Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Page 7 Page 8 Page 9 Page 10 Page 11 Page 12 Page 13 Page 14 Page 15 Page 16 Page 17 Page 18 Page 19 Page 20 Page 21 Page 22 Page 23 Page 24 Page 25 Page 26 Page 27 Page 28 Page 29 Page 30 Page 31 Page 32 Page 33 Page 34 Page 35 Page 36 Page 37 Page 3827 Washington Suburban Sanitary Commission and its affiliated entities NOTICE OF PRIVACY PRACTICES Revision Date: September 23, 2013 Release Date: November 22, 2013 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US. The following entities, owned by or affiliated with WSSC are covered by this notice: This notice applies to the privacy practices of the health plans listed below. As affiliated (related) entities, we might share your protected health information and the protected health information of others on your insurance policy as needed for payment or health care operations. UnitedHealthcare, Kaiser Permanente, CVS/caremark, Delta Dental, National Vision Administrators and SilverScript HIPAA Our Legal Duty This Notice describes our privacy practices, which include how we might use, disclose (share or give out), collect, handle, and protect our members’ protected health information. We are required by certain federal and state laws to maintain the privacy of your protected health information. We are also re- quired to give you this notice about our privacy practices, our legal duties, and your rights concerning your protected health information. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes ef- fect September 23, 2013, and is an amendment of WSSC’s prior notice of privacy practices. We reserve the right to change our privacy practices and the terms of this notice at any time, as long as law permits the changes. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all protected health information that we maintain, including protected health information we created or received before we made the changes. If we make a sig- nificant change in our privacy practices, we will change this notice and send the new notice to our health plan subscribers within sixty days of the effective date of the change. You may request a copy of our notice at any time. For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice. Uses and Disclosures of Medical Information Primary Uses and Disclosures of Protected Health Information We use and disclose protected health information about you for payment and health care operations. The federal health care Pri- vacy Regulations generally do not “preempt” (or take precedence over) state privacy or other applicable laws that provide individ- uals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other federal laws, rather than the HIPAA Privacy Regulations, might impose a privacy standard under which we will be required to oper- ate. For example, where such laws have been enacted, we will follow more stringent state privacy laws that relate to uses and disclosures of the protected health information concerning HIV or AIDS, mental health, substance abuse/chemical dependency, genetic testing, and reproductive rights. In addition to these state law requirements, we also may use or disclose protected health information in the following situations: Payment: We might use and disclose your protected health information for all activities that are included within the defini-