Arcadian Health Plan, Inc. NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Arcadian Health Plan, Inc. is required by law to maintain the privacy of your health information, to provide you with this notice, and to abide by the terms of notice. This notice explains how we may use your health information and how we may "disclose" your health information with others. This notice also explains your rights that you have to your health information. Northeast Community Care provided by Arcadian Health Plan, Inc. will provide a copy of this notice to its members at the time of enrollment and within 60 days of a material revision of this notice by postal mail or post it on our Web site www.arcadianhealth.com . Except for changes required by law, we will not implement an important change to our privacy practices before we revise this notice. In addition, Northeast Community Care will provide a copy of this notice to any member upon request.

WHAT IS HEALTH INFORMATION?

When we use the term "health information" we mean any information which includes both medical information and individual identifiable information. This includes your name, address, date of birth or social security number. This term includes any information created or received by a healthcare provider or health plan that relates to your past or present physical or mental health condition, providing healthcare to you, or the payment of such healthcare.

Some examples of health information that we may receive are:

• Information that you provided on your enrollment form.
• Information provided by your physician or other healthcare provider.
• Information in the form of healthcare claims for healthcare services provided to you.

HOW DO WE USE OR DISCLOSE YOUR HEALTH INFORMATION?

We use or disclose your health information in order to provide you with your healthcare benefits. We may use your health information to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you. We will use and disclose your health information for treatment, payment, and healthcare operations.

• For Treatment. We may use or disclose your health information with your doctor, hospital, or other healthcare provider to help them provide medical care to you.
• For Payment. We may use or disclose your health information in order to help process and pay your claim that your doctor submits to us for healthcare services you receive.
• For Healthcare Operations. We may use or disclose your health information as necessary to our healthcare operations and management of our daily business operations. Examples of healthcare operations include processing your enrollment, quality improvement activities, responses to your questions, resolving your grievance, disease management, or administering a pharmacy benefit plan.

We may also disclose your health information in certain circumstances. Some examples of those special circumstances are:

• To assist with public health activities. For example, this includes disclosures to public health agencies for the purpose of controlling disease, injuries, or disabilities, and for reporting disease outbreaks, as well as disclosures to organizations which are subject to the authority of the Food and Drug Administration, for the purpose of activities related to the quality, safety, and effectiveness of FDA-regulated products.
• To comply with state and federal laws that requires us to release your health information.
• To researchers for the purpose of conducting, or preparing to conduct, medical, clinical, or scientific research, if the research study meets all of the privacy law requirements applicable to research activity.
• For law enforcement purposes to law enforcement agencies, such as in response to a warrant. In addition, we may disclose your health information in response to a law enforcement official's request for information, such as in order to locate a missing person, fugitive, suspect, or witness, or in response to a law enforcement official's request for information about a person who may be a victim of a crime.
• To healthcare oversight agencies for oversight activities authorized by law, such as govern¬mental audits, investigations, licensure and disciplinary actions, and other activities necessary for governmental oversight of the health care system and government healthcare programs.
• To public health or safety officials for purposes of avoiding a serious threat to your health and safety or that of the public, including disaster relief.
• To a government authority (including a social service or protective service agency) for reporting victims of abuse, neglect or domestic violence.
• In response to a court order, subpoena, discovery request, or other lawful process, provided that reasonable efforts have been made to notify you of such disclosure, or that reasonable efforts have been made to obtain a qualified protective order as permitted by law.
• To a coroner or medical examiner as authorized by law for the purpose of identifying a deceased person or determining cause of death. We may also disclose health information to funeral directors for the purpose of carrying out their duties with respect to a decedent.

WHEN DO WE NEED YOUR WRITTEN AUTHORIZATION TO USE OR DISCLOSE YOUR HEALTH INFORMATION?

For any other activity not listed in this notice or permitted by law, Northeast Community Care must obtain your written permission to use or disclose your health information. Your written permission is known as an authorization. Once you give us authorization to release your health information, we cannot guarantee that the person to whom the information is provided will not disclose the information. You may cancel or “revoke” your authorization in writing at any time. Your cancellation will not apply to actions previously taken based on a valid authorization.

YOUR RIGHTS TO YOUR HEALTH INFORMATION

The following are your rights with respect to your health information:

• Right to Request a Restriction

  You have the right to request that we restrict the use or disclosure of your health information for treatment, payment or healthcare operations. We will do our best to accommodate your request however, are not required to do so by law. You also have the right to request that we not disclose your health information to family members or others who are involved in your healthcare or payment for your healthcare. You have the right to terminate a previously submitted restriction.

• Right to Request Confidential Communication

  You may request that we send your health information to you at a certain location or alter¬native means. For example, you may request that we send your information to a P.O. Box rather than your home address. We will accommodate reasonable requests.

• Right to Inspect and Obtain a Copy of Your Health Information

  You have the right to review and obtain your health information that is contained in a designated record set. A designated record set is a set of records which contains enrollment data, payment, claims payment, and case or medical management record systems main¬tained by Northeast Community Care. We may charge you a fee for the cost of copying and mailing. Also, under certain circumstances, we may deny your request. If we deny your request, we will notify you in writing and may provide you with the option to have the denial reviewed.

• Right to Request an Amendment to Your Health Information

  You have the right to request that we make a change to your health information if you believe the information is incorrect or incomplete. You must provide us with a reason for your request. We may deny your request if we did not create the information, we do not maintain the information, or the information is correct and complete. If we deny your request, you will have the right to file a letter of disagreement with us.

• Right to Receive an Accounting of Certain Disclosures of Health Information

  You have the right to an accounting of certain instances in which we have disclosed your health information during the six years prior to your request. Your request must be in writing. Also, please be aware that this accounting will not include:

  • Disclosures made for treatment, payment or healthcare operations.
  • Disclosure of information already made to you pursuant to you or your written authorization.
  • Information disclosed to correctional facilities, law enforcement agencies or health oversight agencies.
  • Other disclosures of which federal law does not require us to provide an accounting.

HOW TO EXERCISE YOUR INDIVIDUAL RIGHTS OR OBTAIN FURTHER INFORMATION

If you wish to exercise one of your individual rights as listed above, or if you have any questions concerning this notice, or if you wish to obtain a paper copy of this notice, please call our Member Services Department at 1-800-573-8597 or TTY/TDD 1-866-573-8591, 7 days a week, 8 a.m. to 8 p.m..

HOW TO FILE A COMPLAINT

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. You may file a complaint with us regarding a possible violation of your privacy rights by sending a letter to Northeast Community Care Attention: Compliance Department 500 12th Street, Suite 350, Oakland, CA 94607. Please describe the facts and circumstances surrounding any uses or disclosures of your health information which you believe to have been inappropriate. We will not take any action against you for filing a complaint.

Arcadian Health Plan, Inc. reserves the right to change the terms of this notice at any time, as long as the change is consistent with state and federal law. Any revisions will apply both to the health information we already have about you at the time of the change and any health information created or received after the change takes effect.

Arcadian Health Plan, Inc. follows all federal and state laws, rules, and regulations addressing the protection of health information. In situations when federal and state laws, rules, and regulations conflict, Arcadian Health Plan, Inc. follows the law, rule, or regulation which provides greater member protection.

Effective Date: 10/01/2009

AHP_ENR017 (09/09)

WEB SITE PRIVACY STATEMENT

At Northeast Community Care we are aware of the privacy concerns of our members and others who visit this Web Site. This Web Site Privacy Statement is intended to assure you that the information you share with us is kept confidential and secure. This Web Site has security measures in place to help protect against the disclosure, loss, misuse, or alteration of information under our control.

Collecting and Using Personal Information

Except as disclosed in this Privacy Statement, we do not collect any identifiable information about visitors to this site. The sources and uses of information are set forth below:

Information Collected When You Visit Our Web Site

We receive and store data about all visitors who use this site including your domain name (such as abc.org); the IP address from which you entered our site; the type of browser and operating system you use; the date and time you visited the site; the pages you viewed on the site; the address of the Web Site you linked from, if any. We do not collect information that can reveal your personal identity unless you voluntarily provide it, for example, when you send us a request for information via email. We use this information to help us design our site, to identify popular features, to resolve user, hardware, and software problems, and to make the site more useful to visitors.

E-mails

If you provide us with your email address through this Web Site, we use it only for the purposes of communicating with you. The confidentiality of any communication transmitted to us or from us via the Internet or by email cannot be guaranteed. Even if you have given us permission to send you e-mails, you may revoke that permission at any time by sending us an email asking us to stop using e-mail to communicate with you. Comments or questions sent to us using e-mail will be shared with our staff who are most able to address your concerns.

Application for Enrollment in Arcadian Health Plans

If you apply for enrollment through this Web Site, you will be asked during the application process to disclose certain personal information so that we can evaluate your eligibility. You will be asked to provide information such as your name, address, other contact information, and your age; whether you are eligible for Medicare Part A, enrolled in Medicare Part B and your Medicare number. We will also ask for certain financial information. We will use the personally-identifiable information you give us only to process the eligibility and enrollment request. Personal information collected during the on-line enrollment process will be protected using Secure Socket Layer ("SSL") technology that encrypts the information you provide. Information you submit directly to us will remain on our servers secured by approved technologies. Only authorized personnel acting to process your request will have access to your personal information.

Use of Information

When processing your information, we may disclose personal information to our affiliate companies for purposes outlined in this Privacy Statement. From time to time, we may establish a business relationship with other companies whom we believe trustworthy and who have confirmed that their privacy practices are consistent with ours ("Business Associates"). We provide our Business Associates with only the information necessary for them to perform these services on our behalf. Each Business Associate must agree to security procedures and practices appropriate to the nature of the information involved, in order to protect your personal information from unauthorized access, use or disclosure. Business Associates are prohibited from using personal information other than as specified by us.

We do not sell information about you to any third party.

Links to Other Sites

We provide links to other Web Sites not controlled by us that may be of interest to you. The privacy policy of that site may differ from the policies in this Privacy Statement. Please review the privacy policy of any site before providing any personal information.

Revisions to the Privacy Statement

We may revise this Web Site Privacy Statement from time to time as we add new features or as laws change that may affect our services. If we make material changes to our Privacy Statement, we will post notice of this on our Web Site. Any revised Privacy Statement will apply both to information we already have about you at the time of the change, and any personal information created or received after the change takes effect. Your continued use of the Web Site will signify your continued agreement to these privacy policies as they may be revised.

Contact Us

If you have any questions about this Privacy Statement you may contact Member Services by telephone at 800-573-8597 or TTY/TDD 866-583-8591, 7 days a week, 8 a.m. to 8 p.m., or send an email to us at webmaster@arcadianhealth.com. If you have questions about your HIPAA protected health information, you may call the same number and ask to speak with our Privacy Officer.

Effective Date: 10/01/2009

AHP_ENR017 (09/09)