Daniel R. Mims, RPh, President

HIPAA COMPLIANCE POLICY

NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US. The following entities are covered by this notice: Institutional Pharmacy Solutions, LLC This notice applies to the privacy practices of the health plans listed below. As affiliated (related) entities, we might share your protected health information and the protected health information of others on your insurance policy as needed fo r pay ment o r health ca re operations. Our Legal Duty This Notice describes our privacy practices, which include how we might use, disclose (share or give out), co llect, h andle, a n d p rotect o u r members’ protected health information. We are required by certain federal and state laws to maintain the privacy o f y o ur p rotected h ealth information. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your protected health information. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect Ap ril 1 4, 2003, and is not intended to amend any prior notice of Institutional Pharmacy Solutions, LLC privacy practices. We reserve the right to change our privacy practices and the terms of this notice at any time, as long as law permits the changes. We reserve th e right to make the changes in our privacy practices and the new terms of our notice effective for all protected health information that we maintain, including protected health information we created or received before we made the changes. If we make a significant ch ange in o ur p riv acy practices, we will change this notice and send the new notice to our health plan subscribers within sixty days of the effective date of the change. You may request a copy of our notice at any time. For more information about our privacy practices, or for additional cop ies o f th is n o tice, please contact us using the information listed at the end of this notice. Uses and Disclosures of Medical Information We use and disclose protected health information about you for payment and health care o peration s. Th e federal h ealth care Priv acy Regulations generally do not “preempt” (or take precedence over) state privacy or other applicable laws that provide indiv iduals greater p rivacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other federal laws, rather than the HIPAA Privacy Regulations, might impose a privacy standard under which we will be required to operate. For example, where such laws have been enacted, we will follow more stringent state privacy laws that relate to uses and disclosures of the protected health information concern ing HIV o r AIDS, mental health, substance abuse/chemical dependency, genetic testing, reproductive rights. In addition to these state law requirem ents, we also may use or disclose protected health information in the following situations: Payment: We might use and disclose your protected health information for all activities that are included within the definition of “payment” as written in the Federal Privacy Regulations. For example, we might use and disclose your protected health information to pay claims for services provided to you by doctors, hospitals, pharmacies and others for services delivered to you that are covered by your health plan. We m igh t als o use your information to determine your eligibility for benefits, to coordinate benefits, to examine medical necessity, to obtain premiums , an d to issue explanations of benefits to the person who subscribes to the health plan in which you participate. Health Care Operations:We might use and disclose your protected health information for all activities that are included within the definition of “health care operations” as defined in the Federal Privacy Regulations. For example, we might use and disclose your protected health information for stop-loss underwriting to determine our premiums for your health plan, to conduct quality assessment and improvement activities, to engage in care coordination or case management, and to manage our business. Business Associates: In connection with our payment and health care operations activities, we contract with individuals an d en tities (called “business associates”) to perform various functions on our behalf or to provide certain types of services (su ch as m emb er s ervice s upp ort, utilization management, subrogation, or pharmacy benefit management). To perform these functions or to provide the services , o u r b u siness associates will receive, create, maintain, use, or disclose protected health information, but only after we require the business associates to agree in writing to contract terms designed to appropriately safeguard your information. Other Covered Entities. In addition, we might use or disclose your protected health information to assist health care providers in co nnection with theirtreatment or payment activities, or to assist other covered entities in connection with certain of their h ealth care o peration s. Fo r example, we might disclose your protected health information to a health care provider when needed by the provider to render treatment to y ou, and we might disclose protected health information to another covered entity to conduct health care operations in the areas of quality as surance and improvement activities, or accreditation, certification, licensing or credentialing. Other Possible Uses and Disclosures of Protected Health Information The following is a description of other possible ways in which we might (and are permitted to) use an d/o r d isclose y ou r p rotected h ealth information. To You or with Your Authorization: We must disclose your protected health information to you, as described in the Individual Rights sec tion of this notice. You may give us written authorization to use your protected health information or to disclose it to anyone f o r an y p u rp ose n ot listed on this notice. If you give us an authorization, you may revoke it in writing at any time. Your revo catio n will n ot affect an y u s e o r disclosures that we made as permitted by your authorization while it was in effect. Without your written authorizatio n, we m ight n o t u se o r disclose your protected health information for any reason except those described in this notice. Disclosures to the Secretary of the U.S. Department of Health and Human Services: We are required to disclos e y o ur p ro tected h ealth information to the Secretary of the U.S. Department of Health and Human Services when the Secretary is in v estigating o r d eterm in ing o u r compliance with the federal Privacy Regulations. 2 To Plan Sponsors. Where permitted by law, we may disclose your protected health information to the plan sponsor of your group health plan to permit the plan sponsor to perform plan administration functions. For example, a plan sponsor may contact us seeking information to ev alu ate future changes to your benefit plan. We may also disclose summary health information (this type of information is defined in the Federal Privacy Regulations) about the enrollees in your group health plan to the plan sponsor to obtain premium bids for the health insurance coverage o ffered through your group health plan or to decide whether to modify, amend or terminate your group health plan. To Family and Friends: If you agree (or, if you are unavailable to agree), such as in a medical emergency situation we m igh t d is clo se y o ur protected health information to a family member, friend or other person to the extent necessary to help with your health care or with payment fo r your health care. Underwriting: We might receive your protected health information for underwriting, premium rating or other activities relating to the creatio n, renewal or replacement of a contract of health insurance or health benefits. We will not use or further disclose this protected health information received under these circumstances for any other purpose, except as required by law, unless and until you enter into a contract of health insurance or health benefits with us. Health Oversight Activities. We might disclose your protected health information to a health oversight agency for activities authorized by law, such as: audits; investigations; inspections; licensure or disciplinary actions; or civil, administrative , o r crimin al p roceedings o r actio ns. Oversight agencies seeking this information include government agencies that oversee: (i) the health care s ys tem ; (ii) go v ernm ent b enefit programs; (iii) other government regulatory programs; and (iv) compliance with civil rights laws. Abuse or Neglect. We might disclose your protected health information to appropriate authorities if we reasonably believe that you migh t b e a possible victim of abuse, neglect, domestic violence or other crimes. To Prevent a Serious Threat to Health or Safety. Consistent with certain federal and state laws, we might disclose y our p rotected h ealth information if we believe that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health o r safety of a person o r the public. Coroners, Medical Examiners, Funeral Directors, and Organ Donation. We might disclose protected health information to a co ro ner o r medical examiner for purposes of identifying you after you die, determining your cause of death, or for the coro ner o r m edical ex aminer to perform other duties authorized by law. We also might disclose, as authorized by law, information to funeral directors so th at they may carry out their duties on your behalf. Further, we might disclose protected health information to organizations that handle organ, eye, or tis sue d on atio n and transplantation. Research. We might disclose your protected health information to researchers when an institutio nal review b o ard o r p riv acy b oard h as: (1) reviewed the research proposal and established protocols to ensure the privacy of the information; and (2) approved the research. Inmates. If you are an inmate of a correctional institution, we might disclose your protected health information to the correctional institution o r to a law enforcement official for: (1)the institution to provide health care to you; (2) your health and safety and the health and safety of o th ers; or (3) the safety and security of the correctional institution. Workers’ Compensation. We might disclose your protected health information to comply with workers’ compensation laws and other s imilar programs that provide benefits for work-related injuries or illnesses. Public Health and Safety: We might disclose your protected health information to the extent necessary to avert a serious and imminent threat to your health or safety or the health or safety of others. Required by Law: We might use or disclose your protected health information when we are required to do so by law. For ex amp le, we m us t disclose your protected health information to the U.S. Department of Health and Human Services upon their request for purpose s of determinin g whether we are in compliance with federal privacy laws. Legal Process and Proceedings: We might disclose your protected health information in response to a court or administrative order, subpoen a, discovery request, or other lawful process, under certain circumstances. Under limited circumstances, such as a court order, warrant, o r gran d jury subpoena, we might disclose your protected health information to law enforcement officials. Law Enforcement: We might disclose to a law enforcement official limited protected health information of a suspect, fugitive, material witness, crime victim, or missing person. We might disclose protected health information where necessary to assist law enforcement officials to capture an individual who has admitted to participation in a crime or has escaped from lawful custody. Military and National Security: We might disclose to military authorities the protected health information of Armed Forces perso nnel u nd er certain circumstances. We might disclose to federal officials protected health information required for lawful intelligence, counterintelligence, and other national security activities. Other Uses and Disclosures of Your Protected Health Information: Other uses and disclosures of your protected health information th at are not described above will be made only with your written authorization. If you provide us with such an au tho rization, y ou m ay revok e th e authorization in writing, and this revocation will be effective for future uses and disclosures of protected health in formation . Ho wever, th e revocation will not be effective for information that we already have used or disclosed in reliance on your authorization. Individual Rights Access: You have the right to look at or get copies of the protected health information contained in a d esignated record s et, with li m ited exceptions. You may request that we provide copies in a format other than photocopies. We will use the format you request unless we can not reasonably do so. You must make a request in writing to obtain access to your protected health information. You may obtain a form to requ est access by using the contact information listed at the end of this notice. You may also request access by sending a letter to the address at th e en d of this notice. If you request copies, we might charge you a reasonable fee for each page, and postage if you want the copies mailed to y o u. If you request an alternative format, we might charge a cost-based fee for providing your protected health information in that format. If you prefer, we will prepare a summary or an explanation of your protected health information, but we might charge a fee to do so. We might deny your request to inspect and copy your protected health information in certain limited circumstances. Under certain co nd itions, our denial will not be reviewable. If this event occurs, we will inform you in our denial that the decision is not reviewable . If y o u are d en ied access to your information and the denial is subject to review, you may request that the denial be reviewed. A licensed health care profession al chosen by us will review your request and the denial. The person performing this review will not be the same person who d enied y o ur in itial request. Disclosure Accounting: You have the right to receive a list of instances in which we or our business associates disclosed your protected h ealth information for purposes other than treatment, payment, health care operations and certain other activities, after April 14, 2003. We will provide you with the date on which we made the disclosure, the name of the person or entity to which we disclosed your protected health informatio n, a description of the protected health information we disclosed, the reason for the disclosure, and certain other information. If you request th is lis t more than once in a 12-month period, we might charge you a reasonable, cost-based fee for responding to these additional requests. You may request an accounting by submitting your request in writing using the information listed at the end of this notice. Yo ur request may be for disclosures made up to 6 years before the date of your request, but in no event, for disclosures made before April 14, 2003. Restriction Requests: You have the right to request that we place additional restrictions on our use or dis clo sure o f y ou r p rotected h ealth information. We are not required to agree to these additional restrictions, but if we do, we will abide by our agreement (except in an emergency). Any agreement that we might make to a request for additional restrictions must be in writing and signed by a person authorized to make such an agreement on our behalf. We will not be liable for uses and disclosures made outside of the requested restriction unless our agreement to restrict is in writing. We are permitted to end our agreement to the requested restriction by notifying you in writing. You may request a restriction by writing to us using the information listed at the end of this notice. In y ou r req uest tell u s: (1 ) th e information of which you want to limit our use and disclosure; and (2) how you want to limit our use and/or disclosure of the information. Confidential Communication: If you believe that a disclosure of all or part of your protected health information may endanger you , y o u h ave the right to request that we communicate with you in confidence about your protected health information. This means that you may request th at we send you information by alternative means, or to an alternate location. We must accommodate your request if: it is reasonable, specifies th e alternative means or alternate location, and specifies how payment issues (premiums and claims) will be handled. You may request a Confidential Communication by writing to us using the information listed at the end of this notice Amendment: You have the right to request that we amend your protected health information. Your request must b e in writin g, and it m u st explain why the information should be amended. We may deny your request if we did not create the information you want amended or for certain other reasons. If we deny your request, we will provide you with a written explanation. You may respond with a statement of disagreement to be appended to the information you wanted amended. If we accept your request to amend the information, we will m ak e reaso nable effo rts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of th at information. Electronic Notice: Even if you agree to receive this notice on our web site, or by electronic mail (e-mail), you are entitled to receive a p ap er copy as well. Please contact us using the information listed at the end of this notice to obtain this notice in written form. If the e-mail transmission has failed, and Institutional Pharmacy Solutions, LLC is aware of the failure, then we will provide a paper copy of the notic e to you. Questions and Complaints If you want more information about our privacy practices or have questions or concerns, please contact the member services number on the back of your card. Filing a Complaint: If you are concerned that we might have violated your privacy rights, or you disagree with a decision we made about y o ur individual rights, you may use the contact information listed at the end of this notice to complain to us. You also may submit a written complaint to the U.S. Department of Health and Human Services (DHHS). We will provide you with the contact information for DHHS upon request. We support your right to protect the privacy of your protected health and financial information. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services. Contact Information Institutional Pharmacy Solutions, LLC HIPAA Compliance and Privacy Office Telephone: (334) 819-4500 Fax: (334) 819-4520 3480, Eastern Blvd Montgomery Alabama, 36116

REAL PEOPLE providing REAL SOLUTIONS with REAL VALUE

Daniel R. Mims, RPh, President

About Daniel