THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice of Privacy Practices describes how QualChoice may collect, use and disclose your Protected Health Information and your rights concerning your Protected Health Information.

"Protected Health Information" (PHI) is information about you, including demographic information collected from you that can reasonably be used to identify you and that relates to your past, present or future physical or mental health or condition, the provision of your health care, or the payment for that care.

We are required to maintain the privacy of your Protected Health Information and to provide you with this notice about our legal duties and privacy practices. We must follow the privacy practices described in this notice while it is in effect. This notice takes effect April 14, 2003, and will remain in effect until replaced, modified, or amended.

Uses and Disclosures of Protected Health Information
Uses and Disclosures for Payment, Health Care Operations and Treatment: We use and disclose Protected Health Information in a number of different ways in connection with health care operations, the payment for your health care, and your treatment. The following are only a few examples of the types of uses and disclosures of your Protected Health Information that we are permitted to make without your authorization.

Payment: We will use and disclose your Protected Health Information to administer your health benefits policy or contract, which may involve the determination of eligibility; claims payment; utilization review and care management; medical necessity review; coordination of care, benefits and other services; and responding to complaints, appeals and external review requests. Likewise, we may also share Protected Health Information with another entity to assist with subrogation of health claims or to another health plan to coordinate benefit payments. In some instances, we may also use and disclose Protected Health Information for purposes of premium billing, underwriting, and the determination of premium rates and co-payments, deductibles, co-insurance and other cost sharing amounts.

Health Care Operations: We will use and disclose your Protected Health Information to support other business activities, including the following:

• Quality assessment and improvement activities, such as peer review and credentialing of providers and accreditation by independent organizations such as the National Committee for Quality Assurance and the American Accreditation HealthCare Commission.
• Performance measurement and outcomes assessment, health claims analysis and health services research.
• Operation of preventive health, early detection, care management, and coordination of care programs in plans that offer these programs, including information about treatment alternatives, therapies, health care providers, settings of care or other health-related benefits and services.
• Medical Care Review.
• Underwriting, premium determination and administration of reinsurance.
• Risk management, auditing, legal services and detection and investigation of fraud and other unlawful conduct.
• Transfer of eligibility and plan information to business associates (for example, Pharmacy Benefit Management -PBM's- for the management of pharmacy benefits, Mental Health Management companies for the management of mental health benefits, Dental Benefit programs for the management of dental benefits, and other programs as necessary to administer your benefit plan).
• Other general administrative activities, including data and information systems management and customer service.
• In the event of any potential sale, transfer, merger, or consolidation of all or part of QualChoice with another covered entity in the course of due diligence related to that activity.

Treatment: We may disclose your Protected Health Information to health care providers (doctors, dentists, pharmacies, hospitals and other caregivers) who request it in connection with your treatment. We may also disclose your Protected Health Information to health care providers in connection with preventive health, early detection and care management programs, in plans that offer these programs.

In connection with payment, health care operations, and treatment, we may collect the following types of information about you:

• Information we receive directly or indirectly from you, your employer, your benefits plan sponsor, or one of its business associates through applications, surveys, or other forms (e.g., name, address, social security number, date of birth, marital status, dependent information, employment information and medical history).
• Information about other insurance coverage and health care transactions with any covered entity (e.g., coordination of coverage with other benefit programs, health care claims, eligibility or payment information, and appeal or complaint information).

We may share your Protected Health Information with affiliates and third party "business associates" that perform various activities for us or on our behalf. Whenever such an arrangement involves the use or disclosure of your Protected Health Information, we will have a written contract that contains terms designed to protect the privacy of your Protected Health Information. We may also contact you about treatment alternatives or other health-related benefits and services that may be of interest to you.

We will not disclose medical Protected Health Information to your employer. We will, however, provide minimal protected information necessary to allow your employer to pay the monthly premium billing statement (for example, name, identification number, and family coverage status).

If we obtain Protected Health Information for underwriting purposes and the policy or contract of health insurance or health benefits is not written with us, we will not use or disclose that Protected Health Information for any other purpose, except as required by law.

We do not destroy Protected Health Information when individuals terminate their coverage with us. The information is necessary and used for many of the purposes described above, even after an individual leaves a plan, and in many cases is subject to legal retention requirements. However, the policies and procedures that protect that information against inappropriate use and disclosure apply regardless of the status of any individual member.

Some of the uses and disclosures described in this notice may be limited, in certain cases, by applicable state laws that are more stringent than the federal standards.

Other Permitted or Required Uses and Disclosures of Protected Health Information
We may use or disclose your Protected Health Information in the following additional situations without your authorization:

Others Involved in Your Healthcare: Unless you request Restriction or Confidential Communication, we may disclose to your spouse, the Protected Health Information directly related to payment for health care services.

We will not disclose your Protected Health Information regarding health care to your spouse, your family, a relative, a close friend, or any other person without your signed authorization explicitly directing us to do so. If you are present for such a disclosure (whether in person or on a telephone call), we will either seek your verbal agreement to the disclosure or provide you an opportunity to object to it. We may also make such disclosures to the persons described above in situations where you are not present or you are unable to agree or object to the disclosure, if we determine that the disclosure is in your best interest. We may also disclose your Protected Health Information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.

Unless we are given an alternative address, we will mail explanation of benefits forms and other correspondence containing protected health information to the address we have on record for the subscriber of the health benefits plan. We will not make separate mailings for enrolled dependents of the subscriber, unless requested by Confidential Communications described in this notice. Similarly, unless you tell us to do otherwise, the claims information contained on our website - www.qcark.com - (and corresponding telephone voice response systems or other integrated internet systems, if available) will be on a combined basis for you and all of your covered dependents. If you would not like us to share any information in any of the foregoing manners with any particular individuals or organizations, please call the toll-free number on your ID for additional information or instructions.

Required by Law: We may use or disclose your Protected Health Information to the extent we are required to do so by law.

Public Health: We may disclose your Protected Health Information to an authorized public health authority for purposes of public health activities. The information may be disclosed for such reasons as controlling disease, injury or disability. In addition, we may make disclosures to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems; to track products to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.

Abuse or Neglect: We may make disclosures to government authorities concerning abuse, neglect or domestic violence.

Health Oversight: We may disclose your Protected Health Information to a government agency authorized to oversee the healthcare system or government programs, or its contractors (e.g., state insurance department, U.S. Department of Labor) for activities authorized by law, such as audits, examinations, investigations, inspections and licensure activity.

Legal Proceedings: We may disclose your Protected Health Information in the course of any legal proceeding, in response to an order of a court or administrative tribunal and, in certain cases, in response to a subpoena, discovery request or other lawful process.

Law Enforcement: We may disclose your Protected Health Information under limited circumstances to law enforcement officials. For example, disclosures may be made in response to a warrant or subpoena; for the purpose of identifying or locating a suspect, witness or missing persons; or to provide information concerning victims of crimes.

Coroners, Funeral Directors and Organ Donation: We may disclose your Protected Health Information in certain instances to coroners, funeral directors and in connection with organ donation.

Research: We may disclose your Protected Health Information to researchers, provided that certain established measures are taken to protect your privacy.

Threat to Health or Safety: We may disclose your Protected Health Information to the extent necessary to avert a serious and imminent threat to your health or safety or to the health or safety of others.

Military Activity and National Security: We may disclose your Protected Health Information to Armed Forces personnel, under certain circumstances, and to authorized federal officials for the conduct of national security and intelligence activities.

Correctional Institutions: If you are an inmate in a correctional facility, we may disclose your Protected Health Information to the correctional facility for certain purposes, including the provision of your health care, your health and safety, or the health and safety of others.

Workers' Compensation: We may disclose your Protected Health Information to the extent required by workers' compensation laws.

Sponsor of Your Health Plan: We may disclose enrollment and disenrollment information to the plan sponsor of your health plan (this is your employer). We may also share Protected Health Information with your employer that summarizes the claims history, expenses, or types of claims of all individuals enrolled in your health plan. We may share such summary health information with your employer for it to obtain premium bids from other health insurance companies or to make decisions about modifying, amending, or terminating your health plan.

Uses and Disclosures of Protected Health Information with an Authorization: Other uses and disclosures of Protected Health Information will be made only with your written authorization, unless otherwise permitted or required by law. You may revoke this authorization, at any time, in writing, except to the extent that we have taken an action in reliance on the use or disclosure indicated in the authorization being revoked.

Many members ask us to disclose their Protected Health Information to third parties for reasons not described in this notice. For example, elderly members often ask us to make their records available to caregivers. To authorize us to disclose any of your Protected Health Information to a person or organization for reasons other than those described in this notice, please call the toll-free phone number on your ID card and you will be provided the appropriate authorization form. You should send the completed form to the address provided under Contact Information for Exercising Member Rights below. You may revoke the authorization at any time by sending us a letter to the same address. Please include your name, address, member identification number and a telephone number where we can reach you.

Your Individual Rights
The following is a brief statement of your additional rights with respect to your Protected Health Information:

Right to Request Restrictions: You have the right to ask us to place restrictions on the way we use or disclose your Protected Health Information for treatment, payment or healthcare operations or as described in the section of this notice entitled Others Involved in Your Healthcare. However, we are not required to agree to these restrictions. If we do agree to a restriction, we may not use or disclose your Protected Health Information in violation of that restriction, unless it is needed for an emergency.

Confidential Communications: We will accommodate reasonable requests to communicate with you about your Protected Health Information by alternative means or to alternative locations. For example, if you are covered under a health plan as an adult dependent (e.g., a spouse or a child attending college) and you want us to send correspondence that contains Protected Health Information to a different address from the member we can accommodate that request. We will ask you to make your confidential communication request in writing.

Access to Protected Health Information: You have the right to receive a copy of Protected Health Information about you that is contained in a "designated record set," with some specified exceptions. A "designated record set" means a group of records that are used by or for us to make decisions about you including enrollment, payment, claims adjudication and case or medical management records. We may ask you to request access to copies of your records in writing and to provide us the specific information we need to fulfill your request. We reserve the right to charge a reasonable fee for the cost of producing and mailing the copies. More information on our fee structure is available by contacting us at the address provided below.

Amendment of Protected Health Information: You have the right to ask us to amend any Protected Health Information about you that is contained in a "designated record set" (see above). All requests for amendment must be in writing. In certain cases, we may deny your request. For example, we may deny a request if we were not the source of the information, as is often the case for medical information in our records. All denials will be made in writing. You may respond by filing a written statement of disagreement with us, and we would have the right to rebut that statement. If you believe someone has received inaccurate Protected Health Information from us, you should inform us at the time of the request if you want him or her to be informed of the amendment.

Accounting of Certain Disclosures: You have the right to have us provide you an accounting of times when we have disclosed your Protected Health Information for any purpose other than the following: (i) treatment, payment or health care operations; (ii) as described in the section of this notice entitled Others Involved in Your Healthcare; (iii) disclosures that you or your personal representative has authorized; or (iv) certain other disclosures, such as disclosures for national security purposes. All requests for an accounting must be in writing. We will require you to provide us the specific information we need to fulfill your request. This accounting requirement applies for six years from the date of the disclosure, beginning with disclosures occurring after April 14, 2003. If you request this accounting more than once in a 12-month period, we may charge you a reasonable fee. More information is available on our fee structure by contacting us at the address provided below.

Contact Information for Exercising Member Rights: You may exercise any of the rights described above by contacting QualChoice Customer Service Department or by writing to the QualChoice's Privacy Official.

Changes to Privacy Practices
We may change the terms of our notice at any time. The new notice will be effective for all Protected Health Information that we maintain. We redistribute a new Notice of Privacy Practices whenever we make a material change in our privacy practices described in our notice.

Questions and Complaints If you have any questions about this notice or would like an additional copy of the notice, please contact QualChoice's Privacy Official (contact information follows).

If you are concerned that your privacy rights may have been violated, please follow the complaint procedures described in your plan documents or on our website, www.qcark.com. You also have the right to complain to the Secretary of Health and Human Services. We will not retaliate against you for filing a complaint. If you have any questions about the complaint process, including the address of the Secretary of Health and Human Services, please call QualChoice Customer Service Toll-Free Number on your ID card or the QualChoice Privacy Official at 501-228-7111 (ext. 5004).

You also may obtain any new notice by contacting the Privacy Official. You may contact the Privacy Official at:

Privacy Official
QualChoice
P.O. Box 25610
Little Rock, AR 72211

Phone: 501-228-7111 (ext. 5004)
Fax: 501-219-5171