The following is a description of when the Plan is permitted or required to use or disclose your protected health information.

Payment, Treatment and Health Care Operations. The Plan has the right to use and disclose your protected health information for all activities that are included within the definitions of “payment,” “treatment” and “health care operations” as defined in the HIPAA Privacy Regulation.

Payment. The Plan will use or disclose your protected health information to fulfill its responsibilities for coverage and providing benefits as established under the Plan. For example, the Plan may disclose your protected health information when a provider requests information regarding your eligibility for benefits under the Plan, or it may use your information to determine if a treatment that you received was medically necessary, experimental or investigational. The Plan may use or disclose your information to evaluate a claim or claim appeal, or to obtain reimbursement under insurance, reinsurance, stop loss or excessive loss policies. ARRA requires disclosures for purposes of payment to meet its minimally necessary standard effective on and after February 17, 2010.

Health Care Operations. The Plan will use or disclose your protected health information to support the Plan’s business functions. These functions include, but are not limited to: quality assessment and improvement, reviewing provider performance, licensing, business planning, underwriting, premium rating and business development. For example, the Plan may use or disclose your protected health information: (1) to provide you with information about a disease management program; (2) to respond to a customer service inquiry from you; (3) in connection with fraud and abuse detection and compliance programs; or (4) to survey you concerning how effectively the Plan is providing services, among other issues. The Plan is prohibited from using or disclosing your PHI that is genetic information for underwriting purposes, premium rating, and coverage renewal. ARRA requires disclosures for purposes of health care operations to meet its minimally necessary standard effective on and after February 17, 2010.

Treatment. The Plan may use or disclose your protected health information to a health care provider who is treating you for purposes related to your treatment. For example, if you were unconscious, the health care provider treating you could contact the Plan to find out what kinds of conditions you might have, such as diabetes, or what prescription drugs you might be taking.

Business Associates. The Plan contracts with service providers — called business associates — to perform various functions on its behalf. For example, the Plan may contract with a third party administrator to perform the administrative functions necessary to pay your medical claims. To perform these functions or to provide services, business associates will receive, create, maintain, use or disclose protected health information, but only after the Plan and the business associate agree in writing to contract terms requiring the business associate to appropriately safeguard your information and agrees to permit the Plan to terminate the contract if the business associate violates the contract.

Organized Health Care Arrangement. The Plan, the dental HMO option offered under the Plan, the Vision Service Plan benefit and the Health Care Flexible Spending Account offered under the Plan are part of an “organized health care arrangement,” and may share your protected health information with each other to carry out payment and health care operations activities.

Other Covered Entities. The Plan may use or disclose your protected health information to assist health care providers in connection with their treatment or payment activities, or to assist other covered entities in connection with certain health care operations. For example, the Plan may disclose your protected health information to a health care provider when needed by the provider to render treatment to you, and the Plan may disclose protected health information to another covered entity to conduct health care operations in the areas of quality assurance and improvement activities, or accreditation, certification, licensing, or credentialing. This also means that the Plan may disclose or share your protected health information with other health care programs or insurance carriers (such as Medicare) to coordinate benefits if you or your family members have other health insurance or coverage or with other health plans maintained by DallasNews Corporation that are part of the same organized health care arrangement.

Required by Law. The Plan may use or disclose your protected health information to the extent required by federal, state or local law.

Public Health Activities. The Plan may use or disclose your protected health information for public health activities that are permitted or required by law. For example, it may use or disclose information for the purpose of preventing or controlling disease, injury or disability, or it may disclose such information to a public health authority authorized to receive reports of child abuse or neglect.

Health Oversight Activities. The Plan may disclose your protected health information to a health oversight agency for activities authorized by law. For example, these oversight activities may include audits; investigations; inspections; licensure or disciplinary actions; or civil, administrative or criminal proceedings or actions. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and government agencies that ensure compliance with civil rights laws.

Immunization Records. The Plan may disclose your PHI constituting immunization records if you are a student or prospective student of a school to comply with state or local laws requiring proof of immunization be provided to a school prior to admission to the school.

Lawsuits and Other Legal Proceedings. The Plan may disclose your protected health information in the course of any judicial or administrative proceeding or in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized). Consistent with applicable laws, the Plan may also disclose your protected health information in response to a subpoena, a discovery request or other lawful process.

Abuse or Neglect. As required by law, the Plan may disclose your protected health information to a government authority that is authorized by law to receive reports of abuse, neglect or domestic violence. Additionally, as required by law, if the Plan believes you have been a victim of abuse, neglect or domestic violence, it may disclose your protected health information to a governmental entity authorized to receive such information.

Law Enforcement. Under certain conditions and consistent with applicable laws, the Plan also may disclose your protected health information to law enforcement officials for law enforcement purposes. These law enforcement purposes include, by way of example: (1) responding to a court order or similar process; (2) as necessary to locate or identify a suspect, fugitive, material witness or missing person; or (3) as relating to the victim of a crime.

Coroners, Medical Examiners and Funeral Directors. The Plan may disclose protected health information to a coroner or medical examiner when necessary for identifying a deceased person or determining a cause of death. The Plan also may disclose protected health information to funeral directors as necessary to carry out their duties.

Organ and Tissue Donation. Consistent with applicable laws, the Plan may disclose protected health information to organizations that handle organ, eye or tissue donation and transplantation.

Research. The Plan may disclose your protected health information to researchers when (1) their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information, or (2) the research involves a limited data set which includes no unique identifiers (information such as name, address, Social Security number, etc. that can identify you).

To Prevent a Serious Threat to Health or Safety. Consistent with applicable laws, the Plan may disclose your protected health information if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. It also may disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.

Military. Under certain conditions, the Plan may disclose your protected health information if you are, or were, Armed Forces personnel for activities deemed necessary by appropriate military command authorities. If you are a member of foreign military service, the Plan may disclose, in certain circumstances, your information to the foreign military authority.

Workers’ Compensation. The Plan may disclose your protected health information to comply with workers’ compensation laws and other similar programs that provide benefits for work-related injuries or illnesses.

Disclosures to the Plan Sponsor. The Plan (or its health insurance issuers or HMOs) may disclose your protected health information to the plan sponsor for Plan administration purposes.

Others Involved in Your Health Care. The Plan may disclose your protected health information to a friend or family member that is involved in your health care or in the payment for your healthcare, unless you object or request a restriction (in accordance with the process described under Right to Request a Restriction). The Plan also may disclose your information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. If you are not present or able to agree to these disclosures of your protected health information, then, using professional judgment, the Plan may determine whether the disclosure is in your best interest.

Disclosures to the Secretary of the U.S. Department of Health and Human Services. The Plan is required to disclose your protected health information to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining the Plan’s compliance with the HIPAA Privacy Regulation.

Disclosures to You. The Plan is required to disclose to you or your personal representative most of your protected health information when you request access to this information. The Plan will disclose your protected health information to an individual who has been designated by you as your personal representative and who has qualified for such designation in accordance with relevant law. Prior to such a disclosure, however, the Plan must be given written documentation that supports and establishes the basis for the personal representation. The Plan may elect not to treat the person as your personal representative if it has a reasonable belief that you have been, or may be, subjected to domestic violence, abuse or neglect by such person; treating such person as your personal representative could endanger you; or the Plan determines, in the exercise of its professional judgment, that it is not in your best interest to treat the person as your personal representative.

Other uses and disclosures of your protected health information that are not described above will be made only with your written authorization, such as for release of psychotherapy notes, or if your PHI is to be used for fundraising, marketing or to be sold. The Plan has no intention of selling your PHI, but is required to disclose such a use is possible. If you provide the Plan with an authorization, you may revoke the authorization in writing, and this revocation will be effective for future uses and disclosures of protected health information. However, the revocation will not be effective for information that the Plan has used or disclosed in reliance on the authorization.

The Plan (or its health insurance issuers, dental HMO, third-party administrators or pharmacy benefit managers) may contact you about appointment reminders, refill reminders, treatment alternatives or other health benefits or services that might be of interest to you, such as case management, disease management, wellness programs or employee assistance programs.