• disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement: name and address; date of birth; social security number; payment history; policy/account number; and name and address of the health care provider and /or health plan.

For example, if your coverage has a coordination of benefits or other type of cost sharing provision, we may request and disclose protected health information about you to the other health plan carrier to determine the benefits due under the terms of your health plan with us. We may also contact your provider regarding your medical treatments and request details to determine if your coverage will pay for the treatments.

For Health Care Operations

We may use and disclose protected health information about you to support our business operations or the business operations of another insurer. These uses and disclosures are necessary to run the company and make sure all of our policyholders receive the services and benefits provided by their health plan coverage. These activities include, but are not limited to:

• underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, however, we are prohibited from using or disclosing genetic information about you for underwriting purposes;
• ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance);
• conducting or arranging for medical review, legal services, and auditing functions, including fraud investigations;
• business planning and development, such as conducting cost-management studies and analyses related to managing and operating the company, including development or improvement of methods of payment or coverage policies; and
• business management and general administrative activities of the company, including, but not limited to:

1. customer service, including the provision of data analyses for policyholders, plan sponsors, or other customers;
2. resolution of internal grievances; and
3. the offer of an enhancement or upgrade to your existing coverage.

To Individuals Involved in Your Care

We may use and disclose your protected health information with your family, friends, personal representative or other individual you identify who are involved in your care or payment of a claim, unless you object. In addition, GTL may use and disclose your protected health information to persons requesting such information if we can reasonably infer from the circumstances that you would not object to the disclosure. If you are not available to give your consent to a disclosure, or in an emergency, we may disclose your protected health information that is directly relevant to such person’s involvement in your care or payment for such care.

To Our Business Associates

We may also share your protected health information to an affiliate or business associate outside of GTL if they need protected health information in order to provide services to us (e.g., billing, claim adjudication and underwriting services.) Whenever an arrangement between GTL and a business associate involves the use or disclosure of your protected health information we will have a written contract that sets forth the terms regarding the use and disclosure of your protected health information and will require them to follow the HIPAA rules relating to the protection of protected health information.

For Other Uses and Disclosures

In addition to the above, we are permitted or required by law to use or disclose your protected health information, without your permission, for the following:

• Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose protected health information about you in response to a court or administrative order. We may disclose protected health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

• Law Enforcement: We may release medical information if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons, or similar process. We may also disclose your protected health information if we suspect child abuse or neglect; we may also disclose your protected health information if we believe you to be a victim of abuse, neglect, or domestic violence.

• Health Oversight Activities: We may disclose protected health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU

You have the following rights with respect to the protected health information we maintain about you.

You have the right to inspect and copy your protected health information. This means you may inspect and obtain a copy of protected health information about you that is contained in a designated record set for as long as we maintain the protected health information. To inspect and copy protected health information that may be used to make decisions about you, you must submit your request in writing to us or to the business associate who maintains the medical information. If we would prefer to send you a summary or explanation of your medical information rather than the actual records, we may do so only with your consent and your agreement in advance to the fees imposed, if any. You may request your records be in paper or electronic format. We may charge a fee for the costs of copying, mailing or other supplies associated with mailing or copying your protected health information. We may deny your request in whole or in part to inspect and copy records in certain circumstances. If you are denied access to medical information, we will provide a written notice explaining the basis for the denial. You may also request that the denial be reviewed. Such request for review will either be approved or denied based on the grounds for denial. If the initial denial is reviewable, the person conducting the review will not be the same person who denied your original request. We will comply with the determination of the representative performing the review.

You have the right to request a restriction of your protected health information.  This means you may ask us not to use or disclose any part of your protected health information for the purposes of payment or health care operations. You may also request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice. Your request must state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you may request and we retain the right to terminate an agreed to restriction. Such termination is only effective with respect to protected health information created or received after GTL has informed the individual of its termination of the restriction. Additionally requesting certain limitations may affect payment of benefits under your health plan. To request restrictions, you must make your request in writing to our Customer Service Department. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

You have the right to request and receive confidential communications. We will accommodate reasonable requests to send your protected health information to you at a different address, or other method of contact. We will not request an explanation from you as to the basis for the request.  For example, you can ask that we only contact you at work or by mail. Requests for confidential communications must be made in writing, signed by you and sent to GTL. Your request must specify how or where you wish to be contacted.

You have the right to request an amendment of your protected health information.   You may request an amendment of your health information contained in a designated record set for as long as the information is kept by GTL or any of our business associates. To request an amendment, you must send us your request in writing to the address included in the “Contact Information” section below, giving details of your request and why you are making it. If we deny your request for amendment in whole or in part, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement. We will provide you with a copy of any such rebuttal. In certain cases, we may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that: (1) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (2) is not part of the designated record set kept by us; (3) is not part of the information which you would be permitted to inspect and copy; or (4) is accurate and complete.

You have the right to receive an accounting of certain disclosures. You have the right to request an accounting of most disclosures of protected health information made by us during the six years prior to the date the accounting is requested, subject to certain exceptions. Your request must be in writing. If you request such an accounting more than once in a 12-month period, we may charge a cost-based reasonable fee.

You have the right to be notified following a breach of unsecured protected health information. You have the right to and will receive a notification of a breach of your unsecured protected health from GTL, or one of its business associates.