Notice of Privacy Practices

Effective July 1, 2024

For Your Protection

This notice describes how medical information about you maybe used and disclosed, and how you can get access to this information. please review this notice carefully. Coupe Health has always been committed to maintaining the security and confidentiality of the information we receive from our members. Whether it’s your medical information or other identifiable information (such as your name, address, phone number or member identification number) (“protected health information”), or information about race, ethnicity, gender, gender identity, sexual orientation or language, we maintain policies and procedures, and other electronic controls, to guard against unauthorized access and use, and unnecessary collection of information. You should know that we are required by law to provide you this notice about our legal duties and privacy practices. We hope that this notice will clarify our responsibilities to you and provide you with a good understanding of your rights.

Please Note: This notice does not apply to members whose employers are self-insured. If your employer is self-insured, you need to contact your employer for more information about your health plan’s privacy practices.

How Coupe Health Safeguards Your Protected Health Information

Our privacy officer has the overall responsibility to implement and enforce privacy policies and procedures to protect your protected health information. You can be assured that every effort is taken to comply with federal and state laws — physically, electronically and procedurally — to safeguard your information. In some situations, where state laws provide greater protection for your privacy, we will follow the provisions of that state law Coupe Health requires all of its employees, business associates (such as Prime Therapeutics), providers and vendors to adhere to federal and state privacy laws. Following are descriptions of how your protected health information is handled throughout our administration of your health plan.

Permitted Handling of Protected Health Information

At Coupe Health, your protected health information is handled in a number of different ways as we administer your health plan benefits. The following examples show you the various uses we are permitted by law to make without your authorization:

Treatment. We may disclose your protected health information to healthcare providers (doctors, dentists, pharmacies, hospitals and other caregivers) who request it to aid in your treatment. We may also disclose your protected health information to these healthcare providers in our effort to provide you with preventive health, early detection and disease and case management programs.

Payment. To administer your health benefits, policy or contract, we must use and disclose your protected health information to determine:

• Eligibility
• Claims payment
• Utilization and management of your benefits
• Medical necessity of your treatment
• Coordination of your care, benefits and other services
• Responses to complaints, appeals and external review requests

We may also use and disclose your protected health information to determine premium costs, underwriting, rates and cost-sharing amounts, provided that no genetic information may be used for underwriting purposes.

Healthcare operations. To perform our health plan functions, we may use and disclose your protected health information to provide programs and evaluations, such as:

• Health improvement or healthcare cost-reduction programs
• Competence or qualification reviews of healthcare professionals
• Fraud and abuse detection and compliance programs
• Quality assessment and improvement activities and outcomes evaluation
• Performance measurement and outcome assessments, health claims analysis and health services outreach
• Case management, disease management and care coordination services

We may also disclose your protected health information to Coupe Health affiliates and business associates (such as Prime Therapeutics) that perform payment activities and conduct healthcare operations on our behalf.

Service reminders. We may contact you to remind you to obtain preventive health services or to inform you of treatment alternatives and/or health-related benefits and services, which may be of interest to you.

Additional Uses and Disclosures

In certain situations, the law permits us to use or disclose your protected health information without your authorization. These situations include:

Required by law. We may use or disclose your protected health information, as we are required to do so by state or federal law, including disclosures to the U.S. Department of Health and Human Services. Also, we are required to disclose your protected health information to you in accordance with the law.

Public health issues. We may disclose your protected health information to an authorized public health authority for public health activities in controlling disease, injury or disability. For example, we may disclose your protected health information to the childhood immunization registry.

Abuse or neglect. We may make disclosures to government authorities concerning abuse, neglect or domestic violence as required by law.

Health oversight activities. We may disclose your protected health information to a government agency authorized to conduct healthcare system or governmental procedures such as audits, examinations, investigations, inspections and licensure activity.

Legal proceedings. We may disclose your protected health information in the course of any legal proceeding, in response to a court order or administrative judge and, in certain cases, in response to a subpoena, discovery request or other lawful process.

Law enforcement. We may disclose your protected health information to law enforcement officials. For example, disclosures may be made in response to a warrant or subpoena or for the purpose of identifying or locating a suspect, witness or missing persons or to provide information concerning victims of crimes.

Coroners, medical examiners, funeral directors and organ donations. We may disclose your protected health information in certain instances to coroners and medical examiners during their investigations. We may also disclose protected health information to funeral directors so that they may carry out their duties. We may disclose protected health information to organizations that handle donations of organs, eyes or tissue and transplantations. For example, if you are an organ donor, we can release records to an organ donation facility.

Research. We may disclose your protected health information to researchers only if certain established measures are taken to protect your privacy. For example, we may disclose to a teaching university to conduct medical research.

To prevent a serious threat to health or safety. We may disclose your protected health information to the extent necessary to avoid a serious and imminent threat to your health or safety or to the health or safety of others.

Military activity and national security. We may disclose your protected health information to armed forces personnel under certain circumstances, and to authorized federal officials for national security and intelligence activities.

Correctional institutions. If you are an inmate, we may disclose your protected health information to your correctional facility to help provide you healthcare or to provide safety to you or others.

Workers’ compensation. We may disclose your protected health information as required by workers’ compensation laws.

Others involved in your healthcare. Unless you notify us in writing, we may disclose certain billing information to a family member who calls on your behalf. The kind of information we will disclose is the status of a claim, amount paid and payment date. We will not, however, disclose medical information, such as diagnosis or the name of the provider.

Your employer. If your coverage is through your employer, we may disclose information to your employer to review group claims data or to conduct an audit. All information that could be used to identify specific participants is removed unless such identification is necessary.

Your Authorization

Any uses and disclosures not described in this notice, including most uses and disclosures of psychotherapy notes, the use and disclosure of protected health information for marketing purposes, and the sale of any protected health information, will require your written authorization except where permitted by law. Keep in mind that you may cancel your authorization in writing at any time.

Your Rights

Coupe Health would like you to know that you have additional rights regarding your protected health information. Your additional rights are described below:

Your right to request restrictions. You have the right to request restrictions on the way we handle your protected health information for treatment, payment or healthcare operations as described in the “Permitted handling of protected health information” section of this notice. The law, however, does not require us to agree to these restrictions. If we do agree to a restriction, we will send you a written confirmation and will not use or disclose your protected health information in violation of that restriction. If we don’t agree, we will notify you in writing.

Your right to confidential communications. We will make every effort to accommodate reasonable requests to communicate with you about your protected health information at an alternative location. For our records, we need your request in writing, except in emergency situations where verbal requests will be accepted. It is important that you understand that any payment or payment information may be sent to the original address in our records.

Your right to access. You have the right to receive (or request that a designated person receive), by written request, a copy of your protected health information that is contained in a “designated record set,” with some specified exceptions. For example, if your doctor determines that your records are sensitive, we may not give you access to your records. You also have the right to request an electronic copy of protected health information that is maintained electronically.

What is a designated record set?

It’s a group of records used to administer your health benefits, including:

• Enrollment
• Payment
• Claims adjudication
• Case or medical management records

Your right to amend your protected health information. You have the right to ask us to amend any protected health information that is contained in a “designated record set.” For our records, your request for an amendment must be in writing. Blue Cross will not amend records in the following situations:

• Coupe Health does not have the records you want amended
• Coupe Health did not create the records that you want amended
• Coupe Health has determined that the records are accurate and complete
• The records have been compiled in anticipation of a civil, criminal or administrative action or proceeding
• The records are covered by the federal Clinical Laboratory Improvement Act

If you have requested an amendment under any of these situations, we will notify you in writing that we are denying your request. You have the right to file a written statement of disagreement with us, and we have the right to rebut that statement. Please note that changes of addresses are not required in writing.

Your right to information about certain disclosures. You have the right to request (in writing) information about any times we have disclosed your protected health information for any purpose other than the following exceptions:

• Treatment, payment, or healthcare operations as described in the “Permitted handling of protected health information” section of this notice
• Disclosures that you or your personal representative have authorized
• Certain other disclosures, such as disclosures for national security purposes

The requirement that we provide you with information about any times we have disclosed your protected health information applies for six years from the date of the disclosure. This applies only to disclosures made on or after April 14, 2003.

Your right to receive notifications of breaches of protected health information. In the event of any unauthorized acquisition, use or disclosure of your unsecured protected health information (a “breach”), Coupe Health will notify you of such breach, unless there is a low probability that your protected health information has been compromised.

Future Changes

Although Coupe Health follows the privacy practices described in this notice, you should know that under certain circumstances these practices could change in the future. For example, if privacy laws change, we will change our practices to comply with the law. Should this occur:

• We will post a new notice on our website bluecrossmn.com by the effective date of the new notice and will also provide a copy of the new notice, or information about the new notice and how to obtain the new notice, in our next annual mailing to members
• The changes will apply to all protected health information we have in our possession, including any information created or received before we change the notice

SMS Terms and Conditions

Coupe Health offers the option for members to receive SMS communications to help them stay informed of important account or benefit-related information, as well as remind members about gaps in care. Message frequency varies. Message and data rates may apply. Replying STOP will stop all SMS communications. Replying HELP will direct you to a web page with various resources. Carriers are not liable for delayed or undelivered messages.

Please be assured that we will not take retaliatory action against you if you file a complaint about our privacy practices either with us or HHS.

No mobile information will be shared with or sold to third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with or sold to any third parties.

Questions & Answers

Q: Will you give my protected health information to my family or others?
A. We will share your protected health information with others only if either of these apply: 1. You are present, in person or on the telephone, and give us permission to talk to the other person, or 2. You sign an authorization form. You should know, however, that state laws do not allow us to disclose certain information about minors — even to their parents.

Q: Who should I contact to get more information or to get an additional copy of this notice?
A: For additional information, questions about this Notice of Privacy Practices, or if you want another copy, please visit the Coupe Health website at coupehealth.com. You may also call us at 833-749-1969 with questions or to obtain forms.

Q: What should I do if I believe my privacy rights have been violated?
A: If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your protected health information, you may either:

1. Call us at the number listed above
2. File a written complaint with our Privacy Officer at the following address:
   Privacy Officer
   Blue Cross and Blue Shield of Minnesota
   3400 Yankee Drive P-32
   Eagan, MN 55121
3. Contact the Minnesota Department of Commerce at (651) 539-1500 or 800-657-3602
4. Contact the Minnesota Department of Health toll-free 1-800-657-3916
5. Notify the Secretary of the U.S. Department of Health and Human Services (HHS). Send your complaint to:
   Office for Civil Rights
   U.S. Department of Health and Human Services
   233 N. Michigan Ave., Suite 240
   Chicago, IL 60601
   Voice Phone (312) 886-2359,
   toll-free 1-800-368-1019 Fax (312) 886-1807 or TTY (312) 353-5693.
6. Call the HHS Voice Hotline number at 1-800-368-1019

Blue Cross® and Blue Shield® of Minnesota and Blue Plus® are nonprofit independent licensees of the Blue Cross and Blue Shield Association.

Coupe Health, LLC is an independent company that provides benefit design services.

Prime Therapeutics LLC is an independent company providing pharmacy benefit management services.