Privacy

NOTICE OF PRIVACY PRACTICES
Effective April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
NO ACTION IS REQUIRED ON YOUR PART.
At Coastal Insurance Services the protection of our clients’ privacy and the confidentiality of medical information has always been a priority. We recognize that you depend upon us to safeguard your personal information and uphold your privacy rights. This document — which is based on state and federal law, as well as our own company code of ethics — offers a declaration of our commitment to preserving member confidentiality and privacy.

OUR PRIVACY PRACTICES
This notice describes Coastal Insurance Services’ privacy practices for both current and former clients. It explains how we use health information about you and when we may share that health information with others. It also informs you about your rights with respect to your health information and how you may exercise these rights. We are required by law to maintain the privacy of your health information and to send you a copy of this notice so that you are aware of how we maintain the privacy of your health information.

Coastal Insurance Services employees are required to comply with our policies and procedures to protect the confidentiality of health information. Any employee who violates our privacy policy is subject to a disciplinary process. Employee access to health information is limited on a business “need-to-know” basis, such as: to make benefit determinations, pay claims, manage care, underwrite coverage, perform quality assessment measurements, administer a plan or provide customer service.

Coastal Insurance Services maintains physical, electronic and process safeguards that restrict unauthorized access to your health information. Such safeguards include secured office facilities, locked file cabinets, and controlled computer network systems and password accounts.

This notice applies to all applicable companies within the Coastal Insurance Services family of companies, which includes businesses owned or controlled by Coastal Insurance Services.

Please share this notice with everyone covered by your policy or contract. You have a right to receive a copy of this notice upon request at any time. If you would like additional copies of the notice or have questions related to the information contained within the notice, please call Client/Customer Services at 310-326-2546. You may also view a copy of this notice on our Web sites at www.Coastal Insurance Services.com.
Should any of our privacy practices change, we reserve the right to change the terms of this notice and to make the new notice effective for all health information that we maintain. We will provide you a copy of the revised notice and post the revised notice on our Web sites.
HEALTH CARE INFORMATION MAINTAINED AT Coastal Insurance Services
When we refer to “information” or “health information” in this notice, we mean information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health and related health care services. Health information may be transmitted or shared in any form or medium (oral, written or electronic).

The health information we receive may vary by product; therefore, the examples that follow may not apply to all members, but are designed to represent the general categories of information that may be received and maintained by Coastal Insurance Services:

Information provided by you on applications, forms, surveys and our Web sites, such as your name, address and date of birth;

Information from physicians, hospitals or other health care providers, clinics, medical groups, or health care service plans;

Information provided by your employer, benefits plan sponsor or association, regarding any group product that you may have;

Information about your transactions and experiences with our affiliates, others and us, such as products or services purchased, account balances, payment history, claims history, policy coverage and premiums;

Information from consumer or medical reporting agencies or other third parties, including medical and demographic information.
HOW WE MAY USE OR SHARE YOUR INFORMATION
The following categories describe how we may use and share your health information. For each category we provide examples that help illustrate each type of use or disclosure. Not every use or disclosure in a category will be listed. However, the ways in which we are permitted to use and share health information will fall into one of these categories.

For Quoting Coverages
We may share health information with health plans in order to procure quotes for insurance on your behalf.

We may also use or share your health information with others to help coordinate and manage your health care. For example, we may talk to your doctor to suggest a disease management or wellness program that can help improve your health.

For Payment
We may use your health information when paying your medical bills submitted to us by you or your health care providers, such as doctors and hospitals. Examples of payment activities include billing, claims management and other related administrative functions.

For Health Care Operations
We may use or share certain health information for necessary health care operations. Examples of health care operations include the following:

Performing quality assessment and improvement activities;

Evaluating provider and health plan performance;

Providing underwriting coverage;

Conducting or arranging medical reviews to determine medical necessity, level of care or justification of services;

Performing auditing functions;

Resolving internal grievances, such as addressing problems or complaints about your access to care or satisfaction with services;

Making benefit determinations, administering a benefit plan and providing customer service; and

Other uses specifically authorized by law.

We may also share your health information with other individuals or entities — also known as business associates — that perform payment or health care operations on behalf of Coastal Insurance Services. However, we will not share your health information with these business associates unless they agree in writing to protect the privacy of that information.
To Make Certain Communications to You
We may use or share your health information with a third party acting on behalf of Coastal Insurance Services in order to inform you about alternative medical treatments and programs or about health-related products and services that may be of value to you.
We may also inform you about enhancements, replacements or substitutions to your health plan coverage.

Information Not Personally Identifiable
We may use or share your health information when it has been “de-identified.” Health information is considered to be de-identified when it does not personally identify you.

We may also use a “limited data set” that does not contain any information that can directly identify you. This limited data set may only be used for the purposes of research, public health matters or health care operations. For example, a limited data set may include your city, county and ZIP code, but not your name or street address.
To the Employee Benefit Plan
Under certain circumstances, we may share limited health information about you with the employee benefit plan through which you receive health benefits. For example, we may share summary health information with the employee benefit plan so that they may obtain bids from other health plans, or modify, amend or terminate coverage with Coastal Insurance Services. We may also share health information related to your enrollment, disenrollment and/or participation in a Coastal Insurance Services health plan. We will not share detailed health information with your benefit plan unless they agree to maintain the privacy of your information.
(For members who reside in California, Coastal Insurance Services may not share your health information with your employer or benefit plan unless you provide written permission for us to do so.)
SPECIAL CIRCUMSTANCES AND STATE AND FEDERAL LAWS
Special situations and certain state and federal laws may require us to use or release your health information. For example, we may be obligated to release your health information for the following reasons:

To comply with state and federal laws that require us to release your health information to others;

To report information to state and federal agencies that regulate our business, such as the U.S. Department of Health and Human Services and your state’s regulatory agencies;

To assist with public health activities; for example, we may report health information to the Food and Drug Administration for the purpose of investigating or tracking a prescription drug and medical device malfunctions;

To report information to public health agencies if we believe there is a serious threat to your health and safety or that of the public or another person; this includes disaster relief efforts;

To report certain activities to health oversight agencies; for example, we may report activities involving audits, inspections, licensure and peer-review activities;

To assist court or administrative agencies; for example, we may provide information pursuant to a court order, search warrant or subpoena;

To support law enforcement activities; for example, we may provide health information to law enforcement agents for the purpose of identifying or locating a fugitive, material witness or missing person;

To correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official;

To report information to a government authority regarding child abuse, neglect or domestic violence;

To share information with a coroner or medical examiner as authorized by law (we may also share information with funeral directors, as necessary to carry out their duties);

To use or share information for procurement, banking or transplantation of organs, eyes or tissues;

To report information regarding job-related injuries as required by your state workers’ compensation laws;

To share information related to specialized government functions, such as military and veteran activities, national security and intelligence activities and protective services for the President and others;

To researchers when their research has been approved by an institutional review board that has approved the research proposal and established protocols to ensure the privacy of your health information;

To a family member or friend under any of the following circumstances: (1) if you provide a verbal agreement to allow such a disclosure;
(2) if you are given an opportunity to object to such a disclosure and you do not raise an objection; or (3) if it can be inferred from the circumstances, based on Coastal Insurance Services’s professional judgment, that you would not object.
WRITTEN PERMISSION TO USE OR SHARE YOUR INFORMATION
For any other activity or purpose not listed above or as otherwise permitted by law we must obtain your written permission — known as an authorization — prior to using or sharing your health information. If you provide a written authorization and you change your mind, you may revoke your authorization in writing at any time.

Once an authorization has been revoked, we will no longer use or share the health information as outlined in the authorization form; however, you should be aware that we may not be able to retract a use or disclosure that was previously made based on a valid authorization.
OTHER RESTRICTIONS REGARDING USE AND DISCLOSURE OF YOUR INFORMATION
Depending on the state in which you reside, there may be additional laws related to the use and disclosure of health information related to HIV status, communicable diseases, reproductive health, genetic test results, substance abuse, mental health and mental retardation.
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
The following are your rights with respect to your health information. If you would like to exercise the following rights, please call Member/Customer Service at the toll-free number on your health plan identification card.

You have the right to ask us to restrict how we use or share your health information for treatment, payment or health care operations. You also have the right to ask us to restrict health information that we have been asked to give to family members or to others who are involved in your health care or payment for your health care.

Please note that while we will try to honor your requests, we are not required by law to agree to the type of restrictions described above.

You have the right to request confidential communications of health information. For example, if you believe that sending your information to your current mailing address would put your safety at risk (e.g. in situations involving domestic disputes or violence), you may ask us to send the information by alternative means (such as by fax) or to an alternate address. We will accommodate reasonable requests for confidential communication of your information.

You have the right to inspect and obtain a copy of the health information we maintain about you in a designated record set. A designated record set refers to a group of records that includes enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for Coastal Insurance Services. The types of health information included in a designated record set may vary depending on the state in which you reside.

This right does not obligate us to grant you access to certain types of health information. Please note that under most circumstances we will not provide you with copies of the following information:

Psychotherapy notes;

Information compiled in reasonable anticipation of, or for use in, a civil or criminal administrative action or proceeding;

Information subject to certain federal laws governing biological products and clinical laboratories;

Medical information compiled and used for quality assurance or peer-review purposes.

If you would like to request access to review or copy your patient medical records, please directly contact your Primary Care Physician or the health care provider who created the records. Patient medical records include records in any form or medium maintained by, or in the custody or control of, a health care provider relating to health history, diagnosis or condition of a patient, or relating to treatment provided or proposed to be provided to the patient.

You have the right to ask us to make changes to the health information that we maintain about you in your designated record set. These changes are referred to as amendments. We may require that your request be in writing and that you provide a reason for your request.

If we make the amendment, we will notify you that it was made. If we deny your request to amend, we will notify you in writing of the reason for denial. This written notification will explain your right to file a written statement of disagreement. In return, we have a right to rebut your statement. Furthermore, you have the right to request that your initial written request, our written denial and your statement of disagreement be included with your health information for any future disclosures.

Please note that, under most circumstances, we are not required to provide you with an accounting of disclosures of the following information:

Any information collected prior to April 14, 2003;

Information shared for treatment, payment or health care operations;

Information already disclosed to you;

Information shared as part of an authorization request;

Information that is incidental to a use or disclosure that is otherwise permitted;

Information provided for use in a facility directory;

Information that was provided to persons involved in your care or for other notification purposes;

Information shared for national security or intelligence purposes;

Information that was shared or used as part of a limited data set for research, public health or health care operation purposes;

Information disclosed to correctional institutions, law enforcement officials or health oversight agencies.

QUESTIONS REGARDING USE AND DISCLOSURE AND YOUR PRIVACY RIGHTS

How to File a Privacy Complaint

If you believe that your privacy rights have been violated, you may file a complaint with us by calling Coastal Insurance Services’s Privacy Line at 310-326-2546. You may also direct your complaints to the Secretary of the U.S. Department of Health and Human Services.

Coastal Insurance Services will not penalize you or take any action against you for filing a complaint.
How to Obtain More Information Regarding Your Rights as well as the Use and Disclosure of Your Health Information

If you have any questions about how we use or share your health information or your rights regarding your health information, you may call Client/Customer Service at 310-326-2546 the during normal business hours.