Clear Choice Health Plans Inc.
Central Oregon Independent Health Services

Effective: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

Clear Choice Health Plans Inc. and Central Oregon Independent Health Services is committed to protecting your personal health information. This notice will refer to Clear Choice Health Plans or Central Oregon Independent Health Services as “the Plan,” “us,” “we,” or “our.”

Personal Health Information (PHI) is information that is maintained by the Plan that identifies an individual who is applying for, or is enrolled in a plan offered or administered by us. This PHI also relates to information that is created or maintained by the Plan, a person’s participation in the plan, the person’s past, present or future physical or mental health condition, the provision of health care to that person, or payment for the provision of health care to that person. We are required by law to:

1. Maintain the privacy of your Personal Health Information (PHI)
2. Provide you with this notice in accordance with the Health Insurance Portability and Accountability Act (HIPAA)
3. Follow the policies and procedures set forth in this Notice

This notice will be sent to our existing Plan members and new members upon enrollment. We reserve the right to change the terms of this Notice at any time. You will be notified of any substantial changes and may request a copy of this notice at any time.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

We may use and disclose your PHI for payment for your health care, for our health care operations, and for your treatment. Below are examples of the types of uses and disclosures of PHI that we may make without your express authorization.

1. For Treatment: The Plan may use and disclose PHI to your provider of care (doctors, pharmacies, hospitals and other caregivers) who are treating you. We will disclose PHI when we are helping you obtain services that you may need. This would include services from another agency or caregiver. We may also disclose PHI about health care claims and encounters, medical history, eligibility, payment information and other information for treatment purposes. For example, we may talk to your provider about your condition and disease management or wellness programs to improve the quality of care. We may also use your PHI to review and approve appropriate hospitalization requests.
   The Plan may share your PHI with individuals or entities that perform business functions for us. We may only disclose this information when it is necessary to perform a function and a business relationship exists that would safeguard this information. For example, we may disclose information to a pharmacy benefit management company so that your prescriptions may be filled by a participating pharmacy.
2. For Payment: The Plan may use and disclose PHI as necessary to determine claims payment for your medical treatment and other care services. This information includes:
   • Eligibility and coverage determinations including coordination of benefits
   • Billing, claims management, obtaining payment under a contract for reinsurance including stop-loss insurance and related health care information
   For example: Your physician or care provider may send a claim for health care services to the Plan for claims adjudication and payment. The claim may contain information that identifies you, your treatment, and your diagnosis.
3. For Health Care Operations: The Plan may use or disclose PHI in order to support the business activities of the Plan. These activities include such things as:
   • Using PHI to determine if the Plan is meeting certain quality goals and standards
   • Quality assessments and project improvement activities
   • Preventive health, early detection and disease case management programs
   • Training of employees
   • Underwriting and rate setting for certain product lines
   • Sharing PHI for entities that help manage your care
   • Sharing PHI with entities that perform a business function for us. Please note that we will only share this information if there is a business need to do so and if our business associate has signed an agreement to protect your PHI
   • Authorization/Referral process
   • Risk management, auditing and review of systems effectiveness and compliance activities
   • The Plan may use or disclose part of your PHI to offer you additional information regarding the Plan or treatment. For example, we may use your name and address to send a newsletter or other information about activities of the Health Plan

PERMITTED AND REQUIRED USES AND RELEASES OF YOUR PHI

The Plan may use or release your PHI in the following examples required by state and federal regulations without your authorization.

1. When the release of PHI is required by law or for public health activities. Examples of these mandatory disclosures include notifying state or local health authorities regarding certain communicable diseases, or provide PHI to a governmental agency or regulator with health care oversight responsibilities such as the Oregon Insurance Division or the Centers for Medicare and Medicaid Services.
2. Health oversight agencies may request PHI to ensure that our Plan meets quality standards
3. When it is required to report because of a serious threat to health or public safety. The Plan may disclose PHI to public health agencies if there is a serious health or safety threat.
4. For health related benefits or services. The Plan may use or release PHI to provide you with information about benefits available to you under your policy or in some situations, about health-related products or services that may be of interest to you.
5. PHI may be released for law enforcement or specific government functions. These include a request by a law enforcement official made through a court order, subpoena, warrant, and summons or from a similar process.
6. The Plan may release PHI to a coroner or medical examiner for identification purposes.
Workers Compensation may request PHI for information related to a job-related injury
7. The Food and Drug Administration may need PHI in the course of an investigation for tracking certain medical incidences or problems.

YOUR RIGHTS REGARDING PERSONAL HEALTH INFORMATION (PHI)

You have certain rights regarding your protected PHI.

1. You have the right to inspect and copy your PHI. You may inspect and obtain a copy of PHI that is contained in a designated record set for as long as we maintain this information. A designated record set means medical and billing records, and any other records that are used by the Plan. You may be charged a fee for the costs of copying, mailing or other supplies associated with this request. Certain types of PHI will not be made available and includes psychotherapy notes or PHI collected by us in connection with, or in reasonable anticipation of any claim or legal proceedings. Your request must be in writing and the Plan will respond to your request no later than 30 days after we receive the request. If for any reason this information is not available on-site, we will respond within 60 days.
2. You have the right to request that the Plan change or amend your PHI. You may request that the Plan change information that is contained in a designated record set. The Plan has the option to agree to the request. You must make this request in writing and the Plan will inform you of the action it will take. If we deny your request you have the right to file a written disagreement with the Plan decision. The Plan may deny the request if the information is:
   1. Not accurate or complete
   2. Was not created by the Plan
   3. Necessary to comply with state and federal regulations
3. You have the right to a list of disclosures the Plan has made of your PHI. This listing will not include disclosures that were made for treatment, payment, health care operations, or required by law as listed above. This list of disclosures will not include any information prior to April 14, 2003. Your request should be in writing and include the specific time frame that you are interested in.
4. You have the right to place a restriction or limitation on PHI that the Plan may use or disclose about you for treatment, payment or health care operations. The Plan may consider your request but is not required to agree to it. To request a restriction, you must make your request in writing and tell us what information you want to limit and the time frame involved. If the Plan does not agree to these restrictions you will be sent a written notification. Please be aware that the Plan cannot agree to restrict the use and disclosure of PHI that the Plan is legally required to do, or that is necessary for treatment, payment, or health care operations.
5. You have the right to request that the Plan communicate with you in a certain way or at a certain location. For example, you can ask that we only contact you by telephone or by mail. To request this confidential communication arrangement, you must make your request in writing. The Plan will consider and accommodate all reasonable requests.
6. You have the write to request a copy of this notice from us at any time.

EXERCISING YOUR RIGHTS AND FILING OF COMPLAINTS

If you believe your privacy rights have been violated you may file a written complaint with the Plan Privacy Contact. Please be assured that the Plan will not retaliate against you for filing a complaint. You may contact
    Clear Choice Health Plans Inc.
    Attn: Grievance/Appeals Administrator
    2650 NE Courtney Drive
    Bend, OR 97701

You may also notify the U.S Department of Health and Human Services
    U.S. Department of Health and Human Services
    200 Independence Ave. SW
    Room 509F, HHH Building
    Washington DC 20201

If you have any questions please contact the Member Services Department at (541) 385-5315 or toll free at (888) 863-3637 (TTY 1-800-735-2900).

The privacy regulation is monitored by the Department of Regulatory Affairs, which also acts as the designated Privacy Officer.