involved in your care or payment for your care or with a person or business assisting in a disaster relief effort.

• Research. Sometimes, we may use and share health information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who got one medication to those who got another for the same problem. Health information about you that has had identifying information removed may be used for research without your consent. We may share health information about you with people who are preparing for a research project, such as to help them look for patients with specific medical needs, so long as the medical information they review does not leave the health system. If the researcher will have information about your mental health treatment that reveals who you are, we will get your consent before we may share that information with the researcher. Unless we notify you in advance and you give us written permission, we will not receive any money or other thing of value when we use or share your health information for research, except for money to cover the costs of preparing and sending the information to the researcher.

• As Required or Permitted By Law. We will share health information about you when we have to or may do so under federal, state or local law. For example, North Carolina law requires that we report to state officials certain injuries to children or disabled adults.

• To Avert a Serious Threat to Health or Safety. We may use and share health information about you when we have to in order to prevent a serious threat to your health and safety or the health and safety of the public or another person. The information shared, however, would only be to someone able to help prevent the threat.

Special Situations

• Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye, or tissue transplantation to facilitate organ or tissue donation and transplantation.

• Workers’ Compensation. When you ask for workers’ compensation for a work related injury or illness, we may share, without your permission, health information about you to your employer, insurer, or care manager who is paying for your treatment for that work related injury or illness.

• Public Health Risks. We may share, without your permission, health information about you for public health activities. These activities generally include the reporting, prevention or control of disease, injury, or disability; to report births and deaths; to report suspected abuse or neglect as required by law; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; and to notify a person who may have been exposed to a disease or may be at risk for getting or spreading a disease or condition.

• Health Oversight Activities. We may share, without your permission, health information to a health oversight agency for activities imposed by law. These activities include audits, investigations, inspections, and licensure. They are necessary for the government to check on the health care system, government programs, and compliance with civil rights laws.

• Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose health information about you because of a court or administrative order. We also may disclose health information about you because of a subpoena or other lawful process by someone else involved in the dispute by disclosing your medical records or information under seal to the court. The parties to the case or their attorneys may not open the copies of your medical record under seal, unless a judge orders otherwise.

• Law Enforcement. We may give out your health information without your permission if asked to do so by a law enforcement official in response to a court order, grand jury demand or search warrant; about a death or injury we believe may be the result of a crime; if required by law to report a violent injury, such as a gunshot or stab wound or a poisoning; if a law enforcement official asks us for information to help locate a fugitive or suspect; or about suspected criminal conduct at the health system.

• Coroners, Medical Examiners and Funeral Directors. We may give out your health information to a coroner or medical examiner without your permission. This may be necessary, for example, to identify a deceased person or to figure out the cause of death. We also may give out health information about patients of the health system to funeral directors as needed to carry out their duties.

• Security, Intelligence Activities and Protective Services. We may give out your health information without your permission to authorized federal or state officials for intelligence, counterintelligence and other governmental activities imposed by law to protect our national security.

• Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we are required to give out health information without your permission to the correctional institution or law enforcement official who has custody of you if necessary for the health system to provide you with health care, to protect your health and safety or the health and safety of others, to obtain payment, or for operations of the health system.

• Behavioral Health Care. Regardless of the other parts of this Notice, any information about your treatment in a special unit, by a designated program or by medical personnel whose primary function is to diagnose, treat, or refer you for alcohol or drug abuse treatment, and psychotherapy notes, will not be disclosed outside the health system except with your written permission, because of a court order, or as required by law. Private notes that a licensed mental health professional has decided to make about a session with you, keep in his or her personal files, and label as psychotherapy notes will not be shared with other people working within the health system, except for training reasons or to defend a legal action brought against the health system, unless you have given permission in writing. Other information about mental health treatment you receive may be shared outside the health system without your permission to obtain payment for your care and to coordinate your care and treatment.

• Minors. Some state and federal laws require additional privacy protections health information. For example, some states give unemancipated minors the legal rights to consent to certain types of care and protects the privacy of those encounters, with specific exceptions.

Other Uses and Disclosures of Medical Information

All other information that is shared in a way not addressed in this notice, including uses or disclosures for marketing purposes, or disclosures of your information in exchange for some form of payment, will be made only after you give your written permission or as required by law. You may change your mind and take back your permission in writing at any time. We will stop sharing this information the day that your written request is

received by applicable location’s health information management office or the area where the record was created. We are unable to take back any disclosures we previously made with your permission.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we keep about you:

• Right to Look At and Copy. You have the right to look at and get a copy of health information that may be used to make decisions about your care, unless your treating physician decides that giving you such information would be harmful to your health or well being. When we do not allow you to look at and get a copy of your health information, you may ask that the denial be reviewed. Another licensed health care professional chosen by the health system will review your request and the denial. The person looking at the review will not be the person who denied your request. We will do what this reviewer decides.

If we have all or any part of your health information in an electronic format, you may ask for an electronic copy of the information or ask that we send an electronic copy to any person or entity you designate in writing.

Your health information is contained in records that belong to the health system. To look at or get a copy of health information that may be used to make decisions about you, you may request the records via phone, email or in writing from the applicable location’s health information management office or the area where the record was created. If you ask for a copy of the information, we may charge a fee for our services.

• Right to Amend. If you feel that health information we have about you is not right or is incomplete, you may ask us to change the information for as long as the information is kept by the health system. You must ask for this change in writing and send it to the applicable location’s health information management office or the area where the record was created. You must also give us your reasons for asking for the change.

We may decide to not make changes if you ask us to change information without providing your request in writing, or does not include a reason why you are asking for the change, or was made by a provider at a non Cone Health site (such as an inpatient or outpatient care center or a doctor, nurse, or pharmacist who is not an employee of the health system). If the information was made by a non health system provider, we usually can forward your request to that provider. If a doctor, nurse, or pharmacist is no longer available for you to ask for changes, then we can review your request with this in mind. We may also deny changes to information that is not part of the health information kept by the health system, is not part of the information which you would be allowed to see and copy, or has been found to be accurate and complete.

• Request an Accounting of Disclosures. You have the right to ask for a list of with whom we have shared your information over the last 6 years, known as an “accounting of disclosures”. This does not include disclosures made to those involved in for treatment, payment, health care operations or disclosures that you gave your consent to share. You must ask for this list in writing from the applicable location’s health information management office or the area where the record was created. You must state a time period that may not be longer than six years before the date of the request. You can get an accounting of disclosures at no charge every 12 months; after that, there may be a fee. In most cases, we will send the accounting of disclosures within 60 days. If we need an extra 30 days, we will let you know.

• Right to Request Restrictions. Except where we are required to disclose information by law, you have the right to ask us not to share or to limit the health information we use or share about you for treatment, payment, or health care operations. For example, do you want to limit sharing information with others involved in your care, such as a family member or friend? We are not required to agree to your request, except if you ask us to not disclose your health information to your health plan by paying for the services out of pocket and in full (note this does affect our ability to share your health information for treatment). If we do agree, we will act on your request unless the information is needed to give you emergency treatment or to share information as required by law. You must make your request in writing and send it to the applicable location’s Health Information Management office or the area where the record was created. In your request, you must tell us what information you want to limit and who you want the limits to apply to.

• Right to Ask for a Different Type of Communication. You have the right to ask that we tell you about medical matters in a certain way or at a certain place. For example, you can ask that we only contact you at work or by mail, or at a mailing address other than your home address. During the registration process, you may request your communication preference by stating how or where you wish to be contacted. We will not ask you the reason for your request. We will accommodate all reasonable requests.