Privacy Policy.

I.Statement of Our Duties

Avergent, LLC maintains privacy practices for clients and customers — protecting information about employees, dependents, and group health plan participants. We comply with the Gramm-Leach-Bliley Financial Modernization Act (GLB Act), HIPAA Privacy regulations, and the HITECH Act.

We are required by law to maintain the privacy of non-public personal information ("NPPI") and protected health information ("PHI").

We reserve the right to modify notice terms with advance notification to current clients.

II.Your Rights Under HIPAA Privacy and HITECH

Clients have rights regarding how protected information is used or disclosed. When we serve employers with group health plans, we have no direct legal duty to employees or dependents to provide individual privacy notices — though contractual obligations as a Business Associate apply.

Primary uses and disclosures of protected health information

Payment. We use protected information for claim payment, eligibility determination, benefit coordination, medical necessity review, premium collection, and issuance of explanations of benefits.

Health care operations. Protected information supports premium determination, quality assessments, care coordination, case management, and business management activities.

Business associates. Contracted entities receive protected information only after we require the business associates to agree in writing to contract terms designed to appropriately safeguard your information.

Other covered entities. Information may be disclosed to healthcare providers for treatment or payment, and to other covered entities for billing, claims payment, or enrollment operations.

Your rights

• Request additional restrictions on uses and disclosures (we are not obligated to comply).
• Access, inspect, copy, and request correction of your protected information.
• Receive an accounting of disclosures for purposes other than payment or operations.
• Request confidential communication methods.
• Obtain paper copies of electronic notices.

III.Information We Collect About You

We collect information from:

1. Direct conversations, applications, or forms completed by clients or participants.
2. Applications or forms regarding current or prospective plan participants.
3. Transaction records with affiliates or other entities.
4. Results of transactions with clients.

IV.Permissible Uses and Disclosures

Information disclosure complies with Business Associate contracts under HIPAA regulations and state and federal privacy laws.

Situations permitted or required by law

We may disclose information without written permission for:

1. Workers' compensation or no-fault law compliance.
2. Insurance regulatory agency audits or administrative proceedings.
3. Public health authority activities.
4. Law enforcement purposes or court orders.
5. Organ procurement or approved research.
6. Reports of abuse, neglect, or domestic violence to authorized agencies.

Uses without objection

Limited information may be disclosed after providing opportunity to object — including office directory maintenance, family notification regarding care involvement, or emergency circumstances.

Uses requiring written permission

All other uses or disclosures of your protected health information will be made only with your written permission, and you may revoke any permission that you give us at any time.

V.Complaints About Misuse of Health Information

You may file complaints with us or with the Secretary of Health and Human Services. Written complaints should outline the issue, surrounding facts, and relevant details — including names and dates.

You will not be retaliated against in any way for filing a complaint.

VI.Confidentiality and Security

Access to non-public personal and health information is restricted to employees and agents who require that information for service delivery. We maintain physical, electronic, and procedural safeguards that comply with state and federal regulations.

VII.Notice of Breach of Protected Health Information

In the event of any unauthorized acquisition, access, use or disclosure of Protected Health Information, we shall fully comply with the breach notification requirements

— including notification to affected individuals regarding potential impact.

VIII.Dispute Resolution

Any controversy or claim arising out of or relating to our privacy policy, or the breach thereof, shall be settled by arbitration in accordance with the rules of the American Arbitration Association.

This Privacy Policy is published by Avergent, LLC. If any provision of this notice is found to conflict with applicable law, the controlling law will govern.