THE OSBORN AND OSBORN HOME CARE, INC.

Privacy Notice

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

INTRODUCTION

The Osborn & Osborn Home Care, Inc. (“Osborn/OHC”) understands that your medical information is private and confidential. Further, we are required by law to maintain the privacy of “protected health information.” “Protected health information” includes any individually identifiable information that we obtain from you or others that relates to your past, present or future physical or mental health, the health care you have received or payment for your health care.

As required by law, this notice provides you with information about your rights and our legal duties and privacy practices with respect to the privacy of protected health information. This notice also discusses the uses and disclosures we will make of your protected health information. We must comply with the provisions of this notice as currently in effect, although we reserve the right to change the terms of this notice from time to time and to make the revised notice effective for all protected health information we maintain. You can always request a written copy of our most current privacy notice from the program’s Department Head or you can access it on our website at www.theosborn.org .

PERMITTED USES AND DISCLOSURES

We can use or disclose your protected health information for purposes of treatment, payment and health care operations. For each of these categories of uses and disclosures, we have provided a description and an example below. However, not every particular use or disclosure in every category will be listed.

1. Treatment means the provision, coordination or management of your health care, including consultations between health care providers relating to your care and referrals for health care from one health care provider to another. For example, a doctor treating you for an injury may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to contact a physical therapist to create the exercise regimen appropriate for your treatment.

2. Payment means the activities we undertake to obtain reimbursement for the health care provided to you, including billing, collections, claims management, determinations of eligibility and coverage and other utilization review activities. For example, prior to providing health care services, we may need to provide information to your Third Party Payer about your medical condition to determine whether the proposed course of treatment will be covered. When we subsequently bill the Third Party Payer for the services rendered to you, we can provide the Third Party Payer with information regarding your care if necessary to obtain payment. Federal or State law may require us to obtain a written release from you prior to disclosing certain specially protected health information for payment purposes, and we will ask you to sign a release when necessary under applicable law.

3. Health care operations means the support functions of The Osborn / OHC that are related to treatment and payment, such as quality assurance activities, case management, receiving and responding to resident comments and complaints, physician reviews, compliance programs, audits, business planning, development, management and administrative activities. For example, we may use your protected health information to evaluate the performance of our staff when caring for you. We may also combine health information about many residents to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students and others for review and learning purposes. In addition, we may remove information that identifies you from your resident information so that others can use the de-identified information to study health care and health care delivery without learning who you are.

We will make a reasonable effort to limit protected health information to the minimum necessary to accomplish the intended purpose of use,

disclosure or request.

OTHER USES AND DISCLOSURES OF

PROTECTED HEALTH INFORMATION

In addition to using and disclosing your information for treatment, payment and health care operations, we may use your protected health information in the following ways:

1. We may contact you to provide appointment reminders for treatment or medical care.

2. We may contact you to tell you about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you.

3. We may disclose to your family or friends or any other individual identified by you protected health information directly related to such person’s involvement in your care or the payment for your care. We may use or disclose your protected health information to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for your care, of your location, general condition or death. If you are present or otherwise available, we will give you an opportunity to object to these disclosures, and we will not make these disclosures if you object. If you are not present or otherwise available, we will determine whether a disclosure to your family or friends is in your best interest taking into account the circumstances and based upon our professional judgment.

4. We may include certain limited information about you in The Osborn / OHC directory while you are receiving services from The Osborn / OHC. This information may include your name, location in the facility, your telephone number and your religious affiliation. This will allow your family, friends, and clergy to visit you in the Facility. The directory information, may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. You may request that your information not be listed in the directory.

5. When permitted by law, we may coordinate our uses and disclosures of protected health information with public or private entities authorized by law or by charter to assist in disaster relief efforts.

6. We will allow your family and friends to act on your behalf to pick-up filled prescriptions, medical supplies, X-rays, and similar forms of protected health information, when we determine, in our professional judgment that it is in your best interest to make such disclosures.

7. Subject to applicable law, we may make incidental uses and disclosures of protected health information. Incidental uses and disclosures are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.

8. We may contact you as part of our fund-raising and marketing efforts as permitted by applicable law; you have the right to opt-out of such communication.

9. We may use or disclose your protected health information for research purposes, subject to the requirements of applicable law. For example, a research project may involve comparisons of the health and recovery of all residents who received a particular medication. All research projects are subject to a special approval process which balances research needs with a resident’s need for privacy. When required, we will obtain a written authorization from you prior to using your health information for research .

10. We will use or disclose protected health information about you when required to do so by applicable law.

[Note: In accordance with applicable law, we may disclose your protected health information to your employer if we are retained to conduct an evaluation relating to medical surveillance of your workplace or to evaluate whether you have a work-related illness or injury. You will be notified of these disclosures by your employer or The Osborn / OHC as required by applicable law.]

11. We are required to provide you with information if we intend to disclose protected health information to the sponsor of the health plan.

12. We may use and disclose your medical information, without your permission for underwriting and premium rating our risk for health coverage, and obtaining stop-loss and similar reinsurance for our health coverage obligations; to the extent we do so, we are prohibited from using or disclosing protected health information that is your genetic information for such purposes.

SPECIAL SITUATIONS

Subject to the requirements of applicable law, we will make the following uses and disclosures of your protected health information.

1. Organ and Tissue Donation. If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

2. Military and Veterans. If you are a member of the Armed Forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.

3. Worker’s Compensation. We may release health information about you for programs that provide benefits for work-related injuries or illnesses.

4. Public Health Activities. We may disclose health information about you for public health activities, including disclosures:

(a) to prevent or control disease, injury or disability;

(b) to report births and deaths;

(d) to persons subject to the jurisdiction of the Food and Drug Administration (FDA) for activities related to the quality, safety, or effectiveness of FDA-regulated products or services and to report reactions to medications or problems with products;

(e) to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;

(f) to notify the appropriate government authority if we believe that an adult resident has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if the resident agrees or when required or authorized by law.

5. Health Oversight Activities. We may disclose health information to Federal or State agencies that oversee our activities. These activities are necessary for the government to monitor the health care system, government benefit programs, and compliance with civil rights laws or regulatory program standards.

6. Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if The Osborn / OHC is given assurances that efforts have been made by the person making the request to tell you about the request or to obtain an order protecting the information requested.

7. Law Enforcement. We may release health information if asked to do so by a law enforcement official:

(a) In response to a court order, subpoena, warrant, summons or similar process;

(b) To identify or locate a suspect, fugitive, material witness, or missing person;

(d) About a death we believe may be the result of criminal conduct;

(e) About criminal conduct on our premises; and

(f) In emergency circumstances, to report a crime, the location of the crime or the victims, or the identity, description or location of the person who committed the crime.

8. Coroners, Medical Examiners and Funeral Directors. We may release health information to a coroner or medical Examiner. Such disclosures may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information about residents to funeral directors as necessary to carry out their duties.

9. National Security and Intelligence Activities. We may release health information about you to authorized Federal officials for intelligence, counterintelligence, or other national security activities authorized by law.

10. Protective Services for the President and Others. We may disclose health information about you to authorized Federal officials so they may provide protection to the President or other authorized persons or foreign heads of state or may conduct special investigations.

11. Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

12. Serious Threats. As permitted by applicable law and standards of ethical conduct, we may use and disclose protected health information if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.

Note: HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records and other specially protected health information may enjoy certain special confidentiality protections under applicable State and Federal law. Any disclosures of these types of records will be subject to these special protections.

13. Uses and Disclosures Requiring Authorization. Use and disclosure of PHI for psychotherapy notes, uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI require a separate authorization.

OTHER USES OF YOUR HEALTH INFORMATION

Other uses and disclosures of protected health information not covered by this notice or the laws that apply to us will be made only with your permission in a written authorization. You have the right to revoke that authorization at any time, provided that the revocation is in writing, except to the extent that we already have taken action in reliance on your authorization.

Osborn/OHC employees are prohibited from posting any content of resident PHI on any social media site. Employees are to ensure that their social media activity does not interfere with their work commitments. Internet access and use is a privilege and must be carried out in a manner that is consistent with job responsibilities and human resources policies addressing appropriate use of scheduled work time and resources. At no time will employees utilize personal or professional social media to share confidential resident protected health information. The inappropriate use of social media by employees that conflicts with The Osborn mission and values, that violates policies and procedures and/or compromises the privacy and security of confidential resident protected health information shall be subject to corrective action, up to and including termination. In addition, breach of PHI may also be subject to legal proceedings and/or criminal federal and state charges. All uses and disclosures of resident identifiable health information shall be carried out in a manner compliant with resident privacy policies, regulations and standards. (Social media sites to include but are not limited to facebook, blogs, twitter, bulletin blogs, networks, multi-media and new media sites, and any social media sites yet to be developed).

YOUR RIGHTS

1. You have the right to request restrictions on our uses and disclosures of protected health information for treatment, payment and health care operations. However, we are not required to agree to your request. To request a restriction, you must make your request in writing to the program Department Head.

2. You have the right to reasonably request to receive confidential communications of protected health information by alternative means or at alternative locations. To make such a request, you must submit your request in writing to the program Department Head.

3. You have the right to inspect and copy the protected health information contained in your medical and billing records and in any other Facility records used by us to make decisions about you, except:

(a) for psychotherapy notes, which are notes that have been recorded by a mental health professional documenting or analyzing the contents of conversations during a private counseling session or a group, joint or family counseling session and that have been separated from the rest of your medical record;

(b) for information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;

(d) if you are a prison inmate, obtaining a copy of your information may be restricted if it would jeopardize your health, safety, security, custody, or rehabilitation or that of other inmates, or the safety of any officer, employee, or other person at the correctional institution or person responsible for transporting you;

(e) if we obtained or created protected health information as part of a research study, your access to the health information may be restricted for as long as the research is in progress, provided that you agreed to the temporary denial of access when consenting to participate in the research;

(f) for protected health information contained in records kept by a Federal agency or contractor when your access is restricted by law; and

(g) for protected health information obtained from someone other than us under a promise of confidentiality when the access requested would be reasonably likely to reveal the source of the information.

In order to inspect and copy your health information, you must submit your request in writing to the program Department Head at our facility. If you request a copy of your health information, we may charge you a fee for the costs of copying and mailing your records, as well as other costs associated with your request.

We may also deny a request for access to protected health information if:

(i) a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger your life or physical safety or that of another person;

(ii) the protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or

(iii) the request for access is made by the individual’s personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to you or another person.

If we deny a request for access for any of the three reasons described above, then you have the right to have our denial reviewed in accordance with the requirements of applicable law.

4. You have the right to request an amendment to your protected health information, but we may deny your request for amendment, if we determine that the protected health information or record that is the subject of the request:

(a) was not created by us, unless you provide a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment;

(b) is not part of your medical or billing records or other records used to make decisions about you;

(d) is accurate and complete.

In any event, any agreed upon amendment will be included as an addition to, and not a replacement of, already existing records. In order to request an amendment to your health information, you must submit your request in writing to the program Department Head, along with a description of the reason for your request.

5. You have the right to receive an accounting of disclosures of protected health information made by us to individuals or entities other than to you for the six prior years, except for disclosures:

(a) to carry out treatment, payment and health care operations as provided above;

(b) incident to a use or disclosure otherwise permitted or required by applicable law;

(d) for The Osborn / OHC’s directory or to persons involved in your care or for other notification purposes as provided by law;

(e) for national security or intelligence purposes as provided by law;

(f) to correctional institutions or law enforcement officials as provided by law;

(g) as part of a limited data set as provided by law; or

(h) that occurred prior to April 14, 2003.

To request an accounting of disclosures of your health information, you must submit your request in writing to the program Department Head. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

6. You have the right to be notified of any breaches of your unsecured PHI.

7. You have the right to request a restriction on certain disclosure to your health plan if the disclosure is purely for carrying out payment or health care operations and the requested restriction is for services paid in full out-of-pocket.

WEBSITE PRIVACY POLICY

The Osborn (“Community”, “We”, “Us”) respects your privacy and is committed to protecting it through our compliance with the following Privacy Policy. This policy describes:

1. The types of information we may collect from you or that you may provide when you visit our website (www.theosborn.org; “website”) or via email, text or other electronic messages between you and the Community.

2. Our practices for collecting, using, maintaining, protecting and disclosing that information.

3. Our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your only recourse is not to use our website. However, you do have the option to opt-out of some tracking (see: “Choices About How We Use and Disclose Your Information”).

By accessing or using the website, you agree to this privacy policy.

INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

We collect several types of information from and about users of our website, including information:

1. That is about you but individually does not identify you, such as your age, gender and interests; how you came to the website (e.g., search engine, third-party website, media campaign or email); and the pages and features of the website you use.

2. By which you may be personally identified, such as name, postal address, email address or telephone number (“personal information”).

3. About your Internet connection, the equipment you use to access our website, and your location.

We collect this information:

1. Automatically as you navigate through the site. Information collected automatically may include IP addresses and information collected through cookies, Web beacons and other tracking technologies (see: “Usage Details, IP Addresses and Cookies and Other Technologies”).

2. Directly from you when you provide it to us (see: “Information You Provide to Us”).

3. From third parties, for example, our business partners.

USAGE DETAILS, IP ADDRESSES, AND COOKIES AND OTHER TECHNOLOGIES

As you navigate through and interact with our website, we may automatically collect certain information about your equipment, browsing actions and patterns. The information we collect automatically is statistical data and does not identify any individual. It helps us improve our website and deliver better and more personalized future services by enabling us to:

1. Estimate our audience size and usage patterns.

2. Analyze and develop the Community’s sales and marketing strategy, determine how visitors find the Community and its website, the user’s interest regarding the Community’s services, and how to improve the Community’s website.

3. Store information about your preferences, allowing us to customize our website according to your individual interests.

4. Speed up your searches.

5. Recognize you when you return to our website.

We do not collect personal Information automatically, but we may tie this information to personal information about you that we collect from other sources or that you provide to us. The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). Cookies are a technology of Web browser software that allows Web servers to recognize the computer used to access a website. A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website.

Flash Cookies. Certain features of our website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from and on our website. Flash cookies are not managed by the same browser settings used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see “Choices About How We Use and Disclose Your Information.”

INFORMATION YOU PROVIDE TO US

The information we collect on or through our website may include:

1. Information that you provide by filling in forms on our website. This includes, but is not limited to, information provided when you submit a request for information or to be contacted by the Community; a request for materials from the Community (e.g., DVDs, white papers and brochures); registering for an event; or subscribing to email communication.

2. Records and copies of your correspondence (including e-mail addresses), if you contact us.

3. Your responses to surveys that we might ask you to complete for research purposes.

4. Details of transactions you carry out through our website and of the fulfillment of your orders.

5. Your search queries on the Site.

HOW WE USE YOUR INFORMATION

The Community and/or its agents use information that we collect about you or that you provide to us, including any personal information:

1. To provide you with information, products or services that you request from us.

2. To fulfill any other purpose for which you provide it.

3. For marketing purposes.

4. To present our website and its contents to you.

5. To allow you to participate in interactive features on our website.

6. In any other way we may describe when you provide the information.

7. For any other purpose with your consent.

We never sell your personal information.

CHOICES ABOUT HOW WE USE AND DISCLOSE YOUR INFORMATION

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe’s website. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.

This website uses Google Analytics to track website activity and visitor behavior. If you want to opt-out of being tracked by Google Analytics, you may use the Google Analytics Opt-out Browser Add-on. Google Analytics also collects data about visits to the website via the DoubleClick cookie and Floodlight tags. This information is being used to provide demographic and interest data about visitors to the website and to target online display advertisements on third-party websites. Using Google’s Ads Settings, visitors can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads.

Promotional Offers from the Community. If you do not wish to have your contact information used by the Company to promote our own services, you can follow the link to unsubscribe from mailing lists at the bottom of email communication; send an e-mail to contact@theosborn.org stating your request; call 914-925-8205 and ask to be removed from marketing lists. This opt-out does not apply to information provided to the Community as a result of entering into a residence agreement, providing health records or other transaction.

ACCESSING AND CORRECTING YOUR INFORMATION

To review and change your personal information, you may call us at 914-925-8205 or send us an e-mail at contact@theosborn.org to request access to, correct or delete any personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

DATA SECURITY

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure. All information you provide to us is stored on our secure servers behind firewalls.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the website.

MINORS

No portion of The Osborn’s website, services and agency services is directed towards minors (individuals below the age of 18). The company does not solicit any information about minors, nor does it market to minors.

COMPLAINTS

If you believe that your privacy rights have been violated, you should immediately contact our Privacy Officer at 914-925-8252 at the Facility. We will not take action against you for filing a complaint. You also may file a complaint with the Secretary of Health and Human Services.

CONTACT PERSON

If you have any questions or would like further information about this notice, please contact the Privacy Officer at 914-925-8252.

This notice is effective as of June 2013.

This notice was reviewed and revised as of June 2016.