Community Care Health (“CCH”) provides health care coverage to you. CCH is required by state and federal law to protect your oral, written, and electronic Protected Health Information (“PHI”). The references to “we” and “us” throughout this Notice means CCH. This Notice has been drafted to comply with the HIPAA Privacy Rules, and any terms not defined in this Notice have the meaning specified in the HIPAA Privacy Rules. PHI includes, but is not limited to, your name, address, personal identifiers, information about your medical history and the medical services provided to you. CCH receives PHI about you when you enroll in the health plan, when you receive services from our providers and facilities, and in connection with payment for your medical services. CCH is required by law to provide you with this Notice, which discloses your rights and how we may use and share your information. CCH has the right to update its privacy practices, and if they are updated the new Notice will be posted to CCH’s website and printed copies will be available upon request.

CCH will not disclose confidential information without your authorization unless it is necessary to provide your health benefits and administer the health plan, or as otherwise required or permitted by law. When we need to disclose individually identifiable information, we will follow the policies described in this Notice to protect your confidentiality. CCH maintains confidential information and has procedures for accessing and storing confidential records. We restrict internal access to your PHI to employees who need that information to provide your benefits. We train those individuals on policies and procedures designed to protect your privacy, and engage in formal education and monitoring of privacy and security practices.

CCH is an affiliate of Community Medical Centers (“CMC”), and we may permit CMC to use your information to support necessary business, financial and clinical functions. For example, CCH may use your PHI as necessary for your medical treatment, authorization determinations, claims processing, eligibility and enrollment, quality of care assurance purposes, detecting fraud or abuse, risk assessment, underwriting and rate making, coordinating the care that you receive, authorizing and processing the payments for your medical services. We do not use or disclose PHI that is genetic information for underwriting purposes. CCH may also share your PHI with its affiliates for purposes that include but are not limited to population health analysis, clinical care monitoring, patient satisfaction surveys, and improving the cost-effectiveness and efficiency of health care delivery. When required by law, we will restrict disclosures to the Limited Data Set, or otherwise as necessary, to the minimum necessary information to accomplish the intended purpose. Disclosures may be made by CCH to individuals and entities (“Business Associates”) who perform various health plan functions and certain types of services. To perform these functions or provide these services, our Business Associates will receive, create, maintain, use or disclose protected health information. CCH requires the Business Associates to agree in writing to contract terms to safeguard your information, consistent with state and federal law. For example, we may disclose your protected health information to a Business Associate to administer claims or provide service support, utilization management, subrogation or pharmacy benefit management. Unless you object, we may provide relevant portions of your protected health information to a family member, friend or other person you indicate is involved in your health care or in helping you make or receive payment for your health care. If you are not capable of agreeing or objecting to these disclosures because of, for instance, an emergency situation, we will disclose protected health information (as we determine) in your best interest. After the emergency, we will give you the opportunity to object to future disclosures to family and friends. If you would like to request confidential communications related to your medical services, either because they are “sensitive services” or disclosure of the services would endanger you in any way, please contact CCH at the phone number or address above to submit such request. CCH complies with all properly made Confidential Communication Requests, if the communication is readily producible in the requested form or format, and such request will remain valid until it is revoked or a new confidential communication request is submitted to CCH. CCH provides employers only with the information allowed under the state and federal law. This information includes summary data about their group and information concerning premium and enrollment data. The only other way that we would disclose your PHI to your employer is if you authorized us to do so. Further, the law allows CCH to disclose your PHI without your authorization in the following circumstances:

Required by law. We may use and disclose your PHI to comply with the law.

Public health activities. We will disclose PHI when we report to a public health authority for purposes such as public health surveillance, public health investigations or suspected child abuse.

Reports about victims of abuse, neglect or domestic violence. We will disclose your PHI in these reports only if we are required or authorized by law to do so, or if you otherwise agree.

To health oversight agencies. We will provide PHI as requested to government agencies that have the authority to audit or investigate our operations.

Lawsuits and disputes. If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a subpoena or other lawful request, but only if efforts have been made to tell you about the request or obtain a court order that protects the PHI requested.

Law enforcement. We may release PHI if asked to do so by a law enforcement official in the following circumstances: (a) to respond to a court order, subpoena, warrant, summons or similar process; (b) to identify or locate a suspect, fugitive, material witness or missing person; (c) to assist the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (d) to investigate a death we believe may be due to criminal conduct; (e) to investigate criminal conduct; and (f) to report a crime, its location or victims or the identity, description or location of the person who committed the crime (in emergency circumstances).

Coroners, medical examiners and funeral directors. We may disclose PHI to facilitate the duties of these individuals.

Organ procurement. We may disclose PHI to facilitate organ donation and transplantation

Medical research. We may disclose PHI for medical research projects, subject to strict legal restrictions.

Serious threat to health or safety. We may disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the general public.

Special government functions. We may disclose PHI to various departments of the government such as the U.S. military or U.S. Department of State.

Workers’ compensation or similar programs. We may disclose your PHI when necessary to comply with worker’s compensation laws.

CCH will not use or disclose your confidential health information for any purpose other than the purposes described in this Notice, without your written authorization. For example, we will not (1) use PHI for marketing purposes, (2) sell your PHI, or (3) provide your PHI to a potential employer with whom you are seeking employment without your signed authorization. You may revoke an authorization that you previously have given by sending a written request to our Privacy Officer at the address listed above, but not with respect to any actions we already have taken.

Right to inspect and copy your PHI. Except for limited circumstances, you may review and copy your PHI. Your request must be addressed to the Privacy Officer, at the address listed at the top of this Notice. In certain situations, we may deny your request, but if we do, we will tell you in writing of the reasons for the denial and explain your rights with regard to having the denial reviewed. If the information you request is in an electronic health record, you may request that these records be transmitted electronically to yourself or a designated individual. If you request copies of your PHI, we may charge you a reasonable fee to cover the cost. Alternatively, we may provide you with a summary or explanation of your PHI, upon your request if you agree to the rules and cost (if any) in advance. Right to correct or update your PHI. If you believe that the PHI we have is incomplete or incorrect, you may ask us to amend it. Your request must be made in writing and must be addressed to the Privacy Officer. To process your request, you must use the form we provide and explain why you think the amendment is appropriate. We will inform you in writing as to whether the amendment will be made or denied. If we agree to make the amendment, we will make reasonable efforts to notify other parties of your amendment. If we agree to make the amendment, we will also ask you to identify others you would like us to notify. We may deny your request if you ask us to amend information that:

• Was not created by us, unless the person who created the information is no longer available to make the amendment;
• Is not part of the PHI we keep about you;
• Is not part of the PHI that you would be allowed to see or copy; or
• Is determined by us to be accurate and complete.

If we deny the requested amendment, we will notify you in writing on how to submit a statement of disagreement or complaint or request inclusion of your original amendment request in your protected health information. Right to obtain a list of the disclosures. You have the right to get a list of PHI disclosures, which is also referred to as an accounting. You must make a written request to the Privacy Officer to obtain this information.

• The list will not include disclosures we have made as authorized by law. For example, the accounting will not include disclosures made for treatment, payment and health care operations purposes (except as noted herein). Also, no accounting will be made for disclosures made directly to you, under an authorization that you provided, or those made to your family or friends. The list will not include other disclosures, including incidental disclosures, disclosures we have made for national security purposes, disclosures to law enforcement personnel or disclosures made before January 1, 2014.
• The list we provide will include disclosures made within the last six years (subject to the January 1, 2014, beginning date) unless you specify a shorter period.
• You may also request and receive an accounting of disclosures of electronic health records made for payment, treatment, or health care operations during the prior three years for disclosures made on or after January 1, 2014.
• The first list you request within a 12-month period will be free. You may be charged for providing any additional lists within a 12-month period.

Right to choose how we communicate with you. You have the right to ask that we send information to you at a specific address or in a specific manner as discussed above, regarding Confidential Communication Requests. Right to request additional restrictions on health information. You may request restrictions on our use and disclosure of your confidential information for the treatment, payment and health care operations purposes explained in this Notice. While we will consider all requests for restrictions carefully, we are not required to agree to a requested restriction. However, we must comply with your request to restrict a disclosure of your confidential information for payment or health care operations if you paid for these services in full, out of pocket.

If you have any questions about this Notice, would like to exercise a right described herein, please contact CCH at the phone number or address listed below. If you believe that CCH has not protected your privacy and you wish to complain, you may file a written grievance at the following address: Community Care Health – Appeals and Grievances, P.O. Box 45020, Fresno, CA 93718. Grievance forms are also available from the CCH Customer Service Team. If you need help completing the form, or you need a translation service, please contact our Customer Service Team at (855) 343-2247.

CCH reserves the right to change the terms of this Notice, and the changes will apply to all confidential information and PHI that we have about you. As noted above, when this Notice is updated it will be posted to CCH’s website and printed copies will be available upon request.