CONFIDENTIALITY PROTOCOL

1. CONFIDENTIALITY PROTOCOL eQHealth Solutions recognizes the inherent rights of the individual to privacy and at the same time acknowledges the need of the medical profession for adequate information. An organization dealing with medical data must accept responsibility and, will endeavor to guide itself by the following policies.

2. CONFIDENTIALITY POLICY All medical information that relates to and identifies specific individual patients and practitioners and certain data relating to health care institutions is strictly confidential and shall not be made known or accessible by the eQHealth Solutions staff, officers, board members, committee members, employees, or consultants, to the public or any governmental unit, agency, or department except as provided in this Confidentiality Protocol.

3. CONFIDENTIALITY GUIDELINES • Only specifically identified professional reviewers and staff will be authorized to review medical data. • All confidential records (including copies of printout analysis, encounter forms, etc.) will be disposed of in a manner that will render them useless when they are no longer needed. • All persons to whom an offer of employment is rendered will be informed prior to employment of the confidentiality of data and the rules and regulations governing that data.

4. CONFIDENTIALITY GUIDELINES(CON’T) D. All employees of eQHealth Solutions will become familiar with the handling of confidential data and information by completing the eQHealth Solutions’ Confidentiality Training Program. Upon completion of this program, each employee must attest to having completed the program, they are aware of their responsibilities to hold this data in confidence and are aware of eQHealth Solutions’ dismissal policy for disclosure of data and the legal penalties of unauthorized disclosure of data and information.

5. E. eQHealth uses data acquired through CMS contract only for CMS contract purposes. If a non-contract use for CMS contract data was found, eQHealth would gain CMS approval prior to use, maintenance or destruction. If such use was approved by CMS, eQHealth would follow QualityNet security guidelines on the appropriate use, storage and destruction of this data. eQHealth Solutions remote employees using laptops to do their work in the field have access to data offsite. All laptops are equipped with full volume encryption using PointSec encryption software. The full volume encryption prevents unauthorized log-ins as well as data loss or misuse in the event of a laptop being lost or stolen. If a remote employee requires routine access to QIO electronic data, a hardware firewall is purchased and installed in their remote office. CONFIDENTIALITY GUIDELINES(CON’T)

6. All employees and consultants of eQHealth Solutions will reaffirm their awareness and agreement with eQHealth Solutions regulations regarding confidentiality of data at least every twelve- (12) months. Any employee or consultant of eQHealth Solutions will be subject to immediate termination for violation of eQHealth Solutions policies regarding confidentiality. (They will in addition, be subject to Federal regulations and law which includes fines and/or imprisonment.) I. Computer data files will be purged of all personal identifiers as soon as such identifiers are no longer required for purposes of review appeals, program monitoring and program evaluation. CONFIDENTIALITY GUIDELINES(CON’T)

7. Should an employee suspect a violation of this confidentiality Protocol has occurred, or might occur, they should report the suspected breach, or potential breach, to their immediate supervisor. They should provide as much specific detail, including dates and times, as possible. Should the employee not want to report the violation to their supervisor, they may report it directly to the Privacy Officer, Project Director, the Compliance Officer or the Hotline. Employees understand that there is no retaliation allowed for the reporting of a potential violation. Subcontractors or consultants should report any violation, or potential violation, to the person managing their contract or the Privacy Officer, Project Director, Compliance Officer or the Hotline. Subcontractors and consultants understand that there is no retaliation for reporting potential violations. CONFIDENTIALITY GUIDELINES(CON’T

8. REVIEW THE PROTOCOL DETAILS You will be given a copy of the Confidentiality Protocol during this training session. You need to review it in detail and discuss with your Manager any questions you might have concerning the definitions as defined by the Protocol or the Statements relative to: Notification to Patients, Practitioners, and Providers Patient, Physician, and Facility Access Purging of Files Authorization and Training Requirements Disclosure & Penalties