HIPAA COMPLIANCE TOOLKIT - Antek HealthWare, LLC has produced this Toolkit to assist you in your compliance efforts. Information has been provided to help you construct policies and procedures for various aspects of your day-to-day operations. We've also included several templates that you can use or alter to fit your needs.

BUSINESS ASSOCIATE AGREEMENT - Antek HealthWare is considered a Business Associate under Health Insurance Portability and Accountability Act (HIPAA) because we provide software to the healthcare industry. As such, Antek has drafted this Agreement to meet all HIPAA requirements that specifically pertain to Antek's products. We have taken this proactive step to insure that our clients are properly covered in regards to Antek's exposure to patient information.

SUMMARY OF HIPAA PRIVACY RULE - Reading this document will orient you with HIPAA and allow you to identify your practice's policies and procedures that need to be addressed to comply with HIPAA. Once you have obtained an understanding of HIPAA, please use Antek HealthWare's HIPAA Tool Kit as a guideline to become HIPAA compliant.

GETTING Ahead OF HIPAA
With the rapidly changing legislative and regulatory impacts on the healthcare environment Antek HealthWare, LLC recognizes that corporations are seeking to ensure that our organization is actively assessing and preparing for compliance with the Health Insurance Portability and Accountability Act (HIPAA). Antek is implementing global strategies to prepare for HIPAA. Our goal is to protect the privacy and security of individually identifiable health information and our client's ability to use our services.

Antek is tracking all proposed, pending and active legislative and regulatory developments that are directly proportionate to Antek's and our customers' business needs. Our primary focus is to research privacy and security regulations and legislation on both the federal and state level. We are actively involved in the impact assessment of HIPAA on Antek's business units.

Antek has developed a HIPAA Task Force that consists of individuals from the following departments: Human Resources; Information Technology; and Operational Representatives.

Antek is addressing the communication of new laws relative to privacy and security through a corporate driven HIPAA program. This program educates the management and employees as required to ensure preparation.

aspe.os.dhhs.gov/admnsimp
The Department of Health and Human Services site contains general information about the administrative simplification portion of HIPAA, an explanation of the Notice of Proposed rulemaking (NPRM) process, updates on when HIPAA standards may be implemented and presentations made by the parties regarding HIPAA.

www.wpc-edi.com
The Washington Publishing Company Web site contains all the implementation guides, data conditions, and the data dictionary (except for retail pharmacy) for X12N standards being proposed under HIPAA.

aspe.os.dhhs.gov/datacncl
The Department of Health and Human Services Data Council Web site includes information on the purpose of the Data Council, membership information, and meeting minutes.

www.disa.org
The Data Interchange Standards Association Web site contains information on ASC X12, information on X12N subcommittees, task groups, and workgroups, including meeting minutes. This site will contain the test conditions and results of HIPAA.

www.wedi.org
The Workgroup for Electronic Data Interchange Web site includes information on EDI in the health-care industry, lists of conferences and other resources.

www.ama-assn.org/ama/pub/category/4234.php
The American Medical Association site provides recent information on all aspects of HIPAA and provides compliance assistance forms and recommendations.

CONFIDENTIALITY REQUIREMENTS
PROTECTING THE PRIVACY OF PATIENTS' HEALTH INFORMATION

1. INFORMATION REQUIRED TO BE PROTECTED.
The privacy of all medical records and other individually identifiable health information must be protected at all times. Information relating to a patient's health care history, diagnosis, condition, treatment, or evaluation shall be considered individually identifiable health information. Confidentiality of this health information must be maintained at all times, and may only be disclosed with the express written consent of the patient. Non-individually identifiable health information, (e.g. health information that cannot be linked to a specific patient) is not included within the definition of protected health information.

2. BOUNDARIES ON HEALTH INFORMATION USE AND RELEASE.
a. Protect individually identifiable health information. Antek shall not publish or otherwise make generally available any information or data that identifies a patient for purposes other than treatment, payment or other health care operations, without his or her express written consent. This does not restrict the internal use of such information or data that is required in the performance of the scope of work that Antek has been engaged to perform for a client. Antek also maintains physical, electronic and procedural safeguards to protect individually identifiable health information. Antek is currently assessing those safeguards and expect to make ongoing improvements to maintain and enhance our level of security for individually identifiable health information.

b. Maintain health information in a manner to protect confidentiality. All individually identifiable health information shall be maintained by Antek in a confidential manner which prevents unauthorized or inadvertent disclosure to third parties.

For example, Antek may share confidential information with a third party under contract or affiliated with Antek for the same purpose of performing the services for which we were engaged, provided that the information shall remain confidential at all times and shall be shared with only those persons that have authority to receive such information.

3. PENALTIES FOR MISUSE OF PERSONAL HEALTH INFORMATION.
There are serious penalties for violation of the confidentiality of health information. Please be advised of the following:

a. State Penalties. Various state laws impose criminal and civil penalties on individuals who misuse or disclose individually identifiable health information without explicit consent by the patient.

b. Federal Penalties. HIPAA (Health Insurance Portability and Accountability Act) is a piece of federal legislation that directly addresses the protection of confidential health information. This law is being phased in over a two-year period. Once effective, HIPAA will provide for civil money penalties up to $25,000 per person, per year for violations of patient confidentiality. HIPAA also provides for federal criminal penalties.

c. Antek Penalties. Any employee who violates the privacy and confidentiality of patient health information, through disclosure or otherwise, may be subject to disciplinary action, including termination of his or her employment with Antek.

The Privacy Policy set forth below defines the commitment of Antek, Inc. t/a Antek HealthWare ("Antek HealthWare") to protect the privacy of Personal Information that is collected or used in the course of conducting Antek HealthWare's business and providing LabDAQ. This Privacy Policy constitutes an agreement between You and Antek HealthWare regarding Your use of and access to LabDAQ.

I. Definitions. In this Privacy Policy:
"You" or "Your" means the person who has agreed to be bound by this Privacy Policy regarding use of and access to LabDAQ and includes the individual or entity that registers for access and use of LabDAQ and all Authorized Persons as such term is defined in Part I of the Terms of Use for LabDAQ . "Patient" means the natural person to which Personal Information refers. "LabDAQ " means the electronic system owned and operated by Antek HealthWare that allows You to electronically submit, process and manage health insurance claims, inquiries and information requests, and includes the computer software and documentation provided to You for use in accessing and using LabDAQ.

II. Privacy In Personal Information. Antek HealthWare acknowledges that a Patient has a right of privacy in all Personal Information that refers or relates to such Patient. As used herein, "Personal Information" means all personally identifiable information referring or relating to a Patient, including but not limited to the Patient's name, addresses, telephone numbers, social security number, insurance information, health condition and medical history information and all Individually Identifiable Health Information as such term is defined in the Health Insurance Portability and Accountability Act of 1996 as amended ("HIPAA").

III. Confidentiality Of Personal Information. Antek HealthWare will respect the legal requirements regarding the privacy of Personal Information and is committed to complying with all applicable law. Antek HealthWare shall maintain the security of Personal Information, and protect the integrity of Personal Information, with a commercially reasonable degree of care. Antek HealthWare shall hold all Personal Information in confidence in perpetuity and shall not use or disclose Personal Information except: (i) as specifically permitted or required by applicable law, regulation, subpoena or court order; (ii) as expressly permitted in writing by You and/or the applicable Patient to which such Personal Information refers or relates; (iii) solely as necessary to effect, administer, or enforce a transaction requested or authorized by You or in connection with servicing or processing a product or service requested or authorized by You; or (iv) otherwise solely for the purposes of operating and providing the services associated with LabDAQ. Antek HealthWare shall allow You reasonable electronic access to all collected Personal Information that was provided to Antek HealthWare by You or that otherwise refers or relates to Patients to allow You to supplement such Personal Information, to correct any Personal Information that is false, inaccurate, incomplete or outdated, and otherwise for such purposes as permitted or required by applicable law. At times, Antek HealthWare shall remove identifiable features from collected Personal Information and use the resulting information for statistical, historic or other purposes, consistent with applicable law ("Aggregate Information").

IV. Extent Of Obligation. This Privacy Policy is intended only to obligate Antek HealthWare to protect Personal Information to the extent required by applicable law. Therefore, while Antek HealthWare shall endeavor to contractually require others who acquire or provide Personal Information from or to Antek HealthWare, such as Antek HealthWare employees and contractors, to comply with the principles and objectives of this Privacy Policy. You agree that Antek HealthWare shall not be held liable for: (i) any improper use or disclosure of Personal Information by You or any other person or entity not under Antek HealthWare's direction or control; or (ii) breach of any duty or obligation set forth in this Privacy Policy which obligation is greater than that required by applicable law.

V. Representations And Warranties; Indemnification. You represent and warrant to Antek HealthWare that: (i) all Personal Information provided by You to Antek HealthWare is true, accurate, complete and current as of the date You provided such Personal Information; (ii) You shall promptly correct, modify or amend all false, incomplete, outdated or inaccurate Personal Information that refers or relates to Patients as it comes, or is brought, to Your attention; (iii) in providing Personal Information to Antek HealthWare, You have complied with all applicable laws, rules and regulations in effect and as amended from. time to time, including but not limited to HIPAA; and (iv) You have obtained all appropriate consents required by all applicable law to allow Antek HealthWare to provide You with the services associated with LabDAQ. You hereby agree to and shall indemnify, defend and hold harmless Antek HealthWare and its employees, directors, a ffiliates, subsidiaries and clients, against any third party claim and any related cost or expense, including legal fees, arising out of or related to any breach by You of these representations and warranties or this Privacy Policy.

VI. Effect Of Termination Of Other Agreements. Within a reasonable time after the termination or expiration of any agreement between You and Antek HealthWare: (i) Antek HealthWare will execute a data inspection of the electronic databases containing Personal Information You provided to Antek HealthWare, so that upon completion of a data scrub of such Personal Information, all such Personal Information in all live electronic databases owned or operated by Antek HealthWare will be rendered inaccessible by any user of the databases other than Antek HealthWare and its employees or agents; and (ii) Antek HealthWare will provide to You, within thirty (30) days of Your written request therefore, a file, in comma delimited format, of all data, including all Personal Information, posted on LabDAQ by You or on Your behalf.

VII. Change Of Policy. Antek HealthWare may modify this Privacy Policy from time to time. Such modifications shall be posted upon Your successful log on to LabDAQ, and You agree to receive notices concerning this Privacy Policy solely by notices posted upon Your log on to LabDAQ. Antek HealthWare will use commercially reasonable efforts to notify You when You log on to LabDAQ if a modified Privacy Policy has been posted. Antek HealthWare shall not apply any such modifications retroactively to Personal Information Antek HealthWare has previously collected. You may give written notice to Antek HealthWare within thirty (30) days of receiving notice of the modifications that You do not consent to such changes (if You do not so object, the modifications shall automatically become effective). If You object to the modifications, Your participation in LabDAQ shall terminate and the provisions of Item VI shall apply.

VIII. Terms Of Use. This Privacy Policy is adopted and incorporated by reference into the Software License and General Terms of Use for LabDAQ ("Terms of Use"). The Terms of Use and the Privacy Policy are the legal documents governing Your use of LabDAQ. Please thoroughly review all provisions of the Terms of Use, in addition to this Privacy Policy, prior to making any use of LabDAQ.