Notice of Privacy Practices

This Notice describes the privacy policies of Calvo’s SelectCare (CSC), Tokio Marine Pacific Insurance Limited ("TMPI"), and health benefit plans underwritten by TMPI (the "Plans"), and how that information may be used or disclosed in administering the Plans. It is intended to describe the policies that protect medical information relating to your past, present and future medical conditions, health care treatment and payment for that treatment ("PHI").

This notice applies to any information created or received by the Plans on or after September 23, 2013 that would allow someone to identify you and learn something about your health. It does not apply to information that contains nothing that could reasonably be used to identify you. It applies to you if you are insured by TMPI on or after September 23, 2013.

The terms "we" or "us" as used throughout this Notice refer to Calvo's SelectCare Health Plans, TMPI or the Plan. The terms "you" and "your" refer to each individual participant in the Plans.

Our Legal Duties

• We are required by law to maintain the privacy of your PHI.
• We are required to provide you this Notice of Privacy Practices.
• We are required to abide by the terms of this Notice until we officially adopt a new notice.

How we may use or disclose your PHI

We may use your PHI, or disclose your PHI to others, for a number of different reasons. This notice describes the categories of reasons for using or disclosing your information. For each category, we have provided a brief explanation, and in many cases have provided examples. The examples given do not include all of the specific ways we may use or disclose your PHI. However, any time we use or disclose your information in administration of the Plans, it will be for one of the categories listed below.

Treatment: We may use or disclose PHI for treatment purposes. For example, we may use or disclose your PHI to coordinate or manage your health care with your doctors, nurses, technicians, or other personnel involved in taking care of you.

Payment: We may use and disclose PHI for purposes related to payment for health care services. For example, we may use your PHI to anyone who helps pay for your care, to settle claims, to reimburse health care Plans for services provided to you or disclose it to another health plan to coordinate benefits.

Health Care Operations: We may use and disclose PHI for plan operations. For example, we may use or disclose your PHI for quality assessment and improvement activities, case management and care coordination, to comply with law and regulation, accreditation purposes, patients’ claims, grievances or lawsuits, health care contracting relating to our operations, legal or auditing activities, business management and general administration, underwriting, obtaining re-insurance and other activities to operate the Plans.

To Business Associates: We may hire third parties that may need your PHI to perform certain services on behalf of TMPI or the Plans. These third parties are "Business Associates" of TMPI or the Plans. Business Associates must protect any PHI they receive from, or create and maintain on behalf of, TMPI or the Plans.

Plan Sponsor: We may disclose certain health and payment information about you to the sponsor of your Plan (the "Plan Sponsor") to obtain premium bids for the Plan or to modify, amend or terminate the Plan. We may release other health information about you to the Plan Sponsor for purposes of Plan administration, if certain provisions have been added to the Plan to protect the privacy of your health information, and the Plan Sponsor agrees to comply with the provisions. Note, however, that your Plan is prohibited from, and will not, use or disclose protected health information that is genetic information of an individual for underwriting purposes.

Family and Friends: We may disclose your PHI to a member of your family or to someone else who is involved in your medical care or payment for care. We may notify family or friends if you are in the hospital, and tell them your general condition. In the event of a disaster, we may provide information about you to a disaster relief organization so they can notify your family of your condition and location. We will not disclose your information to family or friends if you object and you notify us that you object. We may also disclose PHI to your personal representatives who have authority to act on your behalf (for example, to parents of minors or to someone with a power of attorney).

Treatment Options: We may use your PHI to provide you with additional information. This may include giving you information about treatment options or other health-related services that are available for you based on your medical condition.

Public Health Oversight: We may disclose your PHI to a public health oversight agency for oversight activities authorized by law. This includes uses or disclosures in civil, administrative or criminal investigations; licensure or disciplinary actions (for example, to investigate complaints against health care Plans); inspections; and other activities necessary for appropriate oversight of government programs (for example, to investigate Medicaid fraud). This also includes such activities as preventing or controlling disease, and notifying persons of recalls, exposures to disease.

Plan Government Programs Providing Public Benefits: We may disclose your health information relating to eligibility for or enrollment in the Plans to another agency administering a government program providing medical or public benefits, as long as sharing the health information or maintaining the health information in a single or combined data system is required or otherwise authorized by law.

To Report Abuse: We may disclose your PHI when the information relates to a victim of abuse, neglect or domestic violence. We will make this report only in accordance with laws that require or allow such reporting, or with your permission.

Legal Requirement to Disclose Information: We will disclose your information when we are required by law to do so. This includes reporting information to government agencies that have the legal responsibility to monitor the health care system. For instance, we may be required to disclose your PHI, and the information of others, to a state department of health.

Law Enforcement: We may disclose your PHI for law enforcement purposes. This includes providing information to help locate a suspect, fugitive, material witness or missing person, or in connection with suspected criminal activity. We must also disclose your PHI to a federal agency investigating our compliance with federal privacy regulations.

For Lawsuits and Disputes: We may disclose PHI in response to an order of a court or administrative agency, but only to the extent expressly authorized in the order. We may also disclose PHI in response to a subpoena, a lawsuit discovery request, or other lawful process, but only if we have received adequate assurances that the information to be disclosed will be protected.

Specialized Purposes: We may disclose your PHI for a number of other specialized purposes. We will only disclose as much information as is necessary for the purpose. For instance, we may disclose your information to coroners, medical examiners and funeral directors; to organ procurement organizations (for organ, eye, or tissue donation); or for national security and intelligence purposes. We may disclose the PHI of members of the armed forces as authorized by military command authorities. We also may disclose PHI about an inmate to a correctional institution or to law enforcement officials to provide the inmate with health care, to protect the health and safety of the inmate and others, and for the safety, administration, and maintenance of the correctional institution. We may also disclose your PHI to your employer or as otherwise authorized or required by law for purposes of workers’ compensation and work site safety laws (OSHA, for instance). We may disclose PHI to organizations engaged in emergency and disaster relief efforts.

In our effort to better serve your complete insurance needs, we may use the information we collect about you to better understand your relationship with us when assessing your needs, providing you services, and determining what products you may want to know more about.

To Avert a Serious Threat: We may disclose your PHI if we decide that the disclosure is necessary to prevent serious harm to the public or to an individual. The disclosure will only be made to someone who is able to prevent or reduce the threat.

Research: We may disclose your PHI in connection with medical research projects if allowed under federal and state laws and rules. The Plans may also disclose PHI for use in a limited data set for purposes of research, public health or health care operations, but only if a data use agreement has been signed.

Your Rights

Authorization: We will ask for your written authorization if we plan to use or disclose your PHI for reasons not covered in this notice, including but not limited to uses and disclosures relating to psychotherapy notes, marketing activities, and any sale of your PHI. If you authorize us to use or disclose your PHI, you have the right to revoke the authorization at any time. If you want to revoke an authorization, send a written notice to the Privacy Official listed at the end of this notice. You may not revoke an authorization for us to use and disclose your information to the extent that we have already given out your information or taken other action in reliance on the authorization. If the authorization is to permit disclosure of your information to an insurance company, as a condition of obtaining coverage, other laws may allow the insurer to continue to use your information to contest claims or your coverage, even after you have revoked the authorization.

Request Restrictions: You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations. You must make this request in writing. We will consider your request, but we are not required to agree. If we do agree, we will comply with the request unless the information is needed to provide you with emergency treatment. We cannot agree to restrict disclosures that are required by law. We may end the restriction if we tell you.

An important note regarding your right to request restrictions at your health care providers

You have a right to restrict your provider from disclosing protected health information to insurers or health plans because you paid for provider services or items out of pocket and in full. If you choose to use a medical expense reimbursement / flexible spending account (FSA) or a health savings account (HSA) to pay for the health care items or services that you wish to have restricted, you may not restrict disclosure to the FSA or HSA necessary to substantiate or effectuate that payment or reimbursement. That means you will still be required to provide the necessary substantiation of the expenses in order to receive payment.

Confidential Communication: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may ask that we contact you only at home or only by mail. If you want us to communicate with you in a special way, you will need to give us details about how to contact you, including a valid alternative address. You also will need to give us information as to how payment will be handled. We may ask you to explain how disclosure of all or part of your health information could put you in danger. We will honor reasonable requests. However, if we are unable to contact you using the requested ways or locations, we may contact you using any information we have.

Access to and Copies of PHI: With certain exceptions (i.e., psychotherapy notes, information collected for certain legal proceedings, and health information restricted by law), you have a right to access the PHI held by TMPI or the Plans in their enrollment, payment, claims adjudication, and case or medical management records systems that are used by the Plans in making decisions about you (the "Designated Record Set"). To the extent PHI is maintained electronically, you have a right to request an electronic copy of those records. We may charge a reasonable, cost-based fee for copying, mailing, and transmitting the records, and the cost of any specific media you request, to the extent allowed by state and federal law.

To ask to inspect your records, or to receive a copy, send a written request to the Privacy Official listed at the end of this notice. Your request should specifically list the information you want copied. We will respond to your request within a reasonable time, but generally no later than 30 days. If your Health Plan cannot respond to your request within 30 days, an additional 30 days is allowed if that Health Plan provides you with a written statement of the reason(s) for the delay and the date by which access will be provided. We may deny you access to certain information, such as if we believe it may endanger you or someone else, in which case we will also explain how you may appeal the decision.

Amend PHI: You have the right to ask us to amend PHI contained in the Designated Record Set held by TMPI or the Plans if you believe that PHI is not correct, or not complete. You must make this request in writing, and give us the reason you believe the information is not correct or complete. We will respond to your request within 30 days. Any amendment we agree with will be made by an addendum. We may deny your request if we did not create the information, if it is not part of the records we use to make decisions about you, the information is something you would not be permitted to inspect or copy, or if it is complete and accurate.

Accounting of Disclosures: You have a right to receive an accounting of certain disclosures of your information to others. The list will include dates of disclosures, the names of the people or organizations to whom the information was disclosed, a description of the information, and the reason. We will provide the first list of disclosures you request at no charge. We may charge you for any additional lists you request during the following 12 months. You must request this list in writing, and indicate the time period you want the list to cover. We cannot include disclosures made prior to the most recent 6 year period (the longest period for which disclosures are maintained). Disclosures for the following reasons will not be included on the list: disclosures for treatment, payment, or health care operations; disclosures incident to a permitted use or disclosure; disclosures as part of a limited data set; disclosures to your family members, other relatives, or friends who are involved in your care or who otherwise need to be notified about your location, general condition, or death; disclosures for national security purposes; certain disclosures to correctional or law enforcement personnel; disclosures that you have authorized; and disclosures made directly to you or your representatives.

Right to Notification of Breach of Unsecured PHI: We will comply with the requirements of HIPAA and its implementing regulations to provide notification to affected individuals, HHS, and the media (when required) if TMPI, a Plan or a business associate discovers a breach of unsecured PHI.

Rights More Stringent Than HIPAA: In certain instances, protections afforded under applicable state or territorial law may be more stringent than those provided by HIPAA and are therefore not preempted. We will comply with applicable state or territorial law to the extent it is more stringent than HIPAA with regard to requested disclosures of records (i.e., if we receive a subpoena for your PHI, and the state or territory in which you live requires your written consent or a court order to disclose the type of records requested).

Paper Copy of this Privacy Notice: You have a right to receive a paper copy of this notice. If you have received this notice electronically, you may receive a paper copy by contacting the office of the Privacy Official listed at the end of this notice.

Future Changes to this Notice: We reserve the right to change this Notice and the privacy practices of TMPI or the Plans covered by this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future.

If this Notice is maintained by TMPI or the Plans on a website, material changes will be prominently posted on that website, and information regarding the updated Notice will be made available in TMPI's or your Plan's next annual mailing. If the Notice is not maintained on a website, copies of the revised Notice will be made available to you within 60 days of a material change.

Complaints

You have a right to complain if you think your privacy has been violated. We encourage you to contact our Privacy Official. You may also file a complaint with the Secretary of the Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Office of the Privacy Official

If you have any questions regarding this Notice or if you wish to exercise any of your rights described in this Notice, you may contact the Privacy Official at:

Calvo's Insurance Underwriters, Inc.
Attn: Frank Campillo
P.O. Box FJ
Hagåtña, Guam 96932