ACCOUNTABLE CARE ADMINISTRATION LLC

Privacy & Confidential Information

Hospital administration involves access to information concerning patients, employees, medical staff, departmental operations, technology systems, and institutional responsibilities. When administrative functions are performed by an external management organization, protecting this information requires clear authorization, appropriate confidentiality measures, and coordination with the healthcare organization responsible for the records.

ACCOUNTABLE CARE ADMINISTRATION LLC provides outsourced hospital administration and healthcare management services. Our personnel may perform administrative duties within hospital facilities, remotely, or through a combination of on-site and centralized operations.

This policy explains how information may be collected, accessed, used, disclosed, and protected in connection with our website, business communications, and authorized administrative engagements.

Information Collected Through Our Website

Visitors may provide personal or business information when requesting information, discussing potential services, or communicating with our company.

Such information may include names, professional titles, hospital or organizational affiliations, telephone numbers, email addresses, business locations, and descriptions of administrative requirements.

Our website may also collect technical information during normal operation, including Internet Protocol (IP) addresses, browser characteristics, device information, pages accessed, referral sources, and diagnostic records. This information may support website administration, security, troubleshooting, and improvements to online functionality.

The public website is intended for general business communications. Patients, hospital employees, and other visitors should not submit medical records, protected health information, confidential personnel files, authentication credentials, or other sensitive institutional information through ordinary website inquiry forms.

Information Accessed During Hospital Administration

The categories of information involved in an administrative engagement depend on the services authorized by the hospital or healthcare organization.

Our personnel may require access to information associated with:
• Patient registration, admissions, scheduling, transfers, and discharge administration
• Medical records, documentation tracking, and health information management
• Employee recruitment, onboarding, scheduling, attendance, and personnel administration
• Provider credentialing, licensing, medical staff appointments, and professional documentation
• Hospital policies, compliance records, internal audits, and regulatory reporting
• Quality indicators, operational performance reports, and corrective-action records
• Electronic health record systems, user accounts, and technology support requests
• Inventory, procurement, supplier records, and materials administration
• Departmental responsibilities, administrative communications, and management reporting

Access to particular records or systems should be determined by the assigned responsibilities, authorized permissions, and applicable legal and contractual requirements.

Patient Information and Protected Health Information

Certain administrative services may involve access to patient information, including information protected under the Health Insurance Portability and Accountability Act (HIPAA) and other applicable privacy laws.

Accountable Care Administration recognizes that patient information must be handled according to the legal requirements and institutional policies applicable to the engagement.

Where the company performs functions that make it a business associate under HIPAA, the relevant responsibilities are governed by applicable law and an appropriate Business Associate Agreement. Depending on the engagement, authorized personnel may support patient registration, medicalrecord administration, documentation review, release-of-information procedures, or other healthcare administrative activities.

Access to protected health information must be limited according to applicable role-based permissions, minimum-necessary requirements where applicable, and authorized operational purposes.

The company's involvement in administrative processes does not independently grant unrestricted access to patient records or authority to disclose information outside approved procedures.

Hospital-Controlled Records

Hospitals and healthcare systems generally retain responsibility for determining the purposes of their clinical and administrative records, establishing institutional access requirements, and maintaining applicable governance and regulatory responsibilities.

When Accountable Care Administration personnel work within a hospital, they may use hospitalcontrolled systems, follow institutional procedures, and perform duties under delegated administrative authority.

The allocation of responsibilities for information access, record maintenance, disclosure decisions, and privacy compliance depends on the services performed, applicable law, and the agreements governing the relationship.

Providing administrative services does not automatically transfer ownership or independent control of hospital records to Accountable Care Administration.

Workforce and Medical Staff Information

Human resources and medical staff administration may involve confidential information concerning hospital employees, applicants, physicians, and other healthcare professionals.

Records may include employment applications, personnel documentation, scheduling information, attendance records, training records, professional licenses, certifications, credentialing files, and appointment documentation.

Such information should be accessed only for authorized administrative purposes and handled in accordance with applicable employment, privacy, professional, and institutional requirements.

Provider credentialing and medical staff records may be particularly sensitive. Administrative personnel may coordinate documentation and track outstanding requirements, while final decisions concerning clinical privileges, professional competency, and medical staff appointments remain with the authorized hospital bodies.

Information Use Within Administrative Services

Information may be used to perform the administrative responsibilities assigned under an applicable engagement.

These activities may include coordinating hospital departments, maintaining administrative records, supporting patient access, managing workforce processes, administering provider documentation, monitoring operational performance, and supporting institutional compliance activities.

Information may also be used to:
• Maintain administrative schedules, assignments, and departmental workflows
• Identify incomplete records and outstanding documentation
• Coordinate authorized communications between hospital departments
• Support internal reporting and operational reviews
• Administer approved system access and technology support processes
• Track regulatory requirements, policy updates, and corrective actions
• Support inventory administration and materials coordination
• Maintain records required for contractual administration and legal compliance

Information accessed on behalf of a hospital is not treated as unrestricted company information for unrelated business purposes.

Confidentiality and Authorized Personnel

Administrative personnel may work directly within hospital offices, registration areas, medical staff departments, records departments, and other locations where confidential information is routinely handled.

Access to information should correspond to assigned duties and the permissions established by the responsible organization.

Confidentiality requirements may arise from employment obligations, institutional policies, service agreements, nondisclosure arrangements, Business Associate Agreements, and applicable law.

Personnel should not access, disclose, copy, or use restricted information outside their authorized responsibilities.

Where employees or contractors transition between assignments, access permissions and information-handling responsibilities should be reviewed according to applicable procedures.

Healthcare Technology and System Access

Administrative engagements may involve electronic health records, human resources systems, scheduling applications, credentialing platforms, inventory systems, and other hospital technologies.

Authorized activities may include user administration, help-desk support, access coordination, system documentation, and operational technology support.

Access rights should be established according to approved roles and responsibilities.

Accountable Care Administration may coordinate with hospital information technology teams, cybersecurity personnel, and external technology providers regarding system access, security incidents, and operational requirements.

Responsibility for system ownership, technical infrastructure, cybersecurity controls, and incident response is determined by the applicable agreements and institutional arrangements.

Information Sharing and Disclosure

Hospital administration requires communication among authorized departments, employees, providers, technology vendors, and other participants.

Information may be shared when necessary for legitimate administrative functions and permitted by applicable law, institutional policy, and contractual arrangements.

Patient information, personnel records, and other restricted materials must not be disclosed merely because a third party participates in the hospital's operations.

Where applicable, disclosure may require specific authorization, a recognized legal basis, or appropriate contractual safeguards.

Accountable Care Administration may also share its own business information with service providers supporting communications, technology, and ordinary company administration.

Information may be disclosed when required by applicable law or lawful process.

The company does not sell personal information.

Administrative Safeguards and Information Security

Reasonable administrative, technical, and organizational safeguards are used to help protect information maintained within systems under the company's control.

Depending on the engagement, protective measures may involve confidentiality procedures, access restrictions, secure communication methods, personnel responsibilities, record-handling requirements, and coordination with hospital security policies.

When personnel operate within hospital-managed systems, the relevant security procedures and responsibilities may be established by the hospital and the governing agreements.

Suspected unauthorized access, improper disclosure, or other information security concerns should be addressed through the reporting and response procedures applicable to the affected information.

Where a security incident involves protected health information or other regulated data, applicable contractual and legal notification obligations govern the required response.

No electronic or administrative system can guarantee absolute protection against every security risk.

Record Retention and Disposal

Retention requirements differ according to the type of information, the responsible organization, applicable laws, and contractual obligations.

Hospital-controlled records may be subject to institutional retention schedules, healthcare regulations, and specific preservation requirements.

Accountable Care Administration personnel may assist with retention administration, record organization, authorized disposal procedures, or transfer of records within the agreed scope.

The company does not independently determine retention or destruction requirements for hospitalcontrolled records unless authorized to do so under the applicable arrangements.

Information maintained for the company's own business purposes may be retained as reasonably necessary for contractual administration, legal compliance, legitimate business operations, and dispute resolution.

Privacy Rights and Information Requests

Individuals may have rights concerning access to, correction of, or other handling of their personal information under applicable privacy laws.

Requests relating to patient medical records or hospital-controlled information should generally be directed to the responsible healthcare organization through its established procedures.

Where Accountable Care Administration supports the administration of such requests, its personnel act within the authority and responsibilities established for the engagement.

Requests concerning personal information controlled by the company for its own business purposes may be submitted through the company's published contact channels.

Reasonable identity verification or proof of authority may be required before information is disclosed or modified.

Policy Scope and Institutional Agreements

This policy describes the general information-handling principles applicable to Accountable Care Administration's website and outsourced hospital administration activities.

Individual healthcare engagements may be subject to additional privacy requirements, Business Associate Agreements, confidentiality provisions, institutional policies, information security procedures, and contractual obligations.

Those requirements govern the specific information and responsibilities to which they apply.

Nothing in this policy grants independent authority to access patient information, make clinical decisions, override hospital privacy procedures, or disclose restricted records outside authorized purposes.

Questions concerning this policy may be submitted through the contact channels published on the Accountable Care Administration website.