HIPAA Privacy Notice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice of Privacy Practices describes how Gerber Life Insurance Company ("We") may use and disclose your "protected health information" (PHI) to carry out treatment, payment or healthcare operations and for other purposes that are permitted or required by law. It describes your rights to access and control your protected health information. Protected health information is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health condition and related healthcare services.

We are required to maintain the privacy of your health information and to provide you with a notice as to our legal duties and privacy practices with respect to information we collect and maintain about you. We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice at any time. Any new notice will be given to you by mail upon your request and will be effective for all PHI that we maintain at that time.

How we may use or disclose your protected health information

The following categories describe the ways we may use or disclose your protected health information. For each category of uses and disclosures, we will explain what we mean and present some examples. Not every use or disclosure is listed, nor may every use or disclosure pertain to your plan. However, the ways we are permitted to use and disclose information will fall within one of the categories.

Treatment, payment or healthcare operations

Federal law permits Gerber Life Insurance Company to use and disclose your PHI without your authorization or consent for the purposes of treatment, payment and healthcare operations.

Treatment

We may disclose PHI to healthcare providers who are responsible for your medical treatment under the plan. For example, we will provide your physician, upon request, with copies of various reports that should assist him/her in treating you.

Payment

We may use or disclose information about you to determine eligibility for coverage for plan benefits, obtain premiums, facilitate payment for the treatment or services you receive from healthcare providers, determine plan responsibility for benefits or to coordinate benefits. For example, payment functions may include sharing PHI with Medicare or other health plans for purposes of coordination of benefits; reviewing PHI to determine medical necessity of services received; providing PHI to vendors for the collection and payment of fees for Prescription Drug Card benefits.

Healthcare Operations

Healthcare operations refer to the insurance and business functions undertaken by a health plan, among other things. Some examples of uses and disclosures permitted as part of healthcare operations include but are not limited to the disclosure of PHI for underwriting, premium rating and other activities relating to the creation, renewal or replacement of a health insurance contract or plan coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs. We may disclose PHI to consultants who provide legal, actuarial and auditing services to the plan. Operations may also include the use and disclosure of PHI for business planning, management and general administration of the plan. We will share your protected health information with third party "business associates" that perform various activities such as claim administration services on behalf of the plan. Whenever we make an arrangement with a business associate that involves the disclosure of PHI, we will elicit the business associate’s agreement to protect PHI.

Other uses and disclosures permitted without authorization

Federal law also allows a health plan to disclose PHI without your authorization or consent in the following ways:

• To you or a personal representative designated by you or designated by law to act for you. For example, if you have designated a person to receive information regarding payment of the premium on your long-term care or Medicare Supplement policy, we will inform that person when your premium has not been paid.
• To the Secretary of Health and Human Services (HHS) or any employee of HHS as part of an investigation to determine our compliance with the Federal Privacy laws.
• To a health oversight agency such as the Insurance Commissioner’s office to respond to inquiries or investigations of the plan or requests to audit the plan.
• In response to a court order, subpoena, discovery request or other lawful judicial or administrative proceeding.
• As required for law enforcement purposes. For example, to notify authorities of a criminal act.
• As required by law.
• As required to comply with Worker’s Compensation or other similar programs established by law.
• To the sponsor of the plan in which you are a participant if the plan sponsor certifies that the plan documents allow such disclosure.

The examples of uses and disclosures listed above are not an all-inclusive list of the ways in which PHI may be used. They describe the general uses and disclosures that may be made.

Uses and Disclosures of PHI Based on Your Written Authorization

Other uses and disclosures of your PHI will be made only upon receiving your valid written authorization. You may revoke an authorization at any time by providing written notice to us that you wish to revoke an authorization. We will honor a request to revoke as of the day it is received and to the extent that we have not already used or disclosed your PHI in good faith with the authorization.

Your rights in relation to protected health information

Right to Request Restrictions on Uses and Disclosures

You have the right to request that the plan limit its uses and disclosures of PHI in relation to treatment, payment or healthcare operations or not to use or disclose your PHI for these reasons at all. You also have the right to request the plan restrict the disclosure of PHI to family members or personal representatives. Any such request must be made in writing to the Privacy Compliance Office listed in this Notice and must state the specific restriction and to whom the restriction should apply.

The plan is not required to agree to the restriction that you request. However, if it does agree to the requested restriction, it may not violate that restriction except as necessary to allow provision of emergency medical care to you.

Right to Request Confidential Communications

You have the right to request that communications involving PHI be provided to you at an alternative location or by alternative means. The plan is required to accommodate any reasonable request if the normal method of disclosure would endanger you and that danger is stated in your request. Any such request must be made in writing to the Privacy Compliance Office listed in this notice.

Right to Access Your Protected Health Information

You have the right to inspect and copy your PHI that is contained in a designated record set for as long as the plan maintains the PHI. A designated record set may contain claim information, premium records and any other records the plan has created in making claim and coverage decisions relating to you. Federal law does prohibit you from having access to the following records: psychotherapy notes; information complied in the reasonable anticipation of or for use in a civil, criminal or administrative action or proceeding; and PHI that is subject to a law that prohibits access to that information. If your request for access is denied, you may have a right to have that decision reviewed. Requests for access to your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Amend Protected Health Information

You have the right to request that PHI in a designated record set be amended for as long as the plan maintains the PHI. The plan may deny your request for amendment if it determines that the PHI was not created by the plan, is not part of the designated record set, is not information available for inspection, or that the PHI is accurate and complete. If your request for amendment is declined, you have the right to have a statement of disagreement included with the PHI. The plan has the right to include a rebuttal to your statement, a copy of which will be provided to you. Requests for amendment of your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Receive an Accounting of Disclosures

You have the right to receive an accounting of all disclosures, if any, of your PHI that the plan has made for reasons other than disclosures for treatment, payment or healthcare operations, as described above, disclosures made to you or your personal representative and disclosures made pursuant to a valid authorization received from you. Your right to an accounting of disclosures applies only to PHI created by the plan after April 14, 2003 and cannot exceed a period of six years prior to the date of your request. Requests for an accounting of disclosures of your PHI should be directed to the Privacy Compliance Office listed in this Notice.

Right to Receive a Paper Copy of this Notice

You have the right to receive a paper copy of this Notice upon request. This right applies even if you have previously agreed to accept this Notice electronically. Requests for a paper copy of this Notice should be directed to the Privacy Compliance Office listed in this Notice.

Safeguarding protected health information

We maintain physical, electronic and administrative safeguards that meet federal and state requirements. PHI is limited to persons who need the information for authorized business purposes. We will not use PHI for marketing purposes.

Complaints

If you believe that your privacy rights have been violated, you may file a complaint with Gerber Life Insurance Company, the plan or the Secretary of Health and Human Services. We will not retaliate against you for filing a complaint.

Complaints to us should be filed in writing to:

Privacy Compliance Office
Legal Department
Gerber Life Insurance Company
1311 Mamaroneck Avenue
White Plains, NY 10605

Complaints to the Secretary of Health and Human Services should be filed in writing to:

US Department of Health and Human Services
200 Independence Ave. SW
Washington, DC 20201

Privacy contact information

If you have any questions regarding this Notice you may obtain additional information by writing to:

Privacy Compliance Office
Legal Department
Gerber Life Insurance Company
1311 Mamaroneck Avenue
White Plains, NY 10605

Or by calling (914) 272-4000

This Notice was published and becomes effective no later than April 14, 2003.