Notice of Privacy Practices

1. Who This Notice Covers

This Notice applies to all protected health information ("PHI") we create or maintain about you in connection with the home health services we provide, including skilled nursing, home infusion therapy, medication management, personal care, and non-medical in-home support. It applies to every location from which we operate and to all of our nurses, caregivers, office staff, contractors, volunteers, and business associates, including the electronic health record system we use to document your care.

This Notice describes the privacy practices of All Hours Home Healthcare, LLC only. Any independently owned or franchised location that operates as a separate legal entity is responsible for its own privacy practices and will provide you with its own notice.

2. Our Legal Duties

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices regarding your PHI.
• Follow the terms of the Notice currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

3. How We May Use and Disclose Your Health Information Without Your Authorization

Treatment. We may use and disclose your PHI to provide, coordinate, or manage your health care. For example, we may share your records with a physician, specialist, pharmacy, or laboratory involved in your care.

Payment. We may use and disclose your PHI to bill and collect payment for services. For example, we may share information with your health plan to determine eligibility, obtain prior authorization, or submit claims.

Health Care Operations. We may use and disclose your PHI for activities necessary to run our organization, such as quality assessment and improvement, credentialing and peer review, training, care coordination, audits, compliance and legal services, and business planning.

Business Associates. We may disclose your PHI to vendors who perform services on our behalf, such as hosting, analytics, billing, or support providers. Each is required by written contract to safeguard your PHI and use it only for permitted purposes.

Appointment Reminders, Treatment Alternatives, and Health-Related Benefits. We may contact you about appointments, prescription refills, treatment options, or services that may be of interest to you, using the contact information you have provided.

Individuals Involved in Your Care. Unless you object, we may disclose relevant PHI to a family member, friend, personal representative, or other person you identify as involved in your care or payment for your care, and to disaster relief organizations for notification purposes.

As Required by Law. We will disclose PHI when federal, state, or local law requires it.

Public Health and Safety. We may disclose PHI for public health activities, including disease prevention and control, reporting births and deaths, adverse events and product recalls, and notifying persons exposed to a communicable disease.

Victims of Abuse, Neglect, or Domestic Violence. We may disclose PHI to appropriate government authorities as permitted or required by law.

Health Oversight Activities. We may disclose PHI to agencies conducting audits, investigations, inspections, licensure actions, or civil, administrative, or criminal proceedings.

Judicial and Administrative Proceedings. We may disclose PHI in response to a court or administrative order, or in response to a subpoena or discovery request where the required assurances of notice or a protective order have been satisfied.

Law Enforcement. We may disclose PHI to law enforcement officials for purposes permitted by law, such as responding to a court order or warrant, identifying or locating a suspect or missing person, or reporting a crime on our premises.

Decedents. We may disclose PHI to coroners, medical examiners, and funeral directors as necessary to carry out their duties.

Organ and Tissue Donation. We may disclose PHI to organizations that handle organ, eye, or tissue procurement or transplantation.

Research. We may use or disclose PHI for research approved by an Institutional Review Board or Privacy Board that has established protocols to protect your privacy, or as otherwise permitted by law.

Serious Threat to Health or Safety. We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or the public.

Specialized Government Functions. We may disclose PHI for military and veterans activities, national security and intelligence activities, protective services, and correctional institution or law enforcement custody purposes.

Workers' Compensation.We may disclose PHI as authorized by workers' compensation or similar programs.

Fundraising. We do not use or disclose your PHI for fundraising purposes.

4. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before:

• Using or disclosing psychotherapy notes, except as permitted by law.
• Using or disclosing PHI for marketing purposes where we receive financial remuneration from a third party.
• Engaging in any sale of PHI.
• Any other use or disclosure not described in this Notice.

You may revoke an authorization at any time, in writing, by contacting us at the address in Section 7. Revocation is effective when we receive it and does not apply to disclosures we already made in reliance on the authorization, or where the authorization was obtained as a condition of obtaining insurance coverage and other law gives the insurer the right to contest a claim.

5. Your Rights Regarding Your Health Information

Right to Access and Obtain a Copy. You have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set, including an electronic copy in the form and format you request if we can readily produce it. You may also direct us to transmit a copy to a person or entity you designate in a signed, written request. We will respond within 30 days of receiving your request and may extend once by 30 days with written notice. We may charge a reasonable, cost-based fee as permitted by law. In limited circumstances we may deny a request; certain denials are subject to review by a licensed health care professional not involved in the original decision.

Right to Request an Amendment. If you believe PHI we hold is inaccurate or incomplete, you may request in writing that we amend it, including your reason for the request. We will act within 60 days and may extend once by 30 days. If we deny the request, we will provide a written explanation and you may submit a statement of disagreement that will be included with the record.

Right to an Accounting of Disclosures. You have the right to receive a list of certain disclosures we made of your PHI in the six years prior to your request. The accounting excludes disclosures for treatment, payment, and health care operations, disclosures made to you or pursuant to your authorization, and certain other categories permitted by law. One accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests, and we will notify you of the cost in advance so you may withdraw or modify your request.

Right to Request Restrictions. You may request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to persons involved in your care. We are not required to agree to most restrictions, but if we do agree, we will honor it except in an emergency. We must agree to a request to withhold PHI from your health plan when the disclosure is for payment or health care operations, is not otherwise required by law, and the item or service has been paid for in full out of pocket by you or on your behalf.

Right to Request Confidential Communications. You may request that we communicate with you about health matters by a particular means or at a particular location — for example, by a specific email address or phone number. We will accommodate reasonable requests and will not ask you to explain the reason.

Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. A current copy is always available at https://allhours.myhealthcaresync.com/privacy.

Right to Breach Notification. You have the right to be notified if a breach of your unsecured PHI occurs.

Right to Choose Someone to Act for You. If you have given someone medical power of attorney, or if someone is your legal guardian or personal representative, that person can exercise these rights on your behalf. We will verify that the person has authority before we act.

How to Exercise Your Rights. Submit requests in writing to the contact in Section 7. We may ask you to complete a form and to verify your identity before responding.

6. Complaints and Non-Retaliation

If you believe your privacy rights have been violated, you may file a complaint with us at the contact in Section 7, or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201; 1-877-696-6775; https://www.hhs.gov/ocr/privacy/hipaa/complaints/. Complaints must generally be filed within 180 days of when you knew or should have known of the violation.

We will not retaliate against you in any way for filing a complaint or exercising any right described in this Notice.

7. Contact for Privacy Questions and Rights Requests

John Donovan, Privacy Officer
All Hours Home Healthcare, LLC
6 Essex Center Drive, Suite 107
Peabody, MA 01960
Email: privacy@AllHoursHomeHealth.com
Phone: 1-877-406-4245

8. More Protective State and Federal Laws

Some laws provide greater protection than HIPAA for certain categories of information — for example, substance use disorder treatment records (42 C.F.R. Part 2), HIV/AIDS status, mental health records, genetic information, and reproductive health information. Where a more protective law applies, we will follow it.

Because we serve patients in Massachusetts and New Hampshire, we also comply with applicable state requirements, including without limitation:

• M.G.L. c. 111, § 70E (Massachusetts Patients' Bill of Rights) — home health agencies are covered; required patient disclosures apply.
• M.G.L. c. 111, § 70F — HIV test results require specific written informed consent before disclosure; a general HIPAA authorization is not sufficient.
• M.G.L. c. 93H and 201 CMR 17.00 — Massachusetts breach notification and Written Information Security Program requirements.
• N.H. RSA 359-C:20 — New Hampshire breach notification, which runs on its own timeline separate from HIPAA's.
• Reporting duties for suspected abuse, neglect, or exploitation of elders and disabled persons in each state, which apply to our field staff.

9. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain as well as information we receive in the future. The current Notice will always be posted at https://allhours.myhealthcaresync.com/privacy with its effective date and version number shown at the top.

If we make a material change to this Notice, we will: (1) post the revised Notice with a new effective date and version number; (2) provide a copy to patients receiving services at the time of the change, at or before their next scheduled visit, and make a good faith effort to obtain written acknowledgment of receipt; (3) include the current Notice in the admission packet for all new patients; and (4) offer a paper copy to anyone who requests one, at no charge, by contacting us using the information in Section 7. Prior versions of this Notice are retained for at least six years and are available on request.