MISSISSIPPI COMPREHENSIVE HEALTH INSURANCE RISK POOL ASSOCIATION:
NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY. THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US.

Summary of Privacy Practices

"We" (Mississippi Comprehensive Health Insurance Risk Pool Association) and our business associate, Blue Cross & Blue Shield of Mississippi, A Mutual Insurance Company, may use and disclose your medical information, without your permission, for treatment, payment, and health care operations activities and, when required or authorized by law, for public health and interest activities, law enforcement, judicial and administrative proceedings, research, and certain other public benefit functions.

We may disclose your medical information to your spouse and others you involve in your health care or payment for health care, and to appropriate public and private agencies in disaster relief situations.

We will not otherwise use or disclose your medical information without your written authorization.

You have the right to examine and receive a copy of your medical information, to receive an accounting of certain disclosures we may make of your medical information, and to request that we amend, further restrict use and disclosure of, or communicate in confidence with you about your medical information.

Please review this entire notice for details about the uses and disclosures we may make of your medical information, about your rights and how to exercise them, and about complaints regarding or additional information about our privacy practices.

Our Legal Duty

We are required by applicable federal and state law to maintain the privacy of your medical information. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your medical information. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect April 14, 2003, and will remain in effect unless we replace it.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all medical information that we maintain, including medical information we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and send the new notice to our policyholders at the time of the change.

You may request a copy of our notice at any time. For more information about our privacy practices, or for additional copies of this notice, please use the contact information at the end of this notice.

Uses and Disclosures of Medical Information

Treatment: We may disclose your medical information, without your permission, to a physician or other health care provider to treat you.

Payment: We may use and disclose your medical information, without your permission, to pay claims from physicians, hospitals and other health care providers for services delivered to you that are covered by your policy, to determine your eligibility for benefits, to coordinate your benefits with other payers, to determine the medical necessity of care delivered to you, to obtain reinsurance premiums for your health coverage, to issue explanations of benefits and the like. We may disclose your medical information to a health care provider or another health plan for that provider or plan to obtain payment or engage in other payment activities.

Health Care Operations: We may use and disclose your medical information, without your permission, for health care operations. Health care operations include:

• health care quality assessment and improvement activities;
• reviewing and evaluating health care provider and health plan performance, qualifications and competence, health care training programs, health care provider and health plan accreditation, certification, licensing and credentialing activities;
• conducting or arranging for medical reviews, audits, and legal services, including fraud and abuse detection and prevention;
• underwriting and premium rating our risk for health coverage, and obtaining stop-loss and similar reinsurance for our health coverage obligations; and
• business planning, development, management, and general administration, including customer service, grievance resolution, claims payment and health coverage improvement activities, de-identifying medical information, and creating limited data sets for health care operations, public health activities, and research.

We may disclose your medical information to another health plan or to a health care provider subject to federal privacy protection laws, as long as the plan or provider has or had a relationship with you and the medical information is for that plan's or provider's health care quality assessment and improvement activities, competence and qualification evaluation and review activities, or fraud and abuse detection and prevention.

Your Authorization: You may give us written authorization to use your medical information or to disclose it to anyone for any purpose. If you give us an authorization, you may revoke it in writing at any time. Your revocation will not affect any use or disclosure permitted by your authorization while it was in effect. Unless you give us a written authorization, we will not use or disclose your medical information for any purpose other than those described in this notice.

Spouses and Others Involved in Your Care or Payment for Care: We may disclose your medical information to a spouse covered under your benefit plan. We will disclose only the medical information that is relevant to your spouse's involvement. We may use or disclose your name, location, and general condition to notify, or to assist an appropriate public or private agency to locate and notify, a person responsible for your health care in appropriate situations, such as a medical emergency or during disaster relief efforts.

If you are present at the time of disclosure, we will provide you with an opportunity to object. If you are not present or are incapacitated or it is an emergency or disaster relief situation, we will use our professional judgment to determine whether disclosing your medical information is in your best interest under the circumstances.

Health-Related Products and Services: We may use your medical information to communicate with you about health-related products, benefits and services, and payment for those products, benefits and services, that we provide or include in our benefits plan, and about treatment alternatives that may be of interest to you. These communications may include information about the health care providers in our network, about replacement of or enhancements to your health plan, and about health-related products or services that are available only to our policyholders that add value to, although they are not part of, our benefits plan.

Public Health and Benefit Activities: We may use and disclose your medical information, without your permission, when required by law, and when authorized by law for the following kinds of public health and interest activities, judicial and administrative proceedings, law enforcement, research, and other public benefit functions:

• for public health, including to report disease and vital statistics, child abuse, and adult abuse, neglect or domestic violence;
• to avert a serious and imminent threat to health or safety;
• for health care oversight, such as activities of state insurance commissioners, licensing and peer review authorities, and fraud prevention enforcement agencies;
• for research;
• in response to court and administrative orders and other lawful process;
• to law enforcement officials with regard to crime victims, crimes on our premises, crime reporting in emergencies, and identifying or locating suspects or other persons;
• to coroners, medical examiners, funeral directors, and organ procurement organizations;
• to the military, to federal officials for lawful intelligence, counterintelligence, and national security activities, and to correctional institutions and law enforcement regarding persons in lawful custody; and
• as authorized by state worker's compensation laws.

Individual Rights

Access: You have the right to examine and to receive a copy of your medical information, with limited exceptions. You must make a written request to obtain access to your medical information. You should submit your request to the contact at the end of this notice. You may obtain a form from that contact to make your request.

We may charge you reasonable, cost-based fees for a copy of your medical information, for mailing the copy to you, and for preparing any summary or explanation of your medical information you request. Contact us using the information at the end of this notice for information about our fees.

Disclosure Accounting: You have the right to a list of instances after April 14, 2003, in which we disclose your medical information for purposes other than treatment, payment, health care operations, as authorized by you, and for certain other activities.

You should submit your request to the contact at the end of this notice. You may obtain a form from that contact to make your request. We will provide you with information about each accountable disclosure that we made during the period for which you request the accounting, except we are not obligated to account for a disclosure that occurred more than 6 years before the date of your request and never for a disclosure that occurred before April 14, 2003. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to your additional requests. Contact us using the information at the end of this notice for information about our fees.

Amendment: You have the right to request that we amend your medical information. Your request must be in writing, and it must explain why the information should be amended. You should submit your request to the contact at the end of this notice. You may obtain a form from that contact to make your request.

We may deny your request only for certain reasons. If we deny your request, we will provide you a written explanation. If we accept your request, we will make your amendment part of your medical information and use reasonable efforts to inform others of the amendment who we know may have and rely on the unamended information to your detriment, as well as persons you want to receive the amendment.

Restriction: You have the right to request that we restrict our use or disclosure of your medical information for treatment, payment or health care operations, or with family, friends or others you identify. We are not required to agree to your request. If we do agree, we will abide by our agreement, except in a medical emergency or as required or authorized by law. You should submit your request to the contact at the end of this notice. You may obtain a form from that contact to make your request. Any agreement we may make to a request for restriction must be in writing signed by a person authorized to bind us to such an agreement.

Confidential Communications: You have the right to request that we communicate with you about your medical information in confidence by alternative means or to alternative locations that you specify. You must make your request in writing, and your request must represent that the information could endanger you if it is not communicated in confidence as you request. You should submit your request to the contact at the end of this notice. You may obtain a form from that contact to make your request.

We will accommodate your request if it is reasonable, specifies the alternative means or location for confidential communications, and continues to pennit us to collect premiums and pay claims under your health plan, including issuance of explanations of benefits. Please note that an explanation of benefits and other information that we issue about health care that you received for which you did not request confidential communications, or about health care received by others covered by the health plan in which you participate, may contain sufficient information to reveal that you obtained health care for which we paid, even though you requested that we communicate with you about that health care in confidence.

Questions & Complaints

If you disagree with a decision we made about access to your medical information, in response to a request you made to amend, restrict the use or disclosure of, or communicate in confidence about your medical information, you may complain using the contact information at the end of this notice. You also may submit a written complaint to the Office for Civil Rights of the United States Depaituuent of Health and Human Services, 200 Independence Avenue, SW, Room 509F, Washington, D.C. 20201. You may contact the Office of Civil Rights' Hotline at 1-800-368-1019.

We support your right to the privacy of your medical information. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

Mississippi Comprehensive Health Insurance Risk Pool Association
P. O. Box 13748
Jackson, MS 39236
Telephone: (601) 899-9967
Fax: (601) 957-9302