THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Why is the Plan providing me with this Privacy Notice?
This Notice is being provided to you in accordance with the requirements of the Standards for Privacy of Individually Identifiable Health Information of the Health Insurance Portability and Accountability Act (the "HIPAA Privacy Rules") The HIPAA Privacy Rules are federal laws that seek to ensure the privacy and confidentiality of your health information. The HIPAA Privacy Rules require the Plan to take certain actions to protect the privacy of your health information. This Notice has been prepared to advise you of the uses and disclosures of your Protected Health Information (as defined below that my be made by the Plan and to advise you or your rights and the Plan's legal duties relating to the privacy of your Protected Health Information.

What is Protected Health Information?
Protected Health Information (PHI) means information related to a past or present health condition that individually identifies you or could reasonably be used to identify you and is transferred to another entity or maintained by the Plan in written, electronic or any other form.

Will the Plan have access to my Protected Health Information?
Yes. As a Plan enrollee, you should be aware that the Plan may have access to your Protected Health Information from time to time. The Plan may receive your Protected Health Information in a variety of ways. For example, the Plan may receive this kind of information when your health care provider (doctor, hospital, etc.) submits bills for services rendered to you in order that benefits can be paid by the Plan.

When may the Plan use or disclose my Protected Health Information?
The law permits the Plan to use or disclose Protected Health Information to carry out "treatment," "payment" and other "health care operations". When the Plan uses or disclosures your Protected Health Information for treatment, payment or health care operations purposes, the Plan is not required to notify you or obtain your authorization (discussed further below).

Treatment: "Treatment" means the provision, coordination, or management of health care and related services by health care providers, including the coordination or management of health care by a health care provider with a third party (such as an insurer of the Plan), consultation between producers with respect to a patient, and the referral of a patient for heath care from one provider to another. The Plan itself does not engage directly in "treatment" under the HIPAA privacy Rules. However, the Plan may interact with a health care provider in treatment transactions.

Payment: "Payment" means activities undertaken by the Plan to determine or fulfill its responsibility for coverage and provision of benefits under the Plan. Examples of when the Plan might use or disclose Protected Health Information for payment purposes include disclosures to facilitate the payment of claims made against the Plan by health care providers, the Plan's activities to obtain or provide reimbursement for the provision of health care of the Plan's activities in obtaining premiums. When the Plan discloses information for payment purposes, the Plan will attempt only to disclose that Protected Health Information which is minimally necessary to ensure proper and timely payment of claims.

Health Care Operations: "Health care operations" means those other functions and activities that the Plan performs in connection with providing health care benefits. Example of what constitute health care operations during which the Plan might use or disclose your Protected Health Information include activities relating to creation, renewal or replacement of a contract of health insurance or health benefits, business planning and development relating to the Plan, and compliance with the HIPAA Privacy Rules. Another example would include the Plan's use or disclosure of Protected Health Information to better manage its operations, such as when the Plan discloses information with a vendor or consultant (commonly referred to as a "Business Associate" to ensure proper accounting and record-keeping relating to the Plan's provisions of health care benefits.

May the Plan use or disclose my Protected Health Information for other purposes?
Yes. For uses or disclosures of Protected Health Information that are not made for treatment, payment, or health care operations and for which no exception regarding Authorization applies, the law requires the Plan to obtain your Authorization. An Authorization is your approval for the Plan's disclosure of your Protected Health Information to a particular person or entity for a particular purpose. You may revoke an Authorization at any time, but a revocation is not effective if the Plan has already reasonably relied on your Authorization to make a particular use or disclosure. Examples of when an Authorization would be required include when the uses or disclosures are made to your employer for disability, fitness for duty or drug testing purposes. Additionally, if you request that the Plan make use of or disclose your Protected Health Information to a third party, the Plan may require that you sign an Authorization that permits the Plan to honor your request.

When might the Plan make use of or disclose my Protected Health Information without my Authorization?
As discussed above, the Plan is not required to obtain your Authorization for uses or disclosure of your Protected Health Information for treatment, payment or health care operations purposes. Additionally, there are some limited exceptions where the law allows the Plan to make use or disclosure of your Protected Health Information without your Authorization. Most of these uses or disclosure are permitted to promote the government's need to ensure a sage and healthy society. In some cases, you may be given an opportunity to agree or object before the use or disclosure is made; in other cases, you may not be given this opportunity. Whenever the Plan makes these types of uses and disclosures, the Plan ensures that it meets any necessary prerequisites and will not use or disclose your Protected Health Information more than is otherwise permitted under the law.

The types of uses or disclosures of Protected Health Information that may be made without your Authorization and without giving you the opportunity to object include those made:

• To avert communicable or spreading diseases;
• For public health activities;
• For federal intelligence, counter-intelligence and national security purposes;
• To properly assist law enforcement to carry out their duties;
• When a judge or administrative tribunal orders the release of such Protected Health Information;
• For cadaver organ, eye and tissue donations (where appropriate);
• To help apprehend criminals;
• To assist armed forces personnel and operations;
• For military service, veteran's affairs separation/discharge matter;
• For coroner/medical examiner purposes;
• For health oversight purposes (such as when the government requests certain information from the Plan to determine its compliance with applicable laws);
• To assist victims of abuse, neglect or domestic violence;
• To address work-related illness/workplace injuries and for worker's compensation purposes;
• To carry out clinical research that involves treatment where the proper body has determined the importance of doing so;
• For FDA-related purposes;
• For certain health and safety purposes;
• For funeral/funeral director purposes;
• To help determine veterans' eligibility status;
• To protect Presidential and other high-ranking officials; and
• For reporting to correctional institutions/law enforcement officials acting in a custodian capacity

There are also sever types of uses or disclosures of Protected Health Information that the Plan may make without your Authorization as long as, whenever possible, you are given an opportunity to agree or object before the Plan makes the use of disclosure. These exceptions are very limited and generally involve the release of a limited amount of Protected Health Information to aid your family members, close personal friends, or disaster relief personnel in locating you in the even of an emergency or in case of your incapacity.

Will the Plan disclose my Protected Health Information to my employer?
The Plan has the right to disclose your Protected Health information to the Plan Sponsor, which is usually your employer, subject to certain limitations. The Plan may generally disclose to the Plan Sponsor information regarding whether you are enrolled in the Plan and "summary health information," which means information that summarizes the claims history and experiences of the individuals enrolled in the Plan without specifically identifying you or other Plan participants. The Plan may disclose this information without your Authorization, and the Plan Sponsor may only use the information for its activities relating to its sponsorship of the Plan. For example, the Plan Sponsor may use this information to seek bids from health insurers or to analyze its health plan expenses. If the Plan Sponsor needs more than "summary health information" or enrollment information to carry out its responsibilities, then documents that govern the Plan will determine the extent to which Protected Health Information may be used or disclosed, except that in no case may the Plan Sponsor use or disclose your Protected Health Information for employment-related decisions for any other purpose other than as permitted by the Plan documents or by law. Additionally, a Plan Sponsor that receives Protected Health Information from a Plan must make certain certifications to the Plan regarding the uses and disclosures of the information and must ensure that any agents or subcontractors of the Plan Sponsor agree to the same restrictions and conditions that apply to the Plan Sponsor.

Will the Plan use or disclose my Protected Health Information for marketing, fundraising or other similar purposes?
While the Plan does not anticipate using or disclosing your Protected Health Information for marketing, fundraising or other similar purposes, under the HIPAA Privacy Rules, the Plan only make such uses or disclosures with your Authorization, unless the Plan communicates with you face-to-face or provides you with some promotional gift of nominal value, in which case your Authorization would not be required.

Do I have the right to request additional restrictions on the uses or disclosures of my Protected Health Information?
Yes. You have the right to request additional restrictions relating to the Plan's use or disclosure of your Protected Health Information beyond those otherwise required under the HIPAA Privacy Rules. Although the Plan is not legally required to grant these requests, it is your right to make such a request. For additional information or to obtain the proper form for making such a request, please contact the Plan's Privacy Officer.

May I request that certain communications of my Protected Health Information can be made to me at alternate locations?
Yes. The Plan may communicate your Protected Health Information to you in a variety of ways, including by mail or telephone. If you believe that the Plan's communications to you by the usual means will endanger you or your health care and you would like the Plan to make its communications that involve Protected Health Information to you at an alternate location, you may contact the Plan's Privacy Officer to obtain the appropriate request form. The Plan will only accommodate reasonable requests and may require information as to how payment, if any, will be handled.

Do I have the right to obtain access to my Protected Health Information?
Generally yes. You have the right to request and obtain access to your Protected Health Information maintained by the Plan unless an exception applies. The Plan may deny you access to your Protected Health Information if the information is not required to be accessible under the HIPAA Privacy Rules or other applicable law. For example, you do not have a right to access information compiled by the Plan in anticipation of or for use in a civil, criminal or administrative proceeding.

The Plan may charge you a reasonable, cost-based fee for copying (including the cost of supplies and labor) any Protected Health Information required to be copied to adequately respond to your access request, as well as any postage costs and costs associated with preparing an explanation or summary of the Protected Health Information necessary to adequately respond to your access request (unless otherwise precluded by applicable State or other law). If you would like to request access to you Protected Health Information, please notify the Plan's Privacy Officer so that you can complete the appropriate forms.

Do I have the right to an accounting of disclosures of my Protected Health Information made by the Plan?
Yes. You have the right to request and obtain a proper accounting of disclosures the Plan has made of your Protected Health Information that the Plan makes. For example, the Plan is not required to provide an accounting for disclosures made for treatment, payment, or health care operations purposes or for disclosures made with your Authorization. Additionally, the Plan reserves the right to limit its accounts to disclosures made after the compliance date of the HIPAA Privacy Rules.

The Plan will provide you with your first accounting at no charge to you. If you request any additional accountings within a 12-month period, the Plan may charge you a reasonable cost-based fee. At the time that you request a subsequent accounting, the Plan will provide you with information regarding the fees and you will have the opportunity to withdraw or modify your request if you wish to do so.

If I have an objection to the way my Protected Health Information is being handled, may I file a complaint?
Yes. The Plan has procedures in place for receiving and resolving complaints. If you believe that the Plan has violated your privacy right or has acted inconsistently with its obligations under the HIPAA Privacy Rules, you may file a complaint by contacting the Plan's Privacy Officer. You may send a letter outlining your complaint to the Privacy Officer or you may call the Privacy Officer and request a complaint form. The Plan requests that you attempt to resolve your complaint with the Plan via theses complaint procedures since the Plan is in the best position to respond to your complaint. However, if you believe the Plan has violated your privacy rights, you may also file a complaint with the Office of Civil Rights ("OCR") at the United States Department of Health and Human Services ("HHS"). You may contact the HHS OCR at: Medical Privacy, Complaint Division, Office of Civil Rights, United States Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, D.C. 20201. Voice Hotline Number (800) 368-1019. Internet Address www.hhs.gov/ocr.

It is against the policies and procedures of the Plan to retaliate against any person who has filed a privacy complaint, either with the Plan or with HHS OCR. Should you believe that you are retaliated against in any way upon your filing a complaint with the Plan or the HHS OCR, please immediately contact the Plan's Privacy Officer, so that the Plan may properly address the issue.

May I obtain a copy of this Notice?
Yes. If you received this Notice via the Internet or electronic mail, you have the right to request and receive a paper copy of this Notice. If you would like to receive a paper copy of this Notice, please contact the Plan's Privacy Officer.

What if I have additional questions that are not answered in this Notice?
If you have any questions, concerns or issues relating to the privacy of your Protected Health Information that is not covered in this Notice, please contact the Plan's Privacy Officer.

How do I contact the Plan's Privacy Officer?
You may contact the Plan's Privacy Officer by writing to Laura Alcala, Member Services Manager, 4150 East Concours Street, Suite 100 Ontario, CA 91764-4989 Effective April 14, 2003.