The Health Insurance Portability and Accountability Act ("HIPAA") gives individuals covered by health plans enhanced privacy and security protection for their health information. HIPAA protects the participant's privacy rights by providing access to the participant's health information and by preventing the inappropriate use or disclosure of health information to others.

The new HIPAA regulations, and the implementation of the HIPAA privacy protections within the health care industry, will not affect the current health coverage of the participant or the participant's family. There are no changes to the participant's benefits as a result of these regulations.

The participant may see some changes in communications related to their health claims. For example, HIPAA may change the manner in which the Benefits Department communicates with the participant. In the past, the Benefits Department staff may have assisted with the resolution of the participant's health benefit claims. Under the new regulations, the employer, and its Benefits Department, will no longer have access to the participant's Protected Health Information, and they cannot require disclosure of this information to them.

Some communication related to the participant's health benefits coverage is permitted by the HIPAA regulations. For example, information related to the payment of medical bills, and information necessary for the employer to conduct health care operations related to the payment of bills, may be disclosed without violating the regulations.

Please review this Notice in detail. The Privacy Officer or a designated representative will be available upon request to answer any questions about this Notice, or about the purpose and effect of the HIPAA regulations on the participant's medical care and Protected Health Information. For further information, please contact [Privacy Officer of the Group Health Plan].

We are permitted or required by law to use or disclose the participant's Protected Health Information for the following purposes without consent or authorization:

Disclosures for Treatment. We may use and disclose the participant's Protected Health Information as necessary for treatment. For instance, a doctor or health facility involved in the participant's care may request specific Protected Health Information from us in order to make decisions about care.

Disclosures for Payment. We may use and disclose the participant's Protected Health Information as necessary for payment purposes. For instance, we may use information regarding medical procedures or treatment provided to the participant, and information contained in the participant's medical records or correspondence with the health care providers, to authorize payment of claims under the health benefits plan. We may also forward such information to other health plans that also have an obligation to process and pay claims on the participant's behalf. We may contact the participant to provide information needed to authorize payment of claims.

Disclosures for Health Care Operations. We may use and disclose the participant's Protected Health Information as necessary, and as permitted by law, for operating the "Plan". For instance, we may use information contained in the participant's medical records or medical bills for the purposes of business management, accreditation and licensing, quality improvement and assurance, enrollment, underwriting, reinsurance, compliance, auditing, rating, and other business-related functions related to the health benefit plan. We may also disclose the participant's Protected Health Information to another health care facility, health care professional, or health plan for such purposes as quality assurance, coordination of benefits and case management, but only if that facility, professional, or plan also has or had a provider-patient relationship with the participant.

Other Possible Uses and Disclosures of the Plan Participant's Protected Health Information. In addition to uses and disclosures for payment, treatment, and health care operations, we may use or disclose the participant's Protected Health Information for the following purposes, as permitted or required by law, without authorization from the participant:

• Plan Sponsor: We may disclose Protected Health Information to the plan sponsor for the purpose of carrying out plan administration functions, provided that the plan sponsor first certifies that the information provided will be appropriately used and protected from further use and disclosure, and will be maintained and stored in a confidential manner. Protected Health Information disclosed to the plan sponsor will not be used for employment-related decisions or for other employee benefit determinations or in any other manner not permitted by law.
• Treatment Alternatives and Health-Related Programs: We may, on occasion, use the participant's Protected Health Information to determine whether certain treatment alternatives or other health-related programs, products or services should be offered to the participants by or through the health plan. Based on the health information we have on file, we may contact and advise the participant of treatment alternatives or other health-related programs, products or services that may be available to members of the health plan. For example, we may use Protected Health Information to identify whether a participant has a particular health condition, and contact the participant to advise that a disease management program aimed at helping to manage the condition is available to the participant. The participant will not receive marketing materials related to other product lines (i.e., life insurance, long term disability plans, etc.) from the health plan without a prior authorization.
• Required by Law: We may use or disclose Protected Health Information for any purpose, to the extent that such use or disclosure is required by law.
• Public Health Activities: We may use or disclose Protected Health Information for public health activities, such as required reporting of disease, injury, birth and death, or to report adverse events, product defects, or to participate in product recalls, and in connection with required public health investigations.
• Victims of Abuse, Neglect, or Domestic Violence: We may disclose Protected Health Information to appropriate authorities if we reasonably believe that the participant is a possible victim of abuse, neglect or domestic violence.
• Health Oversight Activities: We may use or disclose Protected Health Information when disclosure is required by a health oversight agency conducting oversight activities authorized by law, including audits, civil, administrative, or criminal investigations or proceedings, and inspections, licensures, or disciplinary actions related to the receipt of health care or public benefits.
• Judicial or Administrative Proceedings: We may disclose Protected Health Information when disclosure is required for judicial or administrative proceedings, in response to a subpoena, court order, or other lawful process.
• Law Enforcement Purposes: We may disclose Protected Health Information when required by law for law enforcement purposes. For instance, we may disclose for law enforcement purposes health information related to certain types of injuries, or necessary to identify a suspect, witness, or victim, or responsive to a court or administratively ordered subpoena or discovery request related to a law enforcement inquiry.
• Coroners, Medical Examiners and Funeral Directors: We may disclose Protected Health Information to coroners, medical examiners, or funeral directors consistent with applicable law.
• Organ Procurement Organizations: As permitted by law, we may use or disclose Protected Health Information if necessary to arrange an organ or tissue donation from the participant or a transplant for the participant.
• Research: In limited circumstances, we may use and disclose Protected Health Information for research purposes. In all cases where specific authorization has not been obtained, privacy will be protected by strict confidentiality requirements imposed by an Institutional Review Board or privacy board, which oversees the research. It is important that you have documentation from the researchers to strictly limit the use and dislosure of the information.
• To Avert a Serious Threat to Health and Safety: As permitted by applicable federal and state laws, we may use or disclose Protected Health Information when necessary to prevent or lessen a serious and imminent threat to the health or safety of the participant or to the health and safety of the participant's co-workers or the public.
• Military, Veterans, and National Security: We may disclose Protected Health Information if the participant is a member of the military as required by armed forces services; we may also release Protected Health Information if necessary for national security or intelligence activities.
• Workers' Compensation: We may disclose Protected Health Information to workers' compensation agencies for workers' compensation benefit determination, as required by the laws and regulations related to workers' compensation or similar programs.
• Family and Friends: With the participant's prior authorization, we may disclose Protected Health Information to designated family members, friends, or others who are involved in the participant's care. If the participant is facing an emergency medical situation and is incapacitated, and we determine that a limited disclosure may be in the participant's best interest, we may disclose only the minimum necessary health information to those designated individuals without the participant's authorization.
• Business Associates: We may contract with outside persons or organizations to perform services that we are not able or willing to perform, such as auditing, accreditation, actuarial services, legal services, etc. At times it may be necessary for us to disclose Protected Health Information to one or more of these outside persons or organizations who assist us with the administration of our health care operations. In all cases, we require these business associates to sign agreements ensuring that they will appropriately safeguard the privacy of the participant's information before any Protected Health Information is disclosed to them. For example, we may disclose Protected Health Information to the administrator of the plan, in order for the administrator to perform its daily business activities, including processing and authorizing payment of benefits claims. The administrator may use and disclose Protected Health Information, but only as necessary to carry out treatment, payment, and health care operations, and as permitted by law. In addition, we may disclose Protected Health Information to our workforce members and our business associates as necessary to perform rate setting and plan administration functions as part of our health-care operations.
• The Plan Participant's Authorization for Disclosures: We will not use or disclose participant's Protected Health Information for any purpose, other than those mentioned above, unless the participant has signed a form authorizing the use or disclosure. For example, the participant's authorization is required for the use or disclosure of Protected Health Information for marketing other than a face-to-face encounter, for employment determinations, for fund raising, for non-payment and non-health care operations, and for the disclosure of psychotherapy notes. If an authorization is requested from the participant, and the participant does not authorize the requested disclosure, the participant may refuse to sign the authorization

The plan participant has the right to revoke a prior authorization. The participant may revoke the authorization at any time, provided that the revocation is in writing. If the participant revokes the authorization, we will cease to disclose Protected Health Information for the previously authorized purpose, except to the extent that we have already acted upon the authorization.

The health plan participant and beneficiary, has the following rights:

• Right to Receive Confidential Communications: The participant may request that we communicate in a different manner. For example, the participant may request that communications be sent to an address other than the address of record. Requests for communications by alternative means or to alternative locations should be submitted in writing to the Human Resource Department to forward to the plan administrator. We will honor any reasonable requests for alternative communications if the member clearly provides information that the disclosure of all or part of that information could endanger the member.
• Right to Obtain a Paper Copy: The plan participant has the right to receive additional copies of this privacy notice. The participant should contact the Human Resource Department to obtain additional copies of this notice.
• Right to Request Restrictions: The participant has the right to request restrictions on certain uses or disclosures of Protected Health Information. All requests for restriction must be in writing and forwarded to the Human Resource Department to be forwarded to the plan administrator. The participant must describe in detail the restriction requested. We will review each request for restriction, and will attempt to accommodate all reasonable requests. We retain the right to terminate an agreed-to restriction if we believe such termination is appropriate; for example, if we determine that it is not feasible to comply with the restriction. In the event we terminate a restriction, we will notify the participant of such termination. The participant also has the right to terminate, in writing, any previously agreed-to restriction.
• Right to Inspect and Copy: The participant also has the right to review and obtain a copy of existing Protected Health Information that we maintain about the participant and the participant's dependents, as permitted by law. The participant has the right to copy and/or inspect much of the Protected Health Information that we retain on the participant's behalf. All requests for access must be made in writing to the Privacy Officer of the Plan Administrator and signed by the participant or the participant's representative. The participant will be charged a minimal fee for copies and mailing costs of Protected Health Information. If the participant requests a summary of the Protected Health Information a minimal service fee will be charged.
• Right to Amend: The participant has the right to request an amendment of the Protected Health Information that we maintain about the participant or the participant's dependents. All requests for amendment must be in writing, signed by the participant or the participant's representative, and must state the reasons for the amendment/correction request. All requests should be sent to the Privacy Officer of the Plan Administrator. We are not obligated to honor all requests for amendment, but we will give each request careful consideration. If an amendment or correction the participant requests is approved by us, we may also notify others who use or have access to the participant's Protected Health Information of the amendment. The participant can request amendment request forms from the Human Resource Department.
• Right to Receive an Accounting of Disclosures: The participant has the right to receive an accounting of certain disclosures made by us in regard to the participant's Protected Health Information. Requests for an accounting of disclosures must be in writing and signed by the participant or the participant's representative. The participant can request accounting request forms from the Human Resource Department. The first accounting in any 12-month period is free; the participant will be charged a minimal fee for each subsequent accounting that the participant requests within the same 12-month period.

We are required by law to maintain the privacy of the participant's Protected Health Information.

We are required by law to provide the participant with notice of our legal duties and privacy practices in respect to Protected Health Information, and of the participant's rights with respect to that information.

We are required by law to abide by the terms of this Notice of Privacy Practices as long as it remains effective. We reserve the right to change the terms and conditions of this Notice. In the event that we make a revision to the terms of this Notice, a copy of the revised Notice will be mailed to the participant, and the revised Notice provisions will take precedence over any prior Notice. At any time the participant may request a copy of this Notice from the Privacy Officer.

The "Plans" have appointed Judy K. Benes, Executive Assistant to the Borough Manager as the Privacy Officer of the Borough of West Chester to track all privacy complaints. If the participant believes that their Protected Health Information privacy rights have been violated through an unauthorized disclosure of Protected Health Information, the participant may contact the Privacy Officer for guidance.

All privacy complaints must be submitted in writing. The participant may obtain, from the Human Resource Department, a Privacy Complaint form to be completed and forwarded to the Privacy Officer. The participant may also submit a complaint, in writing, to the Secretary of the U.S. Department of Health and Human Services, at 200 Independence Avenue, S.W., Washington D.C. 20201.

We will not retaliate against any person who files a complaint with us or with the Secretary. We request that the participant first file a complaint with us and allow the Privacy Officer to respond, prior to filing a complaint with the Secretary.

Please take notice that the HIPAA privacy regulations apply to Protected Health Information only. Any resolution of grievances other than for these purposes should continue to be addressed through previously defined channels. For example, complaints about benefit determinations and appeals should continue to be directed to Plan Administrator's Customer Service department, as indicated on the participant's enrollment card.

The participant should keep a copy of this Notice with their health plan records. The participant may request additional copies of this Notice from the Human Resource Department. If the participant has any additional questions related to this Notice, please feel free to contact the Human Resource Department.

The EFFECTIVE DATE of this Notice of Privacy Practices is April 3, 2007.