ASHLEY CLINIC, LLC, ASHLEY PHARMACY, INC. AND HUMBOLDT PHARMACY NOTICE OF PRIVACY PRACTICES FOR PROTECTED HEALTH INFORMATION Effective Date: April 14, 2003

This notice describes how information about you may be used and disclosed and how you can gain access to this information. Please review it carefully.

Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy are committed to protecting the confidentiality and security of our records containing information about you. Typically, this record may contain your symptoms, examination and test results, diagnoses, treatment, a plan for your future care or treatment, and/or prescription-filling and billing-related information. Such records are necessary for the healthcare provider and pharmacist to provide you with quality care and to comply with certain legal requirements. This notice applies to all records of your care created or received by Ashley Clinic, LLC, Ashley Pharmacy, Inc., and/or Humboldt Pharmacy.

1. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy may use and disclose protected health information for treatment, payment, and healthcare operations. Treatment examples include, but are not limited to, requested preschool, life insurance or sports physicals; referral to nursing homes or foster care homes; information obtained by a pharmacist to dispense your prescriptions; home health agencies; and/or referral to other providers for treatment. Payment examples include, but are not limited to, collection agencies and insurance companies for claims including coordination of benefits with other insurers, and for prescription benefits. Healthcare operations examples include, but are not limited to, internal quality control and assurance, including auditing of clinic and pharmacy records, and government and licensure audits.

2. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy are permitted or required to use or disclose protected health information without the individual’s written authorization in certain circumstances. These examples include, but are not limited to, public health requirements, Food and Drug Administration (FDA), medical examiners, coroners, funeral directors, and/or court orders.

3. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy provide services through business associate contracts, for which we may disclose protected health information about you so that they may perform the job that we have asked them to do, and bill you or your third-party payer for the services rendered. We require the business associate to appropriately safeguard your protected health information through a Business Associate Agreement with Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy. Examples include clearinghouses for billing, software vendors, some insurers, and drug wholesalers. Notice of Privacy Practices Page 2

4. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy may release protected health information about you for worker’s compensation or similar programs.

5. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy may release health information about you to a correctional institution or a law enforcement official if you are an inmate of a correctional institution or under the custody of a law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

6. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy may at times contact the patient to provide appointment and pharmacy refill reminders, information regarding treatment alternatives, and/or other health-related benefits and services that may be of interest to the individual patient.

7. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy may release protected health information about you to a friend or family member to the extent necessary to help with your healthcare or with payment for your healthcare. Individuals requesting financial information on patient accounts other than their own will be required to provide authorization from the patient in advance in order for Ashley Clinic, LLC, Ashley Pharmacy, Inc., or Humboldt Pharmacy to release the financial information. You may request a form to list specific people who we may speak to regarding your medical or pharmacy information. In addition, we may disclose protected health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

8. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy will not make any other use or disclosure of a patient’s protected health information without the individual’s written authorization. Such authorization may be revoked at any time. Revocation must be in writing.

9. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy will abide by the terms of this notice or the notice currently in effect at the time of the disclosure.

10. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy reserve the right to change the terms of this notice and to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy will make available a copy of any revisions to the Notice of Privacy Practices. Notice of Privacy Practices Page 3

11. Any person/patient may file a complaint to Ashley Clinic, LLC, Ashley Pharmacy, Inc., Humboldt Pharmacy, or to the Department of Health and Human Services, Office of Civil Rights, if they believe their privacy rights have been violated. To file a complaint with Ashley Clinic, LLC, Ashley Pharmacy, Inc., or Humboldt Pharmacy please contact the Privacy Officer at the following address: Ashley Clinic, LLC, 505 South Plummer, P.O. Box 946, Chanute, KS 66720. A complaint may also be filed by calling 620-431-2500. All complaints will be addressed and the results will be reported to the patient and the appropriate Ashley Clinic personnel.

12. It is the policy of Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy that no retaliatory action will be made against any individual who submits or conveys a complaint of suspected or actual non-compliance of the privacy standards.

13. For further information about this notice you may contact the Ashley Clinic, LLC Privacy Officer at 620-431-2500.

14. The effective date of this notice is April 14, 2003.

Patients have been granted individual rights under the HIPAA Legislation. These include the following:

1. You have the right to inspect and/or request a copy of your protected health information that may be used to make decisions about your care. To inspect and/or request a copy of your protected health information, you must submit your request in writing to the Ashley Clinic, LLC Privacy Officer. If you request a copy of the information, we may charge a fee for the costs of copying (including labor), mailing or other supplies associated with your request. We may deny your request to inspect and/or copy in certain very limited circumstances. If you are denied access to protected health information, you may request that the denial be reviewed.

2. If you feel that protected health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is maintained by Ashley Clinic, LLC, Ashley Pharmacy, Inc., and Humboldt Pharmacy. To request an amendment, your request must be made in writing and submitted to the Ashley Clinic, LLC Privacy Officer. You must provide a reason that supports your request and we may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that was not created by us (unless the person or entity that created the information is no longer available to make the amendment), is not part of the protected health information kept by or for our practice, is not part of the information that you would be permitted to inspect or copy, or is accurate and complete. Notice of Privacy Practices Page 4

3. You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of protected health information about you that were not made for treatment, payment, and/or health care operations. There are certain exceptions to this right. To request this list or accounting of disclosures, you must submit your request in writing to the Ashley Clinic, LLC Privacy Officer. Your request must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. You may request that we provide copies in a format other than photocopies. We will use the format you request unless we cannot practicably do so. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. The accounting must be provided to you no later than 60 days after the receipt of your request, unless we utilize a 30-day extension period.

4. You have the right to request a restriction or limitation on the protected health information we use or disclose about you for treatment, payment or health care operations, as well as the protected health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request restrictions, you must make your request in writing to the Ashley Clinic, LLC Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosure to your spouse. Either you or we may terminate the restriction upon notification of the other.

5. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to the Ashley Clinic, LLC Privacy Officer. We will not ask you the reason for your request. We will accommodate all requests we deem reasonable. Your request must specify how or where you wish to be contacted.

6. You have the right to a paper copy of the current Notice of Privacy Practices. You may ask us to give you a copy of this notice at any time.

7. You will be asked to sign an acknowledgement of receipt of this Notice of Privacy Practices. If you have any questions regarding this Notice of Privacy Practices, please do not hesitate to contact the Ashley Clinic, LLC Privacy Officer for more information or clarification.

April 14, 2003