Privacy Notice

Effective: January 1, 2010

This Notice applies to you if you participate in any of the following Prescription Drug Plans:

• Educators Rx Basic
• Educators Rx Advantage

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Section 1. Introduction

EMI Health (“Prescription Drug Plan”) is dedicated to maintaining the privacy of your health information. This Notice governs benefits that the Prescription Drug Plan provides to you through the purchase of insurance from EMI Health.

The Prescription Drug Plan is required by law to take reasonable steps to ensure the privacy of your personally identifiable health information or “Protected Health Information” (“PHI”) and to inform you about:

• How the Prescription Drug Plan uses and discloses your PHI;
• Your privacy rights with respect to your PHI;
• The Prescription Drug Plan’s legal duties with respect to your PHI;
• Your right to file a complaint with the Prescription Drug Plan and/or with the Secretary of the U.S. Department of Health and Human Services; and
• The person or office to contact for further information about the Prescription Drug Plan’s privacy practices.

The term “Protected Health Information” or “PHI” means all individually identifiable health information transmitted or maintained by the Prescription Drug Plan, regardless of form (oral, written, electronic).

The Prescription Drug Plan is required by law to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy practices.

The Prescription Drug Plan is required to comply with the terms of this Notice. However, the Prescription Drug Plan reserves the right to change its privacy practices and to apply the changes to all PHI received or maintained by the Prescription Drug Plan, including PHI received or maintained prior to the change. If a privacy practice described in this Notice is changed, a revised version of this Notice will be provided to all individuals then covered under the Prescription Drug Plan for whom the Plans still maintain PHI. The revised notice will be posted on the Prescription Drug Plan’s website at: emihealth.com.

Any revised version of this Notice will be distributed within 60 days of the effective date of any material change to the uses or disclosures, the individual rights, the duties of the Prescription Drug Plan or the other privacy practices described in this Notice.

Section 2. Notice of PHI Uses and Disclosures

Except as otherwise indicated in this Notice, uses and disclosures will be made only with your written authorization, subject to your right to revoke such authorization. Please note that Utah Law may impose additional restrictions on how the Prescription Drug Plan may use and disclose health information that relates to HIV/AIDS, domestic violence/abuse and substance abuse and chemical dependency beyond those described below.

1. Required PHI Uses and Disclosures
   • Upon your request, the Prescription Drug Plan is required to give you access to certain PHI in order to inspect and copy it.
   • Use and disclosure of your PHI may be required by the Secretary of the Department of Health and Human Services to investigate or determine the Prescription Drug Plan's compliance with the privacy regulations.
   • The Prescription Drug Plan may contract with business associates for certain services related to the Prescription Drug Plan. PHI about you may be disclosed to these business associates so that they can perform contracted services. To protect your PHI, each business associate is required to appropriately safeguard your PHI.
   • Drug Plan (and its business associates, as applicable) may use and disclose your PHI.
2. Uses and disclosures to carry out treatment, payment and health care operations
   • The Prescription Drug Plan may use PHI without your consent, authorization, or opportunity to agree or object, to carry out treatment, payment and health care operations.
   • Treatment is the provision, coordination or management of health care and related services. It also includes but is not limited to consultations and referrals between one or more of your providers.
   • For example, the Prescription Drug Plan may disclose to a treating specialist the name of your physician so that the specialist may ask for your lab results from the primary care physician.
   • Payment includes but is not limited to actions to make coverage determinations and payment (including billing, claims management, subrogation, plan reimbursement, reviews for medical necessity and appropriateness of care and utilization review and preauthorizations).
   • For example, the Prescription Drug Plan may inform a physician whether you are eligible for coverage or what percentage of the bill will be paid by the Prescription Drug Plan.
   • Health care operations include but are not limited to quality assessment and improvement, reviewing competence or qualifications of health care professionals, underwriting, premium rating and other insurance activities relating to creating or renewing insurance contracts. It also includes disease management, case management, conducting or arranging for medical review, legal services and auditing functions including fraud and abuse compliance programs, business planning and development, business management and general administrative activities.
   • For example, the Prescription Drug Plan may use information about your claims to refer you to a disease management program, project future benefit costs or audit the accuracy of its claims processing functions.
   • The Prescription Drug Plan may also use PHI to contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
3. Authorized uses and disclosures
   • You must provide the Prescription Drug Plan with your written authorization for the types of uses and disclosures that are not identified by this Notice or permitted or required by applicable law.
   • Any authorization you provide to the Prescription Drug Plan regarding the use and disclosure of your health information may be revoked at any time in writing. After you revoke your authorization, the Prescription Drug Plan will no longer use or disclose your health information for the reasons described in the authorization, except for the two situations noted below:
     • The Prescription Drug Plan has taken action in reliance on your authorization before it received your written revocation; or
     • You were required to give the Prescription Drug Plan your authorization as a condition of obtaining coverage.
4. Uses and disclosures that require that you be given an opportunity to agree or disagree prior to the use or release
   • Disclosure of your PHI to family members, other relatives and your close personal friends is allowed if:
     • The information is directly relevant to the family or friend’s involvement with your care or payment for that care; and
     • You have either agreed to the disclosure or have been given an opportunity to object and have not objected.
5. Uses and disclosures for which consent, authorization or opportunity to object is not required
   • Use and disclosure of your PHI is allowed with­out your consent, authorization or request under the following circumstances:
     • When required by law.
     • When permitted for purposes of public health activities, including when necessary to report product defects, to permit product recalls and to conduct post-marketing surveillance. PHI may also be used or disclosed if you have been exposed to a communicable disease or are at risk of spreading a disease or condition, if authorized by law. PHI may also be disclosed to a public health authority authorized to receive reports of child abuse, under certain circumstances.
     • When authorized by law to report information about abuse, neglect or domestic violence to public authorities if there exists a reasonable belief that you may be a victim of abuse, neglect or domestic violence. In such case, the Prescription Drug Plan will promptly inform you that such a disclosure has been or will be made unless that notice would cause a risk of serious harm.
     • To a public health oversight agency for oversight activities authorized by law. This includes uses or disclosures in civil, administrative or criminal investigations; inspections; licensure or disciplinary actions (for example, to investigate complaints against providers); and other activities necessary for appropriate oversight of government benefit programs (for example, to investigate Medicare or Medicaid fraud).
     • When required for judicial or administrative proceedings. For example, your PHI may be disclosed in response to a subpoena or discovery request provided certain conditions are met.
     • For law enforcement purposes, including to report certain types of wounds or for the purpose of identifying or locating a suspect, fugitive, material witness or missing person, provided certain requirements are met. The Prescription Drug Plan may also disclose PHI about an individual who is or is suspected to be a victim of a crime, under certain circumstances.
     • When required to be given to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death or other duties as authorized by law. Also, disclosure is permitted to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
     • For research, subject to certain conditions.
     • When consistent with applicable law and standards of ethical conduct if the Prescription Drug Plan, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person reasonably able to prevent or lessen the threat, including the target of the threat.
     • When authorized by and to the extent necessary to comply with workers’ compensation or other similar programs established by law.

Section 3. Rights of Individuals

1. Right to Request Restrictions on PHI Uses and Disclosures
   • You may request that the Prescription Drug Plan restrict uses and disclosures of your PHI to carry out treatment, payment or health care operations, or restrict uses and disclosures to family members, relatives, friends or other persons identified by you who are involved in your care or payment for your care. However, the Prescription Drug Plan is not required to agree to your request.
   • You or your personal representative will be required to complete a form to request restrictions on uses and disclosures of your PHI.
   • If you wish to make a request to restrict uses and disclosures of your PHI, you should make your request at the address listed at the end of this Notice.
2. Right to Request Communications by Alternative Means/Locations
   • The Prescription Drug Plan will accommodate reasonable requests to receive communications of PHI by alternative means or at alternative locations if you state that the disclosure of all or part of your PHI could endanger you.
   • You or your personal representative will be required to complete a form to request alternative communications.
   • If you wish to make a request for communications by alternative means, you should make your request to the address listed at the end of this Notice.
3. Right to Inspect and Copy PHI
   • You have a right to inspect and obtain a copy of your PHI contained in a “designated record set” for as long as the Prescription Drug Plan maintains the PHI.
   • “Designated Record Set” includes enrollment, payment, billing, claims adjudication and case or medical management record systems maintained by or for a health plan, or other information used by the Prescription Drug Plan to make decisions about individuals.
   • You or your personal representative will be required to complete a form to request access to the PHI in your designated record set.
   • If you wish to make a request for access, you should make your request to the address listed at the end of this Notice.
   • The requested information will be provided within 30 days if the information is maintained on site or within 60 days if the information is maintained offsite. If the Prescription Drug Plan is unable to meet this timeline, it may exercise a single 30-day extension under certain circumstances.
   • If access is denied, you or your personal representative will be provided with a written denial setting forth the basis for the denial, a description of how you may exercise review rights, if any, and a description of how you may complain to the Secretary of the U.S. Department of Health and Human Services.
4. Right to Amend PHI
   • You have the right to request the Prescription Drug Plan amend your PHI or a record about you in a designated record set for as long as the PHI is maintained in the designated record set. You or your personal representative will be required to complete a form to request amendment of the PHI in your designated record set.
   • If you wish to make a request to amend PHI, you should make your request to the address listed at the end of this Notice.
   • The Prescription Drug Plan has 60 days after the request is made to act on the request. A single 30-day extension is permitted if the Prescription Drug Plan is unable to comply with the deadline. If your request is denied in whole or part, the Prescription Drug Plan must provide you with a written explanation of the basis for the denial. You or your personal representative may then submit a written statement disagreeing with the denial and have that statement included with any future disclosures of your PHI.
5. Right to Receive an Accounting of PHI Disclosures
   • At your request, the Prescription Drug Plan will also provide you with an accounting of disclosures by the Prescription Drug Plan of your PHI during the six years prior to the date of your request. However, such accounting need not include PHI disclosures made: (1) to carry out treatment, payment or health care operations; (2) to you about your own PHI; (3) prior to April 14, 2003; or (4) pursuant to your authorization.
   • If you request more than one accounting within a 12-month period, the Plan may charge a reasonable, cost-based health fee for each subsequent accounting.
   • You or your personal representative will be required to complete a form to request an accounting.
   • If you wish to make a request for an accounting, you should make your request to the address listed below at the end of this Notice.
   • If the Prescription Drug Plan cannot provide you with an accounting within 60 days, a single 30-day extension is permitted, provided the Prescription Drug Plan gives you a written statement of the reasons for the delay and the date by which the accounting will be provided.
6. The Right to Receive a Paper Copy of This Notice Upon Request
   • To obtain a paper copy of this Notice contact:
     • Privacy Officer
     • EMI Health
     • 5101 S Commerce Street
     • Murray, Utah 84107-4709
     • Telephone: Salt Lake City (801) 262-7476
     • Outside Salt Lake City (800) 662-5850
     • Outside Utah (800) 548-5264
7. A Note About Personal Representatives
   • You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. Proof of such authority may take one of the following forms:
     • A power of attorney for health care purposes, notarized by a notary public;
     • A court order of appointment of the person as the conservator or guardian of the individual; or
     • Proof that the individual is the parent of a minor child
   • The Prescription Drug Plan retains discretion to deny access to your PHI to a personal representative to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse or neglect. This also applies to personal representatives of minors.

Section 4. Your Right to File a Complaint With the Plans or the HHS Secretary

If you believe that your privacy rights have been violated, you may complain to the Prescription Drug Plan in care of:

• Privacy Officer
• EMI Health
• 5101 S Commerce Street
• Murray, Utah 84107-4709
• Telephone: Salt Lake City (801) 262-7476
• Outside Salt Lake City (800) 662-5850
• Outside Utah (800) 548-5264

You may also file a complaint with:

• Secretary of the U.S. Department of Health and Human Services
• Hubert H. Humphrey Building
• 200 Independence Avenue S.W.
• Washington, D.C. 20201

The Prescription Drug Plan will not retaliate against you for filing a complaint.

Section 5. Whom to Contact at the Plans for More Information

If you have any questions regarding this Notice or the subjects addressed in it, you may contact:

• Privacy Officer
• EMI Health
• 5101 S Commerce Street
• Murray, Utah 84107-4709
• Telephone: Salt Lake City (801) 262-7476
• Outside Salt Lake City (800) 662-5850
• Outside Utah (800) 548-5264

Section 6. Conclusion

PHI use and disclosure by the Plans is regulated by a federal law known as HIPAA (the Health Insurance Portability and Accountability Act). You may find these rules at 45 Code of Federal Regulations Parts 160 and 164. This Notice attempts to summarize the regulations. The regulations will supersede any discrepancy between the information in this Notice and the regulations.

Section 7. Contact Information

If you wish to exercise one or more of the rights listed in this Notice, contact the representative listed below:

• Privacy Officer
• EMI Health
• 5101 S Commerce Street
• Murray, Utah 84107-4709
• Telephone: Salt Lake City (801) 262-7476
• Outside Salt Lake City (800) 662-5850
• Outside Utah (800) 548-5264

EMI Health is a Medicare Contractor for Utah and Idaho.