Privacy and HIPAA Policy

HIPAA INFORMATION

HIPAA is the Health Insurance Portability and Accountability Act of 1996, as amended. Under HIPAA and its accompanying regulations, we are required to maintain the privacy and security of your protected health information, or PHI. We must follow the duties and privacy practices described in the below Notice of Privacy Practices and give you a copy of it. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.

NOTICE OF PRIVACY PRACTICES

Effective Date: May 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by law to maintain the privacy and security of your Protected Health Information (“PHI”) and to provide you with notice of our legal duties and privacy practices with respect to PHI. References to “you” or “your” means the Resident. References to “we” and “our” include the Community and its affiliates and/or related entities. An affiliated covered entity is a group of organizations under common ownership or control who designate themselves as a single affiliated covered entity for purposes of compliance with the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). The Community, its employees, workforce members, and members of the Community's affiliated covered entity who are involved in providing and coordinating healthcare are bound to follow the terms of this Notice of Privacy Practices (“Notice”). For a complete list of the members of the Community's affiliated covered entity, or if you have any questions about this Notice, please contact the Community's Executive Director.

PHI is information that may identify you and that relates to your past, present, or future physical or mental health or condition, the provision of healthcare products and services to you, or payment for such services. This Notice describes how we may use and disclose PHI about you, as well as how you obtain access to such PHI. This Notice also describes your rights with respect to your PHI. We are required by HIPAA to provide this Notice to you.

We are required by law to abide by the terms of this Notice currently in effect. The Community is required to follow the terms of this Notice or any change to it that is in effect. We reserve the right to change our practices and this Notice to make the new Notice effective for all PHI that we maintain. If we do so, the updated Notice will be posted on our website. Upon request, we will provide a hard copy of the revised Notice to you.

We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.

We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

OUR USES AND DISCLOSURES OF YOUR PHI

The following categories describe the ways that we may use and disclose your PHI without your prior authorization. Not every permissible use or disclosure will be listed in this Notice. Note that some types of PHI, such as HIV information, genetic information, alcohol and/or substance abuse records, and mental health records may be subject to special confidentiality protections under applicable state or federal law and we will abide by these protections.

For Treatment—We can use your PHI for providing personal care, medication administration, and other assisted living services to you and can share your PHI with other professionals treating you. Example: A doctor treating you for an injury asks us for information related to your health.
For Payment—We use and share your PHI to bill and get paid by health plans or other payor parties. Example: We give information about you to your health insurance plan and to your representative so they can pay for your services.
For Healthcare Operations—We use and share your PHI to run our Community, improve your care, and contact you when necessary. Example: We may use information about you to review our services and evaluate the performance of our staff.

We may share your information without your written authorization in other ways—usually in ways that contribute to public good. We must meet many legal requirements to do this. This includes:

Help with public health and safety issues—We can share PHI about you in certain situations such as preventing disease, helping with product recalls, reporting adverse events related to medications, reporting suspected abuse, neglect, or domestic violence, or preventing or reducing a serious threat to anyone's health or safety.
Do research—We can use or share your information for health research.
Comply with the law—We will share your information with health oversight agencies if the law requires it, including with the Department of Health and Human Services if it wants to see that we're complying with federal privacy law.
Respond to organ and tissue donation requests—We can share PHI about you with organ procurement organizations.
Work with business associates—There are some services we provide through contracts with third parties who perform services on our behalf. These third-party service providers, referred to as Business Associates, may include medical directors, outside attorneys, billing services, and auditors. We may share your PHI with Business Associates so they can perform services for us.
Work with a medical examiner or funeral director—We can share PHI with a coroner, medical examiner, or funeral director when an individual dies.
Address workers' compensation, law enforcement, and other government requests—We can use or share PHI about you for workers' compensation claims, for law enforcement purposes or with a law enforcement official, for health oversight agencies for activities authorized by law, and certain special governmental functions (such as national security).
Respond to lawsuits and legal actions—We can share PHI about you in response to a court or administrative order, or in response to a subpoena.

Substance Use Disorder Records (42 CFR Part 2)

As of the Effective Date of this Notice, the Community does not operate a federally assisted substance use disorder (“SUD”) treatment program and does not receive or maintain SUD patient records subject to 42 CFR Part 2 (“Part 2”). If we ever receive or maintain such records in the future, we will handle them in accordance with Part 2, which provides greater privacy protections than HIPAA. In particular, Part 2 generally requires your written consent for use or disclosure of such records, and prohibits the use or disclosure of those records in any civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order accompanied by a subpoena or other compulsory legal process. Information that we disclose under HIPAA may be redisclosed by the recipient and may no longer be protected by federal privacy law.

YOUR RIGHTS

When it comes to your PHI, you have certain rights. This section explains your rights and some of our responsibilities to you.

Get an electronic or paper copy of your medical record.
- You can ask to see or get an electronic or paper copy of your medical record and other PHI we have about you. Ask us how to do this.
- We will provide a copy or summary of your PHI, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
- If we maintain your PHI electronically, you have the right to receive it in the electronic form and format you request, if it is readily producible in that form and format. If not, we will work with you on a readable alternative electronic format.
Ask us to correct your medical record.
- You can ask us to correct PHI about you that you think is incorrect or incomplete. Ask us how to do this.
- We may say “no” to your request, but we'll tell you why in writing within 60 days (with one possible 30-day extension). If we deny your request, you have the right to submit a written statement of disagreement, which we will include with your record.
Request confidential communications.
- You can ask us to contact you in a specific way (for example, home or office phone), or to send mail to a different address.
- We will say “yes” to all reasonable requests.
Ask us to limit what we use or share.
- You can ask us not to use or share certain PHI for treatment, payment, or our operations—We are not required to agree to your request, and we may say “no” if it would affect your care.
- If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer—We will say “yes” unless a law requires us to share that information.
Get a list of those with whom we've shared your information.
- You can ask for a list (accounting) of the times we've shared your PHI for six years prior to the date you ask, who we shared it with, and why.
- We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We'll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Get a copy of this privacy notice.
- You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.
Choose someone to act for you.
- If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.
- We will make sure the person has this authority and can act for you before we take any action.

You can ask us how to do each of these things.

YOUR CHOICES

For certain PHI, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations below, contact us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and the choice to tell us to:
- Share information with your family, close friends, or others involved in your care
- Share information in a disaster relief situation
- Include your information in our facility's directory.

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we never share your information unless you give us written permission:
- Most Marketing purposes
- Sale of your information
- Most sharing of psychotherapy notes
- Use or disclosure of genetic information for underwriting purposes

In the case of fundraising:
- We may contact you for fundraising efforts, but you can tell us not to contact you again.

If you provide us with a written authorization to release your information for any reason, you may later revoke that authorization to stop future disclosures at any time. Your revocation must be in writing. Your revocation will not affect any uses or disclosures we already made in reliance on your authorization.

CONCERNS, COMPLAINTS & REQUESTS

You can complain if you feel we have violated your rights by contacting us using the information in this Notice. If you are concerned that we have violated your privacy rights or if you disagree with or have questions about any decisions we have made regarding access or disclosure of your PHI, or if you have requests or questions, please contact:

convercent.com/report (type: “Community Hotline” in text field)

text 828-383-8220

You may also file a complaint with U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, DC 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

We will not retaliate against you for filing a complaint.

CHANGES TO THE TERMS OF THIS NOTICE

We can change the terms of this Notice, and the changes will apply to all information we have about you, including PHI received before the changes. The new Notice will be available upon request, posted prominently in our office, and on our website.

PRIVACY CONTACT

The privacy contact for the Community is:

Privacy Officer

828-322-5535