Vendor Access Information Handbook

Vendor Access Information Handbook

ΑΤΤΕΝΤΙΟΝ VENDORS YOU MUST CHECK IN WITH SECURITY BEFORE YOUR APPOINTMENT

Table of Contents 1. UNM Hospitals Vendor Guideline Check-In Summary....1 Page 2. UNM Hospitals Healthcare Industry Representative Protocol...2-10 3. Summary of Process for Introducing Product into UNM Hospitals....11 4. UNM Hospital & UNM Children s Hospital Vendor Guidelines 12 5. OR Attire Policy.13 6. UNM Health Sciences Center Parking Policy.14-17 7. UNM Hospitals Food and Nutrition Services Policy...18-20 8. UNM Health Sciences Center Use and Disclosure of Protected Health Information...21-36 9. UNM Health Sciences Center Code of Conduct/Organizational Ethics Policy.37-42 10. Deficit Reduction Act of 2005.43-56 11. Vendor Registration Forms...57-62 a. Vendor Checklist b. Acknowledgement of Receipt of Vendor Protocols c. Confidentiality Agreement d. OR Purchasing Policy e. Code of Conduct Certification

Vendor Guideline Check-In Summary All vendor visitors require appointments. Security will verify vendor registration before issuing a UNMH vendor badge. To sign in vendors must provide proper identification and a business card in exchange for an UNMH vendor badge. You must read and acknowledge (by signature) the Vendor Guidelines. The UNMH vendor badge will be valid for the day of visit and valid only for the specific area they have been authorized to access. The UNMH vendor badge must be visible at all times while conducting business at UNMH. At the end of the appointments vendors are expected to sign. *If a vendor is seen without a UNMH vendor badge, they will be escorted to Security, or asked to leave the hospital Thank you for your help and support with this new program and keeping us compliant for JCAHO. Page 1

UNIVERSITY OF NEW MEXICO HOSPITALS HEALTHCARE INDUSTRY REPRESENTATIVE PROTOCOL 1. HOW WE BUY SURGICAL PRODUCTS AND SERVICES University of New Mexico Hospitals (UNMH) uses a combination of methods to seek the best value for products and services. We are members of the University HealthSystem Consortium (UHC); therefore, our primary group purchasing organization (GPO) is Novation. Materials Management is responsible for contracting for items no on a GPO contract, which UNMH accomplishes through the competitive bid process in compliance with State of New Mexico regulations. As allowed within state regulations, we may negotiate directly for pricing, terms, and conditions. Materials Management is responsible to assist you in determining whether your product is a stock or non-stock item. If it is a contracted item, we may be in a long-term contract and not able to switch until the end of the contract. Just as you would want us to honor any contract with you, we work diligently at honoring our contracts with your competitor(s). However, we do understand that the rapid change in technology, regulatory requirements, and methods of delivering healthcare may require us to prematurely change products or services during a contract period. Only those goods and services ordered by UNMH Materials Management and covered by a valid purchase order will be recognized as a valid encumbrance by UNMH. Physicians are not authorized to enter the Hospital into any binding financial commitment(s). In the absence of a valid purchase order, the vendor will not be paid. The shipping of goods or provision of services to UNMH without a valid purchase order will be done at your own risk and without expectation of payment or return. 2. HEALTHCARE INDUSTRY REPRESENTATIVE REGISTRATION All healthcare industry representatives and/or their designees must register annually with Materials Management. It is the responsibility of the vendor to keep track of their annual registration date (for example, if a vendor registers in February then they must register by February 1 st of the following year). To renew your registration you must submit a copy of a current TB test. Privileges are not transferable between company representatives. All representatives entering UNMH need to be registered. For questions on applying for access, please call (505) 272-2257. To register, you and/or your designees will be required to provide proof of knowledge or certification of the following (Vendors not entering into surgical services may not require all of the items listed): 1. Proof of clinical competency and any current, required certifications/licenses regarding your product line(s) 2. Surgical Attire and Traffic Patterns 3. Aseptic Principles and Sterile Technique Page 2

4. 4. Perioperative Safety Concerns (Fire, Electrical, X-Ray, etc) 5. Infection Control and Bloodborne Pathogens 6. Proof of Current Tuberculosis (PPD) test and Measles/Mumps/Rubella (MMR) immunization 7. Complete and sign the following registration forms: Acknowledgement of Receipt of Vendor Protocols Confidentiality Agreement OR Purchasing Policy HSC Compliance Office Code of Conduct Certification It is the healthcare industry representative s responsibility to ensure that all information supplied to UNMH is correct and all protocols are complied with. Failure to provide accurate information and/or comply will result in loss of vendor privileges. 3. HEALTHCARE INDUSTRY REPRESENTATIVE CHECK-IN All vendor visits require appointments. Vendors should not be soliciting without appointments. Security will verify vendor registration before issuing an UNMH vendor badge. For all visits, upon arrival at UNMH: 1. Check in with Security between 7:00am and 5:00pm. To sign in you must provide proper identification and a business card. You will also be asked to read and acknowledge the vendor guidelines before you are issued a UNMH vendor badge. The badge will be valid for the day and valid only for the specific area you have been authorized to access. The badge must be visible at all times while conducting business at UNMH. At the conclusion of your appointment, you are required to sign out. Note: Offsite Hospitals (UPC, CPC, CTH, OSIS) will have badges to distribute. Offsite Clinics will manage vendors due to minimal vendor access needed. For Surgical Services appointments at the Main Hospital or Outpatient Surgical and Imaging Services (OSIS): Note: vendors assigned to a case by a surgeon must arrive at the OR 30 minutes before the case starts. 2. Exceptions to the Monday-Friday, 7:00am 5:00pm appointment times listed above include those times when an approved vendor must be in attendance for a specific surgical procedure; this must be approved in advance by the OR Director or designee. 3. Per the OR Attire policy, all persons who enter the OR will wear UNMH provided scrubs. Scrubs will be donned in the OR dressing areas and can be obtained from the Linen Department. Linen personnel will check your vendor badge prior to issuing scrubs. Page 3

4. Upon arrival at the operating room, check in with the OR Director or Charge Nurse at the front desk of the Main OR and/or OSIS, sign and complete the Vendor Log Book at the front desk. 5. The OR Inventory Coordinator may be contacted and may escort you to and from the OR and/or Sterile Processing. 6. If the OR Inventory Coordinator is not available, or a procedure is delayed, you will be asked to wait in a designated non-patient care area. It is inappropriate for an industry representative to wait in the physician or employee lounges or cafeteria, or to use hospital phones, phone lines, or computers for business purposes. For Pharmacy appointments (for vendors marketing pharmaceuticals or providing clinical information regarding pharmaceuticals): 2. Vendors with appointments in the Main Hospital, Barbara and Bill Richardson Pavilion (BBRP), Mental Health Hospital, Child Psychiatric Hospital and Ambulatory Care Clinics (ACC) must check in at Pharmacy Administration. They will provide information regarding the person they are visiting with, where and what medication they are discussing. 3. Medications must be marketed consistent with FDA labeled indications and UNMH Formulary Guidelines. If UNMH Formulary Guidelines are more restrictive, only use for UNMH approved indications can be detailed. 4. A copy of all detail pieces used at UNMH must be provided and left on file in the Pharmacy Department. Detail pieces that promote a drug outside UNMH formulary guidelines may be prohibited from use at UNMH. 5. Vendors can not make false or misleading statements regarding competitor s products. 6. Any promotional materials for products not on the UNMH formulary must be clearly designated as Non-formulary at UNMH both during presentations and on any detail pieces left with providers. Vendors must inform providers that UNMH Pharmacy will no fill prescriptions or orders for Non-formulary products until they have been reviewed and approved by the Pharmacy and Therapeutics Committee. 7. Providers wishing to request a medication be added to the UNMH formulary should be directed to the Director of Clinical Pharmacy Services. Providers requesting the drug will need to complete a formal written request and submit this request for review by the Pharmacy and Therapeutics Committee. Requests for additions to the UNMH Formulary must come from a UNMH provider and not the vendor. 8. The Executive Director for Pharmacy, Director of Clinical Pharmacy Services, or Director of Pharmacy Operation will evaluate the new medications requested for addition to the formulary, schedule the product for review and provide recommendations to the Pharmacy and Therapeutics Committee. For appointments with Active Clinical Staff, Residents, Fellows, and Medical Students: 2. The clinical staff member s department may be contacted and may escort you to and from your appointment. Page 4

3. If a staff member is not available, you will be asked to wait in a designated nonpatient care area. It is inappropriate for an industry representative to wait in the physician or employee lounges or cafeteria, or to use hospital phones, phone lines, or computers for business purposes. 4. Upon arrival at your appointment, check in with the Department designee. Loitering in UNMH corridors, cafeterias, and other areas is prohibited. Meetings must be held in designated areas only (i.e., conference rooms, offices), not in public areas. 4. PARKING Vendors must park in designated parking areas and are responsible for obtaining parking permits from the UNMH Parking and Transportation Department. Permits will be issued on a daily, monthly, or yearly basis. For questions on parking permits, please refer to the Parking Policy on page 13 or call (505) 272-4074. 5. EVALUATION POLICY Equipment or products will not be purchased without first undergoing an evaluation. Product/equipment and technology is evaluated through UNMH s Value Analysis Program, which includes the committee process (i.e., Technology Assessment Committee, Product Standards Committee, Surgical Services Product Standards Committee). All new equipment or products must be introduced to the organization through the Value Analysis Facilitators. To present equipment or products for evaluation, contact the Value Analysis Facilitators to schedule an appointment. All equipment and/or products to be evaluated for use in a patient care area must be approved by the Value Analysis Facilitators prior to the beginning of the evaluation period. Should any faculty, physician, or staff member practicing or working at the Hospital have any financial or other interest in the equipment, product, and/or service being evaluated, the vendor must disclose the specific relationship to Materials Management and the Value Analysis Facilitators during the initial request for evaluation. Materials Management will not issue a purchase order for any sample product or technology for use in an evaluation unless approved prior to evaluation. All products and equipment must be FDA-approved or have IRB, IND, or IDE numbers for clinical use. Products unauthorized by Materials Management or the Value Analysis Facilitators and left by the vendor with a physician or Hospital staff member for patient use will not be paid for. Equipment: UNMH may not pay for equipment used during an evaluation. This includes, but is not limited to, rental fees, leasing fees, and evaluation fees. Page 5

Products: As a general rule, UNMH may not pay for products used during an evaluation. At UNMH s sole discretion, it may pay for disposable items used during an evaluation. 6. SURGEON REQUESTS FOR SUPPLIES, INSTRUMENTATION, OR EQUIPMENT When a surgeon or assistant/employee of a surgeon requests supplies, instrumentation, or equipment for a scheduled procedure, the vendor is required to contact the OR Director. If the order needs to be shipped to the hospital, a purchase order needs to be obtained in advance. Please include a complete inventory of all instruments delivered to the facility. A designated UNMH employee and a healthcare industry representative must check inventory lists. If a company representative is unavailable, a complete inventory list must still accompany all instrument sets. Invoices for all implants must be presented to the facility within 24 hours of the scheduled surgery time. Physicians are not authorized to enter the Hospital into any binding financial commitment(s). In the absence of a valid purchase order, the vendor will not be paid. 7. SAMPLES/DEMONSTRATIONS/IN-SERVICES FOR SUPPLIES OR EQUIPMENT All samples of supplies and/or equipment must be coordinated through the Value Analysis Facilitators and the appropriate clinical Nurse Educator before distribution to any clinical area(s). Medication samples should be formulary medications only. Medication samples can only be provided to clinics and providers that are approved for samples and follow the Ambulatory Sample-Clinic Procedure. The vendor needs to confirm with Pharmacy that samples can be provided for a clinic or providers prior to leaving samples. All samples for inpatient use need to be supplied to the Inpatient Pharmacy. 8. ITEMS BROUGHT INTO UNMH AS CONSIGNMENT UNMH will work with you to come to a written agreement on all consignment inventory programs. Each situation will be reviewed and determined based on mutual agreement. Items placed on consignment at UNMH may not be loaned or removed without written approval from the appropriate Unit or OR Director or designee. 9. IMPLANTS, EQUIPMENT, OR INSTRUMENTS USED BY SURGICAL SERVICES THAT BELONG TO THE VENDOR UNMH recognizes that there will be times when it is necessary for the vendor to provide instruments or equipment to complete patient procedures. In those instances, the vendor representative bringing products (implants, etc), instruments, or equipment to be used for a procedure must check in with the OR Director or designee and then deliver the products and instruments to the Supervisor of Sterile Processing in Surgical Services. Signatures from both a vendor representative and a hospital employee will be required on the Vendor Instrument Sign-In Sheet/Sign-Out, and to reclaim your products and instruments after use and sterilization. UNMH will not be responsible for the replacement of lost instruments or products if the counts are not completed as stated. UNMH will not be Page 6

responsible for instruments not picked up within 48 hours after terminal cleaning and sterilization. UNMH is not responsible for the product or any subsequent use of the product once it has been removed from UNMH property. 10. VENDOR INSTRUMENT DROP-OFF/PICK-UP If you are dropping off an instrument, the Director of the Operating Room or the Inventory Coordinator must be notified no later than 24 hours in advance of the scheduled case. All instruments and sets must be delivered at least 24 hours before a scheduled procedure to allow for sterilization. During regular working hours (Monday-Friday, 7:00am-5:00pm): 1. Upon arrival at UNMH, the instrumentation/implants will be taken to the Sterile Processing Department where the Sterile Processing Technician will check them in and have all vendors fill out the Vendor Instrument Sign-In/Sign-Out Sheet. 2. A full inventory sheet of all instrumentation/implants must be available at the time of check-in. 3. All instruments brought into UNMH will be accompanied with a MWI, Manufacturers Written Recommendations for processing requirements including decontamination, preparation, and sterilization (exposure times and temperatures). 4. The company name, surgeon s name, date of surgery, and the number of trays per systems should be labeled on the outside of the wrap. All trays must be properly sterilized through Sterile Processing prior to use. During off-hours: 5. Off-hours drop offs must be scheduled in advance with the OR Director or designee. The Charge Nurse will verify completeness of sets and assist vendors in filling out appropriate paperwork before sending instruments/implants to Sterile Processing. After use and sterilization, trays should not be wrapped (unless otherwise stated) and will be returned to the vendor pick-up cart in the OR. Vendors must retrieve their instrumentation/implants no later than 48 hours after terminal cleaning and sterilization. The hospital will not be responsible for the replacement of lost instruments or products if counts are not completed. 11. ACCESS TO PATIENT CARE AREAS Healthcare industry representatives of medical/surgical supplies and equipment are prohibited from entering direct patient care areas unless the presence of the representative is essential to the operation of the equipment/supply that has already been purchased. A patient care area is defined as any area in which an UNMH patient may receive care. The healthcare industry representative shall be allowed in the procedure room to observe only, and only with the consent of the patient (as obtained through the consent form) and the Page 7

permission of UNMH. The patient s procedure team (physician, surgeon, and/or anesthesiologist) may provide permission on behalf of UNMH. Sales representatives and/or vendors shall not perform or assist in any part of direct patient care including the operation of equipment (except pacemakers and/or lasers by nationally certified technicians) during a procedure. They may serve as technical advisors only. Representatives and/or vendors are not to operate any UNMH equipment. Representatives and/or vendors are not to touch patients at any time. Representatives and/or vendors may not scrub on any procedure. The representative and/or vendor will observe all sterile, safety, and OR techniques to maintain patient integrity, and abide by all confidentiality and HIPAA requirements. 12. CONTRACT/PRICE NEGOTIATION Materials Management is the only agent authorized by UNMH to approve pricing or a contract with a vendor or product sales representative. All contracts, voluntary agreements, price agreements, lease/rent agreements, or product evaluation agreements must be reviewed and approved by Materials Management. Contracts and agreements negotiated with a representative of the Hospital or School of Medicine faculty or staff, but without prior authorization by Materials Management will not be honored. Any products left by a vendor under an arrangement without prior approval by Materials Management are considered donations, and no further obligation will be assumed by the System or any of its facilities or departments. 13. GIFTS, GRATUITIES, AND ENTERTAINMENT In order to maintain compliance with federal and state law and to avoid any potential conflicts of interest, all UNMH employees are prohibited from accepting anything of value (including gifts, gratuities, or entertainment) offered by a supplier intending to induce, or given in return for patient referrals, the purchase, lease, or rental of any item or service, or to otherwise influence the decision-making process. To help eliminate the possibility of conflict of interest: 1. Departments and Units may not accept anything of value from potential or current suppliers except promotional or advertising items of nominal value (pens, pads, etc) or modest food that is given as part of a legitimate educational session sponsored by a supplier on campus. Page 8

2. 2. Donations cannot, in any way, be tied to patient referrals, the purchase, lease, or rental of any item or service, or to otherwise influence the decision-making process. If reasonable questions regarding the supplier s intent to influence the decisionmaking process exist, appropriate action will be taken, including the return of the donation to the supplier. 3. Hospital Administration must approve education sessions, in-servicing opportunities, and other issues not expressly addressed in this policy, but which might conflict with these guidelines. 4. Should any faculty, physician, or staff member practicing or working at the Hospital, whether employed by the Hospital or not, have a financial or other interest in any product, equipment, and/or service represented by a vendor, the vendor must disclose the relationship and specific interests to be derived by the faculty, physician, or staff member. 14. UNMH EMPLOYEE RESPONSIBILITIES Each member of UNMH s staff and all other members of UNMH patients medical teams (physicians, surgeons, anesthesiologists, etc) must report violations of these policies to the Executive Director of Materials Management. The staff member/member of the patient medical team should also instruct the product sales representative in violation of this policy to immediately report to the Executive Director of Materials Management. If the Executive Director of Materials Management finds the alleged violation to be valid, they will warn the healthcare industry representative/sales representative/vendor in writing that their conduct violates Hospital policy. Violations of policy could result in the cancellation of the healthcare industry representative s/sales representative s/vendor s privileges to visit the Hospital and the notification of the representative s company. 15. VIOLATION OF POLICIES These policies and regulations for healthcare industry representatives are to be followed rigidly. All UNMH staff will assist in monitoring the level of compliance. In the event that a member of UNMH s staff observes a vendor in a UNMH work area without an approved UNMH Vendor Badge, the staff member should do the following: 1. Ask the vendor if they are aware of the Vendor Access Policy. (If not, they should immediately be directed to Materials Management). 2. Ask the vendor for his/her name and company and either escort them off of the premises or call Security and wait with the vendor until Security arrives to escort him/her off the premises. 3. Notify Materials Management with the vendor information. Failure to comply with these policies can result in the following actions: First infraction: Loss of access privileges for one month Page 9

Second infraction: A letter of reprimand with a copy sent to the company representative s immediate supervisor and loss of privileges for three months Third infraction: A letter of reprimand with a copy sent to the company representative s immediate supervisor and loss of privileges for one year. 16. CONTINUING THE RELATIONSHIP By following the guidelines addressed above, you can develop a solid relationship with UNMH. However, if you feel that you cannot abide by our guidelines, then we simply ask that you do not pursue business with us. We have the right to control with whom we do business and when we will see you. If you have any question about our guidelines, please contact Materials Management or the Value Analysis Facilitators. Page 10

Summary Of How To Get New Product Into UNM Hospitals Vendors will need to contact the Value Analysis Facilitators to schedule an appointment for new product introduction Value Analysis Facilitators will contact Clinicians regarding product introductions Forms can be obtained on the intranet and filled out by requesting Clinician. Return forms to Value Analysis Facilitators. Product will need to go through one of UNMH s standards committees: o Product Standards Committee o Sugical Services Standard Committee o Technology Assessment Committee Value Analysis Facilitators will assist with setting up product evaluation Clinician not interested in trial If Committee approved the product, Materials Management will begin product transition into UNM Hospitals If Committee disapproves the Product End of Process Page 11

UNM Hospital and UNM Children s Hospital Vendor Guidelines 7AM 5 PM It is the policy of the University of New Mexico Hospitals (UNM Hospitals) to control access to its facilities, grounds, and information systems to help assure a secure environment for all patients, visitors, staff, physicians and assets. All healthcare industry representatives and/or their designees must be registered with UNMH through the Materials Management Department. It is the healthcare industry representative s responsibility to ensure that all information supplied to UNMH is correct and all protocols are complied with. Failure to provide accurate information and/or comply will result in loss of vendor privileges. The following guidelines outline procedures for all vendors visiting the hospital. To ensure patient safety, security and protection, it is vitally important that you follow these guidelines. 1. All vendor visits require appointments through the department or person to be visited 2. Security will verify each vendor registration and appointment before issuing a temporary vendor badge 3. All vendors must sign in at the security desk in the lobby area of the BBRP 4. All vendors will be required to provide proper identification and business card prior to being issued a temporary vendor badge (Official Drivers License or other government picture ID) 5. All vendors are required to wear the temporary vendor badge while present within UNMH Facilities 6. At the conclusion of the appointment, vendors are required to sign out 7. Between 5 PM and 8 PM, the vendor needs to call security at 272-2160 to sign out 8. Vendors should not be soliciting without appointments, this will result in the vendor being requested to leave property and can curtail future privileges 9. The vendor badge is valid for the day and only for the specific area you have been authorized to visit 10. All visitors and packages are subject to search upon entry into any UNM Hospitals Facility 11. All persons entering any UNM Hospitals facility may be requested to undergo a security-screening process, which can include a search of all packages and the use of a metal detection device. 12. Any person who wishes to not participate, will not be granted access and will be requested to leave the property 13. Vendor disruption of patient care or comfort will not be tolerated at any time 14. Vendors may have their privileges curtailed, or if necessary, be required to leave UNMH at any time by nursing supervisors or security personnel violation of vendor procedures 15. It is the policy of UNM Hospitals to prohibit weapons of any type on UNMH Property 16. It is the policy of UNM Hospitals that smoking is not permitted by anyone within or on the grounds of UNM Hospitals owned or operated facilities, I acknowledge that I have read and understand the UNM Hospitals vendor guidelines. My signature affirms that I agree to abide by the guidelines as set forth above. The purpose of the UNM Hospitals Security Management Plan is to provide a secure and safe environment that allows patients, visitors, personnel and volunteers to deliver or receive quality services with minimal threats against their personal well being and property. Electronic security monitoring systems are deployed throughout UNMH Facilities and UNM Health Sciences Center (UNM/HSC) Facilities Page 12

New OR Attire Policy Goes into effect February 2 All Staff including Surgeons, Residents, Med students, OR staff, Anesthesia staff PHYSICIANS EFFECTIVE 3/2/2009 UNMH provided scrubs (Greens) will be donned in the OR dressing areas upon entry or re-entry to the facility. ALL persons who enter the OR will wear attire intended for use in the OR. Long Sleeved jackets or lab coats must be worn for trips to other areas outside or OR (Lab coats must be washed take them home!). Non-scrubbed people may wear hospital provided disposable longsleeved jacket in OR. If you wear your scrubs outside of the hospital, you must change into clean scrubs before returning to OR. No cloth head covers allowed hair must be covered at ears and neck. Masks should be discarded properly they are not saved by hanging them around neck remove them. Non-dedicated OR shoes (worn out of hospital) must have shoe covers. Dedicated OR shoes are not worn out of the hospital. Page 13

Page 14

Page 15

Page 16

Page 17

Department Policies and Procedures University Hospitals Food and Nutrition Services Primary Age Group: All Ages X Newborns Pediatrics Adults POLICY: It is the policy of the University Hospitals that the Food and Nutrition Department will provide all food and nutrition services to the medical facility. This includes patient food and nourishment, enteral feedings, catered food for special functions, and maintaining an employee restaurant. The department also provides for all aspects of nutritional care and education for inpatients of all ages and acts as a referral for the clinics and outpatients. The department is a source of nutrition information for hospital employees. GENERAL INFORMATION and DESIRED OUTCOMES: 1. University Hospital Food & Nutrition Department Phone Numbers: 1.1 Director of Food and Nutrition 2-0212 1.2 Manager of Food Production 2-9085 1.3 Manager of Retail and Catering Services 2-0950 1.4 Supervisors 2-2224 1.5 Manager of Clinical Nutrition 2-2967 1.6 Clinical Dietitians 2-0213 2-0214 1.7 Nutrition Care Office 2-2152 2-2153 1.8 Carrrie Tingley Café 2-5395 2. Behavioral Health Services Food & Nutrition Departments Phone Numbers: 2.1 Children's Psychiatric Center 2.1.1 Director Food Service 2-8078 2.1.2 Supervisor 2-8810 2.1.3 Kitchen 2-0088 2.1.4 Cafeteria 2-9737 Page 18

2.2 2.2 University Psychiatric Center 2.2.1 Director Food Service 2-2913 2.2.2 Supervisor 2-1334 2.2.3 Kitchen/Cafeteria 2-8799 3. University Hospital Food and Nutrition Department: 3.1 Hours of Operation: The department is open from 4:00 a.m. until 10:00 p.m. A supervisor is on-duty from 4:30 a.m. to 8:30 p.m. and can be reached by calling 2-2224 or 2-2152. If food is needed after 8:30 p.m., there is a Food and Nutrition Services employee in the Cafeteria until 10:00 p.m. Vending services are provided 24 hours. 3.2 Hours of Service: 3.2.1 Patient Meal Service: Breakfast tray line is from 7:00 a.m. to 8:00 a.m.; lunch tray line from 11:30 a.m. to 1:00 p.m.; and dinner tray line from 4:30 p.m. to 6:00 p.m. 3.2.2 Catering Events: The Food and Nutrition Department is responsible for all catering of hospital functions within University Hospital and the Ambulatory Care Center during the hours of 6:00 a.m. to 6:00 p.m., Monday through Friday. If catering is needed at other times, please contact the Food and Nutrition Department at extension 2-2224 to make arrangements. 4. University Hospital Cafeteria: 4.1 Cocina de Salud Cafeteria is open for staff and visitors only. If hospital inpatients want to be served, they need documentation of their diet order. 4.2 The restaurant operates a grill for short-order items, a hot food line, salad bar, and offers specialty sandwiches and salads. 4.3 Hours of Service: 4.3.1 Breakfast: Full breakfast is served from 6:00 a.m. to 10:00 a.m. The grill is open from 6:00 a.m. to 10:00 a.m. 4.3.2 Lunch: Hot entrees are served from 11:00 a.m. to 2:00 p.m. The grill is open from 11:00 a.m. to 2:00 p.m. 4.3.3 Dinner: Hot entrees are served from 4:30 p.m. to 10:00 p.m. The grill is open from 4:30 p.m. to 10:00 p.m. 4.3.4 The cafeteria is closed for set up from 10:00 a.m. to 11:00am. 5. Behavioral Health Services: 5.1 Hours of Operation: 5.1.1 Children's Psychiatric Center 6:30 a.m. - 6:00 p.m. Monday - Friday 9:00 a.m. - 6:00 p.m. Saturday- Sunday, Holidays 5.1.2 University Psychiatric Center 6:30 a.m. - 6:30 p.m. 7 days a week 5.2 Hours of Service: 5.2.1 Patient Meal Service - Children's Psychiatric Center Breakfast: 7:15 a.m. - 8:00 a.m. Monday - Friday Lunch: 11:00 a.m. - 12:00 Noon Page 19

Dinner: 5:00 p.m. - 6:00 p.m. 5.2.2 Patient Meal Service University Psychiatric Center Breakfast: 7:30 a.m. - 8:30 a.m. Lunch: 11:0 0 a.m. - 12:00 Noon Dinner: 5:00 p.m. - 6:00 p.m. 5.3 Cafeteria for Guests and Staff: 5.3.1 Children's Psychiatric Center Breakfast: 7:30 a.m. - 8:30 a.m. Continental Fare Lunch: 12:00 Noon - 1:30 p.m. Dinner: 5:00 p.m. - 6:00 p.m. 5.3.2 University Psychiatric Center Breakfast: 7:30 a.m. - 9:00 a.m. Lunch: 11:45 a.m. - 1:15 p.m. Dinner: 5:00 p.m. - 6:00 p.m. 5.4 Catering Events: Food and Nutrition Department handles catering functions within the hospitals and at various hospital functions within the Health Science Center. One week advance notice is preferred with minimum of 48 hour notice. Cancellation of the event should occur within 24 hours. Contact the numbers above for assistance. PROCEDURE: 1. Procedures for catering: 1.1. Contact the Food and Nutrition Department to either pick up a catering brochure or to plan a menu. A seven (7)-day notification of the event is requested. 1.2. Payment can be made by either of the following four methods: 1.2.1. Cash or check made out to CPC or UPC or UH Food & Nutrition Department 1.2.2. Purchase Requisition. 1.2.3. Credit Card at UH 1.2.4 If requesting support of payment, the request must first be submitted to the Administrator in charge of Professional Services for approval. 1.3. Any verbal arrangements must be followed up by a written confirmation. 1.4. If a cancellation of a meeting is necessary, please cancel at least 24 hours in advance. Events that are canceled less than 24 hours will be subject to a charge at the discretion of the Food and Nutrition Management. Development Date: October 1991 Developed By: Director, Food & Nutrition Services Revised Date: 12/96, 1/99, 5/00, 11/03 Reviewed By: Food Service Director and Managers UH, UPC/CPC Approved By: Director of Food and Nutrition Services Approved Date: 9/00, 11/03 (Food and Nutrition Services.doc) Page 20

Policy UNMHSC Clinical Operations Primary Age Group: All Ages X Use and Disclosure of Protected Health Information Newborns Pediatrics Adults POLICY : It is the policy of the University of New Mexico Health Sciences Center (UNMHSC) to protect our patients private health information maintained in designated record sets against unlawful use or disclosure, in accordance with applicable laws and regulations, and to disclose protected patient information only in accordance with the law and procedures stated in this policy. This policy applies to all patient identifiable health information contained in designated records sets (See, UNMHSC Policy: HIPAA Designated Record Set), whether in oral, paper or electronic form, and to all UNMHSC employees, providers, volunteers, and contractors having access to the PHI. CROSS REFERENCES: Patient Rights and Responsibilities HIPAA Designated Record Set HIPAA Patient Privacy: Right to Request to Amend Record Set Patient Right to Access Charges for Access Electronic transmissions/e-mail GENERAL INFORMATION and DESIRED OUTCOME: 1. Protected patient health information 1.1. oral, paper or electronic information; 1.2. identifies or may be likely to lead to the identification of the individual patient; and 1.3. the information relates to the past, present or future health of the individual patient. 2. A patient s personal representative as used in this Policy is: Page 21

2.1 2.1 For an unemancipated minor, a personal representative is the individual patient s parent, guardian, custodian, or person serving in loco parentis to the minor. 2.1.1 if the minor is authorized by state law to provide the only required consent for the medical, mental health, or rehabilitative services, the minor must consent unless the minor lacks decisional capacity. 2.1.2 if New Mexico law is silent with regard to whether an unemancipated minor may solely consent to the medical or mental health services, then the physician will determine whether disclosure to the personal representative is in the unemancipated minor s best interests. Contact UNMHSC Office of General Counsel. 2.2 For an adult who lacks decisional capacity, a personal representative is a courtappointed guardian, an agent named by the individual patient in an advance directive, or a surrogate health care decision-maker according to the New Mexico Uniform Health Care Decisions Act, 24-7A-1, et. Seq., NMSA 1978, as amended. 2.2.1 If a provider believes that disclosing to the personal representative may be harmful to the individual patient, the provider must contact UNMHSC Office of General Counsel, (505) 272-2377, MS09 5300UNMHSC Health Sciences and Services Bldg., 318. 3 Designated record sets are maintained by UNMHSC (See: UNMHSC Policy HIPAA Designated Record Sets ): 3.1 To provide continuity of care to the patient; 3.2 To evaluate the quality of the care and services to the patient and provide data necessary for hospital and clinical operations; 3.3 To obtain payment or establish a claim for payment for rendered care; 3.4 To provide a record to assist UNMHSC in defending against claims or lawsuits; 3.5 For medical education, training, and research; 3.6 To identify deceased persons by established medical, x-ray, dental or other records when identification cannot be established by ordinary means. 4 The UNMHSC will make reasonable efforts to limit the use or disclosure to the minimum amount of information necessary to accomplish the purpose of the use or disclosure, except when 4.1 The request for information is made by the individual patient or the individual patient s personal representative; 4.2 When the information is requested by the US Department of Health and Human Services 4.3 Federal or state laws require use or disclosure beyond the minimum necessary. Page 22

5 All UNMHSC and UNM Hospital staff, employees and volunteers who, because of their job descriptions, have need to access protected health information must have a current Certificate of Confidentiality on file; all staff, employees and volunteers requesting access to protected health information must produce valid identification. 6 UNMHSC is required to keep an accounting of disclosures of protected health information made after April 14, 2003. A individual patient has the right to receive an accounting of disclosures of protected health information made by the UNMHSC during the six years prior to the date the accounting is requested, except for disclosures for 6.1 treatment, payment or hospital operations 6.2 national security and intelligence purposes 6.3 routine disclosures made to Business Associates or Trading Partners 6.4 to the individual patient who is the subject of the protected health information; 6.5 incidental disclosures made during use or disclosure otherwise permitted or required 6.6 pursuant to an authorization 6.7 the facility s directory or to persons involved in the individual patient s care or other notification purposes; 6.8 to correctional institutions or law enforcement officials 6.9 as part of a limited data set 6.10 that occurred prior to April 14, 2003 7 For assistance and information about UNMHSC s uses and disclosures of protected health information, contact 7.1 the UNMHSC Privacy Officer, (505) 272-2121, UNM Hospital, 2211 Lomas Blvd., NE, Albuquerque, NM 87106; or 7.2 the UNMHSC Office of General Counsel, (505) 272-2377, UNMHSC Health Sciences & Services Bldg., 318. 8 Uses and disclosures: 8.1 Authorization not required for: 8.1.1 Treatment for the individual patient, including the coordination and management of health care among health care providers or by a health care provider with a third party, consultations between health care providers, and referrals of a patient for health care from one health care provider to another. 8.1.1.1 UNMHSC may also disclose protected health information to another covered entity or health care provider for their payment activities for health services rendered to the individual patient. 8.1.2 Payment, including using and disclosing the minimum necessary information to third party payers, insurance companies, ambulance services, other Page 23

8.1.3 hospitals and providers who also have a treatment relationship with the patient in order for all providers of health care services to receive payment. 8.1.3 UNMHSC clinical operations, including such activities as quality assurance, peer review and risk management; fiscal management and planning; staffing; equipment and capital purchases; planning; program development and implementation, education, training, and skills improvement programs; resolution of internal grievances, and other activities which allow a hospital or clinic to maintain and develop its health care programs. 8.1.3.1 UNMHSC may disclose protected health information to another covered entity for its health care operations activity or fraud and abuse detection or compliance, if the other covered entity has or has had a relationship with the individual patient who is the subject of the protected health information being requested, and the requested information pertains to such relationship. 8.1.4 To report child, vulnerable adult, and resident abuse, neglect or exploitation to the appropriate government entity authorized by law to receive and investigate such reports and pursue social services, health care, and legal services for the patient. 8.1.4.1 UNMHSC must attempt to notify the vulnerable adult or the vulnerable adult s personal representative that a report is to be made, except that the vulnerable adult s personal representative should not be notified if the provider believes telling the personal representative would place the vulnerable adult in danger. 8.1.5 To report matters of national security and intelligence to the appropriate authorities. 8.1.6 To respond to a valid written request for past, present or future health information about an individual patient when the individual patient is currently in law enforcement custody or control, such as an inmate in a jail, prison, detention center, honor farm or halfway house, on parole or probation, or in a program of criminal rehabilitation prior to the termination of such parole or probation, or program of rehabilitation. 8.1.7 To assist law enforcement in identifying or locating a missing person or fugitive; 8.1.8 To disclose to law enforcement upon official written request, when the requested information is about an individual patient who is suspected to be a victim of a crime or to report a crime on the UNMHSC campus; 8.1.9 By a provider of emergency medical services in response to a medical emergency to report a crime, including the commission and nature of the crime; the location of the crime; the identity, description, and location of the perpetrator of such crime. Page 24

8.1.10 8.1.10 To health oversight authorities for required reporting of certain diseases and injuries and for other health oversight activities, such as for licensure and accreditation. 8.1.11 To the medical examiner or a coroner for identification of a deceased individual patient, the determination of death, and to carry out their other lawful duties; 8.1.12 To funeral directors to carry out their duties, and in reasonable anticipation of death. 8.1.13 For research purposes if the researcher first obtains the appropriate waiver or approval of the institutional review board ( IRB ; HRRC ) or otherwise complies with the HIPAA Privacy Policy. (See, Policy: Use and Disclosure of Protected Health Information for Research). Documentation of IRB/HRRC approval or waiver must be maintained by UNMH MIS. 8.1.14 To the government about an individual patient who is on active military service or is a veteran receiving veteran s services. 8.1.15 To government programs providing public health benefits to the individual patient; 8.1.16 To disclose protected health information as authorized by and to the extent of the law to comply with worker s compensation or other similar programs. 8.1.17 For inclusion in the hospital directory and to provide general health information to friends and family who call and request the status of a patient by name, unless the individual patient opts out of this provision. 8.1.18 To provide a hospital patient s name, religious affiliation to a member of the clergy unless the individual patient opts out of this provision. 8.1.19 To the appropriate organization for cadaveric organ, eye or tissue donation 8.1.20 For specialized government functions. 8.1.21 To avert serious imminent threat to health or safety of the individual patient or another person. 8.1.22 To family and friends calling to inquire about a specific hospitalized individual patient s condition, stated in general terms (e.g., critical, stable, improved ), including the individual patient s location in the hospital, unless the individual patient requests that no information be given. 8.2 Authorization required for: 8.2.1 All non-routine uses and disclosures of protected health information; 8.2.2 For UNMHSC marketing activities if the individual patient is provided an opportunity to opt out of further contact by the UNMHSC, but no authorization required if Page 25

9 Core elements of a valid authorization: 8.2.2.1 the marketing activity occurs in a face-to-face meeting between a provider and the individual patient and marketing information is about products and service related to the individual patient s health; 8.2.2.2 the marketing activity involves a gift or service of nominal value. 8.2.2.2.1 if the marketing involves direct or indirect payment to the UNMHSC from a third party, the Authorization must state that the remuneration is involved. 8.2.2.3 Use and disclosure of psychotherapy notes, unless the use or disclosure is 8.2.2.3.1 use by the originator of the psychotherapy notes 8.2.2.3.2 under supervision, use and disclosure in educating, training, improving the skills of mental health providers in counseling. 9.1 Specific and meaningful description of the information to be disclosed ; 9.2 Specific justification for disclosure of the entire record. 9.3 Addressed to the UNM Health Sciences Center, a clinical facility of the UNMHSC, or a UNMHSC credentialed provider; 9.4 Identifies the persons or class of persons to whom the disclosures are to be made; 9.5 Specifies the purpose of the disclosure 9.5.1 When the individual patient initiates the authorization for his or her own purposes, a statement such as At the individual patient s request is sufficient 9.6 An expiration date or event (e.g., none ; end of research ); 9.7 The patient s or personal representative s signature and date; 9.7.1 If signed by a personal representative, a description of his or her authority to act for the individual patient, i.e.; 9.7.2 An unemancipated minor s authorization must be signed by the minor s personal representative (e.g., parent; legal guardian; custodian; person en loco parentis to the minor). (NOTE: See Exceptions Section A2.1this policy re: Minors); 9.7.2.1 If the personal representative is other than an unemancipated minor s parent, then proof of authority and documentation in the designated record set is required. 9.8 The authorization contains a statement notifying the individual patient that the individual patient may revoke the authorization in writing at any time except to Page 26

the extent the UNMHSC has used or disclosed the information according to the authorization; 9.9 The authorization contains a statement notifying the individual patient that the information disclosed according to the authorization may not be protected against disclosure by the third party authorized to receive the information; 9.10 For deceased persons, the authorization is signed by the next of kin, or legal administrator or personal representative of the deceased's estate with proof of authority and proper identification documented in UNMHSC file: 9.11 If the Individual patient is unable to sign the authorization by reason of physical or mental status, the authorization must be signed by the patient s personal representative. 9.12 Authorizations for disclosure of records of drug and alcohol rehabilitation services, HIV/AIDS testing results, mental health services, psychotherapy notes, research subjects, genetic information and analysis must comply with additional legal requirements as set out in applicable sections in this policy. 10 An authorization will be deemed invalid if: 10.1 The expiration date has passed. 10.2 The authorization has not been filled out completely. 10.3 The authorization is known by UNMHSC to have been revoked. 10.4 Any information in the authorization is known by the UNMHSC to be false. 10.5 The authorization does not contain a statement that information disclosed pursuant to the authorization may no longer be protected after disclosure. 10.6 The authorization does not contain a statement that the individual patient may revoke the authorization at any time except to the extent the UNMHSC has already acted on the authorization. 10.7 The authorization is not properly executed. 11 Legal process 11.1 Subpoenas must be accompanied by the authorization of the individual patient or by satisfactory assurances, in writing, documenting that 11.1.1 the party requesting the information has made a good faith attempt to provide written notice to the patient; 11.1.2 the notice included sufficient information about the litigation or proceeding in which the health information is requested in order to permit the individual patient to raise objections with the court or administrative tribunal; and 11.1.3 the time for the individual patient to raise objections has elapsed and Page 27 11.1.3.1 no objections were filed; or

11.1.3.2 11.1.3.2 all objections filed have been resolved by the court or tribunal and the 11.1.3.3 disclosures being sought are consistent with such resolution. 11.2 Letters from an attorney requesting protected health information must be accompanied by a valid authorization (See Section Nine), or by a subpoena and the required assurances. 11.3 Questions or concerns, contact the: 12 Methods of Disclosure 11.3.3 UNMHSC Privacy Officer, (505) 272-2121, fax 272-, UNM Hospital, 2211 Lomas Blvd., NE, Albuquerque, NM 87106; or 11.3.4 UNMHSC Office of General Counsel, at (505) 272-2377, fax 272-1938, UNMHSC, MS09 5300, Health Sciences & Services Bldg., 318. 12.1 Paper copies of the information to be disclosed must be made by the HIM/Medical Records department, unless otherwise authorized by UNMHSC. 12.2 Electronic disclosures (e.g., by telephone, fax, computer) must be made according to the UNMHSC policy on electronic transmission of protected health information. 13 Charges for copies or summaries of records 13.1 See UNMHSC Policy: Charges/Patient Release Information ; 13.2 Copies for Applicants for Disability Benefits (Social Security Administration): 13.2.3 Within thirty days of receiving a request from a patient or former patient who is applying for benefits based on a disability or who is appealing a denial of such benefits or from an authorized representative of such a patient or former patient, the UNMHSC HIM/Medical Records Department shall furnish the requestor with a copy of that patient s medical records. 13.2.4 Charges are according to Policy: Charges/Patient Release Information ; 13.3 Inform the requestor of charges in accordance with the policy, Charges/Patient Release Information, and that the requestor may be billed by the University and/or its business associate responsible for making such copies or producing the agreed-to summaries of the protected health information; 13.4 Any exception to this procedure must be approved by the Director of HIM/Medical Records, the Patient Assistance Coordinator, or by the UNMHSC clinical facility s administrator. 14 Disclosure of Specially Protected Health Information 14.1 Disclosure of information from confidential drug and alcohol abuse rehabilitation records (42 CFR Part 2): Page 28

14.1.3 14.1.1 With the valid authorization of the individual patient, or, if the individual patient lacks decisional capacity, the authorization of the individual patient s personal representative 14.1.2 Without the individual patient s authorization 14.1.2.1 To medical personnel to the extent necessary to meet a bona fide medical emergency; 14.1.2.2 To qualified personnel for scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify directly or indirectly, any individual patient in any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner; 14.1.2.3 To insurer or other third party payer only for the purpose of obtaining payment for services. The program director may exercise the right of the individual patient to consent to a disclosure for this purpose, if the individual patient, other than a minor or an adult who has been adjudicated incompetent, suffers from a medical condition that prevents knowing or effective action on his or her own behalf; 14.1.2.4 When authorized by an appropriate order of a court of competent jurisdiction granted upon a showing of good cause and the order is accompanied by a subpoena duces tecum; 14.1.2.5 Reporting under state law of incidents of suspected child abuse and neglect to the appropriate state or local authorities 14.1.3 Except as authorized by court order (see 1.2.4 above), no record may be used to initiate or substantiate any criminal charges against a patient or conduct any investigation of a patient; 14.1.4 Form of Authorization for disclosure of 42 CFR Part 2 records: 14.1.4.1 The authorization is in writing and contains: 14.1.4.1.1 The specific name or general designation of the program or person permitted to make the disclosure. 14.1.4.1.2 The name or title of the person or organization to which disclosure is to be made (e.g., Centers for Medicare and Medicaid Services(CMS), including the appropriate intermediary or carrier, specified by name); 14.1.4.1.3 The name of the individual patient; 14.1.4.1.4 The purpose or need for the disclosure (e.g., for processing a claim for Medicare payment and for such evaluation of the treatment program as is legally and Page 29

administratively required in the overall conduct of the Medicare program); 14.1.4.1.5 How much and what kind of information is to be disclosed; 14.1.4.1.6 The signature of the patient or personal representative; 14.1.4.1.7 The date on which the authorization is signed; 14.1.4.1.8 The date on which the consent is signed; 14.1.4.1.9 Statement that the authorization is subject to revocation at any time, except to the extent that the program or person, making the disclosure, has already acted in reliance on it (Acting in reliance includes the provision of services in reliance on a valid authorization or consent to disclose information to a third-party payer.); 14.1.4.1.10 If the patient wishes, the consent statement may be expanded to permit disclosure by a provider to any other person, organization, or program, as appropriate. Authorization may also be given to CMS and its contractors to re-disclose specific information to third party payers for insurance purposes. The provider should keep the signed authorization with the patient's medical records; 14.1.4.1.11 If the patient wishes, the consent statement may be expanded to permit disclosure by a provider to any other person, organization, or program, as appropriate. Authorization may also be given to CMS and its contractors to re-disclose specific information to third party payers for insurance purposes. The provider should keep the signed authorization with the patient's medical records; 14.1.4.1.12 The date, event, or condition upon which the consent will expire if not revoked before. The date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given. 14.1.5 REQUIRED STATEMENT MUST ACCOMPANY DISCLOSURE: This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. Page 30

A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient." 14.2 Disclosure of HIV/AIDS Testing results 14.2.1 With the authorization of the individual patient (whether adult or unemancipated minor) 14.2.2 With an appropriate court order if the individual patient is unable or unwilling to authorize disclosure and the requestor is 14.2.2.1 An exposed first responder (e.g., EMT, law enforcement, firemen and public safety officer, nurse, physician or other health-care provider rendering aid to the individual patient); or 14.2.2.2 A victim of criminal sexual assault 14.2.3 REQUIRED STATEMENT MUST ACCOMPANY DISCLOSURE: "This information has been disclosed to you from records whose confidentiality is protected by state law. State law prohibits you from making any further disclosure of such information without the specific written consent of the person to whom such information pertains, or as otherwise permitted by state law. A person who makes an unauthorized disclosure of this information is guilty of a petty misdemeanor and shall be sentenced to imprisonment in the county jail for a definite term not to exceed six months or the payment of a fine or not more than five hundred dollar ($500), or both." 14.3 Disclosure of sexually transmitted diseases including HIV/AIDS to government/public health authorities 14.3.1 With the authorization of the individual patient or, if appropriate, the individual patient s personal representative; 14.3.2 Without the individual patient s or individual patient s personal representative s authorization, disclosure may be made only to: 14.3.2.1 The New Mexico Department of Health and the Centers for Disease Control and Prevention of the United States Public Health Service in accordance with reporting requirements for a diagnosed case of a sexually transmitted disease. HIV/AIDS test results are transmitted to the Department of Health in accordance with reporting requirements established by regulation. [State regulation 7 NMAC 4.3.11, Notifiable Diseases/Conditions in New Mexico, Section 11.2.4 Human Immunodeficiency Virus (HIV) and Acquired Page 31

14.3.2.2 Immunodeficiency Syndrome (AIDS) outlines requirements for reporting to the state Office of Epidemiology.] 14.3.2.2 A health facility or health care provider that procures, processes, distributes or uses: 14.3.2.2.1 A human body part from a deceased person, with respect to medical information regarding the person; 14.3.2.2.2 Semen for the purpose of artificial insemination; (for HIV/AIDS patient, semen provided prior to the effective date of the HIV Test Act, June 16, 1989, for the purpose of artificial insemination); 14.3.2.2.3 Blood or blood products for transfusion or injection; or 14.3.2.2.4 Human body parts for transplant with respect to medical information regarding the donor recipient; 14.3.2.2.5 Health facility staff committees or accreditation or oversight view organizations that are conducting program monitoring, program evaluation or service review, as long as any identity remains confidential; 14.3.2.2.6 Authorized medical or epidemiological researchers who may not further disclose any identifying characteristics or information; and 14.3.2.2.7 For purposes of application or reapplication for insurance coverage, and to insurers or reinsurers upon whose request the test was performed. 14.3.2.2.8 Test results of persons formally charged for allegedly committing certain criminal offenses may be disclosed to the victim of the alleged criminal offense or the victim's parent or legal guardian. 14.3.3 With authorization of the adult or minor individual patient or, if the individual patient lacks decisional capacity, the individual patient s (See Section 4.2 for definition) Disclosure may be made to: 14.3.3.1 Patient or the appropriate personal representative; 14.3.3.2 Any person designated in a legally effective authorization to release of the test results executed prior to or after the test by the patient or the patient's appropriate personal representative; 14.3.3.3 An authorized agent, a member of the medical staff or an employee of UNMHSC or provider if the health care facility itself is authorized to obtain the test results, the agent or employee provides patient care or handles or processes Page 32

15 14.3.3.4 specimens of body fluids or tissues, and the agent or employee has a need to know such information; 14.3.3.4 The authorization to disclose information form must be in writing and include: 14.3.3.4.1 The name of the organization (hospital, etc.) which is making the disclosure; 14.3.3.4.2 The name or title of the person or organization to which disclosure is to be made; 14.3.3.4.3 The name of the patient;\ 14.3.3.4.4 The purpose or need for the disclosure; 14.3.3.4.5 The extent or nature of information to be disclosed; 14.3.3.4.6 A statement specifying a date (not to exceed one year, after which renewal is required), event, or condition upon which consent will expire without written revocation; 14.3.3.4.7 The date on which the consent is signed; 14.3.3.4.8 A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. This includes the provision of treatment services in reliance on a valid consent to disclose information to the third party payer. 14.3.3.4.9 The signature of the patient, or, if the patient lacks capacity, the signature of the legally authorized representative. Disclosure of mental health and developmental disabilities information: 15.1 Without authorization of the individual patient or the individual patient s personal representative, as appropriate to (Note: The form described under this section 15.1 should be filled in and placed in the chart, recording any release of information, and specifying that consent is not needed for this specific release.) 15.1.1 A mental health or DD professional or employee or trainee working with mentally disordered or developmentally disabled persons, to the extent that individual patient s practice, employment or training on behalf of the patient requires that the individual patient have access to such information; 15.1.2 When necessary to protect against a clear and substantial risk of imminent serious physical injury or death inflicted by the client on himself or another; 15.1.3 A primary caregiver of the patient; the information shall be limited to what is necessary for the continuity of the patient's treatment in the judgment of Page 33

the treating physician or certified psychologist who discloses the information; 15.1.4 An insurer contractually obligated to pay part or all of the expenses relating to the treatment of the patient at the residential facility. The information disclosed shall be limited to data identifying the patient, the facility and the treating or supervising physician and the dates and duration of the residential treatment. 15.2 With the authorization of the individual patient or, if the patient lacks capacity, the individual patient s personal representative, to: 15.2.1 Patient over 14 years of age and their parent, guardian or legal 15.2.2 custodian; 15.2.3 Parent, guardian or legal custodian of patient under age 14; 15.2.3.1 Disclosures requested in both 4.2.1 and 4.2.2 must be approved by an appropriate mental/behavioral health provider. If a physician or other mental health or DD professional believes and notes in the patient's medical records that such disclosure would not be in the best interest of the patient, then disclosure to the patient or parent, legal guardian custodian may be denied. 15.3 CORE ELEMENTS OF VALID AUTHORIZATION to disclose mental health and developmental disability information: 15.3.1 The authorization must be in writing; 15.3.2 A statement of the patient s right to examine and copy the information to be disclosed; 15.3.3 The name of the hospital or UNMHSC clinic, unit, department, provider that is to make the disclosure; 15.3.4 The name or title of the proposed recipient of the information; 15.3.5 The name of the patient; 15.3.6 A description of the use that may be made of the information; 15.3.7 The date the authorization is signed; 15.3.8 The signature of the individual patient or, if the patient lacks capacity, signature of the individual patient s personal representative as defined in this policy. 16 Disclosure of genetic information obtained after May 20 1998 or results of genetic analysis obtained after May 20, 1998 from medical records (Legal liabilities attaching to violations to the Genetic Information Privacy Act apply to genetic information or analysis results regardless of when they were obtained.) 16.1 Without authorization of patient or appropriate personal representative, (as defined in Section 15.2), a person's genetic information or results of genetic analysis may be obtained, transmitted or used, pursuant to federal or state law or regulations only. Page 34

16.1.1 To identify a person in the course of a criminal investigation by a law enforcement agency; 16.1.2 The person has been convicted of a felony, for purposes of maintaining a DNA database for law enforcement purposes; 16.1.3 To identify deceased persons 16.1.4 To establish parental identity; 16.1.5 To screen newborns; 16.1.6 If the genetic information or results of the genetic analysis are not identified with the person or person's family members; 16.1.7 By a court for determination of damage awards pursuant to the Genetic Information Privacy Act; 16.1.8 By medical repositories or registries; 16.1.9 For the purpose of medical or scientific research and education, including retention of genetic information or genetic analysis if the identity of the person or person's family members is not disclosed; or 16.1.10 For the purpose of emergency medical treatment consistent with applicable law. 16.1.11 Actions of an insurer and third parties dealing with an insurer in the ordinary course of conducting and administering the business of life, disability, income or long-term care insurance are exempt from the above provisions if the use of genetic analysis or genetic information for underwriting purposes is based on sound actuarial principles or related to actual or reasonably anticipated experience. However, before or at the time of collecting genetic long-term care insurance, the insurer shall notify in writing an applicant for insurance or the insured that the information may be used, transmitted or retained solely for the purpose stated above. *NOTE: Nothing in section 16 authorizes obtaining, retaining, transmitting or using a patient's genetic information or the results of genetic analysis if the patient or, as appropriate, the patient s personal representative objects on the basis of religious tenets or practices. 16.2 With the individual patient s authorization, or, as appropriate, the individual patient s personal representative, for : 16.2.1 Psychotherapy notes except: 16.2.1.1 To carry out treatment, payment or other health care operations 16.2.1.1.1 Use by the originator of the psychotherapy notes for treatment 16.2.1.1.2 Use by the facility for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or Page 35

16.2.1.1.3 Use by the facility to defend itself in a legal action or other proceeding brought by the patient or the patient s personal representative. 16.2.2 REQUIRED ELEMENTS OF THE AUTHORIZATION: 16.2.2.1 The name of the organization (hospital, etc.) or provider to make the disclosure; 16.2.2.2 The name or title of the person or organization to which disclosure is to be made; 16.2.2.3 The name of the individual patient; 16.2.2.4 The purpose or need for disclosure; 16.2.2.5 A specific date (not to exceed one year, after which renewal is required), event, or condition upon which the authorization will expire without written revocation. 16.2.2.6 The date on which the consent is signed; 16.2.2.7 The signature of the individual patient, or, if individual patient lacks capacity, the signature of the personal representative, printed name, and proof of authority (e.g., parent of a minor ; court appointed guardian ). REFERENCES: Health Insurance Portability and Accountability Act of 1996, 45 CFR Parts 160 and 164; 42 USCA s 290dd-2 (1992), (Confidentiality of Records); 42 CFR Part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records); NMSA 1978, Section 24-7A-5 and 24-7A-8 (1997), (Uniform Health Care Decisions Act); 7 NMAC 7.2.7.10; NMSA 1978, Section 24-1-9.4 and Section 24-1-9.5(1996), (Sexually Transmitted Diseases); NMSA 1978, Section 24-2B-6 (1999), (Human Immunodeficiency Virus Testing); NMSA 1978, Section 24-1B-7 (1997), (County Maternal Child Health Plan); 7 NMAC 4.3.8 and 7 NMAC 4.3.11 (Control of Disease & Conditions of Public Health Significance); 42 CFR s 438.224; NMSA 1978, Section 43-1- 19 (1998), (Mental Health and Developmental Disabilities); NMSA 1978, Section 24-21- 1 to 24-21-7 (1998), (Genetic Information Privacy); HCFA Manuals, Hospitals HO 191.4; HCFA State Operating Manual (SOM). R. Philip Eaton, MD, Vice President, Health Sciences Date Page 36

Development Date: _12/02 Developed By: _HIPAA Privacy Subcommittee Revised Date: _UNMHSC University Counsel 1/03 Reviewed By: P.J. Tietjen Approved By: P.J. Tietjen Approved Date: 02/03 (Use and Disclosure of PHI Policy.doc) Applies To: UNM HSC Functional Area: Compliance Component (If Limited To): Department (If Limited To): Title: CODE OF CONDUCT/ORGANIZATIONAL ETHICS POLICY Policy Patient Age Group: 0(X) N/A ( ) All Ages ( ) Newborns ( ) Pediatric ( ) Adult POLICY STATEMENT The purpose of this Code of Conduct/Organizational Ethics Policy (hereinafter Code of Conduct ) is to provide standards by which all HSC faculty and staff will conduct themselves in order to protect and promote HSC-wide integrity and to ensure compliance with the many laws and regulations under which the HSC operates. All employees and third-party affiliates of the HSC are obligated to incorporate the Code of Conduct into their daily performance. As the Code of Conduct is based on federal and state laws and regulations, failing to follow the Code of Conduct, and any operational policies and procedures promulgated to implement this policy, may subject the HSC and/or the individuals involved to criminal and civil prosecution, as well as subjecting employees to disciplinary action up to and including termination. Employees must also comply with all specific policies applicable to their employment. APPLICABILITY All UNM HSC employees, faculty and staff members, and third-party affiliates. POLICY AUTHORITY HSC Compliance Director REFERENCES Regents Health Sciences Center Compliance Policy University Physician Associates Billing Compliance Plan and Associated Policies Applicable HSC Clinical Component Policies on Patient Rights and Responsibilities, Medical Records, Confidentiality, Conflicts of Interest, Billing, Others Faculty Handbook Provisions Regarding Conflicts of Interest, Human Subjects Research, Research Fraud University Business Policies Regarding Conflicts of Interest, Sponsored Project Management Policies; Reporting Misconduct and Retaliation Health Sciences Center Medical Staff Bylaws, Rules and Regulations, Policies HSC Multiple Project Assurance, Human Research Review Committee ( HRRC ) Investigators Manual for Conducting Human Subject Research Page 37

and Review. University Business Policy Regarding Contracts Signature Authority IMPLEMENTATION PROCEDURES 1. Legal Compliance: The HSC will strive to ensure that all activity by or on behalf of the HSC is in compliance with applicable federal, state, and local laws and regulations. 1.1 HSC faculty and staff will become familiar with, and follow, all applicable requirements related to their patient care, research, and other activities. Among other requirements, HSC faculty and staff will: 1.1.1 Adhere to the New Mexico licensure statutes and regulations applicable to their professional practice, and inform the HSC regarding any change in status or debarment from any governmental program. 1.1.2 Not deny medically necessary care to HSC patients on the basis of their race, creed, color, national origin, ancestry, religion, sex, sexual orientation, marital status, age, handicap or source of payment, or any other classification prohibited by law, nor emergency medical treatment in accordance with EMTALA. 1.1.3 Ensure that bills are submitted for the service of a teaching physician who involves residents or fellows in patient care only where the service and documentation are in accordance with regulations promulgated at 42 C.F.R. Sections 415.150 to 415.184, requiring that the teaching physician 1) personally furnish the service; 2) furnish the service jointly with the resident/fellow; or 3) be physically present during the key portion of a service furnished by the resident/fellow, unless the HSC has obtained an outpatient center exception for the service. In the latter case, service will be provided in accordance with the outpatient exception rule. 1.1.4 Submit bills to third party payers only for medically necessary and reasonable services, which are adequately documented, and in compliance with all applicable legal requirements. 1.1.5 Waive co-payments or deductibles only in accordance with written HSC policies, HSC contractual arrangements, and applicable laws and regulations. 1.1.6 Refrain from conduct that may violate fraud and abuse laws. In particular, no HSC employee will engage in any conduct that involves 1) direct, indirect or disguised solicitation, receipt, or offer of payment, whether in cash or in kind (e.g., receiving free services/products), in exchange for, or which is otherwise intended to induce, the referral of patients or the purchase of products or services, unless such arrangement has been reviewed and Page 38

approved for compliance by HSC legal counsel; 2) knowingly submitting false, fraudulent or misleading claims or assurances, or being reckless as to the accuracy of such claims or assurances, to any government entity or third-party payer, including claims for services not rendered or which characterize the service differently than the service actually provided, or any other claims or assurances that do not comply with the requirements of a particular program (e.g., falsely certifying medical necessity, up-coding, billing outside of teaching physician requirements, billing for non-covered services, failing to refund overpayments made by a health care program, misusing grant funding, etc.); 3) making false representations to any payer, contractor, or governmental entity in any matter; and 4) referring patients to an entity with which the physician employee or a family member has a direct or indirect financial or compensation arrangement, unless the arrangement has been reviewed and approved for compliance with self-referral laws by HSC counsel. 1.1.7 Follow all grant or contract requirements for conducting funded research, including but not limited to those governing effort reporting, use of funds and allowable costs, cost transfers, and program income. 1.1.8 Refrain from submitting bills to federal government payers for investigational drugs or devices (except Class B medical devices and Group C drugs if permitted in accordance with applicable rules, unless otherwise permitted by written policy of the payer), or for services provided to research subjects solely for research purposes or that have been paid for by a grant. 1.1.9 Submit all proposed research (including reviews of medical records and use of existing patient samples) to the HRRC prior to initiation and follow HRRC policies and procedures, and conduct all research in accordance with the HSC Multiple Project Assurance and applicable laws and regulations. 1.1.10 Avoid conflicts of interest and any appearance of impropriety in dealings with vendors and with private and public entities providing funding for HSC programs. HSC employees will conduct all transactions with third parties free from offers or solicitations of gifts, favors, or other improper inducements in exchange for business or assistance, and will notify the HSC of any of their own outside interests (such as ownership, directorship, or financial interest in a company contracting with the HSC) that may raise a conflict of interest issue. Vendors and other contractors will be expected to comply with HSC policies and state and federal laws and regulations applicable to their dealings with the HSC and its patients, faculty and staff. 1.1.11 Protect the rights of HSC patients and research subjects to privacy and to confidentiality of their medical records, including electronic records, in Page 39

accordance with applicable federal and state laws and regulations and accreditation standards. HSC employees will utilize patient medical records solely for legitimate business or patient care purposes, or HRRC approved research, and will not engage in unauthorized review or disclosure of medical records. 1.1.12 Seek advice from the HSC Compliance Director, a Compliance Officer, or HSC legal counsel regarding any questions on the existence or interpretation of any law relevant to the employee s activities. If there is any compliancerelated inquiry from any agency or other external source, HSC faculty and staff will promptly notify one of these persons for advice. 1.2 HSC faculty and staff will refrain from signing contracts for research or patient care services, purchases, or other arrangements unless they are individuals who have been officially authorized to sign such contracts under a delegation of authority pursuant to the University s Contracts Signature Authority and Review Policy. 2. General and Business Ethics Requirements: 2.1 HSC faculty and staff will comply with the highest standards of medical and business ethics in interactions with patients, families of patients, visitors, colleagues, contractors, government regulatory agencies, and the community. Employees and third-party affiliates will accurately and honestly represent the HSC and its capabilities, and their relationship to the HSC, and will refrain from disparaging the capabilities of other providers. 2.2 HSC faculty and staff owe a fiduciary duty of loyalty to the HSC. HSC faculty and staff will not usurp business opportunities of the HSC, nor utilize their HSC position or knowledge obtained through their position to profit personally or to assist others to profit at the expense of the HSC. HSC faculty and staff will safeguard HSC resources and use facilities, equipment, supplies, and other resources only for valid HSC purposes, unless otherwise approved in accordance with written UNM and/or HSC policies. 2.3 HSC faculty and staff will treat patients and research subjects, visitors, faculty, staff, students, and others having interactions with the HSC with dignity, respect, and courtesy, and will foster an environment of trust and safety for HSC patients. 2.4 The HSC will strive to provide medical services to meet the identified needs of its patients and in furtherance of its educational and research mission, adhering to the highest possible uniform standards of care, consistent with available resources, and will advise patients of appropriate therapeutic alternatives. Clinical decision-making will not be inappropriately influenced by economic factors and/or risk arrangements with third-party payers. Page 40

2.5 The HSC will provide services only to those patients to whom it can safely provide care within HSC facilities, and, if medically necessary, will arrange for transport to another facility where medically necessary care can be provided, consistent with applicable laws and regulations. 2.6 To the extent possible and appropriate, the HSC will permit each patient or his or her designated representative to participate in planning for the patient s care at the HSC and after discharge from HSC facilities. 2.7 The HSC will provide patient advocacy and social services, and will arrange for biomedical ethics consultations, as appropriate. 2.8 Patients who are hospitalized at HSC facilities for a lengthy stay, and whose condition warrants, may perform or refuse to perform tasks in or for the facility, appropriate to their medical condition and therapeutic goals. 2.9 The HSC will perform discharge planning for patients to try to ensure that patients have continuity of care after discharge, as appropriate for their condition, and to provide unbiased information to patients about resources available to them after discharge. 2.10 The HSC will bill patients only for services that were actually delivered, in compliance with applicable federal and state laws and regulations, and will provide bills to patients and their third-party payers that itemize services delivered, applicable charges, and dates of service. The HSC will bill patients in accordance with uniform charge schedules, as required by applicable laws and regulations. Where discounted payments will be accepted from patients third-party payers, under written contracts, the HSC will calculate cost-share amounts due from patients in a fair, honest, and ethical manner, based on requirements of those contracts. 2.11 The HSC will provide information to patients who request assistance in understanding the cost of their care and will attempt to resolve questions and objections to the satisfaction of payments. The HSC will provide financial assistance information to patients, as required, and will attempt to assist patients in qualifying for financial assistance. The HSC will handle billing disputes with patients in a prompt, fair, courteous and honest manner. 3. Affirmative Responsibility: HSC faculty and staff will promptly notify the HSC Compliance Director or another appropriate high level employee, HSC legal counsel, or the University Internal Auditor as applicable, of any possible violations of the law or other improper activity by HSC employees or third-party affiliates. 4. Non-Retaliation: HSC faculty and staff will refrain from taking any adverse action against any person who reports in good faith a suspected violation or concern arising under this Code of Conduct. Page 41

5. Applicability: This Code of Conduct applies to all HSC clinical and academic components and employees, the HSC Medical Staff, and University Physician Associates. To the extent feasible, this Code of Conduct will also apply to HSC contractors and vendors. PROCEDURE: 1. The HSC will develop and implement related policies and procedures to give full effect to this Code of Conduct at every appropriate level of the HSC. Any such policies and procedures will be deemed to be incorporated by reference herein. 2. The HSC will publish this Code of Conduct on its website for all HSC employees. Each HSC component will develop mechanisms for training faculty and staff of those components in requirements of the policy and will make semi-annual reports to the Vice President for Health Sciences regarding the implementation and evaluation of those training mechanisms. 3. HSC faculty and staff who fail to adhere to this policy will be subject to disciplinary action, which may include termination, if appropriate. SUMMARY OF CHANGES Revised Date & Format of existing policy (10/10/2000). KEY WORDS Compliance, Code of Conduct, Ethics RESOURCES/TRAINING Resource/Office Position/Title Dept. Phone Internet/Link HSC Compliance Director 272-2588 See below http://hsc.unm.edu/admin/compliance/hotline.shtml DOCUMENT APPROVAL & TRACKING Item Contact Date Approval Owner Jeff Wiggins, HSC Compliance Director Consultant(s) N/A Committee(s) UNM HSC Executive Compliance Committee Y Human Resources [Name], HR Administrator, [UNM HSC] N/A Legal (Required) Scot Sauder, Sr. Assoc. University Counsel, UNM HSC Y Official Approver Dr. Paul Roth, Executive Vice President for Health Sciences Y Page 42

Official Signature 07/19/2006 Effective Date 07/19/2006 Origination Date 10/10/2000 Issue Date Clinical Operations P&P Coordinator Pending ATTACHMENTS None. Page 43

Deficit Reduction Act of 2005 (DRA) Vendor Training Jeff Wiggins, JD, MHA HSC Compliance Director November 2006 Page 44

Background On February 8, 2006, President Bush signed the Deficit Reduction Act of 2005 (the DRA ). It has transformed the nature of compliance programs from voluntary to mandatory for those institutions receiving $5 million or more in Medicaid reimbursement. Page 45

Background Continued The government has been granted additional resources to combat fraud and abuse in both the Medicare and Medicaid programs. Compliance aspects of the DRA are effective January 1, 2007. Page 46

Focus on Medicaid Medicaid is the largest health insurance program in the US. It is jointly funded by Federal and state governments. Federal contribution in Fiscal Year 2004 topped $176 billion and is expected to exceed $193 billion in Fiscal Year 2007. Page 47

Focus Continued In Fiscal Year 2004, Medicaid covered 43.7 million low-income children and adults and expected to exceed 46 million in Fiscal Year 2007. Bottom line = Medicaid spending, which grew 7.7% alone last year. Fraud and abuse enforcement is aimed at containing the rise in Medicaid spending. Page 48

Examples of Medicaid Fraud Billing for services not rendered. Billing for undocumented services. Including improper entries on cost reports. Double billing for services. items or services. Assigning incorrect Making false statements. Participating in kickbacks. Billing for medically unnecessary codes to secure higher reimbursement. Page 49

Federal False Claims Act (31 USC 3729) Federal statute that covers fraud involving any Federally funded contract or program (i.e., Medicare/Medicaid) and establishes liability for any person who knowingly presents or causes to be presented a false or fraudulent claim to the U.S. government for payment. Page 50

False Claims Act Liability Subject to civil monetary penalties (CMP) ranging from $5,000 to $11,000 for each false claim submitted. In addition to the CMP, can be required to pay three times amount of damages sustained by U.S. government. Office of Inspector General (OIG) may seek to exclude the provider or supplier from participation in Federal health care programs. Page 51

Qui Tam Whistleblower Provisions Purpose = to encourage people to come forward and report misconduct involving false claims. Allows any person (with actual knowledge of allegedly false claims) to file a lawsuit on behalf of the U.S. government. Persons often referred to as relators. Page 52

Qui Tam Procedures The relator must file the lawsuit on behalf of the government in a Federal district court. If the government decides to intervene, the prosecution of the lawsuit will be directed by the U.S. Department of Justice (DOJ). If not, the relator can continue with the lawsuit on his/her own. If the DOJ is successful, the relator may receive 15% to 30% of the amount received and may be entitled to reasonable expenses, including attorney s fees and costs for bringing the lawsuit. Page 53

No Retaliation The False Claims Act also grants relators protection from retaliation from employers for filing a lawsuit or assisting (i.e., providing testimony) in a False Claims Act action. Relief may include: employee reinstatement, back pay, or any other damages arising from retaliatory conduct. Page 54

NM Medicaid False Claims Act (Chap. 27, Art. 14 NMSA 1978) Provides for similar procedures under the Federal False Claims Act except that the action shall be brought in the name of the State of New Mexico Provides for awards of at least 15% but not more that 25% of the action or settlement. Provides employee protection from employer retaliation for bringing or assisting in a false claims action. Page 55

UNM Policy Against Retaliation UNM Business Policy 2200, Reporting Misconduct and Retaliation To extent allowed by law, reasonable efforts are made to protect confidentiality of relators. Prohibits and has sanctions against any type of retaliation against those who report concerns. Works in conjunction with the Federal False Claims Act and the NM Medicaid False Claims Act in protecting relators. Page 56

How to Report Internally You may contact UNM Purchasing at 505-277-2036. HSC Compliance Director at 505 272-2588. Anonymous toll-free 24/7 contracted HSC Compliance Hotline: 1-888-899-6092 Page 57

VENDOR REGISTRATION FORMS Page 58

VENDOR CHECKLIST The Healthcare Industry Representative demonstrates knowledge of the following subject matter and/or certification of the following, as supported by the attached documentation: Acknowledgement of Receipt of Vendor Protocols Vendor Confidentiality Agreement OR Purchasing Policy Code of Conduct Certification Proof of Current PPD Proof of Current MMR Proof of clinical competency and any current, required certifications/licenses regarding your product line Clinical Competency Documentation Type Expiration Date Surgical Attire and Traffic Patterns Aseptic Principles and Sterile Techniques Perioperative Safety Concerns (Fire, Electrical, X-Ray, etc) Infection Control and Bloodborne Pathogens Healthcare Industry Rep (print): Date: Healthcare Industry Rep (sign): Page 59

ACKNOWLEDGEMENT OF RECEIPT OF VENDOR PROTOCOLS These access and privacy protocols have been prepared to assist you in becoming acquainted with UNMH. UNMH reserves the right to modify, suspend, revoke, terminate, or change in whole or in part, any of its policies, procedures, or practices at any time with or without notice. This is to acknowledge that I have received a copy of the UNMH vendor protocols. I agree to read the guidelines carefully and to comply with the policies and procedures as stated. Signed: Date: Printed: Company Name: Are you employed by this company or a contractor? If you stated contractor, list actual company employed by or if self-employed: Phone Number: E-Mail: If you have a business card with you, please attach it to this document before returning. Page 60

CONFIDENTIALITY AGREEMENT I,, understand and acknowledge that I may receive or have access to patient health information that is confidential and protected from disclosure under federal and state privacy laws, including the Health Insurance Portability and Accountability Act ( HIPAA ) Privacy Rule. I agree that I will not discuss nor release any protected health information of patients to any unauthorized person. I will use protected health care information only as it relates to my job duties or the purposes for which the protected health information has been disclosed to me. I understand that violation of this Confidentiality Agreement ( the Agreement ) is grounds for immediate termination of my relationship with the University of New Mexico Health Sciences Center ( HSC) and could constitute a violation of federal and/or state privacy laws and subject me to fines, penalties and other actions under those federal and state privacy laws. I understand that this Agreement does not stop me from reporting breaches of confidentiality that I observe to the United States Department of Health and Human Services. I agree to adhere to any requirements by the HSC that pertain to maintaining patient confidentiality and the confidentiality of all patient information I may access in the course of my relationship with the University of New Mexico Health Sciences Center. I further agree to abide by the confidentiality terms of this Agreement even after termination of my association with the HSC. Signed: Printed Name: Date: Page 61

TO: All VENDORS to the University of New Mexico Hospitals Operating Room/Perioperative Services DATE: November 1, 2006 FROM: RE: The University of New Mexico Hospitals Operating Room (OR) Purchases of Products and/or Services The University of New Mexico Hospitals requires that the purchase of supplies, implants, equipment, rental equipment, and other items be processed on a purchase order through authorized personnel representing the hospital. The Surgical Services Product Standards Committee and Technology Assessment Committee are the ONLY authorized representatives that may evaluate and approve all new, replacement or trial products and/or equipment used in the Operating Room PRIOR to use. Individual physicians are not authorized to approve any purchases for the University of New Mexico Hospitals. Please be aware that the University of New Mexico Hospitals is not responsible for payment of products and/or services used in the Operating Room without prior approval from either of the committees listed previously. We appreciate the partnership we have developed with you. Please respect our purchasing policies. We look forward to working with you in the future. Name: (PRINT) Signature: Company Name: (PRINT) Date: Page 62

HSC COMPLIANCE OFFICE This certifies that I have received, read, understood and will abide by the University of New Mexico (UNM) Health Sciences Center's (HSC) Code of Conduct Organizational Ethics Policy (hereinafter, Code of Conduct.) I understand that the Code of Conduct applies to me and my job and understand that I am expected to comply with it. I know it is my right and responsibility to seek guidance on ethical and compliance issues when I am uncertain about which actions to take and to report situations to management when I have reason to believe that there is a violation of our policies. I also understand that neither the Code of Conduct nor this document constitutes an employment contract between UNM and myself. I will cooperate fully with UNM and the Compliance Officers and Committees to the extent necessary or helpful to the implementation and the operation of the Code of Conduct and the Compliance Program. Please complete the following (please print): Name: Job Title: Work Phone: Dept: Email: SIGNATURE: DATE: If you have any questions/concerns, please feel free to contact Jeff Wiggins, HSC Compliance Director, at 272-2588. Page 63