Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions, please contact ValueOptions at the phone number provided in your member materials.

Who Will Follow This Notice
This notice applies to the ValueOptions companies listed below.

• ValueOptions, Inc.
• ValueOptions of Texas, Inc. (NorthSTAR)
• Value Behavioral Health of Pennsylvania, Inc.
• Massachusetts Behavioral Health Partnership (MBHP)
• CHCS IPA, Inc.
• Value Behavioral Health IPA of New York, Inc.
• Behavioral Health Administrators
• First Option Corporation-Nebraska, Inc.
• Health Management Strategies International, Inc.   (HMSI)
• ValueOptions of Ohio, Inc.
• FHC Options of Texas, Inc.
• OPTIONS Health Care, Inc.
• Florida Health Partners, Inc.
• SyCare-Options Colorado, LLC
• West Slope-Options Colorado, LLC
• FHC Options-Puerto Rico, Inc.
• Value Health Reinsurance, Inc.
• Wellington Life Insurance
• Achieve Solutions, L.C.

How We Safeguard Your Protected Health Information

Your individual information about your past, present or future health, the health care you receive, or the payment for the health care is called "Protected Health Information" ("PHI"). ValueOptions is required to protect PHI that we have received or created, and to give you this Notice about our privacy practices. We may receive PHI from sources other than you through a paper or electronic inquiry to your group health plan or its business associates, your other health insurance companies, your providers or other available databases. This Notice explains how, when and why we may use or share your PHI. In most cases, we must use or share only the minimum necessary PHI to accomplish a task. The law has special protections for some kinds of information, including substance abuse information.

We are required to follow the privacy practices described in this Notice, but we may change our privacy practices and this Notice at any time. If we make changes, we will update the Notice here on our Web site at accordingly. You may also request a copy of the new Notice by calling the customer service number in your member materials or handbook.

How We May Use Your Protected Health Information and Share It with Others
We use PHI and share it with others for a variety of reasons. Examples of the types of persons who have access to your PHI are our customer service representatives, our care managers, our medical professionals, our claims administration staff, your group health plan if it complies with the law and public authorities that are permitted access under the law. Sometimes we must have your written agreement to share PHI. Sometimes we are allowed by law to use or share your PHI without your written agreement. Here are some examples of how we use and share PHI.

For treatment:
We may disclose your PHI to caregivers who are involved in providing your health care or Employee Assistance Program (EAP) services. For example, your PHI may be shared with the health professional that is treating you.

For payment:
We may use and share your PHI to pay claims from the health professionals who have provided services to you. We may also use and share your PHI to obtain payment for our services. For example, we may release portions of your PHI to a state Medicaid agency or to another insurance company that provides your coverage. We may also use your PHI, with the PHI of many others, to establish our premiums.

For health care operations:
We may use and share your PHI to operate our health plans, EAP services and other programs. For example, we may use your PHI in deciding whether you are eligible for specific services, or share your PHI with other professionals involved in your care. We may combine and analyze data from different sources so that your health plans and treating professionals can receive information about the products and services you are receiving to better coordinate your care. Unless you provide us with different directions, we may send appointment reminders and other similar information to your home. We may also send you information about treatment alternatives and health-related benefits. We may also use your PHI in studying the quality of the health care services provided, or share your PHI with our accountants or attorneys for audits or litigation. If we are providing health benefits to you under an employer-sponsored group health plan, we may disclose your PHI to the sponsor of the plan.

Individuals involved in your care or payment for your care:
We may release PHI about you to a friend or family member who is involved in your medical care. We may also give information to someone who helps pay for your care.

When required by law:
We will share PHI about you when required by federal, state or local law. We may share PHI when a law requires us to report information about suspected abuse, neglect or domestic violence, or relating to suspected criminal activity. We must also share PHI with authorities that monitor our compliance with privacy requirements.

For public health activities:
We may share PHI when we are required to collect information about disease or injury, or to report information to a public health authority.

For health oversight activities:
We may share PHI with an agency responsible for monitoring the health care system for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensing.

Relating to decedents:
We may share PHI relating to an individual's death with coroners, medical examiners or funeral directors, and to organ procurement organizations relating to organ, eye, or tissue donations or transplants.

For research purposes:
In certain circumstances, and under supervision of a privacy board, we may share PHI in order to assist medical or psychiatric research.

To prevent threats to health or safety:
In order to avoid a serious threat to health or safety, we may share PHI with law enforcement or other persons who might prevent or reduce the threat of harm.

For specific government functions:
We may share PHI of military personnel and veterans in certain situations, with correctional facilities in certain situations, with other government programs for eligibility and enrollment and for national security reasons.

Lawsuits and disputes:
If you are involved in a lawsuit or dispute, we may disclose PHI about you in response to a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request or other lawful request by someone else involved in the dispute, but only if efforts have been made to tell you about the request (which may include written notice) or to obtain an order protecting the information requested.

Law enforcement:
We may release PHI if asked to do so by a law enforcement official:

• in response to a court order, subpoena, warrant, summons or similar process
• to identify or locate a suspect, fugitive, material witness or missing person
• about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement
• about a death we believe may be the result of criminal conduct
• about criminal conduct at a hospital
• in emergency circumstances to report a crime, the location of the crime or victims or the identity, description or location of the person who committed the crime

By law we must have your written permission (an "authorization") to use or give out your PHI for any purpose that is not set out in this Notice. You may take back ("revoke") your written permission at any time, except if ValueOptions or our subcontractors have already acted based on your permission.

Your Rights Regarding Your Protected Health Information
You have the following rights relating to your PHI. You may exercise these rights by contacting ValueOptions at the number in your member materials.

To request restrictions on uses or sharing with others:
You have the right to ask us to limit how we use or share your PHI. We will consider your request, but we don't have to agree to it. If we do agree to restrictions, we will put the agreement in writing and follow it, except in emergency situations. We cannot agree to limit the uses or sharing of information that are required by law.

To choose how we contact you:
You have the right to ask that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To make a request regarding how we communicate with you, you must make your request in writing as indicated in your member materials. We will agree to your request as long as it is reasonable for us to do so.

To inspect and copy your PHI:
You have a right to see and copy your protected health information if you put your request in writing as directed in your member materials. We will respond to your request within the time required by law. If we deny your request, we will give you written reasons for the denial and explain your appeal rights. In certain situations, we may deny access to some parts of your PHI and you cannot appeal that decision. We will not provide access to psychotherapy notes, information we collect for legal actions or any lab test information protected by law, and you can't appeal those decisions. If you want copies of your PHI, a charge for copying may be required, depending on your circumstances. You have a right to choose to get a summary instead of a copy of the whole record.

To request changes or corrections of your PHI:
If you believe that there is a mistake or missing information in your PHI, you may request that we correct or add to the record. You must submit your request in writing as indicated in your member materials, along with a reason that supports your request. We will respond within the time required by law. We may deny the request if we determine that the PHI: (i) is correct and complete; (ii) was not created by us and/or is not part of our records, or (iii) is a type of information that we cannot disclose. If we deny your request for changes, we will tell you in writing the reasons for denial and explain your rights to have your request and our denial, together with any statement of disagreement made part of your PHI. If we approve the request for changes, we will change the PHI, and tell you and others that need to know, about the change.

To find out what disclosures have been made:
You have the right to obtain a list of the disclosures we made of your PHI, including the date, the person receiving the PHI and the purpose of the disclosure. This list will not include disclosures for treatment, payment or health care operations, any release of information we made to you or to those you authorized, your family, or any release to national security or intelligence authorities. The list will not include any disclosures made before April 14, 2003 and may not include disclosures that law enforcement or health authorities asked us not to list. To request this list, you must send your request in writing as indicated in your member materials. We will respond to your written request for a list within a period required by law. You can request a list of disclosures going back up to six years but no earlier than April 14, 2003. There will be no charge for one list each year. There may be a charge for more than one list per year.

To receive this notice:
You have a right to receive a paper copy of this Notice and/or an electronic copy by email upon request.

How to Complain About Our Privacy Practices
If you think we may have violated your privacy rights, or you disagree with a decision we made about access to or changes to your PHI, you should follow the appeal instructions we will give you. You may file a complaint at the number listed in your member materials. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services. We will not discriminate against you in any way because you file a complaint.