Effective Date: 20-MARCH-2019

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information.

As required by the Health Insurance Portability and Accountability Act (HIPAA), Abbott Diabetes Care (ADC, we, us or our) is providing you with this Notice of Privacy Practices (Notice) describing (1) the uses and disclosures of health information that may be made by ADC, (2) your rights under HIPAA, and (3) ADC's legal obligations with respect to your health information. Health information includes individually-identifiable medical, insurance, demographic and medical payment information, such as information about your diagnosis, medications, insurance status, medical claims history and policy information.

Scope

Abbott Diabetes Care is a hybrid entity under HIPAA, meaning that it is a single legal entity with business functions that include HIPAA-regulated activities and non-HIPAA related activities. Only the information that ADC creates or receives related to its HIPAA-related activities are subject to HIPAA requirements and this Notice. This includes the following information:

• Information that you share with your healthcare provider through the LibreView system;
• Additional information that we receive from your healthcare provider through the LibreView system;
• Information that we use to investigate your health plan benefits relating to the FreeStyle Libre system;
• Information that we receive from the Durable Medical Equipment ("DME") supplier who provided you with your FreeStyle Libre system;
• Information that we use to support your healthcare providers who use the LibreView system and the performance and improvement of the FreeStyle Libre system;
• Information that you provide to us and/or we receive from you through training programs on the safe and effective use of the FreeStyle Libre system;
• Information that you provide and we receive from you through LibreView system (or through the LibreLink app).

All other functions of, and services provided by, ADC are not subject to HIPAA and/or the terms of this Notice.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of ADC's responsibilities to help you. You may exercise these rights by writing to our Privacy Officer at the address or email address provided at the end of this Notice.

Get a copy of your medical record

• You can ask to see or get a copy of your medical record and other health information we have about you. Ask us how to do this.
• We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee. There are some situations where we may say "no" to your request, but we’ll tell you why in writing within 30 days, and you may have the right to have this decision reviewed.

Ask us to correct your medical record

• You can ask us to correct health information about you that you think is incorrect or incomplete.
• We will respond to your request, usually within 60 days. There are some situations where we may say "no" to your request, but we'll tell you why in writing within 60 days and allow you to submit a written statement of disagreement.

Request confidential communications

• You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
• We will say "yes" to all reasonable requests. However, we may condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact.

Ask us to limit what we use or share

• You can ask us not to use or share certain health information for treatment, payment, or our operations. Your request must state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to your request, and we may say "no" if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say "yes" unless a law requires us to share that information or it is needed to provide emergency treatment.

Get a list of those with whom we've shared information

• You can ask for a list (accounting) of the times we've shared your health information for six years prior to the date you ask (or a shorter time period that you request), who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We'll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
• We will respond to your request, usually within 60 days.

Get a copy of this Notice of Privacy Practices

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Choose someone to act for you

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated

• You can complain if you feel we have violated your rights by contacting us using the information on the last page of this Notice.
• You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
• We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care;
• Share information in a disaster relief situation;
• Include your information in a hospital directory.

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases we never share your information unless you give us written permission:

• Marketing purposes;
• Sale of your information;
• Most sharing of psychotherapy notes.

In the case of fundraising:

• We may contact you for fundraising efforts, but you can tell us not to contact you again.

ADC's Uses and Disclosures of Your Health Information

Treatment, Payment and Health Care Operations

We use and share your health information for treatment, payment, and health care operations purposes as described below.

• Treatment. We can use your health information to aid in analyzing and evaluating your historical glucose data, glucose test results, and ketone test results. We can also share your health information with other health care professionals who are treating you.
  Example: We use your glucose data to provide your doctor with reports that help you control your glucose levels. We can also use your health information for training you on how to better review and interpret your glucose data.
• Payment. We can use and share your health information to obtain reimbursement from health plans or other entities for health care services, and determine your eligibility or coverage for such services.
  Example: We give information about you to your health insurance plan to determine your eligibility and coverage for a glucose reader.
• Health Care Operations. We can use and share your health information to run and improve our health care services, conduct business planning and development activities, and contact you when necessary.Example: We use health information about you to analyze and manage your use of our cloud-based glucose monitoring platform in order to improve the platform and related services.

Other Uses and Disclosures

As described below, we are also allowed or required to share your information in other ways that usually contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your health information for these purposes. For more information, please visit: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

• Public Health and Safety Activities. We can share health information about you in certain situations such as:
  • Preventing disease;
  • Helping with product recalls or tracking FDA-regulated products;
  • Reporting adverse reactions to medications or medical device adverse events;
  • Reporting suspected abuse, neglect or domestic violence;
  • Preventing or reducing a serious threat to anyone's health or safety.
• Research. We can use or share your information for health research.
• Comply with the Law. We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to verify that we are complying with HIPAA.
• Respond to Organ and Tissue Donation Requests. We can share health information about you with organ procurement organizations.
• Work with a Medical Examiner or Funeral Director. We can share health information with a coroner, medical examiner or funeral director when an individual dies.
• Address Workers' Compensation, Law Enforcement and Other Government Requests. We can use or share health information about you:
  • For workers' compensation claims;
  • For law enforcement purposes or with a law enforcement official;
  • With health oversight agencies for activities authorized by law;
  • For special government functions such as military, national security and presidential protective services.
• Respond to Lawsuits and Legal Actions. We can share health information about you in response to a court or administrative order, or in response to a subpoena.

ADC's Responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information, please visit www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Changes to the Terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on this website.

Contact ADC / ADC Privacy Official

If you have any questions regarding this Notice or ADC's use and disclosure of your health information, you may obtain additional information by:

Writing to:

HIPAA Privacy Officer
Abbott Diabetes Care
1420 Harbor Bay Pkwy
Alameda, CA 94502

Emailing to:

diabetescareprivacy@abbott.com

ADC-05307 Ver 3.0 04/19