GRUTZMACHER & LEWIS, A MEDICAL CORPORATION
 
NOTICE OF PRIVACY PRACTICES
 
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
 
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION, PLEASE REVIEW IT CAREFULLY.
 
About Us
 
Grutzmacher & Lewis, A Medical Corporation is an Ophthalmology practice specializing in Cataract,
Cornea, Glaucoma and Refractive Surgery.
 
What is “Protected Health Information” or “PHI”?
 
“Protected health information,” or “PHI” for short, is information that identifies who you are and relates
to, your past, present, or future physical or mental health or condition, the provision of health care to
you, or past, present, or future payment for the provision of health care to you. PHI does not include
information about you that is publicly available, or that is in a summary form that does not identify who
you are. If you are an employee of our participating physician’s office, PHI does not include your health
information in your personnel file.
 
Purpose of this Notice
 
In the course of doing business, we gather and maintain PHI about our patients. We respect the privacy
of your PHI and understand the importance of keeping this information confidential and secure. This
Notice describes our privacy practices and how we protect the confidentiality of your PHI. We are
obligated to maintain the privacy of your PHI by implementing reasonable and appropriate safeguards.
We are also obligated to explain to you by this Notice about our legal obligations to maintain the privacy
of your PHI. We must follow our Notice that is currently in effect.
 
How We Protect Your PHI
 
We restrict access to your PHI to those employees who need access in order to provide services to our
patients. We have established and maintain appropriate physical, electronic and procedural safeguards to
protect your PHI against unauthorized use or disclosure. We have established a training program that our
employees must complete and update annually. We have also established a Privacy Office, which has
overall responsibility for developing, training and overseeing the implementation and enforcement of
policies and procedures to safeguard your PHI against inappropriate access, use and disclosure.
 
Types of Use and Disclosure of PHI We May Make Without Your Authorization
 
Treatment; Payment; Health Care Operations
Federal and state law allows us to use and disclose your PHI in order to provide health care services to
you, as well as to bill and collect payments for  the health care services provided to you by our
participating physicians. For example, we may use your PHI to authorize referrals to specialists and to
review the quality of care provided by your participating physician. We may disclose your PHI to health
plans or other responsible parties to receive payment for the  services provided to you by our
participating physicians.
 
We may also use or disclose your PHI, for example, to recommend to you treatment alternatives, to
inform you about health-related benefits and services that we offer, or to contact you to remind you of
your appointments. We conduct these activities to provide health care to you, and not as marketing.
 
Federal and state law also allows us to use and disclose your PHI as necessary in connection with our
health care operations. For example, we may use your PHI for resolution of any grievance or appeal that
you file if you are unhappy with the care you have received. We may also use your PHI in connection
with population-based disease management programs. We may use or disclose your PHI to perform
certain business functions to our business associates, who must also agree to safeguard your PHI as
required by law.
 
We are also allowed by law to use and disclose your PHI without your authorization for the following
purposes:
 
1.  When required by law – In some circumstances, we are required by federal or state laws to disclose
certain PHI to others, such as public agencies for various reasons;
2.  For public health activities – Such as reports about communicable diseases, defective medical
devices to the FDA or work-related health issues;
3.  Reports about child and other types of abuse or neglect, or domestic violence;
4.  For health oversight activities – Such as reports to governmental agencies that are responsible for
licensing physicians or other health care providers;
5.  For lawsuits and other legal disputes – In connection with court proceedings or proceedings before
administrative agencies, or to defend us or our participating physicians in a legal dispute;
6.  For law enforcement purposes –Such as responding to a warrant, or reporting a crime;
7.  Reports to coroners, medical examiners, or funeral directors – To assist them in performance of their
legal duties;
8.  For tissue or organ donations – To organ procurement or transplant organizations to assist them;
9.  For research – To medical researchers with an approval of an institutional review board (IRB) or
privacy board that oversees studies on human subjects. Researchers are also required to safeguard
your PHI;
10. To avert a serious threat to the health or safety of you or other members of the public;
11. For national security and intelligence/military activities – Such as protection of the President or
foreign dignitaries; and
12. In connection with services provided under workers’ compensation laws.
 
We may disclose your PHI, without your written authorization, to your family members or other persons
if they are involved in your care or payment for  that care. We may also  notify disaster relief
organizations to assist them with  their relief efforts. When you are a patient at a hospital or medical
facility with which we are affiliated, we may create a directory that includes your name, your location at
the facility, your general condition and your religious affiliation. Information in this directory may be
disclosed to visitors and clergy. However, we must first provide you with an opportunity to agree or
object to such disclosure. If you cannot agree or object  because you are incapacitated or otherwise
unavailable, we will use our professional judgment.

You, as a parent, can generally  control your minor child’s PHI.  In some cases, however, we are
permitted or even required by law to deny your access to your child’s PHI, such as when your child can
legally consent to medical services without your permission.
 
There are some types of PHI, such as HIV test results or mental health information, which are protected
by stricter laws. However, even such PHI may be used or disclosed without your written authorization if
required or permitted by law.
 
Authorizations
 
All other uses and disclosures of your PHI must be made with your written authorization.
 
If you need an authorization form, we will send you one for you or  your personal representative to
complete. When you receive the form, please fill it out and send it to the following address:
 
GRUTZMACHER & LEWIS, A MEDICAL CORPORATION
1515 RIVER PARK DRIVE, SUITE 100
SACRAMENTO, CA 95815
 
You may revoke or modify your authorization at any time by writing to us at the same address. Please
note that your revocation or modification may not be effective in some circumstances, such as when we
have already taken action relying on your authorization.
 
Your Rights Regarding Your PHI
 
Access to Your PHI

You have the right to review and copy your PHI we maintain. If you wish to have access to your PHI,
please write to us. We will respond to your request and tell you when and where you can review your
PHI in our possession within our normal business hours. If you would like a copy of the information we
have, please write to us at the same address. If we provide you with a copy, we may charge a reasonable
administrative fee for copying your PHI to the extent permitted by applicable law. If we deny your
request for review or copy of your PHI, we will explain the reason in writing. If we don’t have your
PHI, but know who does, we will tell you who to contact.
 
Right to Amend Your PHI

You have the right to request amendments to your PHI. If you wish  to have your PHI corrected or
updated, please write to us and tell us what you want changed and why. We will respond to you in
writing, either accepting or denying your request. If we deny your request, we will explain why. You
may also send us an addendum that is no longer than 250 words in length for each item you believe is
incorrect. Please clearly indicate that you want the addendum to be included in your PHI. We will attach
your addendum to the record(s) of your PHI. Your amended PHI will be available for your review upon
request.
 
Right to Receive an Accounting of Disclosures of Your PHI

You have the right to request an accounting of certain disclosures that we make of your PHI. You can
request an accounting by writing to us. Please note that certain disclosures, such as those made for
treatment, payment, or health care operations, need not be included in the accounting we provide to you.
We will respond to your request within a reasonable period of time, but no later than 60 days after we
receive your written request.
 
Right to Receive a Copy of This Notice

You have the right to request and receive a paper copy of this Notice. 
 
Right to Request Restrictions

You have the right to request restrictions on how we use and disclose your PHI for our treatment,
payment, and health care operations. All requests must be made in writing. Upon receipt, we will review
your request and notify you whether we have accepted or denied your request. Please note that we are
not required to accept your request for restrictions. Your PHI is critical for providing you with quality
health care. We believe we have taken appropriate  safeguards and internal restrictions to protect your
PHI, and that additional restrictions may be harmful to your care.
 
Right to Confidential Communications

You have the right to request that we provide your PHI  to you in a confidential manner. For example,
you may request that we send your PHI by an alternate means (e.g., sending by a sealed envelope, rather
than a post card) or to an alternate address (e.g., calling you at a different telephone number, or sending
a letter to you at your office address rather than your home address). We will accommodate any
reasonable requests, unless they are administratively too burdensome, or prohibited by law.
 
Right to Complain

We must follow the privacy practices set forth in this Notice while in effect. If you have any questions
about this Notice, wish to exercise your rights, or file a complaint; please direct your inquiries to:
 
GRUTZMACHER & LEWIS, A MEDICAL CORPORATION
1515 RIVER PARK DRIVE, SUITE 100
SACRAMENTO, CA 95815
 
You may contact your Health Plan or the California Department of Managed Care with your concerns as
well. You also have the right to directly complain  to the Secretary of the United States Department of
Health and Human Service. We will not retaliate against you for filing a complaint against us.
 
Rights Reserved 
 
We will use and disclose your PHI to the fullest extent authorized by law. We reserve the rights as
expressed in this Notice. We reserve the right to revise our privacy practices  consistent with law and
make them applicable to your entire PHI we maintain, regardless of when it was received or created. If
we make material or important changes to our privacy practices, we will promptly revise our Notice.
Unless the changes are required by law, we will not implement material changes to our privacy practices
before we revise our Notice. You may request updates to this Notice at any time. 
 
Effective Date
 
The effective date of this Notice is April 14, 2003.