WellSpark Health’s Privacy Notice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

At WellSpark Health , protecting the privacy and confidentiality of your personal information is very important to us. In order to provide and administer benefits and services to you, we may collect, use, and disclose personal information. We are required by law to maintain the privacy of your personal information and to provide individuals with notice of our legal duties and privacy practices with respect to such personal information. If the privacy of your unsecured personal information is breached, we are required to notify you following such breach. This notice describes what types of information we collect, the measures we take to safeguard it, and the situations in which we might share that information. If you have questions about this notice or wish to exercise any of the rights outlined below, please call Member Services at the toll-free number on your ID card or 1-877-224-7350 for assistance. In this notice, the term “personal information” refers to any information about you that is created and received by us, including information that may reasonably identify you and that relates to your past, present, or future physical or mental health or condition, or information related to payment for your health care.

INFORMATION WE COLLECT

WellSpark Health collects information that helps us administer your health benefits plan. Like all health care companies, we collect the following types of information about you and your dependents:

• Information we receive from you, your employer or benefits plan sponsor (for group health plans), medical provider or third parties, contained in applications, enrollment forms, surveys, health risk assessments, or other forms (e.g., name, address, social security number, date of birth, marital status, dependent information, payment information, medical history)[1]

• Information about your relationship and transactions with us, our affiliates, our agents, and others (e.g., claims, payment information, medical history, eligibility information, service inquiries, complaints, appeal and grievance information).

The information collected and stored by us is used for specific business purposes such as administering your benefit plan and complying with laws and regulations and the requirements of accreditation

organizations.

HOW WE PROTECT YOUR INFORMATION

In accordance with applicable laws and our corporate policies, WellSpark Health has a responsibility to protect the privacy of your personal information. We maintain security standards and processes, including physical, electronic and procedural safeguards, to ensure that access to your non-public personal information is limited to authorized persons who need it to provide services and benefits to you. For example, all WellSpark Health employees are required to sign and abide by an Employee Confidentiality Agreement. Security measures such as using codes instead of names, restricted computer access, locked receptacles, and shredding information which is no longer needed or required to be retained by law, are just a few of the ways in which we protect your privacy.

WHO RECEIVES YOUR PERSONAL INFORMATION AND WHY

Upon enrolling in our benefit plans, you consent to our use and disclosure of personal information about you and your dependents necessary to administer your benefit plan and to provide services to you such as paying claims and providing health education programs. Also, when necessary to facilitate the operation of our benefit plans, your receipt of medical treatment, or other related activities, we use your personal information internally, and disclose it to health care providers (doctors, pharmacies, hospitals and other caregivers), our affiliates, and those who help us to administer the benefit plans.  We may also share it

with other insurers, third party administrators, plan sponsors (under limited circumstances for group health plans to permit the plan sponsor to perform plan administration functions), health care provider organizations, and others who may be financially responsible for payment of the services or benefits you receive under your plan.

These parties are also required to keep confidential your personal information as provided by applicable laws. We do not otherwise disclose personal information about you except with your authorization

or as otherwise permitted or required by law.

Here are some other examples of what we do with the information we collect and the reasons it might be disclosed to third parties:

• Plan and benefit administration purposes which may involve claims payment and medical management; medical necessity review; coordination of care, benefits, and other services; response to your inquiries or requests for services; building awareness about our products and programs; conducting grievance and appeals reviews; investigation of fraud and other unlawful conduct; auditing; underwriting and ratemaking; administration of reinsurance and excess or stop-loss insurance policies.

• Operation of preventive health, early detection and health education programs through which we, our affiliates, or contractors send educational materials and screening reminders to eligible members and providers. We may also use or disclose personal information to identify and contact members who may benefit from participation in specific disease or case management programs and send relevant information to those members (and their providers) who enroll in the programs.

• Quality assessment and improvement activities including accreditation organizations such as the National Committee for Quality Assurance (“NCQA”) and other independent organizations; performance measurement and outcomes assessment; health claims analysis and reporting, and health services research.

• Data and information systems management.

• Performing required regulatory compliance activities/reporting; responding to requests for information from regulatory authorities; responding to subpoenas or court orders; reporting suspected fraud or other criminal activity; conducting litigation or dispute resolution proceedings; and performing third party liability and related activities.

• Transitioning of policies or contracts from and to other insurers, HMOs or third party administrators; and facilitation of due diligence activities in connection with the purchase, sale or transfer of health  benefits plans.

• To affiliated entities or nonaffiliated third parties who act on our behalf to provide plan administration services as permitted by law.

• Plan Sponsor: We may share your personal information with the health plan administrator through which you receive your health benefits. For example, we may share information that does not identify  specific enrollees for the purpose of obtaining premium bids or to modify or terminate a health plan.

WHEN IS YOUR AUTHORIZATION REQUIRED?

Except as described in this Notice of Privacy Practices, and as permitted by applicable state or federal law, we will not use or disclose your personal information without your written authorization. We specifically require your written authorization prior to using or disclosing your personal information for the purposes described below:

Marketing. A signed authorization is required for the use or disclosure of your personal information for a purpose that encourages you to purchase or use a product or service except under certain limited circumstances, such as when the marketing communication is face-to-face or when marketing includes the distribution of a promotional gift of nominal value provided by us.

Sale of PHI. A signed authorization is required for the use or disclosure of your personal information in the event that we receive remuneration for such use or disclosure, except under certain circumstances as allowed by applicable federal or state law.

In addition, we require your written authorization prior to using or disclosing personal information for purposes not listed above (e.g., data requested for a worker’s compensation or auto insurance claim). We are not permitted to use or disclose your genetic information for underwriting purposes. In the event that you are unable to give the required authorization (for example, if you are or become legally incompetent), we accept authorization from any person legally authorized to give authorization on your behalf. If you provide us with written authorization, you may revoke that written authorization at any time, except to the extent that we have already relied upon it, or, if the authorization was obtained as a condition of obtaining insurance coverage, other law provides us with the right to contest a claim under the policy or the policy itself. To revoke an authorization that you previously gave, you may send us a letter stating that you would like to revoke your authorization. Please provide your name, address, member identification number, the date the authorization was given, and a telephone number where you may be reached.

SPECIAL RULES REGARDING DISCLOSURE OF CERTAIN PERSONAL INFORMATION

If a use or disclosure of personal information described above in this notice is prohibited or materially limited by other laws that apply to us, it is our intent to meet the requirements of the more stringent law. For example, additional restrictions may apply to disclosures of personal information that relates to care for psychiatric conditions, substance abuse or HIV-related testing and treatment. In most cases, this information may not be disclosed without your specific written permission, except as may be specifically required or permitted by federal or applicable state law.

Mental Health Information. Certain mental health information may be disclosed for treatment, payment, and health care operations as permitted or required by law. Otherwise, we will only disclose such  information pursuant to an authorization or court order, or as otherwise required by law.

Substance Abuse Treatment Information. If we have information regarding treatment you have received in a substance abuse program, federal law protects the confidentiality of patient records containing information about alcohol and drug abuse. These records may be disclosed only upon limited circumstances.

HIV-Related Information. We may disclose HIV-related information only as permitted or required by state law. For example, state law may allow HIV-related information to be disclosed without

your authorization for treatment purposes, certain health oversight activities, or pursuant to a court order.

INDIVIDUAL RIGHTS FOR CONNECTICARE MEMBERS

As a WellSpark Health member, the following are your rights concerning your personal information. In order to exercise any of the rights outlined below, please call Member Services for assistance at the toll-free number on your ID card or 1-877-224-7350

Right to Request Restrictions: You have the right to ask us to place restrictions on the way we use or disclose your personal information. However, we are not required to agree to a requested restriction.

Right to Request Confidential Communications: We will accommodate reasonable requests to communicate with you about your personal information by alternative means or at alternative locations.

We may ask you to make your request in writing.

Right to Access Personal Information: If you want to access medical record information about yourself, or if you have a question regarding your care, you should go to the provider (e.g., doctor, pharmacy, hospital or other caregiver) that generated the original records. If you want to access the claims or other related information we maintain concerning you and your dependents, please contact Member Services. In accordance with applicable law, we will permit you to obtain documents reflecting information we receive from your providers when they submit claims or encounters to us for payment. If this information is in electronic format, you have the right to obtain an electronic copy of your health information maintained in our electronic record. We reserve the right to charge you an administrative fee.

Right to Request Amendment of Personal Information: You have the right to request that we amend your personal information. If you believe the information in your medical records is wrong or incomplete, contact the provider who was responsible for the service or treatment in question. If we are the source of a confirmed error in our records concerning you, we will correct or amend the records we maintain. If we deny your request, we will provide you a written explanation. We are not able to correct the records created or maintained by your provider.

Right to Request an Accounting of Disclosures of Personal Information: You have the right to receive a list of instances in which we or our business associates disclosed your personal information. This  accounting of disclosures does not include information about disclosures made: for treatment, payment, or health care operations; to you or your personal representative; or pursuant to your written authorization. If you request this list more than once in a twelve-month period, we may charge you a reasonable cost-based fee for responding to these additional requests. You must submit this request in writing using WellSpark Health’s  request form. This form may be obtained by contacting Member Services.

Right to Receive a Notice of Privacy Practices. You have a right to receive a paper copy of this Privacy Notice. If you would like to have a more detailed explanation of these rights or if you would like to exercise one or more of these rights, please contact Member Services.

WHAT HAPPENS TO PERSONAL INFORMATION FOLLOWING TERMINATION

Even after you are no longer enrolled in any WellSpark Health plan, we may maintain your personal information as required to carry out plan administration purposes on your behalf as discussed above. However, the policies and procedures that safeguard that information against inappropriate use and disclosure apply regardless of the termination status.

DISTRIBUTION OF CONNECTICARE’S PRIVACY NOTICES

We send a privacy notice to our members upon enrollment, when our privacy practices are materially changed, when a member requests a copy, and annually upon renewal of the member’s health plan.

VIOLATION OF PRIVACY RIGHTS

If you believe your privacy rights have been violated, you may complain to WellSpark Health the Department of Insurance, or to the Secretary of the U.S. Department of Health and Human Services. To file a complaint with WellSpark Health, please follow the grievance and appeal procedures described in your plan documents or call Member Services at the toll free number on your ID card or 1-877-224-7350. We will not take any action against you for filing a complaint.

WE MUST ABIDE BY THE TERMS OF THIS NOTICE. WE RESERVE THE RIGHT TO CHANGE THE TERMS OF THIS NOTICE AND TO MAKE THE PROVISIONS OF THE NEW NOTICE EFFECTIVE FOR ALL PERSONAL INFORMATION WE MAINTAIN.

This notice describes the privacy practices of WellSpark Health. and its affiliated companies: ConnectiCare, Inc.; ConnectiCare Holding Company, Inc.; ConnectiCare of Massachusetts, Inc.; ConnectiCare Insurance Company, Inc.; and ConnectiCare Benefits, Inc.

Additional rights may be available to members under applicable state law.

Effective Month, XX, XXXX


[1] Information we collect through our Internet Web site is subject to WellSpark Health’s  Internet Privacy Policy, which is available on our Web site atwww.wellsparkhealth.com.