Gateway EDI, Inc.
Notice of Privacy Practices

1. This notice describes how trading partners, business associates and other covered entities’ patient health information may be used and disclosed and how they can get access to this information. Please review it carefully.

2. Gateway EDI has a legal duty to safeguard Protected Health Information (PHI).

   Gateway EDI is legally required to protect the privacy of health information. This information is called “protected health information,” or “PHI” for short, and it includes information that can be used to identify a patient that we received about a past, present, or future health or condition, the provision of health care to the patient, or the payment of this health care. We are providing this notice to trading partners, business associates and other covered entities about our privacy practices that explains how, when, and why we use and disclose PHI. With some exceptions, we may not use or disclose any more PHI than is necessary to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this notice.

   However, Gateway EDI reserves the right to change the terms of this notice and our privacy policies at any time. Any changes will apply to the PHI we already have. Before we make an important change to our policies, we will promptly change this notice and post a new notice on our web site at www.gatewayedi.com. You can also request a copy of this notice from the contact person listed in Section VI below at any time.

3. How we may use and disclose Protected Health Information.

   Gateway EDI uses and discloses health information for many different reasons. These disclosures are further outlined in the respective Trading Partner Agreement, Business Associate Contract, or Chain of Trust Partner Agreement. Below, we describe the different categories of our uses and disclosures and give some examples of each category.

   1. We may use and disclose PHI for the following reasons documented in our agreements:

      1. To obtain payment for treatment.
         Gateway EDI uses and discloses PHI on behalf of health care providers in order to forward insurance claims electronically and on paper for payment to insurance payers, and to electronically forward patient billing information for collections.
      2. To obtain payment for treatment.
         Gateway EDI uses and discloses PHI on behalf of health care providers in order to forward insurance claims electronically and on paper for payment to insurance payers, and to electronically forward patient billing information for collections.

   2. We may use and disclose PHI which are not documented in our agreements:

      1. When a disclosure is required by federal, state or local law, judicial or administrative proceedings, or law enforcement.
         For example, Gateway EDI will make disclosures when a law requires that we report information to government agencies and law enforcement personnel; or when ordered in a judicial or administrative proceeding.
      2. For public health activities.
         In certain circumstances, we may report information about births, deaths, and various diseases, to government officials in charge of collecting that information.
      3. For health oversight activities.
         For example, we will provide information to assist the government when it conducts an investigation or inspection of a health care provider or organization.
      4. For research purposes.
         For example, we may provide PHI in order to conduct medical research.
      5. To avoid harm.
         In order to avoid a serious threat to the health or safety of a person or the public, we may provide PHI to law enforcement personnel or persons able to prevent or lessen such harm.
      6. For specific government functions.
         Gateway EDI may disclose PHI of military personnel and veterans in certain situations. And we may disclose PHI for national security purposes or conducting intelligence operations.

   3. All other uses and disclosures require prior written authorization.

      In any other situation not described in sections IIIA or B above, Gateway EDI will ask for written authorization before using or disclosing any trading partners, business associates and other covered entities’ PHI. This authorization can later be revoked in writing to stop any future uses and disclosures - to the extent that Gateway EDI has not taken any action relying on the authorization.

4. Rights regarding PHI

   As a trading partner, business associate or other covered entity you have the following rights with respect to PHI:

   1. The right to request limits on uses and disclosures of PHI.
      You have the right to ask that Gateway EDI limit how we use and disclose your PHI. We will consider your request but are not legally required to accept it. If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.

   2. The right to choose how we sent PHI to you.
      You have the right to ask that we send information to you at an alternate address (physical or electronic) or by alternate means (regular mail or electronic). We must agree to your request so long as we can easily provide it in the format you requested.

   3. The right to see and get copies of your PHI.
      In most cases, you have the right to look at or get copies of your PHI that we have. If Gateway EDI does not have your PHI but know who does, we will tell you how to get it. If a request is made for PHI other than that already provided, you must make the request in writing. Gateway EDI will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you, in writing, our reasons for the denial and explain your right to have the denial reviewed.

   4. The right to get a list of the disclosures we have made.
      You have the right to get a list of instances in which we have disclosed your PHI. The list will not include uses or disclosures that you have already consented to, s uch as those made for payment or health care operations. The list also will not include uses and disclosures made for national security purposes, to corrections or law enforcement personnel, or before April 1, 2002.

   5. The right to get this notice by e-mail.
      You have the right to get a copy of this notice by e-mail. Even if you have agreed to receive notice via e-mail, you also have the right to request a paper copy of this notice.

5. How to complain about our privacy practices

   If you think that Gateway EDI may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you may file a complaint with the person listed in Section VI below. You also may send a written complaint to the Secretary of the Department of Health and Human Services at Region VII, Office for Civil Rights, U.S. Department of Health and Human Services, 601 East 12th Street, Room 248, Kansas City, MO 64106 or e-mail at OCRComplaint@hhs.gov or fax at 816/426-3686. We will take no retaliatory action against you if you file a complaint about our privacy practices.

6. Person to contact for information about this notice or to complain about our privacy practices.

   If you have any questions about this notice or any complaints about our privacy practices,
   or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact:

   Jim Bettendorf, Director of Compliance
   Gateway EDI, Inc.
   One Financial Plaza
   501 N. Broadway 3rd Floor
   St. Louis, MO 63102
   800/969-3666 x1213
   314/588-8641 (f)
   jbettendorf@gatewayedi.com

7. Effective date of this notice.

   This notice went into effect on April 1, 2002.

   --- Revised July 18, 2005 ---