1. Rocky Mountain Center for Reproductive Medicine Policy: RMCRM's Privacy Officer, Colleen Mortensen, is responsible for developing, approving and revising a Notice before distribution. In no event shall the Notice be combined in a single document with RMCRM's Authorization.

The Notice must comply with the requirements of 45 C.F.R. §164.520. For example, the Notice must adequately describe the Uses and Disclosures of PHI that may be made by the RCMRM, as well as the individual's rights and it's legal duties regarding PHI.

2. Distribution of the Notice. The Notice shall be distributed or otherwise made available as follows:

For "indirect service providers": Beginning on April 14, 2003, RMCRM must provide the Notice to each individual at or before the date of the first service delivery. For "direct service providers": Beginning on April 14, 2003, RMCRM must provide the Notice to each individual at or before the date of the first service delivery. RMCRM must make a good faith effort to obtain a written acknowledgment when the Notice is accepted by the individual or his/her legal representative. If a written acknowledgment cannot be obtained despite a good faith effort, RMCRM must document that attempt and the reason why a written acknowledgment could not be obtained (e.g., the patient refused). In an emergency situation, RMCRM need not attempt to obtain a written acknowledgment of an individual until it is practicable to do so.

3. Revisions to the Notice: Whenever there is a significant change to the Uses or Disclosures, individuals' rights, or the Physician Office's legal duties regarding PHI or the way RMCRM handles PHI, the Notice must be promptly revised, and the revised Notice must be posted and made available, but only as required in Sections 2(b), (c) and (d), above. RMCRM need not request a new written acknowledgment when providing a revised Notice. No significant change may be implemented before the effective date of the revised Notice if the change affects any term stated in the Notice, unless the change is due to a change in law. The Privacy Officer is responsible for determining whether a change in Uses or Disclosures, individuals' rights, RMCRM's legal duties or the way the RMCRM's handles PHI is significant or "material".

The original and each revised Notice must include a version number that consists of the month number, the day number and the year number on which the revised Notice becomes effective, followed by a decimal point, followed by the version's sequence number. For example, if the first Notice becomes effective on April 14, 2003, the version number will be 04142003.1. The version number must appear under the title of the Notice on the first page, and as a footer on each following page.

4. Documentation. A copy of each version of the Notice must be retained for as long as it is effective, and for at least six (6) years after it is no longer effective.

A. maintain the privacy of your health information, also known as "protected health information" or "PHI";

B. provide you with this Notice, and

C. comply with this Notice.

A. Uses and Disclosures for Treatment, Payment and Health Care Operations. We may use or disclose your PHI to provide treatment to you. For example, we may disclose your PHI to physicians, nurses, and other health care personnel who are involved in your care. We may also use and disclose your PHI to contact you as a reminder that you have an appointment for treatment at our office, to tell you about or recommend possible treatment options or alternatives, or about health-related benefits or services that may interest you.

We may also use or disclose your PHI for payment-related activities. For example, we may use or disclose your PHI to your insurance carrier in order to get paid for treatment provided to you. We may use your PHI to create the bills that we submit to the insurance company, or we may disclose certain portions of your PHI to our business associates who perform billing and claims processing services to us.

We may also use or disclose your PHI for business-related activities, such as to operate our office. For example, we may use your PHI to evaluate the quality of care you received from us, or to evaluate the performance of those involved with your care. We may also provide your PHI to our attorneys, accountants and other consultants to make sure we are complying with the laws that affect us. We may also use and disclose your PHI to contact you in connection with our fundraising efforts.

B. Uses and Disclosures That Require Us to Give You the Opportunity to Object. Unless you object, we may provide relevant portions of your PHI to a family member, friend or other person you indicate is involved in your health care or in helping you get payment for your health care. In an emergency or when you are not capable of agreeing or objecting to these disclosures, we will disclose PHI as we determine is in your best interest.

C. Certain Public Health and Other Government-Requested Uses and Disclosures. If you consent, the law allows us to disclose PHI without your further written authorization in the following circumstances:

In general, we may disclose a minor patient's PHI to a parent or guardian, but we may deny the parent's access to the minor patient's PHI in some situations.

For some types of PHI, there may be additional restrictions on our uses or disclosures described above. For example, drug and alcohol abuse patient treatment information, HIV test results, mental health information, and genetic testing results are given greater protections under Colorado laws. Such Colorado laws include the following examples: (i) uses and disclosures of PHI related to conception by artificial insemination (C.R.S. § 19-4-106); (ii) research activities involving records of alcohol or drug abuse patients and mental health patients (C.R.S. § 25-1-312) (C.R.S. § 25-1-1108) (C.R.S. § 27-10-120); (iii) disclosure of certain PHI to family members of mental health patients (C.R.S. § 27-10-120.5); (iv) certain public health disclosures related to quality management (C.R.S. § 25-3-109) or HIV information (C.R.S. § 25-4-1402.5) (C.R.S. § 25-4-1404) (C.R.S. § 25-4-1405) (C.R.S. § 25-4-1405.5) or misadministration of radionuclides (5 C.C.R. 1007-1, RH 7.13.1.2); (v) certain health oversight activities related to the long-term care ombudsman program (C.R.S. § 26-11.5-108); (vi) certain disclosures for judicial and administrative proceedings (C.R.S. § 13-90-107(g), (k)); (vii) certain disclosures for law enforcement and other activities (C.R.S. § 18-4-412); (viii) certain disclosures to avert a serious threat to health or safety (C.R.S. § 13-21-117); (ix) certain disclosures to correctional institutions (C.R.S. § 17-27.1-101(4)); (x) uses and disclosures of mental health information for education or training purposes (2 C.C.R. 502-1, 112.2 M) (3C.C.R. 721, Rule 9) (3 C.C.R. 726-1, Rule 9) (3 C.C.R. 731-1, Rule 10) (3 C.C.R. 736-1, Rule 9) (3 C.C.R. 737-1, Rule 9); and (xi) uses and disclosures of drug or alcohol abuse treatment patients (2 C.C.R. 502-1, 112.2 N).

A. The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask us to limit how we use and disclose your PHI, as long as you are not asking us to limit uses and disclosures that we are required or authorized to make to the Secretary of the federal Department of Health Services, related to our facility's patient directory, or any of the disclosures described in Section III, above. Any such request must be submitted in writing to, Colleen Mortensen, our Privacy Officer. We are not required to agree to your request. If we do agree, we will put it in writing and will abide by the agreement except when you require emergency treatment.

B. The Right to Choose How We Communicate With You. You have the right to ask that we send information to you at a specific address (for example, at work rather than at home) or in a specific manner (for example, by e-mail rather than by regular mail, or never by telephone). We must agree to your request as long as it would not be disruptive to our operations to do so. You must make any such request in writing, addressed to, Colleen Mortensen, our Privacy Officer.

C. The Right to See and Copy Your PHI. Except for limited circumstances, you may look at and copy your PHI if you ask in writing to do so. Any such request must be addressed to, Colleen Mortensen, our Privacy Officer. In certain situations we may deny your request, but if we do, we will tell you in writing of the reasons for the denial and explain your right to have the denial reviewed.

If you ask us to copy your PHI, we will charge you $14.00 for up to the first ten pages, and thereafter $0.50 per page. X-rays and similar test results will be charged to you at our cost. Alternatively, we may provide you with a summary or explanation of your PHI, as long as you agree to that and to the cost, in advance.

D. The Right to Correct or Update Your PHI. If you believe that the PHI we have about you is incomplete or incorrect, you may ask us to amend it. Any such request must be made in writing and must be addressed to, Colleen Mortensen, our Privacy Officer, and must tell us why you think the amendment is appropriate. We will not process your request if it is not in writing or does not tell us why you think the amendment is appropriate. We will inform you in writing as to whether the amendment will be made or denied. If we agree to make the amendment, we will ask you who else you would like us to notify of the amendment.

We may deny your request if you ask us to amend information that:

If we deny the requested amendment, we will tell you in writing how to submit a statement of disagreement or complaint, or to request inclusion of your original amendment request in your PHI.

E. The Right to Get a List of the Disclosures We Have Made. You have the right to get a list of instances in which we have disclosed your PHI. The list will not include, for example, disclosures we have made for our treatment, payment and health care operations purposes, or those made directly to you or your family or friends. Neither will the list include disclosures we have made with your written authorization, for national security purposes or to law enforcement personnel, disclosure of any limited data set, or disclosures made before April 14, 2003.

Your request for a list of disclosures must be made in writing and be addressed to, Colleen Mortensen, our Privacy Officer. The list we provide will include disclosures made within the last six years unless you specify a shorter period. The first list you request within a 12-month period will be free. You will be charged our costs for providing any additional lists within the 12-month period.