HARVARD UNIVERSITY GROUP HEALTH PROGRAM NOTICE OF PRIVACY PRACTICES
Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

HARVARD UNIVERSITY GROUP HEALTH PROGRAM IS COMMITTED TO PROTECTING THE PRIVACY OF OUR MEMBERS:

We understand that medical information about you is personal, and that protecting that information is important. In order to provide you with quality care, customer service, and to comply with certain legal and accreditation requirements, we create records of your enrollment, referral authorizations, and the claims generated from all the medical care you receive as a member of Harvard University Group Health Program (HUGHP) and Harvard University Health Program ã Point of Service (HUGHP POS) Plan. This notice tells you the ways in which we may use and disclose your personal, individually identifiable, health information, and our obligations to keep your information private. This notice also describes your privacy rights.

We are required by law to protect the privacy of individually identifiable health information about you ("Your Protected Health Information"), to give you this notice of our legal duties and our privacy practices, and to follow the terms of this notice.

WHO WILL FOLLOW THIS NOTICE:

This notice applies to the Harvard University Group Health Program (HUGHP) and Harvard University Group Health Program Ò Point of Service (HUGHP POS) Plan, hereafter referenced to as "the Plan". It applies to all HUGHP and HUGHP POS employees and other persons under the direct control of the Plan.

HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION:

The following categories show the different ways we may use and disclose to others Your Protected Health Information. For each category we give some examples, but not every use or disclosure in a category is listed. Your Protected Health Information will not be used or disclosed for purposes other than those described in this notice without your written authorization.

For Treatment: Your Protected Health Information may be used or disclosed by us to facilitate your treatment and for the coordination and management of your health care. For example, a doctor treating you for a particular condition may need to obtain information from us about prior treatment of a similar or different condition, including the identity of the health care provider who treated you previously.

For Payment: Your Protected Health Information may be used and disclosed by HUGHP to let your health care providers know that anticipated services will be, or will not be, covered by the plan, for example, to make coverage determinations, administer claims and coordinate benefits with other coverage you may have. Your Protected Health Information may also be used and disclosed to pay for health care you have received, or may be disclosed to another health plan or provider for its payment activities. For example, a non-HUHS doctor submits a claim to us following your hospital visit for knee surgery and we pay the provider for that service.

For Health Care Operations: Your Protected Health Information may be used or disclosed for a variety of healthcare-related purposes that are necessary for HUGHP to function. We may use your Protected Health Information to ensure that all our plan members receive quality care and to ensure that HUGHP continues to comply with federal and state laws. For example, we may use your Protected Health Information to do business planning and conduct quality assessments and improvement activities. We may also disclose Your Protected Health Information to another health plan or health care provider that has or had a relationship with you for it to conduct quality assessment and improvement activities, accreditation, certification, licensing, or credentialing activities; or for the purpose of health care fraud or abuse detection or compliance.

In addition, we may use or disclose Your Protected Health Information to contact you to tell you about alternative treatments or health-related benefits and services that may be of interest to you.

Disclosures to the Plan Sponsor:

Your Protected Health Information may be disclosed to certain employees or other individuals under our control as necessary for them to carry out our responsibilities to administer HUGHP's payment and health care operations activities. We are not permitted to use Your Protected Health Information disclosed by or on behalf of HUGHP for any other purpose without your authorization. The plan documents identify by position the specific employees or other individuals under our control who are authorized to have access to or receive Your Protected Health Information for plan administration purposes. We cannot use Your Protected Health Information obtained from HUGHP for any employment-related actions or to administer plans that are not subject to HIPAA without your authorization. However, health information derived from other sources, for example in connection with an application for disability benefits or for approval of a FMLA leave, is not protected by HIPAA.

Special Situations: In addition to the above, there may be times when we use or disclose Your Protected Health Information for the following reasons:

As Required By Law: We will disclose Your Protected Health Information when required to do so by federal, state, or local law. Third Parties: We may disclose Your Protected Health Information to third party business associates who assist in plan administration. Third parties include third party administrators, consultants, lawyers and other service vendors.

Health Oversight and Public Health Activities: We may disclose Your Protected Health Information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil laws. We may also disclose Your Protected Health Information to public authorities for purposes of preventing or controlling disease, reporting child abuse or neglect or certain other public health reasons.

Lawsuits and Disputes: We may disclose Your Protected Health Information about you in response to a subpoena, discovery request, or other lawful order from a court. We will take reasonable steps to notify you or your attorney before responding to such requests.

Law Enforcement: We may release Your Protected Health Information as part of law enforcement activities: in investigations of criminal conduct or of victims of crime; in response to court orders; in emergency circumstances; or when required to do so by law. Workers' Compensation: We may disclose Your Protected Health Information as necessary to comply with workers' compensation laws.

Exceptions: Federal and state law require special privacy protections for the subset of your medical record that is about genetic testing. In order for us to disclose any information about genetic testing that is or may be in your medical record, we must obtain your separate, specific consent, unless we are otherwise permitted by law to make such disclosure.

YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU:

You have the following rights regarding Your Protected Health Information:

Right to Inspect and Copy: You have the right to have access to a copy of your medical record files and billing records maintained by HUGHP. Usually, this includes enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for HUGHP.

To inspect and copy information from such medical record files and billing records, you must submit your request in writing to the Manager of HUHS/HUGHP Member Services. If you request a copy of the information, we may charge a fee for the costs of copying and postage. Under limited circumstances, HUGHP may deny you access to a portion of your records.

Right to Request Amendment: If you feel that medical information we have about you in your medical record files or billing record is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by HUGHP.

To request an amendment, your request must be made in writing and submitted to our Privacy Officer. In addition, you must provide a reason that supports your request. You may obtain a form for this purpose from the Privacy Officer.

We may deny your request for an amendment if the information contained in your medical record file or billing record is accurate and complete or if other special circumstances apply.

Right to an Accounting of Disclosures: You have the right to an "accounting of certain disclosures." This is a list or report of the disclosures we made of Your Protected Health Information for reasons other than payment or healthcare operations, and for which you did not sign an authorization.

To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer. Your request must state a time period that may not be longer than six years prior to the request date and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists during the same 12-month period, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at the time before any costs are incurred.

Right to Request Restrictions: You have the right to request a restriction or limitation on Your Protected Health Information we use or disclose for treatment, payment, or health care operations. You also have the right to request a limit on Your Protected Health Information we disclose to someone who is involved in your care or the payment of your care, such as a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. To request restrictions, you must make your request in writing to our Privacy Officer. In your request, you must state (1) what use or disclosure you want to limit, (2) what information you want to limit, and/or (3) to whom you want the limits to apply. No agreement to comply with a requested restriction shall be effective unless an authorized representative of HUGHP signs the agreement.

Right to Request Confidential Communications: You have the right to request and we will accommodate any reasonable written request to our Privacy Officer to receive Your Protected Health Information by alternative means of communication or alternative locations. Please note that in certain instances such as eligibility and enrollment concerns, the health plan is obliged to communicate directly with the employee rather than a dependent member.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice at any time, even if you have agreed to receive this notice electronically. To obtain a paper copy of this notice, please request one from Member Services or the University's Benefits Office.

CHANGES TO THIS NOTICE:

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health plan information we already have about you as well as any information we receive in the future. We will post a copy of the current notice. Our notice will always contain the effective date in the top right-hand corner of the first page.

COMPLAINTS:

If you believe your privacy rights have been violated or we are not in compliance with these privacy practices, you may file a complaint with the plan's Privacy Officer or with the Secretary of the Department of Health and Human Services. To file a complaint with HUGHP, write to our Privacy Officer whose address is listed below. All complaints must be submitted in writing.

The Privacy Officer and Harvard University Group Health Program will investigate all complaints. You will not be penalized in any way for making a complaint.

Complaints filed with the Secretary of Health and Human Services must be in writing and must be sent within 180 days of when you knew (or should have known) that the act or omission occurred. Your letter must include: the name of the plan, and a description of the acts or omissions that you believe are in violation of privacy requirements.

OTHER USES OF MEDICAL INFORMATION:

Other uses and disclosures of health plan information not covered by this notice or the laws that apply to us will be made only with your written authorization. If we obtain your written authorization to disclose Your Protected Health Information for any reason not stated in this notice you may revoke your written authorization, except to the extent that we have taken action in reliance upon it, by delivering a written revocation statement to the Privacy Officer identified below.

LIMITATIONS ON APPLICATION OF THIS NOTICE:

This Notice does not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. In addition, the Plan may use or disclose "summary health information" to Harvard University, the Plan Sponsor, for purposes of obtaining premium bids or modifying, amending or terminating the plan. Summary health information is information that summarizes claims history, claims expenses or types of claims experienced by individuals for whom the Plan Sponsor provides benefits under the plan and from which individual identifying information, other than a zip-code, has been deleted. The Plan and the Plan Sponsor may also use or disclose eligibility and enrollment information without your authorization.

CONTACT INFORMATION:

To request any of the above rights, or for further information about this Privacy Notice, please contact us as directed above:

Harvard University Group Health Program
Attn: Privacy Officer
75 Mt. Auburn Street
Cambridge, MA 02138
Telephone: 617-496-1630

Secretary of Health and Human Services
200 Independence Avenue, S.W.
Washington, DC 20201
Telephone: 202-619-0257
Toll Free: 1-877-696-6775