Notice of Privacy Practices

At American Benefits Group, your privacy is very important to us. All of the information we receive from you will be held in the strictest confidence, and will not be used for any purpose other than that for which it was intended. No information about you will be sold, reused, rented, loaned, or otherwise disclosed except as may be provided herein.

If you have any questions about your privacy, please contact us.

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES OUR PRIVACY PRACTICES, HOW WE TREAT MEDICAL AND PERSONAL INFORMATION ABOUT YOU, HOW IT MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. THIS NOTICE IS EFFECTIVE AS OF SEPTEMBER 23, 2013.

During the course of providing you and your employer with benefit plan administration services, we may have access to information about you that is deemed to be Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act). This Notice of Privacy Practices (Notice) describes our legal obligations and your legal rights regarding your Protected Health Information. Among other things, this Notice describes how your Protected Health Information may be used or disclosed to carry out treatment, payment, or health care operations, or for any other purposes that are permitted or required by law.

The HIPAA Privacy Rule protects certain medical information known as "Protected Health Information" (“PHI”). Generally, PHI consists of any health information, including demographic information, collected from you or created or received by a health care provider, a health care clearinghouse, a health plan, or your employer on behalf of a group health plan, from which it is possible to individually identify you and that relates to:

• your past, present, or future physical or mental health or condition;
• the provision of health care to you; or
• the past, present, or future payment for the provision of health care to you.

OUR RESPONSIBILITIES

We are required by law to:
• maintain the privacy of your PHI;
• provide you with certain rights with respect to your PHI;
• provide you with a copy of this Notice of our legal duties and privacy practices with respect to your PHI; and
• follow the terms of the Notice that is currently in effect.

HOW WE MAY USE AND DISCLOSE PHI

Under the law, we may use or disclose PHI under specific circumstances. The following categories describe different ways that we use and disclose PHI for purposes of health plan administration. For each category of uses or disclosures listed we will explain what we mean and try to give some examples. Not every permitted use or disclosure or category will be listed. However, all of the ways that we use and disclose information will fall within one of the listed categories.

For Payment (as described in applicable regulations). We may use or disclose PHI to determine eligibility for Plan benefits, to determine benefit responsibility under the Plan, or to coordinate Plan coverage. For example, we may share PHI with another entity to assist with the adjudication or subrogation of health claims or to another health plan to coordinate benefit payments.

For Health Care Operations. We may use and disclose your protected health information for other Plan operations. These uses and disclosures are necessary to run the Plan. For example, we may use medical information in connection with conducting quality assessment and improvement activities; underwriting, premium rating, and other activities relating to Plan coverage; submitting claims for stop-loss (or excess-loss) coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; and business management and general Plan administrative activities. However, we will not use your genetic information for underwriting purposes.

To Business Associates. We may contract with individuals or entities known as Business Associates to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, Business Associates will receive, create, maintain, transmit, use, and/or disclose PHI, but only after they agree in writing with us to implement appropriate safeguards regarding PHI. For example, we may disclose your PHI to a Business Associate to process your claims for Plan benefits, but only after the Business Associate enters into a Business Associate contract with us.

As Required By Law. We will disclose PHI when required to do so by federal, state or local law. For example, we may disclose PHI when required by national security laws or public health disclosure laws.

To Avert a Serious Threat to Health or Safety. We may use and disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

To Plan Sponsors. For the purpose of administering the plan, we may disclose PHI to certain employees of the Employer. However, those employees will only use or disclose that information as necessary to perform plan administration functions or as otherwise required by HIPAA, unless you have authorized further disclosures. Your protected health information cannot be used for employment purposes without your specific authorization.

SPECIAL SITUATIONS
Public Health Risks. We may disclose PHI for public health activities (e.g., to prevent or control disease, injury or disability).

Health Oversight Activities. We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release PHI if asked to do so by a military or law enforcement official in response to a court order, subpoena, warrant, summons, investigation or similar process.

Coroners and Medical Examiners. We may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.

National Security and Intelligence Activities. We may release PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

REQUIRED DISCLOSURES

Government Audits. We are required to disclose your PHI to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule.

Disclosures to You. When you request, we are required to disclose to you the portion of your PHI that contains medical records, billing records, and any other records used to make decisions regarding your health care benefits. We are also required, when requested, to provide you with an accounting of most disclosures of your PHI if the disclosure was for reasons other than for payment, treatment, or health care operations, and if the PHI was not disclosed pursuant to your individual authorization.

OTHER DISCLOSURES

Personal Representatives. We will disclose your PHI to individuals authorized by you, or to an individual designated as your personal representative, attorney-in-fact, etc., so long as you provide us with a written notice/authorization and any supporting documents (i.e., power of attorney).

Spouses and Other Family Members. Unless otherwise authorized by you, we will only speak with you regarding your PHI and we will send all communications to you. This includes communications relating to your spouse and other family members who are covered under the Plan, and includes communications with information on the use of Plan benefits by your spouse and other family members and information on the denial of any Plan benefits to your spouse and other family members.

Authorizations. Other uses or disclosures of your PHI not described above will only be made with your written authorization. For example, in general and subject to specific conditions, we will not use or disclose information relating to your care or treatment; we will not use or disclose your protected health information for marketing; and we will not sell your protected health information. You may revoke written authorizations at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

YOUR RIGHTS

You have the following rights with respect to your PHI:

Right to Inspect and Copy. You have the right to inspect and copy certain PHI that may be used to make decisions about your Plan benefits. To inspect and/or receive a copy your PHI, you must submit your request to us in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed.

Right to Amend. If you feel that your PHI is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan.

To request an amendment, your request must be made in writing and must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Is not part of the PHI kept by or for the Plan;
• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is already accurate and complete.

We must act on your request for an amendment of your PHI no later than 60 days after receipt of your request. We may extend the time for making a decision for no more than 30 days, but we must provide you with a written explanation for the delay. If we deny your request, we must provide you a written explanation for the denial and an explanation of your right to file a statement of disagreement with us and any future disclosures of the disputed information will include your statement.

Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of your PHI. The accounting will not include (1) disclosures for purposes of treatment, payment, or health care operations; (2) disclosures made to you; (3) disclosures made pursuant to your authorization; (4) disclosures made to friends or family in your presence or because of an emergency; (5) disclosures for national security purposes; and (6) disclosures incidental to otherwise permissible disclosures.

To request this list or accounting of disclosures, you must submit your request in writing. Your request must state a time period you want the accounting to cover, which may not be longer than six years before the date of the request. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12 month period will be provided free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on your PHI that we use or disclose including PHI that we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a treatment that you had.

Except as provided in the next paragraph, we are not required to agree to your request. However, if we do agree to the request, we will honor the restriction until you revoke it or we notify you.

We will comply with any restriction request if (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid in full by you or another person.

To request restrictions, you must make your request in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply - for example, disclosures to your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.

Right to Be Notified of a Breach. You have the right to be notified in the event that we (or a Business Associate) discover a breach of unsecured protected health information.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

You may obtain a copy of this notice at our website, www.amben.com. To obtain a paper copy of this notice call us at 800-499-3539.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with the Plan or with the Office for Civil Rights of the United States Department of Health and Human Services. To file a complaint with the Plan, contact us directly or contact your Human Resource Administrator. All complaints must be submitted in writing.

You will not be penalized or in any other way retaliated against for filing a complaint with your employer, the Office for Civil Rights or with us.

OTHER USES OF PHI

Other uses and disclosures of PHI not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the services that we provided to you.

Connected Cash Program

We shall obtain the following consents and maintain a record (e.g., date and time stamp) of such consents from an Eligible Cardholder: (i) separate affirmative opt-in consent to the Program’s terms and conditions and privacy notice prior to card linking, and (ii) separate affirmative opt-In consent at the point of card linking to authorize Mastercard to monitor and provide Transaction Data (as defined below) to American Benefits Group and any third parties authorized by us (as applicable) for purposes of operating the Program, including fulfilling offers any other intended uses of Transaction Data such as targeting offers that may be of interest to Eligible Cardholder (if applicable, and to the extent that such use is authorized by Mastercard). Alegeus represents and warrants that the Program terms and conditions and privacy notice are comprehensive and accurate, with disclosures about card linking in connection with the Program that are pre-approved by Mastercard, including that Mastercard will be monitoring the Transaction Data on the Enrolled Cardholder’s linked card(s) if a cardholder elects to link their card in connection with the Program. American Benefits Group further represents and warrants that the privacy notice will include disclosures on all data collection, uses, and sharing practices in connection with the Program, including with respect to the PAN or any other user ID and Transaction Data. We further represents and warrants that it shall provide Enrolled Cardholders with the ability to subsequently revoke consent to transaction monitoring and that such opt-out process is adequately described in the Program terms and conditions and the privacy notice.

MISCELLANEOUS

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice on our website. The Notice will indicate the most recent effective date.

We must make our internal practices, books and records related to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance of the Plan with privacy regulations.

When we no longer need PHI disclosed to us, for the purposes for which the PHI was disclosed, we must, if feasible, return or destroy the PHI that is no longer needed.

To request a disclosure of your PHI, an accounting of disclosures of your PHI, authorize a disclosure, request an inspection, copy or amendment of your PHI, request a restriction on the disclosure of your PHI or to request confidential communications or file a complaint, please submit your request in writing to:

American Benefits Group
Attn. Privacy Officer
320 Riverside Drive
PO Box 1209
Northampton, MA 01061-1209

If you have any questions about your private information or to obtain a paper copy of this notice, please call us at: 800-499-3539.

Privacy Policy