This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Protecting the Privacy of Your Personal Health Information Dean is required by law to maintain the privacy of your personal health and financial information (collectively referred to as “nonpublic personal information”) and provide you with written notification of our legal duties and privacy practices concerning that information. This No- tice describes how we protect the confidentiality of our members’ (and former members’) nonpublic personal information. It includes brief explanations on how we obtain, use, and protect your nonpublic personal information. Types of Nonpublic Personal Information Dean Collects About You We collect a variety of nonpublic personal information needed to administer health insurance coverage and benefit. We collect nonpublic personal information about you from some of the following sources: Information we receive directly or indirectly from you or your employer or benefit plan sponsor through applications, surveys or other forms. The information may be received in writing, in person, by telephone or electronically. Examples include name, address, social security number, date of birth, marital status and medical history. Information about your transactions with us, our affiliates, our providers, our agents and others. This includes information from health care claims, medical history, eligibility information, payment information, service request, and appeal and grievance information. Information you authorize us to collect from others. Choices about Your Health Information We will not use or disclose your health information without your written authorization, except as described in this Notice. You generally have the right and choice to tell us to: Share information with your family, close friends or others involved in payment for your care. Share information in a disaster relief situation. In the following cases we never share your information unless you give us written permission: Most uses and disclosures of psychotherapy notes. Marketing purposes. Sale of your information. If you do give us written authorization to use or disclose your health information for a particular purpose, you may change your mind at any time. You must let us know in writing if you change your mind. How Dean May Use or Disclose Your Health Information We will not disclose your nonpublic personal information unless we are allowed or required by law to do so. The following categories describe the ways that Dean may use and disclose your nonpublic personal information. For each category of uses and disclosures, we will explain what we mean and present some examples. Not every use or disclosure we might make will be listed. However, all the ways we are permitted to use and disclose information will fall within one of the categories. Note: Some of the uses and disclosures described in this notice may be limited in certain cases by applicable State laws that are more stringent than Federal laws, including disclosures related to mental health and substance abuse, developmental disability, alcohol and other drug abuse (AODA), and HIV testing. We are allowed to use and disclose information that falls within one of the following categories: Payment. We may use and disclose your health information to make and collect payment for treatment and services you receive, such as: determining your eligibility for plan benefits, obtaining premiums, determining your health plan’s responsibility for benefits, and collecting payment for your health services. Health Care Operations. We may use and disclose your health information to support our business activities and improve our coverage and services. However, we are not allowed to use genetic information to decide whether we will give you coverage or the price of that coverage. Health care operations include such activities as: Underwriting Premium rating Other functions related to plan coverage Quality assessment and improvement activities Activities designed to improve health and reduce health care cost Case management and care coordination Notice: We are part of an Organized Health Care Arrangement (OHCA) with SSM Health and Dean Health System. As part of the OHCA, we may from time to time share your information with other members of the OHCA in order to perform joint health care operations. These uses and disclosures allow the OHCA to run efficiently. For example, we may share your information in order to: improve population health management; conduct quality assessment and improvement activities; conduct or arrange for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; and business management and general OHCA administrative activities. Treatment. We may disclose your health information to a physician or other health care provider that is treating you. We may contact you with information on treatment alternatives and other related functions that may be of interest to you. Distributing Health-related Benefits and Services. We may use and disclose your health information to provide information on health-related benefits and services that may be of interest to you. Disclosure to Plan Sponsors. If applicable, we may disclose your health information to the sponsor of your group health plan for purposes of administering benefits under the plan. If you have a group health plan, your employer is the plan sponsor. Public Safety. We can share health information about you for certain situations such as: preventing disease; helping with product recalls; reporting adverse reactions to medications; reporting suspected abuse, neglect, or domestic violence; and preventing or reducing a serious and imminent threat to the health or safety of a particular person or the public. Research. Under certain circumstances, and only after a special approval process, we may use and disclose your health information to help conduct research. Respond to organ and tissue donation requests. We can share health information about you with organ procurement organizations, a coroner, medical examiner, or a funeral director when an individual dies. Required by Law. We will share information about you if laws require it, including with the Department of Health and Human Services if it wants to see that we are complying with federal privacy law Workers’ Compensation, Law Enforcement, and Other Government Requests. We can use and share health information about you: for workers’ compensation claims; for law enforcement purposes or with a law enforcement official; with health oversight agencies for activities authorized by law; and for special government functions such as military, national security, and presidential protective services. Workers’ Compensation, Law Enforcement, and Other Government Requests. We can use and share health information about you: for workers’ compensation claims; for law enforcement purposes or with a law enforcement official; with health oversight agencies for activities authorized by law; and for special government functions such as military, national security, and presidential protective services. Legal Actions. We may disclose your health information in the course of any administrative or judicial proceeding. How Dean Protects This Information We limit the collection of nonpublic personal information to that which is necessary to administer our business, provide quality service, and meet regulatory requirements. We maintain physical, electronic, and procedural safeguards that comply with federal regulations to safeguard your nonpublic personal information. We limit the internal use of oral, written, and electronic nonpublic personal information about you and ensure that only authorized staff and business associates with the need to know have access to it. We maintain safeguards for your nonpublic personal information and review them regularly to protect your privacy. Your Health Information Rights Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of your health information. Right to Request Confidential Communications. You have the right to receive your health information through a reasonable alternative means or at an alternative location. Right to See and Copy. You have the right to see and copy certain health information about you. Right to Correct Records. You have a right to request that Dean correct certain health information held by Dean if you think it is incorrect or incomplete. Right to Accounting of Disclosures. You have the right to receive a list “accounting of disclosures” of your health information made by us in the past six years. The list will not include disclosures made for purposes of treatment, payment, health care operations, or certain other disclosures (such as those you asked us to make). Right to Copy of Notice. You have a right to receive a paper copy of this Notice at any time. Right to be Notified of a Breach. You will be notified in the event of a breach of your unsecured protected health information. Right to a Representative. You have the right to appoint a medical power of attorney, of if someone is your legal guardian, that person can exercise your rights and makes choices about your health information. Changes to this Notice of Privacy Practices Dean may change this Notice from time to time and make the new provisions effective for all nonpublic personal information we maintain, including information we created or received before the change. Dean will always comply with the current version of this Notice. Complaints Please submit complaints about this Notice or how we handle your health information, in writing, to our Privacy Officer. Dean will not hold any complaint you submit against you in any way. In addition, if you believe your privacy rights have been violated, you may file a complaint with the Secretary of the U.S. Department of Health and Human Services. If you have questions, complaints or want to exercise any of your health information rights, call the Customer Care Center at 800-279-1301 (or, if you purchased coverage on the Health Insurance Marketplace, at 800-279-1302) or contact us at the following address: Privacy Officer PO Box 56099 Madison, WI 53705 The effective date of this notice is 8/21/2017.