THIS NOTICE ALSO APPLIES TO YOUR SPOUSE AND OTHER ELIGIBLE DEPENDENTS. PLEASE SHARE IT WITH THEM.

The MBA is considered a "hybrid entity" under HIPAA, because not all of the benefits offered by the MBA are covered by the privacy protections of HIPAA. The only plan offered by the MBA that is subject to HIPAA is the Hospital Plus plan.

We are legally required to maintain the privacy of your PHI. The primary purpose of this notice is to describe the legally permitted uses and disclosures of PHI, some of which may not apply to the MBA in practice. This notice also describes your right to access and control your PHI.

We are required to abide by the terms of this Notice of Privacy Practices ("Notice"). However, we reserve the right to change the terms of this or any subsequent Notice at any time. If we elect to make a change, the revised Notice will be effective for all PHI that we maintain at that time. Within 60 days of any material revision of our privacy practices we will distribute a new Notice. Additionally, you may contact the MBA directly at any time to obtain a copy of the most recent Notice, or visit our website at www.nalc.org/depart/mba to view or download the current Notice.

This Notice is effective April 14, 2004.

Treatment: Means the provision, coordination or management of your health care. While we do not provide treatment, we may use or disclose your PHI to support the provision, coordination or management of your care. For example, we may disclose your PHI to an individual responsible for coordinating your health care.

Payment: Means activities in connection with processing claims for your health care. We may need to use or disclose your PHI to determine eligibility for coverage, medical necessity and for utilization review activities. For example, we could disclose your PHI to physicians engaged by the MBA for their medical expertise in order to help us determine eligibility for coverage.

We may disclose your PHI to third parties who are known as "Business Associates" that perform various activities for us. In such circumstances, we will have a written contract with the Business Associate, which requires the Business Associate to protect the privacy of your PHI.

We may also disclose your PHI and your dependents' PHI, on Explanations of Benefit ("EOB") forms and other payment-related correspondence, that are sent to you.

Health Care Operations: Generally means general administrative and business functions that the MBA must perform in connection with the Hospital Plus plan in order to function as a health plan. For example, we may need to review your PHI as part of the plan's efforts to uncover instances of provider abuse and fraud.

Reminders: We may use your PHI to provide you with reminders.

Treatment Alternatives: We may use your PHI to inform you about treatment alternatives.

Health-Related Benefits And Services: We may use or disclose your PHI to inform you about other health-related benefits and services that may be of interest to you.

Disclosure To Trustees: We may disclose your PHI to Trustees in connection with appeals that you file following a denial of a benefit claim or a partial payment. In addition, any Trustee may receive PHI if you request that Trustee to assist you in your filing or perfecting a claim for benefits under the MBA's Hospital Plus plan. Trustees may also receive PHI if necessary for them to fulfill their fiduciary duties with respect to the MBA. Such disclosures will be the minimum necessary to achieve the purpose of the use or disclosure. Such Trustees must agree not to use or disclose PHI other than as permitted in this Notice or as required by law, not to use or disclose the PHI with respect to any employment-related actions or decisions, or with respect to any other benefit plan maintained by the Trustees.

Disclosure to Others Involved In Your Care or Payment of Your Care: We may disclose to your spouse or other members of your immediate family your PHI that is directly relevant to such individual's involvement in your health care or payment of your health care, unless you request us in writing not to do so.

Disclosure of PHI Pursuant to Your Authorization: We may disclose your PHI to anyone that you authorize. Contact the MBA to obtain a copy of the appropriate form to authorize the people who may receive this information.

Disaster Relief: We may disclose your PHI to any authorized public or private entities assisting in disaster relief efforts.

Personal Representatives: We may disclose your PHI to your Personal Representative in accordance with applicable state law or the Privacy Rule. A Personal Representative is someone authorized by court-order, power of attorney, or a parent of a child, in most cases. In addition, a Personal Representative can exercise your personal rights with respect to PHI.

Required By Law: We may use or disclose your PHI to the extent that we are required to do so by federal, state or local law. You will be notified, if required by law, of any such uses or disclosures.

Public Health: We may disclose your PHI for public health purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of preventing or controlling disease (including communicable diseases), injury or disability. If directed by the public health authority, we may also disclose your PHI to a foreign government agency that is collaborating with the public health authority.

Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections and legal actions. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.

Abuse Or Neglect: We may disclose your PHI to any public health authority authorized by law to receive reports of child abuse or neglect. In addition, if we reasonably believe that you have been a victim of abuse, neglect or domestic violence we may disclose your PHI to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal. In addition, we may disclose your PHI under certain conditions in response to a subpoena, discovery request or other lawful process, in which case, reasonable efforts must be undertaken by the party seeking the PHI to notify you and give you an opportunity to object to this disclosure.

Law Enforcement: We may also disclose your PHI if requested by a law enforcement official as part of certain law enforcement activities.

Coroners, Funeral Directors, And Organ Donation: We may disclose your PHI to a coroner or medical examiner for identification purposes, or other duties authorized by law. We may also disclose your PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out his/her duties. We may disclose such information in reasonable anticipation of death. PHI may be used and disclosed for cadaveric organ, eye or tissue donation and transplant purposes.

Research: We are permitted to disclose your PHI to researchers when their research has been approved by an institutional review board that has established protocols to ensure the privacy of your PHI. However, the MBA does not routinely disclose PHI to researchers.

Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.

Military Activity And National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by military command authorities; or (2) to a foreign military authority if you are a member of that foreign military service. We may also disclose your PHI to authorized federal officials conducting national security and intelligence activities including the protection of the President.

Workers' Compensation: We may disclose your PHI to comply with workers' compensation laws and other similar legally established programs.

Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the institution or law enforcement official if the PHI is necessary for the institution to provide you with health care; to protect the health and safety of you or others; or for the security of the correctional institution.

Required Uses And Disclosures: We must make disclosures to you and to the Secretary of the U.S. Department of Health and Human Services to investigate or determine our compliance with the federal regulations regarding privacy.

Authorization For Other Uses And Disclosures Of Your PHI: Other uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted by law as described above. If you authorize us to use or disclose your PHI for purposes other than set forth in the Notice, you may revoke that authorization, in writing, at any time, except to the extent that we have already taken action based upon the authorization. Thereafter, we will no longer use or disclose your PHI for the reasons covered by your written authorization.

Under federal law, however, you may not inspect or copy psychotherapy notes or information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding.

We may decide to deny access to your PHI. Depending on the circumstances, that decision to deny access may be reviewable by a licensed health professional who was not involved in the initial denial of access and who has been designated by the MBA to act as a reviewing official.

To request access to inspect and/or obtain a copy of any of your PHI, you must submit your request in writing to our Privacy Officer at the address below indicating the specific information requested. If you request a copy, please indicate in which form you want to receive it (i.e., paper or electronic). We shall impose a fee to cover the costs of copying and postage.

Right To Request A Restriction Of Your PHI: You may ask us not to use or disclose any part of your PHI for the foregoing purposes. You may also request that we not disclose your PHI to your spouse or immediate family members, as described above. We are not required to agree to a restriction that you may request. However, if we do agree to the request, will not use or disclose your PHI in violation of that restriction unless it is needed to provide emergency treatment or we terminate the restriction with or without your agreement. If you do not agree to the termination, the restriction will continue to apply to PHI created or received prior to our notice to you of our termination of the restriction. To request a restriction you must write to our Privacy Officer at the address below indicating what information you want to restrict, whether you want to restrict use, disclosure or both, and to whom you want the restriction to apply.

Right To Request To Receive Confidential Communications From Us By Alternative Means Or At An Alternative Location: As described above, you may designate certain third parties to receive communications from the MBA with respect to the Hospital Plus program on your behalf. In addition, you may request in writing and we must accommodate your reasonable requests to receive communications of PHI from us by alternative means or at alternative locations if you believe that disclosure of the information could endanger you. Contact the Privacy Officer to obtain the appropriate form.

Right To Amend Your PHI: If you believe that PHI that we have about you is incorrect or incomplete, you may request it to be amended. Your request must be made in writing and submitted to our Privacy Officer. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Did not originate with us, unless the person or entity that originated the PHI is no longer available to make the amendment;
  
  
• Is not contained in the records maintained by the MBA;
  
  
• Is not part of the information which you would be legally permitted to inspect and copy;
  
  
• Is accurate and complete.

If we deny your request for amendment, you have the right to file a written statement of disagreement with us or you can request us to include your request for amendment along with the information sought to be amended if and when we disclose it in the future. We may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal.

Right To An Accounting Of Disclosures: You have the right to request an accounting or list of disclosures of your PHI made by the MBA or its Business Associates. We are required to comply with your request except with respect to disclosures:

• Made in connection with your receiving treatment, our payment for such treatment and for health care operations;
  
  
• Made to you regarding your own PHI;
  
  
• Pursuant to your written authorization;
  
  
• To a person involved in your care or for other permitted notification purposes;
  
  
• For national security or intelligence purposes;
  
  
• To correctional institutions or law enforcement officials.

To request an accounting of disclosures, you must submit your request in writing to our Privacy Officer. You have the right to receive an accounting of disclosures of PHI made within six years (or less) of the date on which the accounting is requested, but not prior to April 14, 2004. Your request should indicate the form in which you want the list (e.g., paper or electronic). The first request within a 12-month period will be free of charge. For additional requests within the 12-month period, we will charge you for the costs of providing the accounting. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any cost is incurred.

Right To Obtain A Paper Copy Of This Notice: You may request a paper copy of our Notice at any time, even if you have previously agreed to accept this Notice electronically. Additionally, you may visit our website at www.nalc.org/depart/mba to view or download the current Notice.

If you have any questions regarding this Notice or would like to submit a written request as described above, please contact: