INTERNET PRIVACY POLICY CHA Health Internet Privacy and Security Policy CHA Health is sensitive to privacy protection issues, especially in connection with our subscribers' use of our services through the Internet. We respect your right to privacy, and believe that it is important for you to know how we handle the information we have about you. To better protect your privacy, we provide this statement explaining our information practices. Information We Collect When you visit our site or participate in one of our health care plans, we may collect or receive three types of information about you: personally identifiable information, health information, and non-identifiable information. The types of personally identifiable information we collect or receive include: contact information (e.g., name, address, telephone number, and e-mail address), demographic information (e.g., date of birth and gender), social security number information, and dependent information (e.g., name and date of birth of spouse or child covered by plan). In our interactions with you, CHA Health, or agents acting on our behalf, also may create or receive health information (i.e., information that relates to a person's physical or mental health, the provision of health care to a person, or the payment for the provision of health care to a person). In addition, we may collect certain non-identifiable information, such as session level information (domain, machine identification and IP address) for any computer connecting to our domain. We retain this information only for the purpose of improving the function and service level of our Internet services and the prevention of intentional damage perpetrated on the site. How We Use the Information CHA Health uses the information provided about you to enable you to access your benefits information. For example, we use this information to provide you with summaries of claims, referrals and authorizations, and to provide you with information regarding your health plan (e.g., coverage information, including deductibles). We also use this information to enable us to service your account, such as to enable you to change your primary care physician or to order replacement ID cards. CHA Health will not edit, use, or disclose health information about you without your prior authorization unless CHA Health has a good faith belief that disclosure is: (1) for purposes of carrying out treatment, payment or health care operations; (2) requested by legally authorized governmental agencies; (3) in response to a subpoena, court order, or other legal process; or (4) for use in emergency situations. From time to time, CHA Health may release information in the aggregate to provide employers with statistical reports regarding their employees' claims. Access to Member Information by Employers, Health Care Providers and Agents In addition to allowing members to review their own information, the CHA Health infrastructure enables three types of authorized entities to access different types of information in our database. The three types of authorized entities are: health care providers, employers and agents. Health care providers may access personally identifiable information and health information needed for treatment and payment of claims. For example, a health care provider may access member information to help determine member eligibility for particular services (if a referral or authorization has been issued), as well as health claim information to check the payment status of claims submitted by the provider. Employers may access personally identifiable information, such as employee contact information, dependent information, and other demographic information. Employers usually cannot, however, access health or specific claims information about an identified individual. Agents (individuals or entities that facilitate the employers' relationship with CHA Health) can access only aggregate information, non-personally identifiable or health information. For example, agents may access only information that helps them determine their commissions (e.g., the number of employees participating in a plan). E-mailing the Site We welcome and encourage your comments and questions about our Web site and services, and have provided e-mail addresses for that purpose. Information and correspondence you share with us will be handled in strict confidence. Please note, however, that this e-mail functionality on our site (unlike those areas that require a sign-in and are password-protected) does not provide the same level of security. Therefore, please do not use e-mail to communicate information to us that you consider confidential. You may, instead, contact us via telephone at the Customer Service toll-free number if you need to share confidential information with us. Cookies We may use "cookies" at our site to ease navigation and store user passwords and preferences. We will not, however, use cookies for marketing or promotional purposes. Links to Other Web sites Our site contains links to other Web sites whose privacy practices are not covered by this privacy notice. For example, in the Health Links area of our site, we enable users to access additional health care information through such organizations as the American Heart Association and the American Diabetes Association. Visitors should consult the privacy notices posted at these sites as we are not responsible for the privacy practices of such sites. Security CHA Heaths maintains appropriate physical, electronic, and procedural safeguards to protect your personally identifiable and health information. This information is protected from unauthorized access by a secure firewall and data base architecture. Although we take appropriate measures to safeguard against unauthorized disclosures of information, we cannot assure you that information we have about you will never be disclosed in a manner that is inconsistent with this Privacy Statement. Reviewing and Correcting Your Information Site users may correct some information using this site. For example, subscribers may update their mailing address and change a Primary Care Physician for any enrolled member of their family. Site users may also inspect their plan benefits, enrollment, claims summaries, and referral/authorization information. If you would like to correct, change, or update any of your personally identifiable information that cannot be changed using the site's services, please email us at memberservices@cha-health.com, or contact us at the following telephone number and address: CHA Health Member Services 859-232-8686 or 800-457-5683 PO Box 23468, Lexington, KY 40523-3468 Changes to our Privacy Practices We may change this privacy statement at any time by posting revisions to our Web site. In the introduction to the privacy and security statement posted at the site, we will inform users of material changes in our information practices prior to implementation. An example of a material change to our information practices would be a change that may increase the types of recipients to whom we would distribute health information. Contact Us If you have any questions or concerns about our information practices policy, please contact us at memberservices@cha-health.com or write to CHA Health Member Services, PO Box 23468, Lexington, KY 40523-3468 or by phone at 859-232-8686 or toll free 800-457-5683. This Health and Privacy Policy Statement  is not intended to and does not create any contractual or other legal rights in or on behalf of any party. This Internet Privacy Statement is effective as of August 2001 and was last updated on January 2007. This internet privacy statement is not intended to and does not create any contractual or other legal rights in or on behalf of any party.