HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Aging Gracefully Home Care LLC ("Aging Gracefully," "we," "us," or "our") is committed to protecting the privacy of your Protected Health Information ("PHI"). We are required by law to maintain the privacy of PHI, to provide you with this Notice of our legal duties and privacy practices regarding PHI, and to follow the terms of the Notice currently in effect.

This Notice applies to all PHI maintained by Aging Gracefully Home Care, whether received from you, your healthcare providers, your family, or any other source, and whether stored on paper or electronically.

1. What Is Protected Health Information?

Protected Health Information (PHI) is information about you, including basic demographic information, that may identify you and that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or the payment for healthcare services.

2. How We May Use and Disclose Your Protected Health Information

We may use and disclose your PHI for the following purposes without your specific authorization:

For Treatment

We may use your PHI to provide, coordinate, or manage your home care services. For example, we may share information with the caregivers assigned to your care, or with healthcare providers who participate in your treatment.

For Payment

We may use your PHI to obtain payment for the home care services we provide. This may include billing you, your insurance provider, Medicare, Medicaid, or other payers.

For Healthcare Operations

We may use your PHI for our healthcare operations, including:

• Quality assessment and improvement activities
• Caregiver training and competency evaluation
• Compliance and licensing reviews
• Audits, including those required by Louisiana HCBS regulations
• General administrative functions

Required by Law

We will use and disclose your PHI when required by federal, state, or local law, including:

• Reporting suspected abuse, neglect, or exploitation of vulnerable adults
• Reporting communicable diseases as required by Louisiana public health law
• Responding to subpoenas, court orders, or other lawful legal process
• Reporting to OIG/SAM, CMS, or other federal regulatory agencies

Public Health Activities

We may disclose your PHI for public health activities, such as preventing or controlling disease, injury, or disability.

Health Oversight Activities

We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, inspections, licensure, and disciplinary actions.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, or discovery request.

Law Enforcement

We may disclose your PHI to law enforcement when required by law or in response to a valid legal process.

To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of you, another person, or the public.

Workers' Compensation

We may disclose your PHI as authorized by and to the extent necessary to comply with Louisiana workers' compensation laws.

Family Members and Others Involved in Your Care

Unless you object, we may disclose to a family member, personal representative, or other person identified by you the PHI directly relevant to that person's involvement in your care or payment for your care.

Business Associates

We may share your PHI with business associates (such as billing services, scheduling platforms, or IT vendors) who provide services on our behalf. All business associates are required by contract to protect your PHI in accordance with HIPAA.

3. Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. Specifically, your written authorization is required for:

• Marketing communications (other than face-to-face communications or promotional gifts of nominal value)
• Sale of your PHI
• Most uses and disclosures of psychotherapy notes
• Other uses and disclosures not specifically permitted by this Notice or by law

You may revoke your authorization at any time in writing, except to the extent we have already acted in reliance on it.

4. Your Rights Regarding Your Protected Health Information

You have the following rights regarding your PHI:

Right to Access

You have the right to inspect and obtain a copy of your PHI, in most cases, including in electronic format if available. We may charge a reasonable, cost-based fee for copies. To request access, submit a written request to our office.

Right to Request Amendment

If you believe your PHI is incorrect or incomplete, you have the right to request that we amend it. We may deny your request under certain circumstances. If we deny your request, we will provide a written explanation.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your PHI in the six (6) years prior to your request. The first accounting in any 12-month period is free; additional requests within 12 months may be subject to a reasonable fee.

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request, except where you request that we not disclose PHI to a health plan for services that you have paid for in full out of pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a specific way or at a specific location (for example, only by mail, only at work). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

Right to Be Notified of a Breach

You have the right to be notified if we (or a business associate) experience a breach of your unsecured PHI.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

• Aging Gracefully Home Care's Privacy Officer (contact information below)
• The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) at:
  200 Independence Avenue, SW
  Washington, D.C. 20201
  Toll-free: 1-800-368-1019
  TDD: 1-800-537-7697
  Online: https://www.hhs.gov/hipaa/filing-a-complaint/

You will not be retaliated against for filing a complaint.

5. Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI
• Follow the terms of the Notice currently in effect

6. Changes to This Notice

We reserve the right to change this Notice and our privacy practices at any time. Any change will apply to PHI we already have as well as PHI we receive in the future. The new Notice will be available upon request, on our website, and posted in our office. The "Effective Date" at the top of this Notice reflects the most recent version.

7. Contact Our Privacy Officer

For questions about this Notice or to exercise any of your rights, contact our Privacy Officer:

Privacy Officer — Aging Gracefully Home Care LLC
9800 Airline Highway, Suite 241
Baton Rouge, LA 70816
Phone: (225) 244-6012
Email: info@aginggracefullycare.com