GR-68737 (2-26) ACIC Page 1 of 4

• Notice became effective October 1, 2025 Legal Rights & Agreement Rules

Notice of Privacy Practices

Para recibir esta notificación en español por favor llamar al número gratuito de Member Services (Servicios a Miembros) que figura en su tarjeta de identificación.

• Spanish version available by calling Member Services Legal Rights & Agreement Rules

This Notice of Privacy Practices applies to Aetna’s insured health benefit plans. It does not apply to any plans that are self-funded by an employer. If you receive benefits through a group health insurance plan, your employer will be able to tell you if your plan is insured or self-funded. If your plan is self-funded, you may want to ask for a copy of your employer’s privacy notice.

• Covers Aetna's insured plans, not employer self-funded plans Legal Rights & Agreement Rules

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

• Covers Aetna's insured plans, not employer self-funded plans Legal Rights & Agreement Rules

Aetna1 considers personal information confidential. We protect the privacy of that information in accordance with federal and state privacy laws, as well as our own company privacy policies. This notice describes how we may use and disclose information about you in administering your benefits, and it explains your legal rights regarding the information.

• Treats personal information as confidential under law and company policy Legal Rights & Agreement Rules

When we use the term “personal information,” we mean information that identifies you as an individual, such as your name and Social Security Number, as well as financial, health and other information about you that is nonpublic, and that we obtain so we can provide you with insurance coverage. By “health information,” we mean information that identifies you and relates to your medical history (i.e., the health care you receive or the amounts paid for that care).

• Defines "personal information" and "health information" Legal Rights & Agreement Rules

This notice became effective on October 1, 2025.

• Notice became effective October 1, 2025 Legal Rights & Agreement Rules

How Aetna Uses and Discloses Personal Information

• Does not destroy personal information when coverage ends; may keep using it for the described purposes Retention & Deletion

In order to provide you with insurance coverage, we need personal information about you, and we obtain that information from many different sources – particularly you, your employer or benefits plan sponsor if applicable, other insurers, HMOs, or third-party administrators (TPAs), and health care providers. In administering your health benefits we may use and disclose personal information about you in various ways, including:

• Obtains personal information from you, employers, insurers, administrators and providers Data Access & Collection
• May use and disclose information for running its health business, such as quality work and disease management Use & Processing
• Operational uses include underwriting, fraud investigation, pharmacy programs and policy transfers Use & Processing
• May use and disclose information to pay for covered services Use & Processing
• May disclose information to health care providers who treat you Sharing & Disclosure
• May disclose information to other covered entities and their business associates Sharing & Disclosure

Health Care Operations: We may use and disclose personal information during the course of running our health business – that is, during operational activities such as quality assessment and improvement; licensing; accreditation by independent organizations; performance measurement and outcomes assessment; health services research; and preventive health, disease management, case management and care coordination. For example, we may use the information to provide disease management programs for members with specific conditions, such as diabetes, asthma, or heart failure. Other operational activities requiring use and disclosure include administration of reinsurance and stop loss; underwriting and rating; detection and investigation of fraud; administration of pharmaceutical programs and payments; transfer of policies or contracts from and to other health plans; facilitation of a sale, transfer, merger or consolidation of all or part of Aetna with another entity (including due diligence related to such activity); and other general administrative activities, including data and information systems management, and customer service.

• May use and disclose information for running its health business, such as quality work and disease management Use & Processing
• Operational uses include underwriting, fraud investigation, pharmacy programs and policy transfers Use & Processing
• Information may be used to facilitate a sale, merger or consolidation, including due diligence Sharing & Disclosure

Payment: To help pay for your covered services, we may use and disclose personal information in a number of ways – in conducting utilization and medical necessity reviews; coordinating care; determining eligibility; determining formulary compliance; collecting premiums; calculating cost-sharing amounts; and responding to complaints, appeals and requests for external review. For example, we may use your medical history and other health information about you to decide whether a particular treatment is medically necessary and what the payment should be – and during the process, we may disclose information to your provider. We also mail Explanation of Benefits forms and other information to the address we have on record for the subscriber (i.e., the primary insured). We also use personal information to obtain payment for any mail order pharmacy services provided to you.

• You can ask Aetna to communicate with you in a certain way or at a certain location Account & Service Control
• May use and disclose information to pay for covered services Use & Processing
• Explanation of Benefits forms are mailed to the subscriber's address on record Sharing & Disclosure

1 For purposes of this Notice, “Aetna” and the pronouns “we,” “us” and “our” refer to all of the HMO and licensed insurer subsidiaries of Aetna

• "Aetna" and "we" mean the HMO and insurer subsidiaries that share information as one covered entity Sharing & Disclosure

Inc. These entities have been designated as a single affiliated covered entity for federal privacy purposes. The members of the Aetna ACE can share Protected Health Information (PHI) with each other. We do this for the treatment, payment and health care operations of the Aetna ACE and as allowed by HIPAA and this Notice. For a full list of the members of the Aetna ACE, contact the Aetna Privacy Office at PrivacyAetna@aetna.com.

• "Aetna" and "we" mean the HMO and insurer subsidiaries that share information as one covered entity Sharing & Disclosure

Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records. We also may use personal information in providing mail order pharmacy services and by sending certain information to doctors for patient safety or other treatment-related reasons.

• May disclose information to health care providers who treat you Sharing & Disclosure

Disclosures to Other Covered Entities: We may disclose personal information to other covered entities, or business associates of those entities for treatment, payment and certain health care operations purposes. For example, if you receive benefits through a group health insurance plan, we may disclose personal information to other health plans maintained by your employer if it has been arranged for us to do so in order to have certain expenses reimbursed.

• May disclose information to other covered entities and their business associates Sharing & Disclosure

Additional Reasons for Disclosure

We may use or disclose health information about you in providing you with treatment alternatives, treatment reminders, or other health-related benefits and services. We also may disclose such information in support of:

• May use health information to offer treatment alternatives, reminders and related benefits Use & Processing
• May disclose to your employer for plan administration in limited situations Sharing & Disclosure
• May disclose to researchers if measures protect your privacy Sharing & Disclosure
• May disclose to service providers who assure they will protect it Sharing & Disclosure
• May disclose to regulators, for workers' compensation and as required by law Sharing & Disclosure
• May disclose to law enforcement and in response to court orders or lawful process Sharing & Disclosure
• May disclose for matters of public interest as required or permitted by law Sharing & Disclosure
• May disclose to coroners, funeral directors and organ donation groups Sharing & Disclosure

• Plan Administration – to your employer (for group health insurance plans), when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.
• • May disclose to your employer for plan administration in limited situations Sharing & Disclosure
• Research – to researchers, provided measures are taken to protect your privacy.
• • May disclose to researchers if measures protect your privacy Sharing & Disclosure
• Business Partners – to persons who provide services to us and assure us they will protect the information.
• • May disclose to service providers who assure they will protect it Sharing & Disclosure
• Industry Regulation – to state insurance departments, boards of pharmacy, U.S. Food and Drug Administration, U.S. Department of Labor and other government agencies that regulate us.
• • May disclose to regulators, for workers' compensation and as required by law Sharing & Disclosure
• Workers’ Compensation – to comply with workers’ compensation laws.
• • May disclose to regulators, for workers' compensation and as required by law Sharing & Disclosure
• Law Enforcement – to federal, state, and local law enforcement officials.
• • May disclose to law enforcement and in response to court orders or lawful process Sharing & Disclosure
• Legal Proceedings – in response to a court order or other lawful process.
• • May disclose to law enforcement and in response to court orders or lawful process Sharing & Disclosure
• Public Welfare – to address matters of public interest as required or permitted by law (e.g., child abuse and neglect, threats to public health and safety, and national security).
• • May disclose for matters of public interest as required or permitted by law Sharing & Disclosure
• As Required by Law – to comply with legal obligations and requirements.
• • May disclose to regulators, for workers' compensation and as required by law Sharing & Disclosure
• Decedents – to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as authorized by law; and to funeral directors as necessary to carry out their duties.
• • May disclose to coroners, funeral directors and organ donation groups Sharing & Disclosure
• Organ Procurement – to respond to organ donation groups for the purpose of facilitating donation and transplantation.
• • May disclose to coroners, funeral directors and organ donation groups Sharing & Disclosure

Required Disclosures: We must use and disclose your personal information in the following manner:

• Must disclose to you or your representative and to the federal health department Sharing & Disclosure

• To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
• • Must disclose to you or your representative and to the federal health department Sharing & Disclosure
• To the Secretary of the Department of Health and Human Services, as necessary, for HIPAA compliance and enforcement purposes.
• • Must disclose to you or your representative and to the federal health department Sharing & Disclosure

Disclosure to Others Involved in Your Health Care

• May disclose to relatives, friends, the subscriber or others you identify when relevant to your care or payment Sharing & Disclosure
• You can ask Aetna to restrict uses and disclosures, but it may say no Use & Processing

We may disclose personal information about you to a relative, a friend, the subscriber of your health benefits plan or any other person you identify, provided the information is directly relevant to that person’s involvement with your health care or payment for that care. For example, if a family member or a caregiver calls us with prior knowledge of a claim, we may confirm whether or not the claim has been received and paid. You have the right to stop or limit this kind of disclosure by calling the toll-free Privacy Compliance Department number at 1-800-264-4000.

• May disclose to relatives, friends, the subscriber or others you identify when relevant to your care or payment Sharing & Disclosure
• You can stop or limit disclosures to people involved in your care by phone Sharing & Disclosure
• You can ask Aetna to restrict uses and disclosures, but it may say no Use & Processing

If you are a minor, you also may have the right to block parental access to your health information in certain circumstances, if permitted by state law. You can contact us using the toll-free Privacy Compliance Department number at 1-800-264-4000 – or have your provider contact us.

• Minors may be able to block parental access if state law permits Sharing & Disclosure

Uses and Disclosures Requiring Your Written Authorization

• Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules

In all situations other than those described above, we will ask for your written authorization before using or disclosing personal information about you. For example, we will get your authorization:

• Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules

• for marketing purposes that are unrelated to your benefit plan(s),
• • Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules
• before disclosing any psychotherapy notes,
• • Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules
• related to the sale of your health information, and
• • Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules
• for other reasons as required by law.
• • Asks for written authorization for other uses, such as unrelated marketing, psychotherapy notes and sales Legal Rights & Agreement Rules

If you have given us an authorization, you may revoke it in writing at any time, if we have not already acted on it. If you have questions regarding authorizations, please call the toll-free Privacy Compliance Department number at 1-800-264-4000.

• You can revoke an authorization in writing unless Aetna already acted on it Legal Rights & Agreement Rules

PHI disclosed as permitted by HIPAA may be subject to redisclosure by the recipient and no longer protected by HIPAA.

• Disclosed health information may be redisclosed and lose HIPAA protection Sharing & Disclosure

Additional Restrictions on Use and Disclosure

• Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules

Some state and federal laws may require special privacy protections, including certain requirements to obtain attestations from requestors, that limit the use and disclosure of certain sensitive health information. Such laws may protect information related to:

• Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules

• Alcohol or substance use disorder
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Biometric Information
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Child or adult abuse or neglect, including sexual assault
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Communicable diseases
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Genetic information
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• HIV/AIDs
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Mental health
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Minors
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Reproductive health
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules
• Sexually transmitted diseases
• • Special state or federal protections may apply to certain sensitive information Legal Rights & Agreement Rules

We will follow the law that is stricter (or more protective of your PHI), where it applies to us. If you would like additional information about additional use or disclosure restrictions that may apply to your sensitive PHI, please contact the Aetna Privacy Office.

• Aetna follows the stricter law where it applies; contact the Privacy Office for details Legal Rights & Agreement Rules

Substance Use Disorder Information

• Information from substance use disorder programs is handled under the consent and HIPAA Use & Processing

We are not a substance use disorder treatment program. We may receive or keep information about you that comes from a substance use disorder program. If a substance use disorder program provides us this information through a 42 CFR Part 2 consent, including a consent for future uses and disclosures for treatment, payment, and health care operations, we will use or share that information in accordance with both the consent and HIPAA. In limited situations where we may disclose this information without your permission, such as medical emergencies and government audits, we will follow the law that is more protective of your information. We will not use or share this information in any legal case against you unless:

• Information from substance use disorder programs is handled under the consent and HIPAA Use & Processing
• Will not use that information in a legal case against you without consent or a court order Legal Rights & Agreement Rules

• You give us written consent, or
• • Will not use that information in a legal case against you without consent or a court order Legal Rights & Agreement Rules
• A court orders us with a subpoena or other legal requirement.
• • Will not use that information in a legal case against you without consent or a court order Legal Rights & Agreement Rules

You or Aetna must also receive notice and a chance to be heard.

• Will not use that information in a legal case against you without consent or a court order Legal Rights & Agreement Rules

Your Legal Rights

• Federal privacy rules give members several rights over their health information Legal Rights & Agreement Rules

The federal privacy regulations give you several rights regarding your health information

• Federal privacy rules give members several rights over their health information Legal Rights & Agreement Rules

• You have the right to ask us to communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent, you might want us to send health information (e.g. Explanation of benefits (EOB) and other claim information) to a different address from that of your subscriber. We will accommodate reasonable requests.
• • You can ask Aetna to communicate with you in a certain way or at a certain location Account & Service Control
• You have the right to ask us to restrict the way we use or disclose health information about you in connection with health care operations, payment, and treatment. We will consider, but may not agree to, such requests. You also have the right to ask us to restrict disclosures to persons involved in your health care.
• • You can ask Aetna to restrict uses and disclosures, but it may say no Use & Processing
• You have the right to ask us to obtain a copy of health information that is contained in a “designated record set” – medical records and other records maintained and used in making enrollment, payment, claims adjudication, medical management, and other decisions. We may ask you to make your request in writing, may charge a reasonable fee for producing and mailing the copies and, in certain cases, may deny the request.
• • You can ask for a copy of your designated record set; it may need to be in writing and may carry a fee Account & Service Control
• You have the right to ask us to amend health information that is in a “designated record set.” Your request must be in writing and must include the reason for the request. If we deny the request, you may file a written statement of disagreement.
• • You can ask Aetna to amend your designated record set, in writing with a reason Account & Service Control
• You have the right to ask us to provide a list of certain disclosures we have made about you, such as disclosures of health information to government agencies that license us. Your request must be in writing. If you request such an accounting more than once in a 12-month period, we may charge a reasonable fee.
• • You can ask for a list of certain disclosures; repeat requests within 12 months may carry a fee Sharing & Disclosure
• You have the right to be notified following a breach involving your health information.
• • You have the right to be notified of a breach involving your health information Security & Safeguards
• You have the right to know the reasons for an unfavorable underwriting decision. Previous unfavorable underwriting decisions may not be used as the basis for future underwriting decisions unless we make an independent evaluation of the basic facts. Your genetic information cannot be used for underwriting purposes.
• • You can learn the reasons for an unfavorable underwriting decision; genetic information is not used for underwriting Use & Processing
• You have the right with very limited exceptions, not to be subjected to pretext interviews.2 You may make any of the requests described above, may request a paper copy of this notice, or ask questions regarding this notice by calling toll-free 1-800-264-4000.
• • You have the right, with very limited exceptions, not to be subjected to pretext interviews Data Access & Collection
  • Requests, a paper copy and questions can be made by calling 1-800-264-4000 Account & Service Control

You also have the right to file a complaint if you think your privacy rights have been violated. To do so, please send an email to Aetna Privacy Office at PrivacyAetna@aetna.com or send your request to the following address:

• You can file a privacy complaint with Aetna or the federal health department without penalty Legal Rights & Agreement Rules

HIPAA Member Rights Team P.O. Box 14079

• You can file a privacy complaint with Aetna or the federal health department without penalty Legal Rights & Agreement Rules

Lexington, KY 40512-4079

• You can file a privacy complaint with Aetna or the federal health department without penalty Legal Rights & Agreement Rules

You may stop the paper mailing of your EOB and other claim information by visiting https://www.aetna.com/ and click “Log In/Register”. Follow the prompts to complete the one-time registration. Then you can log in any time to view past copies of EOBs and other claim information. You also may write to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

• You can file a privacy complaint with Aetna or the federal health department without penalty Legal Rights & Agreement Rules
• You can stop paper mailing of Explanation of Benefits forms by registering on the website Account & Service Control

Aetna’s Legal Obligations

• Federal rules require Aetna to keep information private, give notice and follow this notice Legal Rights & Agreement Rules

The federal privacy regulations require us to keep personal information about you private, to give you notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

• Federal rules require Aetna to keep information private, give notice and follow this notice Legal Rights & Agreement Rules

Safeguarding Your Information

• Protects information with administrative, technical and physical safeguards Security & Safeguards

We guard your information with administrative, technical, and physical safeguards to protect it against unauthorized access and against threats and hazards to its security and integrity. We comply with all applicable state and federal law pertaining to the security and confidentiality of personal information.

• Protects information with administrative, technical and physical safeguards Security & Safeguards

This Notice is Subject to Change

• Aetna may change the notice and its policies at any time, applying to information it already holds Legal Rights & Agreement Rules

We may change the terms of this notice and our privacy policies at any time. If we do, the new terms and policies will be effective for all of the information that we already have about you, as well as any information that we may receive or hold in the future.

• Aetna may change the notice and its policies at any time, applying to information it already holds Legal Rights & Agreement Rules

Please note that we do not destroy personal information about you when you terminate your coverage with us. It may be necessary to use and disclose this information for the purposes described above even after your coverage terminates, although policies and procedures will remain in place to protect against inappropriate use or disclosure.

• Does not destroy personal information when coverage ends; may keep using it for the described purposes Retention & Deletion

Coverage may be underwritten or administered by one or more of the following companies: Aetna Health Inc.; Aetna Health of California Inc.; Aetna Dental of California Inc.; Aetna Dental Inc.; Aetna Life Insurance Company; Aetna Insurance Company of Connecticut; Aetna Health Insurance Company of New York; American Continental Insurance Company; Continental Life Insurance Company of Brentwood, Tennessee and Corporate Health Insurance Company; Aetna Health and Life Insurance Company, Aetna Health Insurance Company, Coventry Health and Life Insurance Company, First Health Life and Health Insurance Company. Mail order pharmacy services may be provided by Aetna Rx Home Delivery, LLC.

• Coverage may be underwritten or administered by several Aetna insurers; mail order pharmacy by Aetna Rx Home Delivery Legal Rights & Agreement Rules

2 We do not participate in pretext interviews.

• Footnote: Aetna does not participate in pretext interviews Data Access & Collection

GR-68737 (2-26) ACIC