This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

• What the notice covers: records containing your PHI Legal Rights & Agreement Rules

Our privacy commitment

Thank you for giving us the opportunity to serve you. In the normal course of doing business – providing medical care to you – Cigna HealthcareSM creates records about you and the treatment and services we provide to you. The information we collect is called Protected Health Information (PHI). We take our obligation to keep your PHI secure and confidential very seriously.

• What the notice covers: records containing your PHI Legal Rights & Agreement Rules
• Some PHI disclosures need no written authorization Sharing & Disclosure

We are required by federal and state law to protect the privacy of your PHI and to provide you with this Notice about how we safeguard and use it and to notify you following a breach of your unsecured PHI.

• Legal duty to protect PHI, give notice and notify of breach Legal Rights & Agreement Rules

When we use or give out (disclose) your PHI, we are bound by the terms of this Notice. This Notice applies to all electronic or paper records we create, obtain, and/or maintain that contain your PHI.

• What the notice covers: records containing your PHI Legal Rights & Agreement Rules

How we protect your privacy

We understand the importance of protecting your PHI. We restrict access to your PHI to authorized workforce members who need that information for your treatment, for payment purposes and/or for health care operations. We maintain technical, physical and administrative safeguards to ensure the privacy of your PHI.

• PHI access limited to authorized staff with safeguards Security & Safeguards

To protect your privacy, only authorized and trained workforce members are given access to our paper and electronic records and to non-public areas where this information is stored.

• PHI access limited to authorized staff with safeguards Security & Safeguards

Workforce members are trained on topics including:

• Workforce privacy training and Privacy Office monitoring Security & Safeguards

• Privacy and data protection policies and procedures including how paper and electronic records are labeled, stored, filed and accessed.
• • Workforce privacy training and Privacy Office monitoring Security & Safeguards
• Technical, physical and administrative safeguards in place to maintain the privacy and security of your PHI
• • Workforce privacy training and Privacy Office monitoring Security & Safeguards

Our corporate Privacy Office monitors how we follow the policies and procedures, and educates our organization on this important topic.

• Workforce privacy training and Privacy Office monitoring Security & Safeguards

How we use and disclose your PHI

Uses of PHI without your authorization

• Some PHI disclosures need no written authorization Sharing & Disclosure
• PHI disclosed under these purposes may lose HIPAA protection Sharing & Disclosure
• Right to request restrictions on use and disclosure Legal Rights & Agreement Rules

We may commonly disclose your PHI without your written authorization for the following purposes:

• Some PHI disclosures need no written authorization Sharing & Disclosure

• Treatment:
• • Disclosure of PHI for treatment Sharing & Disclosure
• To share with hospital staff, nurses, doctors, pharmacists, optometrists, health educators and other health care professionals and personnel at health care facilities so they can determine your plan of care.
• • Disclosure of PHI for treatment Sharing & Disclosure
• To help you obtain services and treatment you may need. For example, to order lab tests and using the results.
• • Disclosure of PHI for treatment Sharing & Disclosure

855489 f 10/25 © 2025 Cigna Healthcare. Some content provided under license. Offered by Cigna Health and Life Insurance Company or its affiliates.

• Which Cigna companies 'Cigna Healthcare' refers to Legal Rights & Agreement Rules

• To coordinate your health care and related services with a different health care facility or professional.
• • Disclosure of PHI for treatment Sharing & Disclosure
• Payment:
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• To obtain payment of premiums for your coverage.
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• To make coverage determinations. For example, to speak to a health care professional about payment for services provided to you.
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• To coordinate benefits with other coverage you may have. For example, to speak to another health plan or insurer to determine your eligibility or coverage.
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• To obtain payment from a third party that may be responsible for payment, such as a family member.
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• To otherwise determine and fulfill our responsibility to provide your health benefits. For example, to administer claims.
• • Disclosure of PHI for payment and benefits administration Sharing & Disclosure
• Health care operations:
• • Disclosure of PHI for health care operations Sharing & Disclosure
• To provide customer service.
• • Disclosure of PHI for health care operations Sharing & Disclosure
• To support and/or improve the programs or services we offer you.
• • Disclosure of PHI for health care operations Sharing & Disclosure
• To assist you in managing your health. For example, to provide you with information about treatment alternatives to which you may be entitled.
• • Disclosure of PHI for health care operations Sharing & Disclosure
• To support another health plan, insurer, or health care professional who has a relationship with you for activities such as case management, care coordination and quality improvement activities. For example, we may share your claims information with your doctor if you have a medical need that requires attention.
• • Disclosure of PHI for health care operations Sharing & Disclosure

We may also disclose your PHI without your written authorization for the following other purposes, as permitted or required by law:

• Some PHI disclosures need no written authorization Sharing & Disclosure

• Disclosures to others involved in your health care.
• • Disclosure to family, caregivers and a child's other parent Sharing & Disclosure
• If you are present or otherwise available to direct us to do so, we may disclose your PHI to others. For example, a family member, a close friend, or your caregiver.
• • Disclosure to family, caregivers and a child's other parent Sharing & Disclosure
• If you are in an emergency situation, are not present, or are incapacitated, we will use our professional judgment to decide whether disclosing your PHI to others is in your best interests. If we do disclose your PHI in a situation where you are unavailable, we would disclose only information that is directly relevant to the person’s involvement with your treatment or for payment related to your treatment. We may also disclose your PHI in order to notify (or assist in notifying) such persons of your location or your general medical condition.
• • Disclosure to family, caregivers and a child's other parent Sharing & Disclosure
• We may disclose your child’s PHI to your child’s other parent.
• • Disclosure to family, caregivers and a child's other parent Sharing & Disclosure
• Disclosures to your employer as sponsor of your health plan. We may disclose your PHI to your employer or to a company acting on your employer’s behalf, so that entity can monitor, audit and otherwise administer the employee health plan in which you participate. Your employer is not permitted to use the PHI we disclose for any purpose other than administration of your benefits. The Health Plan may also provide Summary Health Information to the plan sponsor as allowed by law so that the plan sponsor may solicit premium bids from other health plans or modify, amend or terminate the plan. See your employer’s health plan documents for information on whether your employer receives PHI and, if so, the identity of the employees who are authorized to receive your PHI.
• • Disclosure to your employer as plan sponsor Sharing & Disclosure
  • Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules
• Disclosures to vendors and accreditation organizations. We may disclose your PHI to:
• • Disclosure to service vendors and accreditation bodies Sharing & Disclosure
• Companies that perform certain services we’ve requested. For example, we may engage vendors to help us to provide information and guidance to users with chronic conditions like diabetes and asthma.
• • Disclosure to service vendors and accreditation bodies Sharing & Disclosure
• Accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement purposes. Please note that before we share your PHI, we obtain the vendor’s or accreditation organization’s written agreement to protect the privacy of your PHI.
• • Disclosure to service vendors and accreditation bodies Sharing & Disclosure
• Communications. We may disclose your PHI to:
• • Communications: in-person product encouragement, nominal gifts, marketing limit Sharing & Disclosure
• Encourage you to purchase or use a product or service that is not part of the health care services and benefits we provide when we meet with you in person, as permitted by law.
• • Communications: in-person product encouragement, nominal gifts, marketing limit Sharing & Disclosure
• Provide you with a promotional gift of nominal value. Except as permitted by law, we will not use your PHI for marketing purposes without your prior written authorization.
• • Communications: in-person product encouragement, nominal gifts, marketing limit Sharing & Disclosure
• Health or safety. We may disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or the health and safety of another individual or the general public
• • Disclosure to prevent a serious and imminent threat Sharing & Disclosure
• Public health activities. We may disclose your PHI to:
• • Public health reports: disease, immunizations, abuse Sharing & Disclosure
• Report health information to public health authorities authorized by law to receive such information for the purpose of preventing or controlling disease, injury or disability, or monitoring immunizations
• • Public health reports: disease, immunizations, abuse Sharing & Disclosure
• Report child abuse or neglect, or adult abuse, including domestic violence, to a government authority authorized by law to receive such reports
• • Public health reports: disease, immunizations, abuse Sharing & Disclosure
• Report information about a product or activity that is regulated by the U.S. Food and Drug Administration (FDA) to a person responsible for the quality, safety or effectiveness of the product or activity
• • Public health: product safety reports and exposure alerts Sharing & Disclosure
• Alert a person who may have been exposed to a communicable disease, if we are authorized by law to give this Notice
• • Public health: product safety reports and exposure alerts Sharing & Disclosure
• Health oversight activities. We may disclose your PHI to:
• • Disclosure for health oversight activities Sharing & Disclosure
• A government agency that is legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs, such as Medicare or Medicaid.
• • Disclosure for health oversight activities Sharing & Disclosure
• Other regulatory programs that need health information to determine compliance.
• • Disclosure for health oversight activities Sharing & Disclosure
• Research. We may disclose your PHI for research purposes, but only according to and as allowed by law.
• • Disclosure for research only as the law allows Sharing & Disclosure
• Compliance with the law. We may use and disclose your PHI to comply with the law.
• • Disclosures to comply with law, courts, police and government Sharing & Disclosure
• Judicial and administrative proceedings. We may disclose your PHI in a judicial or administrative proceeding or in response to a valid legal order.
• • Disclosures to comply with law, courts, police and government Sharing & Disclosure
• Law enforcement officials. We may disclose your PHI to the police or other law enforcement officials, as required by law or in compliance with a court order or other process authorized by law.
• • Disclosures to comply with law, courts, police and government Sharing & Disclosure
• Government functions. We may disclose your PHI to various departments of the government such as the U.S. military or the U.S. Department of State as required by law.
• • Disclosures to comply with law, courts, police and government Sharing & Disclosure
• Workers’ compensation. We may disclose your PHI when necessary to comply with workers’ compensation laws and similar programs.
• • Disclosures for workers' compensation, organ procurement and coroners Sharing & Disclosure
• Organ and Tissue Procurement. We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
• • Disclosures for workers' compensation, organ procurement and coroners Sharing & Disclosure
• Decedents. We may disclose your PHI to a coroner or medical examiner as authorized by law.
• • Disclosures for workers' compensation, organ procurement and coroners Sharing & Disclosure

If we disclose your PHI for any of the purposes above, the PHI may be subject to redisclosure by the recipient and may no longer be protected by HIPAA.

• PHI disclosed under these purposes may lose HIPAA protection Sharing & Disclosure

Uses of PHI that require your authorization

• Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules

Other than for the purposes described above or as permitted by applicable law, we must obtain your written authorization to use or disclose your PHI.

• Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules

For example, we would need your authorization:

• Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules

• To use your PHI to a prospective employer.
• • Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules
• Use your PHI for marketing communications and when we receive direct or indirect payment from a third party for making such communications.
• • Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules
• For any sale involving your PHI, as required by law.
• • Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules

Uses and disclosures of certain PHI deemed “Highly Confidential.”

• Some PHI disclosures need no written authorization Sharing & Disclosure
• Specially protected PHI categories need your written authorization Sharing & Disclosure

For certain kinds of PHI, federal and state law may require enhanced privacy protection. These would include PHI that is:

• Specially protected PHI categories need your written authorization Sharing & Disclosure

• Maintained in psychotherapy notes;
• • Specially protected PHI categories need your written authorization Sharing & Disclosure
• About substance use disorder prevention, treatment and referral;
• • Specially protected PHI categories need your written authorization Sharing & Disclosure
• About HIV/AIDS testing, diagnosis or treatment;
• • Specially protected PHI categories need your written authorization Sharing & Disclosure
• About venereal and/or communicable disease(s);
• • Specially protected PHI categories need your written authorization Sharing & Disclosure
• About genetic testing.
• • Specially protected PHI categories need your written authorization Sharing & Disclosure

We can only disclose this type of specially protected PHI with your prior written authorization except when specifically permitted or required by law. Any other uses and disclosures not described in this Notice will only be made with your prior written authorization. We will not share your substance use disorder treatment records received from federally assisted substance use disorder treatment programs for civil, criminal, administrative, or legislative proceedings against you unless you provide your consent in writing, or we receive a court order. We are prohibited from using or disclosing PHI that is genetic information for underwriting purposes.

• Some PHI disclosures need no written authorization Sharing & Disclosure
• Written authorization needed for uses not otherwise described Legal Rights & Agreement Rules
• Specially protected PHI categories need your written authorization Sharing & Disclosure
• Limits on substance use disorder records and genetic information Legal Rights & Agreement Rules

Cancellation.

• You can cancel a written authorization for future use Legal Rights & Agreement Rules

You may cancel – or revoke – a written authorization you gave us before. The cancellation, submitted to us in writing, will apply to future uses and disclosures of your

• You can cancel a written authorization for future use Legal Rights & Agreement Rules

PHI. It will not impact disclosures made previously, while your authorization was in effect.

• You can cancel a written authorization for future use Legal Rights & Agreement Rules

Your individual rights

• Individual rights cover PHI Cigna Healthcare creates, obtains or maintains Legal Rights & Agreement Rules

You have the following rights regarding the PHI that Cigna Healthcare creates, obtains, and/or maintains about you.

• Individual rights cover PHI Cigna Healthcare creates, obtains or maintains Legal Rights & Agreement Rules

• Right to request restrictions. You may ask us to restrict the way we use and disclose your PHI for treatment, payment and health care operations, as explained in this Notice. We are not required to agree to the restrictions, but we will consider them carefully. If we do agree to the restrictions, we will abide by them.
• • Right to request restrictions on use and disclosure Legal Rights & Agreement Rules
• Right to receive confidential communications. You may ask to receive Cigna Healthcare communications containing PHI by alternative means or at alternative locations. For example, you may ask that we contact you by phone at home, rather than at work. We will accommodate reasonable requests whenever feasible.
• • Right to receive confidential communications Legal Rights & Agreement Rules
• Right to inspect and copy your PHI. You may ask in advance to review or receive a copy of your PHI that is included in certain paper or electronic records we maintain such as prescription and billing records. Under limited circumstances, we may deny you access to a portion of your records. You may request that we disclose or send a copy of your PHI to a Health Information Exchange (HIE).
• • Right to inspect and copy your PHI Legal Rights & Agreement Rules
• Right to amend your records. You have the right to ask us to correct your PHI contained in our electronic or paper records if you believe it is inaccurate. If we determine that the PHI is inaccurate, we will correct it if permitted by law. If a health care facility or professional created the information that you want to change, you should ask them to amend the information.
• • Right to ask to amend your records Legal Rights & Agreement Rules
• Right to receive an accounting of disclosures. Upon your request, we will provide a list of the disclosures we have made of your PHI for a specified time period. However, the list will exclude:
• • Right to an accounting of disclosures, with exclusions and a fee Legal Rights & Agreement Rules
• Disclosures you have authorized.
• • Right to an accounting of disclosures, with exclusions and a fee Legal Rights & Agreement Rules
• Disclosures made earlier than six years before the date of your request (in the case of disclosures made from an electronic health record, this period may be limited to three years before the date of your request).
• • Right to an accounting of disclosures, with exclusions and a fee Legal Rights & Agreement Rules
• Disclosures made for treatment, payment, and health care operations purposes except when required by law.
• • Right to an accounting of disclosures, with exclusions and a fee Legal Rights & Agreement Rules
• Certain other disclosures that are excepted by law. If you request an accounting more than once during any 12-month period, we will charge you a reasonable fee for each accounting report after the first one.
• • Right to an accounting of disclosures, with exclusions and a fee Legal Rights & Agreement Rules
• Right to name a personal representative. You may name another person to act as your Personal Representative. Your representative will be allowed access to your PHI, to communicate with the health care professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant your representative, he or she may also have authority to make health care decisions for you.
• • Right to name a personal representative Legal Rights & Agreement Rules
• Right to receive a paper copy of this Notice. Upon your request, we will provide a paper copy of this Notice, even if you have already received one, as described in the Notice Availability and Duration
• • Right to a paper copy of this notice Legal Rights & Agreement Rules

section later in this Notice.

• Right to a paper copy of this notice Legal Rights & Agreement Rules

Actions you may take

Contact us.

• How to contact Cigna Healthcare's Privacy Office Account & Service Control

If you have questions about your privacy rights, believe that we may have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact us in writing or by telephone. Cigna Healthcare Privacy Office PO Box 188014 Chattanooga, TN 37422 Telephone Number 800.234.4077 privacyoffice@cigna.com For certain types of requests, you must complete and mail to us an applicable form, which is available by calling the International Service Centers or going to our website (www.Cignaenvoy.com).

• How to contact Cigna Healthcare's Privacy Office Account & Service Control

Contact a government agency.

• Right to complain to the U.S. HHS Office for Civil Rights without retaliation Legal Rights & Agreement Rules

If you believe we may have violated your privacy rights, you may also file a written complaint with the Secretary (“the Secretary”) of the U.S. Department of Health and Human Services (HHS). Your complaint can be sent by email, fax, or mail to the HHS’ Office for Civil Rights (OCR). For more information, go to the OCR website http://www.hhs. gov/ocr/privacy/ hipaa/complaints. We will provide you with the contact information for the OCR Regional Manager in your area if you request it from our Privacy Office. We will not take any action against you if you exercise your right to file a complaint, either with us or with the Secretary.

• Right to complain to the U.S. HHS Office for Civil Rights without retaliation Legal Rights & Agreement Rules

Notice availability and duration

• Where to get a copy of the notice Account & Service Control

Notice availability.

• Where to get a copy of the notice Account & Service Control

A copy of this Notice is available by calling the International Service Centers or on our website (go to www.Cignaenvoy.com and click Notice of Privacy Practices).

• Where to get a copy of the notice Account & Service Control

Right to change terms of this Notice.

• Cigna Healthcare may change the notice and apply it to existing PHI Legal Rights & Agreement Rules

We may change the terms of this Notice at any time, and we may, at our discretion, make the new terms effective for all of your PHI in our possession, including any PHI we created or received before we issued the new Notice. If we change this Notice, we will update the Notice on our website and, if you are enrolled in a Cigna Healthcare, Global Health Benefits plan at that time, we will send you the new Notice, as required. In addition, you can obtain a copy of the new Notice upon request when you call the International Service Centers or from our website.

• What the notice covers: records containing your PHI Legal Rights & Agreement Rules
• Cigna Healthcare may change the notice and apply it to existing PHI Legal Rights & Agreement Rules

Effective date

• Notice dates: effective April 14, 2003, updated October 15, 2025 Legal Rights & Agreement Rules

This Notice is effective as of April 14, 2003, and updated as of October 15, 2025.

• Notice dates: effective April 14, 2003, updated October 15, 2025 Legal Rights & Agreement Rules

Cigna Healthcare products and services are provided exclusively by or through operating subsidiaries ofThe Cigna Group, including Cigna Health and Life Insurance Company, Cigna Life Insurance Company of Canada, Cigna Global Insurance Company Limited, Evernorth Care Solutions, Inc., and Evernorth Behavioral Health, Inc. The Cigna Healthcare name, logo, and other Cigna marks are owned by Cigna Intellectual Property, Inc., licensed for use by The Cigna Group and its operating subsidiaries.“Cigna Healthcare”refers to The Cigna Group and/or its subsidiaries and affiliates. 855489 f 10/25 © 2025 Cigna Healthcare. Some content provided under license. All rights reserved.

• Which Cigna companies 'Cigna Healthcare' refers to Legal Rights & Agreement Rules