I. This Notice describes how medical information about you may be used and disclosed to trading partners, business associates, and other covered entities, and how patients can get access to this information. The information in this Notice applies to the policies and practices of Medical Associates of Clinton, Iowa, P.L.C. (hereinafter referred to as "Medical Associates", "MA", or the "clinic") and to Gateway Surgery Center, L.L.C. (hereinafter referred to as "Gateway Surgery", or "GSC"). PLEASE REVIEW IT CAREFULLY.

II. Medical Associates and Gateway Surgery have a legal duty to guard Protected Health Information (PHI). Medical Associates and Gateway Surgery are legally required according to the Federal HIPAA law [PL104-191] enacted in 1996 to protect the privacy of health information. This information is called "Protected Health Information" or "PHI". PHI includes information that can be used to identify a patient based on a past, present or future health condition, the provision of healthcare to the patient, or the payment for this healthcare. MA and GSC are providing this Notice to patients no later than the date of first treatment or as soon as practical in case of emergency treatment on or after April 14th, 2003 as stated in the federal regulations. Our privacy practices explain how, when and why we use and disclose PHI. With some exceptions, we may not use or disclose any more PHI than is necessary to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this Notice.

Medical Associates and Gateway Surgery reserve the right to change the terms of this Notice and our privacy policies at any time. Any changes will apply to the PHI we already have. Before we make important changes to our policies, we will promptly change this Notice and post a new Notice at various locations in the clinic. You can also request a copy of this Notice from the contact person listed in Section VI below at any time.

III. How we may use and disclose Protected Health Information (PHI). Medical Associates and Gateway Surgery use and disclose health information for many reasons. These disclosures are further outlined in business associate contracts that MA and GSC have with trading partners or covered entities. Below we discuss the different categories of our uses and disclosures and give some examples.

A. We may use and disclose PHI for the following reasons documented in our agreements:

1. For treatment, and payment for treatment. MA and GSC use and disclose PHI related to services provided to patients by and on behalf of our providers. MA and GSC also forward information for insurance claims electronically and on paper to insurance payors and health plans for payment and forward patient billing information for collections.

2. For healthcare operations. MA and GSC use and disclose PHI on behalf of their providers to insurance payors defined in health plans and individual patients by forwarding responses regarding the status of insurance claims to other healthcare providers as well. PHI may be disclosed to healthcare providers, insurance companies, and other covered entities as part of the provider enrollment, payor requests and customer service operations of MA and GSC. MA and GSC will also use PHI when contacting you either by telephone or other means regarding appointments, reminders, and treatment options. MA and GSC may also provide PHI for peer review, audit activities etc. or to our legal counsel, consultants, and others in a manner compliant with the laws and regulations which govern us.

B. We may use and disclose PHI which is not documented in our agreements:

1. When a disclosure is required by federal, state or local law, judicial or administrative proceedings or law enforcement. For example, MA and GSC will make disclosures when the law requires that it report information to certain government agencies and law enforcement personnel or in a judicial or administrative proceeding.

2. For public health activities: In certain circumstances, MA and GSC may report information about births, deaths and various diseases to government officials in charge of collecting that information.

3. For health oversight activities: For example, MA and GSC will provide information to assist the government when it conducts an investigation or inspection of the healthcare provider, Medical Associates, or Gateway Surgery.

4. For research purposes: For example, MA and GSC may provide PHI in order to conduct medical research.

5. To avoid harm: In order to avoid a serious threat to the health or safety of a patient or the public, we may provide PHI to certain law enforcement staff or persons able to prevent or lessen such harm.

6. For specific government functions: MA and GSC may disclose PHI of military and veterans' staff in certain situations. MA and GSC may disclose PHI for national security purposes or the conduct of intelligence operations.

C. All other uses and disclosures which require written authorization: In any of the situations not described in Sections III.A. or III.B., MA and GSC will ask for written authorization before using or disclosing any PHI to business associates, trading partners, and other covered entities. This authorization can either be revoked in writing to stop any future uses and disclosures - to the extent that Medical Associates or Gateway Surgery have not taken any action relying on the original authorization.

IV. Rights regarding PHI. As a patient, business associate, or other covered entity, you have the following rights with respect to PHI:

A. The right to request limits on uses and disclosures of PHI. You have the right to ask MA or GSC in writing to limit how we use and disclose your PHI. MA and GSC will consider your request but are not legally required to accept it. If MA or GSC accepts your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.

B. The right to choose how we send PHI to you. You have the right to request in writing that we send information to you at an alternate address (physical or electronic or by any other means). We must agree to the request only as long we can easily provide it in the format requested by you.

C. The right to see and get copies of your PHI. In most cases, you have the right to look at or get copies (for a reasonable fee when indicated as posted at our HIM department) if paid in advance of your receiving the PHI that we have. If Medical Associates or Gateway Surgery do not have your PHI or knows who does, we can instruct you on how to get it. If a request has been made for PHI other than that already provided, you must make another request in writing. Medical Associates or Gateway Surgery will respond within 30 days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you in writing and explain your right to have the denial reviewed.

D. Total disclosures we have made: You have the right to get a list of instances in which we have disclosed your PHI, except for Treatment, Payments, and Operations for up to 6 years prior, (but after April 14, 2003). The list will not include the uses of disclosures that you have already consented to such as those made for payment or healthcare operations. The list will also not include uses and disclosures made for national security purposes to corrections or law enforcement personnel. MA and GSC allow a patient one accounting within a twelve month period at no charge. A reasonable fee as posted at HIM will be charged for any subsequent request of accounting of disclosures after the first free one in any twelve month period.

E. The right to amend protected health information: Medical Associates and Gateway Surgery allow an individual to request the practice amend the protected health information maintained in the medical record or the billing record without it being crossed over, deleted, or tampered with. MA and GSC will document all requests and respond to these requests in a timely fashion and inform the patient of their appeal rights when a request is denied in whole or in part. Generally, MA and GSC will act on a request for amendment no later than 60 days after receipt of such a request. If MA or GSC cannot act on the amendment within 60 days, we will extend the time for such action by 30 days and within the 60 day time limit provide the requestor with a written statement of the reasons for the delay and the date by which Medical Associates or Gateway Surgery will complete action on the request. Only one such extension will be allowed. If MA or GSC denies a request in whole or in part, MA or GSC will provide the requestor with a written denial. MA and GSC allow the patient to submit a written statement disagreeing with the denial of all or in part of the initial request. The patient statement must include the basis of the disagreement. MA and GSC limit the length of such statement of disagreement to one page. Medical Associates or Gateway Surgery will notify you when it accepts the request to amend the PHI maintained by Medical Associates or Gateway Surgery. The request must be in writing and should be marked Attention: Privacy Officer: Medical Associates OR Privacy Officer: Gateway Surgery Center, as the case may be.

F. The right to get this Notice by e-mail: You have the right to get a copy of this Notice by e-mail. Even if you agree to receive a Notice by e-mail, you also have the right to request a paper copy of this Notice.

V. How to complain about our privacy practices: If you think that Medical Associates or Gateway Surgery may have violated your privacy rights or you disagree with a decision we made about access to your PHI, you may file a complaint with the person listed in Item VI below. You also may send a written complaint to the Secretary of the Department of Health and Human Services, 200 Independence Ave. S.W., Washington, D.C. 20201. MA and GSC will take no retaliatory action against if you file a complaint about our privacy practices.

VI. Person to contact for information about this Notice or a complaint about privacy practices: If you have any questions about this Notice or complaints about our privacy practices or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact our Privacy Officer at Medical Associates OR Gateway Surgery Center.

VII. Effective date of this Notice: This Notice will go into effect April 14, 2003.