NOTICE OF PRIVACY PRACTICES

Gold Cross Services, Inc.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY

Effective Date: April 14, 2003
Revision Date: February 17, 2026

Your health information is personal, and Gold Cross Services is committed to protecting it.  We are required by law to maintain the privacy and confidentiality of individually identifiable protected health information (“PHI”). A Federal law often referred to as “HIPAA” requires us to provide you with a copy of this Notice of Privacy Practices (“Notice” or “NPP”), which describes our privacy practices and our legal duties with respect to PHI.  Under certain circumstances, we may also be required to notify you following a breach of unsecured PHI.

In general, you are afforded certain rights and choices with respect to your PHI, and we are permitted to use and disclose your PHI in certain situations. Below is a summary of these basic categories. More specific descriptions for each appears later in this document.

You have the right to:

-Receive a copy of your medical record (in paper or electronic format)

-Request that your medical record be corrected or amended

-Request confidential communications between you and us

-Place restrictions or limitations as to what information about you we share

-Obtain a list of those with whom we have shared your PHI

-Obtain a copy of this NPP (in paper or electronic form)

-Choose someone to act on your behalf

-File a complaint if you believe your Privacy rights have been violated.

You have certain choices in how we share your PHI (and restrict or limit such) including:

-Informing family and friends about your condition

-Enabling disaster relief

-Market our services and sell your information

-Fundraise

Ways in which we are permitted to use or disclose your PHI include:

-Provide treatment

-Bill (and receive payment for) such treatment

-Provide internal audits, training, and other healthcare operations

-Assist with public health and safety issues

-Perform research

-Comply with Federal and state laws

-Sharing information with medical examiner or funeral director (as applicable and necessary)

-Respond to workers compensation, law enforcement, and other governmental requests

-Respond to lawsuits, legal actions, or administrative investigations

Our responsibilities to you include:

-Maintain privacy and security of your PHI

-Notify you of a breach

-Adhere to the obligations outlined in this Notice

-Not share or disclose your information other than as described below (except if you give us permission otherwise)

-Consider state law restrictions that are more stringent than HIPAA

-Provide additional assurances to patients receiving Part 2  / SUD services

YOUR RIGHTS

Access Your Medical Record. You can ask to access/review or receive an electronic (or paper) copy of your medical record and other health information we have about you. Any such request should be made in writing to our Privacy Officer. We will provide a copy or a summary of your health information (or reasons why we are denying such a request) within 30 days of your request. We may charge a reasonable, cost-based fee for providing paper copies of your records.

Amend Your Medical Record. You can ask us to correct or amend health information contained within our medical record that you believe is incorrect or incomplete. Any such request should be made in writing to our Privacy Officer. We may refuse to make such an amendment, and will provide reasons within 60 days.

Choose Method of Communications. You can ask that we communicate to you in a certain way or at a certain address (e.g., work or home). We will generally be agreeable to all reasonable requests. Any such request should be made in writing to our Privacy Officer.

Restrict Use and Disclosure of Your PHI. To exercise this right, you must submit a written request to our Privacy Officer.  We are not required to agree to your request; however, if we do agree, we will put our agreement in writing, and will abide by that agreement exception to the extent the use or disclosure of such PHI is necessary to provide you treatment in an emergency.  Notwithstanding the foregoing, we must agree to a restriction on the use or disclosure of your PHI if: (i) the disclosure is for our payment or health care operations purposes and is not otherwise required by law and (ii) you or another person acting on your behalf has paid for our services in full.

Receive an Accounting of Disclosures. You can request access for a list of the times we’ve shared your health information with third parties for the 6-year period preceding your request. We are not required to provide you an accounting of disclosures: (i) made for our treatment, payment or health care operations purposes, (ii) made directly to you, your family or friends, (iii) made for national security purposes, to law enforcement or certain other governmental purposes.  If you request more than one accounting within a 12-month period, we may charge you a reasonable fee for each additional accounting.

Appoint a Representative. You can choose or otherwise designate someone to exercise your rights and make choices about your health information (e.g., a medical power of attorney (“POA”) or legal guardian).

Receive a Paper Copy of this Notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

File a Complaint. If you believe that your privacy rights have been violated, you may file a complaint with Gold Cross Services, Inc. or with Secretary of the Department of Health and Human Services (DHHS).  To file a complaint with us, please put your complaint in writing and mail it to the following address: Privacy Officer, Gold Cross Services, Inc. 1717 South Redwood Rd. Salt Lake City, UT. 84104. You may also contact our Privacy Officer by phone at: 801-975-4335.  To file a complaint with the DHHS, you must put your complaint in writing and mail it to: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201.  You will not be retaliated against or denied any health services if you elect to file a complaint.

YOUR CHOICES

For certain health information, you can choose what information we share. If you have a clear preference for how we share your information with family and friends related to your care, or in a disaster relief situation, let us know your preference and (if possible) we will follow your instructions.

If you are not able to tell us your preference (e.g., if you are unconscious) we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety (to yourself and/or others). Please note that we will never share your information (unless you give permission) for marketing or sale of your information.

We may use your PHI for certain fundraising activities. You have the right to elect to opt out of such fundraising communications and in no event will the provision of medical care be conditioned upon your willingness to receive fundraising communications.

You may revoke a previous written authorization in writing at any time.  If you elect to revoke a prior written authorization, we will immediately stop any further uses or disclosures of your PHI for the purposes set out in the written authorizations to the extent we have not already acted in reliance on your authorization; however, we will be unable to retract any disclosures previously made with your permission.

HOW WE USE OR DISCLOSURE YOUR PHI WITHOUT YOUR SPECIFIC AUTHORIZATION OR APPROVAL

Treatment.  We may use or disclose your PHI in connection with our treatment or transportation of you.  For example, we may disclose your PHI to doctors, nurses, technicians, medical students or any other health care professional involved in taking care of you.  We may also provide information about you to a hospital or dispatch center via radio, telephone or other electronic means.  We may provide a hospital or other health care facility with a copy of the medical records created by us in the course of treating or transporting you.

Payment.  We may use and disclose your medical information to obtain payment from you, an insurance company or other third parties.  For example, we may provide PHI to your health insurance plan in order to receive payment for our services.

Health care operations.  We may use and disclose your PHI for quality assurance activities, licensing and training programs to ensure that our personnel meet our standards for care, and to ensure that our personnel follow our established policies and procedures.  We may also use your information for obtaining legal, financial or accounting services, conducting business planning, processing complaints, and for the creation of reports that do not individually identify you.

Where permitted or required by law. Examples include, but are not limited to: 

• For public health activities, including disclosures to public health authorities authorized by law to collect information for the purpose of preventing or controlling disease, injury or disability, for reporting births and deaths, and for the conduct of public health investigations.  We may also be required by law to disclose information related to possible child abuse or neglect.
• To a social service or other protective services agency authorized by law to receive reports about victims of abuse, neglect or domestic violence.  We will make every effort to obtain your permission before releasing this information; however, in some cases, we may be required or authorized by law to act without your permission.
• For health oversight activities.
• For judicial and administrative proceedings, in response to a court order, subpoena, discovery request or other lawful process.
• For law enforcement purposes, including disclosures: (i) to comply with laws requiring the reporting of certain types of injuries, (ii) made pursuant to a court order, warrant, subpoena, grand jury subpoena or other lawful process, (iii) to assist law enforcement in identifying or locating a suspect, fugitive, material witness or missing person, (iv) about the victim of a crime, if, under the circumstances, we are unable to obtain your permission, (v) about a death we reasonably believe may be the result of a crime, (vi) about a crime committed on our premises, or (vii) to notify law enforcement of the commission of a crime, the location of a victim or to identify the perpetrator of a crime, but only in emergency situations.
• To coroners, medical examiners, funeral directors, organ procurement organizations, approved medical research projects.
• To avert a serious threat to health or safety.
• For military and veterans activities, national security and other specialized government functions.
• To comply with laws relating to workers’ compensation or similar programs.

OUR OBLIGATIONS TO YOU

Maintain Privacy and Security. HIPAA requires us, as a “covered entity” to maintain your PHI in a secure, confidential, and safe manner.

Notify You of a Breach. We will let you know if there is a breach of your PHI. A breach is anything that compromises the privacy or security of your health/medical information. We must notify you no later than 60 days following our discovery of such unauthorized use or disclosure (“breach”) and will contain a description of the breach (including the type of information involved, date of breach (if known), the date of the discovery of the breach), description of  steps you should take to protect yourself from potential harm resulting from the breach, a brief description of what we are doing to investigate the breach, to protect against future breaches, and to mitigate the harm to you and a way to contact us to ask questions or obtain additional information.

Honor this NPP.  We must follow the duties and privacy practices described in this NPP and give you a copy of it. You may choose to receive an electronic copy of this notice. Please note that we can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will only be provided to you in the event you receive medical care from us after the effective date of the new notice. Otherwise, the new notice will be available upon request, at our office, and posted on our website.

Respect your wishes.  We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

Respect State Laws. If there are state laws that are more restrictive or impose greater limits on disclosures, we will adhere to the more stringent state law requirements. 

NOTICE TO PART 2 / SUBSTANCE USE DISORDER (SUD) PATIENTS

Consistent with amendments to 45 CFR 164.520, this paragraph applies to any patients for which we receive and/or maintain any SUD records about you from a Part 2 provider governed by 42 USC 290dd-2. Disclosures of health information are specifically subject to and limited by any applicable stricter laws (including 42 CFR Part 2). We will only use your SUD records consistent with treatment, payment, and healthcare operations and will grant you the same rights concerning your records as described in this NPP. Additionally, if we receive SUD records about you from a Part 2 provider subject to certain limitations, we will honor such limitations and restrictions. Please note that your SUD records may be subject to redisclosure but only where permitted by HIPAA and/or Part 2. However, your SUD treatment records received by us from programs subject to Part 2 shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless: you provide written consent, or disclosure is required by a court order (which must be accompanied by a subpoena or other legal requirement compelling disclosure).  Finally, federal rules provide patients protections with respect to internal fundraising efforts we may conduct, we will provide you with a clear and conspicuous opportunity to allow you to opt-out of any fundraising communications from us.