COX HEALTHPLANS CONFIDENTIALITY NOTICE

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Cox Health Insurance Company, Inc., Cox Health HMO, Inc., and Cox HealthPlans, LLC shall be referred to hereafter as Cox HealthPlans. Cox HealthPlans is part of the Cox Health family of companies. Cox HealthPlans is the provider of insurance services that involves compiling personal and sometimes sensitive information. Cox HealthPlans takes seriously a commitment to protecting the confidentiality and security of information collected about individuals. We respect the confidentiality of your health information and will protect your information in a responsible and professional matter. We are required by law to maintain the privacy of your health information and to send you this notice.

This notice explains how we use information about you and when we can share that information with others. It also informs you about your rights with respect to your health information and how you can exercise these rights.

When we refer to information or protected health information in this notice we mean the following:

1. Individually identifiable health information that contains details about the physical or mental health of a specific, identifiable individual, that is:

• Transmitted by electronic media
• Maintained in any medium
• Transmitted or maintained in any other form or medium.

Cox HealthPlans collects member information that is necessary for business purposes with respect to the insurance provided. Those business services include but are not limited to: evaluating requests for insurance, evaluating and processing benefit claims, collection of premium and/or benefit claims, quality assurance, utilization review, disease management, processing grievances and appeals, state and federally mandated reporting, administering services and processing requests from, and on behalf of, our members.

The information Cox HealthPlans collects comes from various sources, including but not limited to:

Information provided on applications and related forms, for example, name, address, social security number, and health information.

Responses from your employer, benefit plan sponsor, or association regarding any group products Cox HealthPlans may provide, for example, name, age, address, and social security number.

Third-party reports, such as member history, demographic and/or medical information if relevant to the product or service provided to you.

HOW WE USE OR SHARE INFORMATION

The following are ways we may use or share information about you:

We may use the information to determine payment your medical bills that have been submitted to us by doctors and hospitals for payment.

We may share your information with your doctors or hospitals to help them provide medical care to you. For example, if you are in the hospital, we may give them access to any pre-certification forms sent to us by your doctor.

We may use or share your information with others to help manage your health care. For example, we might talk to your doctor to suggest a disease management or wellness program that could help improve your health.

We may share your information with others who help us conduct our business operations. For example, we may share information for purposes of underwriting group policies. We will not share your information with these outside groups unless they agree to keep it protected.

We may use or share your information for certain types of public health or disaster relief efforts.

We may use or share your information to give you information about alternative medical treatments and programs or about health related products and services that you may be interested in. For example, we might send you information about diabetic programs or cardiac rehabilitation.

We may use or share your information to share information with an employee benefit plan through which you receive health benefits. We will not share detailed health information with your benefit plan unless they promise to keep it protected.

There are also state and federal laws that may require us to release your health information to others. We may be required to provide information for the following reasons:

We may report information to state and federal agencies that regulate us such as the US Department of Health and Human Services and the Missouri Department of Insurance.

We may share information for public health activities. For example, we may report information to the Food and Drug Administration for investigating or tracking of prescription drug and medical device problems.

We may report information to public health agencies if we believe there is a serious health or safety threat.

We may share information with a health oversight agency for certain oversight activities (for example, audits, inspections, licensure, and disciplinary actions.)

We may provide information to a court or administrative agency (for example, pursuant to a court order, search warrant or subpoena).

We may report information for law enforcement purposes. For example, we may give information to a law enforcement official for purposes of identifying or locating a suspect, fugitive, material witness or missing person.

We may report information to a government authority regarding child abuse, neglect or domestic violence.

We may share information with a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law. We may also share information to funeral director as necessary to carry out their duties.

We may use or share information for procurement, banking or transplantation of organs, eyes or tissue.

We may share information relative to specialized government functions, such as military and veteran activities, national security and intelligence activities, and the protective services for the President and others.

We may report information on job-related injuries because of requirements of your state worker compensation laws.

If one of the above reasons does not apply, we must get your written permission to use or disclose your health information. If you give us written permission and change your mind you may revoke your written permission at any time. Once you give us authorization to release your health information, we cannot guarantee that the person to whom the information is provided will not disclose the information.

We are also prohibited from using or disclosing your health information as follows:

Federal and State laws require us to restrict uses and disclosures of personal health information. For example, the selling of personal health information to a third party or the disclosure of information to a third party for the purpose of: (1) marketing a product or service; (2) employment decisions; or (3) credit worthiness.

Cox HealthPlans does not, under any circumstances, advertise lists of our members.

HOW INFORMATION IS SAFEGUARDED

Cox HealthPlans has implemented and continues to enhance security standards and processes, including physical, electronic and procedural safeguards, to ensure that access to member information is limited to employees or business associates who require the information for their jobs. These employees and business associates are required to protect the confidentiality of the information. The employees and business associates are required to comply with the established policies of Cox HealthPlans.

WHAT ARE YOUR RIGHTS

The following are your rights with respect to your health information. If you would like to exercise the following rights, please contact us at Cox HealthPlans, PO Box 5750, Springfield, MO. 65801-5750.

You have the right to ask us to restrict how we use or disclose your information for treatment, payment, or health care operations. You also have the right to ask us to restrict information that we have been asked to give to family members or to others who are involved in your health care or payment for your health care. Please note that while we will try to honor your request, we are not required to agree to these restrictions.

You have the right to ask to receive confidential communications of information. For example, if you believe that you would be harmed if we send your information to your current mailing address (for example in situations involving domestic disputes or violence), you can ask us to send the information by alternative means (for example by fax) or to an alternative address. We will accommodate reasonable requests by you as explained above.

You have the right to inspect and obtain a copy of information that we maintain about you in your designated record set. A “designated record set” is the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for Cox HealthPlans. The term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.

However, you do not have the right to access certain types of information and we may decide not to provide you with copies of the following information:

• Contained in psychotherapy notes
• Compiled in reasonable anticipation of, or for use in a civil criminal or administrative action or proceeding
• Subject to certain federal laws governing biological products and clinical laboratories.

Additionally, in certain other situations, we may deny your request to inspect or obtain a copy of your information. If we deny your request, we will notify you in writing and may provide you with a right to have the denial reviewed.

You have the right to ask us to amend information we maintain about you in your designated record set. We may require that your request be in writing and that you provide a reason for your request. We will respond to your request no later than 60 days after we receive it. If we are unable to act within 60 days, we may extend that time by no more than an additional 30 days. If we need to extend this time, we will notify you of the delay and the date by which we will complete action on your request.

If we make the amendment, we will notify you that it was made. In addition, we will provide the amendment to any person that we know has received your health information. We will also provide the amendment to other persons identified by you.

If we deny your request to amend, we will notify you in writing of the reason for the denial. The denial will explain your right to file a written statement of disagreement. We have a right to rebut your statement. However, you have the right to request that your written request, our written denial and your statement of disagreement be included with your information for any future disclosures.

You have the right to receive an accounting of certain disclosures of your information made by us during the six years prior to your request. Please note that we are not required to provide you with an accounting of the following information:

Any information collected prior to April 14, 2003.

Information disclosed or used for treatment, payment, and health care operations purposes.

Information disclosed to you or pursuant to your authorization;

Information that is incident to a use or disclosure otherwise permitted.

Information disclosed for a facility's directory or to persons involved in your care or other notification purposes;

Information disclosed for national security or intelligence purposes;

Information disclosed to correctional institutions, law enforcement officials or health oversight agencies;

Information that was disclosed or used as part of a limited data set for research, public health, or health care operations purposes.

We may require that your request be in writing. We will act on your request for an accounting within 60 days. We may need additional time to act on your request, and therefore may take up an additional 30 days. Your first accounting will be free, and we will continue to provide to you one free accounting upon request every 12 months. However, if you request an additional accounting within 12 months of receiving your free accounting, we may charge you a fee. We will inform you in advance of the fee and provide you with an opportunity to withdraw or modify your request.

EXERCISING YOUR RIGHTS

You have a right to receive a copy of this notice upon request at any time. You can also view a copy of the notice on our web site at www.coxhealthplans.com. Should any of our privacy practices change, we reserve the right to change the terms of this notice and to make the new notice effective for all protected health information we maintain. Once revised, we will provide the new notice to you by direct mail and post it on our website.

If you have any questions about this notice or about how we use or share information, please contact our Regulatory Compliance Department at (800) 205-7665 or 417-269-2900. That office is open Monday through Friday from 8:00 a.m. to 5:00 p.m. You can also send us questions by e-mail at Support@coxhealthplans.com.

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Regulatory Compliance Department at Cox HealthPlans, PO Box 5750, Springfield, MO. 65801-5750. You may also notify the Secretary of the U.S. Department of Health and Human Services of your compliant.

We will not take any action against you for filing a compliant.

Cox HealthPlans will reaffirm this privacy policy annually in writing, as long as you maintain an ongoing relationship with our company. Any additional questions regarding this policy may be address to us at: Privacy Policy, Director of Regulatory Compliance, Cox HealthPlans, PO Box 5750 Springfield, Missouri 65801-5750.