NOTICE OF PRIVACY PRACTICES

for the
Standard Plan and State Maintenance Plan
(currently administered by WPS Health Insurance)
and the
Prescription Drug Benefit Plan
(currently administered by Navitus Health Solutions)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. THE PRIVACY OF YOUR INFORMATION IS IMPORTANT TO US. PLEASE REVIEW IT CAREFULLY.

You do not need to do anything regarding this notice. It is intended to make you aware of your rights under the privacy rule of the federal Health Insurance Portability and Accountability Act (HIPAA) and to inform you how the Wisconsin Department of Employee Trust Funds (ETF) uses and discloses your protected health information. Protected health information is information about you, including demographic data collected from you, that can reasonably be used to identify you and relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the payment for that care.

Please note that while ETF administers many benefit programs for state and local government employees, this notice applies to only the plans listed above. Different policies and regulations apply to records associated with other benefit programs.

OUR RESPONSIBILITIES

ETF receives some protected health information as a necessary part of administering health benefits for members. ETF is required by law to maintain the privacy of your protected health information and to provide you with a notice of the above plans’ duties and privacy practices. The term "we" in this notice means ETF and our business associates. Business associates are companies and individuals with whom ETF contracts for services, including but not limited to: claim processing, utilization review, actuarial services, claim appeals services and participant surveys. In order to perform their respective functions for ETF, ETF’s business associates sometimes must receive your protected health information. ETF requires a contractual commitment from all business associates to protect the privacy of any health information received in the course of providing services.

WPS Health Insurance (WPS) is the current third-party plan administrator for the Standard Plan and State Maintenance Plan. Navitus Health Solutions (Navitus) is the pharmacy benefit manager (PBM) for the prescription drug benefit program. WPS and Navitus are business associates and are required to safeguard your health information according to HIPAA’s privacy regulation and their respective contracts with the State of Wisconsin.

If you have health insurance with a health maintenance organization (HMO) or a preferred provider plan (PPP), you should receive a notice from your HMO or PPP regarding its privacy practices relating to your health insurance benefit.

We reserve the right to change the terms of this notice and to make the new notice provisions apply to information we already have about you as well as to any information we may receive in the future. We are required by law to comply with the privacy notice that is currently in effect. We will notify you of any material changes to this notice by distributing a new notice to you and posting the new notice on our web site (http://etf.wi.gov).

HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

Treatment: We may use or disclose your protected health information for treatment purposes. Treatment includes providing, coordinating, or managing health care by one or more health care providers or doctors. Treatment can also include coordination or management of care between a provider and a third party, and consultation and referrals between providers. For example, we may share your health information with a pharmacy in order to verify your eligibility for benefits.

Payment: We may use or disclose your protected health information for the payment of covered services that you receive under your benefit plan or to otherwise manage your account or benefits. Payment includes activities by ETF or by organizations hired by ETF to obtain premiums, to make coverage determinations and to provide reimbursement for health care. This can include eligibility determinations, reviewing services for medical necessity or appropriateness, utilization management activities, claims management, and billing. We may also use and disclose your protected health information to determine premium costs, underwriting, rates and cost-sharing amounts. For example, we may share information about your coverage or the expenses you have incurred with another health plan in order to coordinate the payment of your benefits.

Health Care Operations: We may use or disclose your protected health information to administer the plans covered by this notice and to coordinate coverage and services on your behalf. We may also use or disclose your health information during the grievance or claim review process in resolving your insurance complaints. Other examples of health care operations include:

• Quality assessment and improvement activities;
• Activities designed to improve the health plan or reduce costs;
• Reviewing and evaluating health plans, including participant satisfaction surveys;
• Training of ETF personnel and contractors;
• Transfer of eligibility and plan information to business associates (for example, to the PBM for the management of pharmacy benefits);
• Reviews and auditing, including compliance reviews, ombudsperson services, legal services, and audit services;
• Business management and general administrative activities, including customer service; and
• Fraud and abuse detection and compliance programs.

As Permitted or Required By Law: We may share your protected health information as permitted or required by state and federal law, including but not limited to disclosures to comply with Workers’ Compensation laws or similar legal programs; for U.S. Department of Health and Human Services investigations, in judicial and administrative proceedings and as required under Wisconsin law for state auditing purposes.

Organized Health Care Arrangement: We may participate in an Organized Health Care Arrangement (OHCA). An OHCA can take several forms under HIPAA, including offering health benefits under a
combination of group health plans and HMOs. We may share your protected health information to coordinate the operations of the plans and to better serve you as a participant in the plans.

For Distribution of Information Related to Health Benefits and Services: We may use and disclose your protected health information to inform you of treatment alternatives or of other health related services and benefits that may be of interest to you.

Plan Sponsors: Your employer is not permitted to receive your protected health information related to the plans covered by this notice for any purpose other than the administration and coordination of your benefit plan. For example, we may disclose to your employer whether an employee is participating in the plans or has enrolled or disenrolled in any available option offered by the plans. We may disclose summary health information to your employer, or someone acting on your employer's behalf, so that it can monitor, audit or otherwise administer the employee health benefit plan that the employer sponsors and in which you participate. Summary health information is data that combines information from many participants and does not include information on the individual level.

Special Circumstances: If you are unavailable to communicate, such as in a medical emergency or other situation in which you are not able to provide permission, we may release limited information about your general condition or location to someone who can make decisions on your behalf.

Authorization: We will obtain your written permission before we use or disclose your protected health information for any other purpose, unless otherwise stated in this notice. If you grant such permission,
you may later withdraw your consent at any time, in writing, using the contact information listed at the end of this notice. We will then stop using your information for that purpose. However, if we have already
used or disclosed your information based on your authorization, we cannot undo any actions we took before you withdrew your permission.

YOUR HEALTH INFORMATION RIGHTS

You have rights under federal privacy laws relating to your protected health information. If you wish to exercise any of the following rights, please submit your request in writing to the ETF Privacy Officer using
the contact information provided at the end of this notice. We are not required to agree to every request. We will notify you if we approve your request or explain the reason(s) for our decision if we deny your
request. We may charge you a fee to cover the costs of processing your request. If so, we will inform you of the fee before proceeding.

Restrictions/Confidential Communications: You may request that we not use your protected health information for certain treatment, payment or health care operations or that we communicate with you using reasonable alternative means or locations.

View or Receive a Copy of Your Health Information: You have the right to review or obtain a copy of the protected health information that is used to make decisions about you. We are not required to give you certain information, including information prepared for use in legal actions or proceedings.

Amendment of Your Records: If you believe that your protected health information is incorrect or incomplete, you may request that your information be changed. Your request must include the reason(s) why you believe the change should be made. In certain situations we will not amend records, such as when we did not create the records that you want amended.

Request a Listing of Who Was Given Your Information and Why: Upon request we will provide you with a list of certain disclosures that we have made since April 14, 2003. The list will not include disclosures you authorized, or disclosures we made for treatment, payment, or health care operations or disclosures for which a listing is otherwise restricted by law.

Copy of the Privacy Notice: You have a right to obtain a paper copy of this notice at any time.

Complaints: If you feel that your privacy rights have been violated, you may file a complaint by contacting ETF’s Privacy Officer using the information provided below. Federal law prohibits any retaliation against you for filing a complaint. You may also file a complaint with the federal Office of Civil Rights.

EFFECTIVE DATE: OCTOBER 9, 2006