Common use of Our Responsibilities Clause in Contracts

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 47 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 48 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 48 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain Your Rights You have the privacy right to: • Get a copy of your protected health paper or electronic medical record • Correct your paper or electronic medical record • Request confidential communication • Ask us to limit the information and we will follow the terms share • Get a list of those with whom we’ve shared your information • Get a copy of this privacy notice while it is • Choose someone to act for you • File a complaint if you believe your privacy rights have been violation You have some choices in effect. the way that we use and share information as we: • Your past, present, or future physical or mental health or Tell family and friends about your condition • Providing Provide disaster relief • Include you in a hospital directory • Provide mental health care • The past, present, or future payment for providing you health care Market our services and sell your information • Raise funds We collect may use and share your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose includewe: • Information Treat you • Run our organization • Bill for your services • Help with public health and safety issues • Do research • Comply with the law • Respond to organ and tissue donation requests • Work with a medical examiner or your employer provide on applications funeral director • Address workers’ compensation, law enforcement, and other forms, such as names, addresses, social security numbers, government requests • Respond to lawsuits and dates legal actions Get an electronic or paper copy of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website record • You can ask to see or get a an electronic or paper copy of your health and claims records medical record and other health information we have about you. Ask us how to do this. • We will provide a copy or a summary of your health and claims recordsinformation, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want Ask us to obtain copies of correct your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. record • You can ask us to correct your health and claims records if information about you that you think they are is incorrect or incomplete. Ask us how to do this. • We may say no “no” to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do notto all reasonable requests. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but and we may say “no” if we doit would affect your care. • If you pay for a service or health care item out-of-pocket in full, we you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will abide by our agreement (except when necessary for treatment in an emergency)say “yes” unless a law requires us to share that information. • You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. • We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the right to authorize individuals to act on notice electronically. We will provide you with a paper copy promptly. • If you have given someone medical power of attorney or if someone is your behalf with respect to legal guardian, that person can exercise your rights and make choices about your health information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) • We will make sure the person has this authority and explain what type of information they may receive. • You have the right to revoke an authorization except can act for actions already taken based on your authorizationyou before we take any action. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4pg. 1. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Rights by sending a letter to 000 Xxxxxxxxxxxx Xxxxxx, X.X., Xxxxxxxxxx, X.X. 00000, calling 0-000-000-0000, or visiting xxx.xxx.xxx/xxx/xxxxxxx/xxxxx/xxxxxxxxxx/. • We will not retaliate against you for filing a complaint. In these cases, you have both the right and choice to tell us to: • With Share information with your family, close friends, or others involved with your health care or payment for in your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your • Share information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. situation • Include your information in a hospital directory In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your Most sharing of psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • . We can use your health information and share it with other professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 41 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 49 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 44 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 44 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23Please review it carefully. “Protected health information“ (PHI) is information about you, 2013. We are required including demographic information, that may identify you or be used to maintain the privacy of identify you, and that relates to your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, present or future physical or mental health or condition • Providing you condition, the provision of health care • The services, or the past, present, present or future payment for providing the provision of health care. Y our Rights Regarding Your PHI You have the right to: ● Get a copy of your paper or electronic medical record ● Correct your paper or electronic medical record ● Request confidential communication ● Ask us to limit the information we share ● Get a list of those with whom we’ve shared your information ● Get a copy of this privacy notice ● Choose someone to act for you health care ● File a complaint if you believe your privacy rights have been violated O ur Uses and Disclosures We collect may use and share your information as necessary we: ● Treat you ● Run our organization ● Bill for your services ● Help with public health and safety issues ● Do research ● Comply with laws that may be in place now or in the future Y our Rights When it comes to provide your health information, you with health insurance products have certain rights. This section explains your rights and services and some of our responsibilities to administer our businesshelp you. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • ● You can ask to see or get a an electronic or paper copy of your health and claims records medical record and other health information we have about you. • Ask us how to do this. ● We will provide a copy or a summary of your health and claims recordsinformation, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • ● You can ask us to correct your health and claims records if information about you that you think they are is incorrect or incomplete. • Ask us how to do this. ● We may say no “no” to your request, but we’ll tell you why in writing within 60 days. • ● You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • ● We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do notto all reasonable requests. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • ● You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but and we may say “no” if it would affect your care. ● If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information. ● You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we doshared it with, we and why. ● We will abide by our agreement include all disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (except when necessary for treatment in an emergencysuch as any you asked us to make). • We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the right to authorize individuals to act on notice electronically. We will provide you with a paper copy promptly. ● If you have given someone medical power of attorney or if someone is your behalf with respect to legal guardian, that person can exercise your rights and make choices about your health information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) ● We will make sure the person has this authority and explain what type of information they may receivecan act for you before we take any action. • You have the right to revoke an authorization except for actions already taken based on your authorization. • ● You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • at ● You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • Rights by sending a letter to 000 Xxxxxxxxxxxx Xxxxxx, X.X., Xxxxxxxxxx, X.X. 00000, calling 0-000-000-0000, or visiting xxx.xxx.xxx/xxx/xxxxxxx/xxxxx/xxxxxxxxxx/. ● We will not retaliate against you for filing a complaint. • With Y our Choices xxxxxxxxxxxx.Xx these cases, you have both the right and choice to tell us to: ● Share information with your family, close friends, or others involved with your health care or payment for in your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale ● Sharing of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, O ur Uses and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. Disclosures We typically use or share your health information in the following ways: • . ● We can use your health information and share it with other professionals who are treating you. ● We can use and share your health information to run our practice, improve your care, and contact you when necessary.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 45 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueShield of Northeastern New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 45 15049R_NENY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 46 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.

Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. This notice took effect on September 23, 2013. We are required to maintain the privacy of your protected health information and we will follow the terms of this notice while it is in effect. • Your past, present, or future physical or mental health or condition • Providing you health care • The past, present, or future payment for providing you health care We collect your information as necessary to provide you with health insurance products and services and to administer our business. We may also disclose this information to nonaffiliated third parties as described in this notice. The types of information we may collect and disclose include: • Information you or your employer provide on applications and other forms, such as names, addresses, social security numbers, and dates of birth • Information about your interactions with us or others (such as providers) regarding your medical information or claims • Information you provide in person, by phone, in email, or through visits to our website • You can ask to see or get a copy of your health and claims records and other health information we have about you. • We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee. • We may ask that you submit your request in writing. Please note, if you want to obtain copies of your medical records, you should contact the practitioner or facility. We do not generate, modify, or maintain complete medical records. • You may also request that we send a copy of your information to a third party. We may ask that you submit a written, signed authorization form permitting us to do so and we may charge a reasonable fee for copying and mailing your personal information. • You can ask us to correct your health and claims records if you think they are incorrect or incomplete. • We may say no to your request, but we’ll tell you why in writing within 60 days. • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not. • All requests should be made in writing. • It may take a short period of time for us to implement your request. • We will comply with your request if it is reasonable and continues to permit us to collect premiums and pay claims under your policy, including issuing certain explanations of benefits and policy information to the BlueCross BlueShield of Northeastern Western New York is a division of HealthNow New York Inc., an independent licensee of the BlueCross BlueShield Association. 15049R_NENY_12_19 49 15049R_WNY_12_19 f11011 subscriber of the policy. For example, even if you request confidential communications: ο We will mail the check for services you receive from a nonparticipating provider to you but made payable to the subscriber ο Accumulated payment information such as deductibles (in which your information might appear), will continue to appear on explanations of benefits sent to the subscriber ο We may disclose to the subscriber, as the contract holder, policy details such as eligibility status or certificates of coverage • You can ask us not to use or share certain health information for treatment, payment, or our operations. • We are not required to agree to your request, but if we do, we will abide by our agreement (except when necessary for treatment in an emergency). • You have the right to authorize individuals to act on your behalf with respect to your information. You must identify your authorized representatives on a HIPAA-compliant authorization form (available on our website) and explain what type of information they may receive. • You have the right to revoke an authorization except for actions already taken based on your authorization. • You can complain if you feel we have violated your rights by contacting us using the information listed on page 4. • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. • We will not retaliate against you for filing a complaint. • With your family, close friends, or others involved with your health care or payment for your care when you are present and have given us permission to do so. If you are not present, if it is an emergency, or you are not able to give us permission, we may give your information to a family member, friend, or other person if sharing your information is in your best interest. In these cases, the person requesting your information must accurately verify details about you (e.g., name, identification number, date of birth, etc.) and prove involvement with your health care or payment for your health care by providing details relevant to the information requested. For example, if a family member calls us with prior knowledge of a claim (e.g., provider’s name, date of service, etc.), we may confirm the claim’s status, patient responsibility, etc. We will only disclose information directly relevant to that person’s involvement with your health care or payment for your health care. • In a disaster relief situation. In these cases we never share your information unless you give us written permission: • Marketing purposes • Sale of your information • Disclose your psychotherapy notes • Make certain disclosures of information considered sensitive in nature, such as HIV/AIDS, mental health, alcohol or drug dependency, and sexually transmitted diseases. Certain federal and state laws require that we limit how we disclose this information. In general, unless we obtain your written authorization, we will only disclose such information as provided for in applicable laws. We typically use or share your health information in the following ways: • We can use your health information and share it with professionals who are treating you.