Important information

Notice of privacy practices

Important information about your rights and our responsibilities

Protecting your personal health information is important. Each year, we’re required to send you specific information about your rights and some of our duties to help keep your information safe. This notice combines three of these required yearly communications:

• One notice combines three required yearly communications Legal Rights & Agreement Rules

• State notice of privacy practices
• • One notice combines three required yearly communications Legal Rights & Agreement Rules
• Health Insurance Portability and Accountability Act (HIPAA) notice of privacy practices
• • One notice combines three required yearly communications Legal Rights & Agreement Rules
• Breast reconstruction surgery benefits
• • One notice combines three required yearly communications Legal Rights & Agreement Rules

Would you like to go paperless and read this online or on your mobile app? Go to https://www.anthem.com and sign up to get these notices by email.

• Members can sign up to get these notices by email Account & Service Control

State notice of privacy practices

When it comes to handling your health information, we follow relevant state laws, which are sometimes stricter than the federal HIPAA privacy law. This notice:

• State privacy law is followed and can be stricter than HIPAA Legal Rights & Agreement Rules

• Explains your rights and our duties under state law.
• • State privacy law is followed and can be stricter than HIPAA Legal Rights & Agreement Rules
• Applies to health, dental, vision, and life insurance benefits you may have.
• • State privacy law is followed and can be stricter than HIPAA Legal Rights & Agreement Rules

Your state may give you additional rights to limit sharing your health information. Please call the Member Services phone number on your ID card for more details.

• Your state may give extra rights to limit sharing Sharing & Disclosure

Your personal information

Your nonpublic (private) personal information (PI) identifies you, and it’s often gathered in an insurance matter. You have the right to see and correct your PI. We may collect, use, and share your PI as described in this notice. Our goal is to protect your PI because your information can be used to make judgments about your health, finances, character, habits, hobbies, reputation, career, and credit.

• Personal information is nonpublic data; you can see and correct it Account & Service Control
• The company may collect, use and share personal information Use & Processing

We may receive your PI from others, such as doctors, hospitals, or other insurance companies. We may also share your PI with others outside our company — without your approval, in some cases. But we take reasonable measures to protect your information. If an activity requires us to give you a chance to opt out, we’ll let you know, and we’ll let you know how to tell us you don’t want your PI used or shared for an activity you can opt out of.

• Personal information may come from doctors, hospitals and other insurers Data Access & Collection
• PI can be shared outside the company without approval in some cases Sharing & Disclosure
• Opt-out chances are announced when an activity requires them Use & Processing

THIS NOTICE DESCRIBES HOW MEDICAL, VISION, AND DENTAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

• The HIPAA notice header covers medical, vision and dental information Legal Rights & Agreement Rules

HIPAA notice of privacy practices

We keep the health and financial information of our current and former members private as required by law, accreditation standards, and our own internal rules. We’re also required by federal law to give you this notice to explain your rights and our legal duties and privacy practices.

• Members' health and financial information is kept private; this notice is federally required Legal Rights & Agreement Rules

Your protected health information

There are times we may collect, use, and share your Protected Health Information (PHI) as allowed or required by law, including the HIPAA privacy rule. Here are some of those times:

• PHI may be collected, used and shared as allowed or required by law Use & Processing

Payment: We collect, use, and share PHI to take care of your account and benefits, or to pay claims for healthcare you get through your plan.

• PHI is used for payment: accounts, benefits and paying claims Use & Processing

Healthcare operations: We collect, use, and share PHI for our healthcare operations.

• PHI is used for the company's healthcare operations Use & Processing

Treatment activities: We don’t provide treatment, but we collect, use, and share information about your treatment to offer services that may help you, including sharing information with others providing you treatment.

• The company does not provide treatment but uses treatment information to offer services Use & Processing

Y0114_26_3016239_0000_NM_C Effective May 2025 1082691MUSENABS_0002

• A footer line reads Effective May 2025 Legal Rights & Agreement Rules

Examples of ways we use your information:

• We keep information on file about your premium and deductible payments.
• • Examples: payment records, benefit checks and explanation of benefits Use & Processing
• We may give information to a doctor’s office to confirm your benefits.
• • Examples: payment records, benefit checks and explanation of benefits Use & Processing
• We may share explanation of benefits (EOB) with the subscriber of your plan for payment purposes.
• • Examples: payment records, benefit checks and explanation of benefits Use & Processing
• We may share PHI with your doctor or hospital so that they may treat you.
• • Example: PHI may be shared with your doctor or hospital for treatment Sharing & Disclosure
• We may use PHI to review the quality of care and services you get.
• • Examples: quality-of-care review and help with conditions like asthma or diabetes Use & Processing
• We may use PHI to help you with services for conditions like asthma, diabetes, or traumatic injury.
• • Examples: quality-of-care review and help with conditions like asthma or diabetes Use & Processing
• We may collect and use publicly and/or commercially available data about you to support you and help you get health plan benefits and services.
• • Example: publicly or commercially available data about you may be collected and used Data Access & Collection
• We may use PHI with technology to support and enable services provided to you.
• • Example: PHI may be used with technology to support services Use & Processing
• We may use your PHI to create, use, or share de-identified data as allowed by HIPAA.
• • Example: PHI may be used to create, use or share de-identified data Use & Processing
• We may also use and share PHI directly or indirectly with health information exchanges for payment, healthcare operations, and treatment. If you don’t want your PHI to be shared in these situations, visit www.anthem.com/privacy for more information.
• • Example: PHI may be shared with health information exchanges Sharing & Disclosure

Sharing your PHI with you:

We must give you access to your own PHI. We may also contact you about treatment options or other health-related benefits and services. When you or your dependents reach a certain age, we may tell you about other plans or programs for which you may be eligible, including individual coverage. We may also send you reminders about routine medical checkups and tests. You may get emails that have limited PHI, such as welcome materials. We’ll ask your permission before we contact you.

• The company must give you access to your own PHI Account & Service Control
• The company may contact you about treatment options, other plans and reminders Use & Processing
• The paragraph ends: we will ask your permission before we contact you Use & Processing

Sharing your PHI with others:

In most cases, if we use or share your PHI outside of treatment, payment, operations, or research activities, we have to get your okay in writing first. We must also get your written permission before:

• Outside treatment, payment, operations or research, written permission is usually needed Sharing & Disclosure
• Written permission is required for certain marketing, selling PHI and psychotherapy notes Sharing & Disclosure

• Using your PHI for certain marketing activities.
• • Written permission is required for certain marketing, selling PHI and psychotherapy notes Sharing & Disclosure
• Selling your PHI.
• • Written permission is required for certain marketing, selling PHI and psychotherapy notes Sharing & Disclosure
• Sharing any psychotherapy notes from your doctor or therapist.
• • Written permission is required for certain marketing, selling PHI and psychotherapy notes Sharing & Disclosure

We may also need your written permission for other situations not mentioned above. You always have the right to cancel any written permission you have given at any time.

• Written permission may be needed in other situations and can always be cancelled Account & Service Control

You have the right and choice to tell us to:

• You can tell the company to share with family or friends and in emergencies Sharing & Disclosure

• Share information with your family, close friends, or others involved with your current treatment or payment for your care.
• • You can tell the company to share with family or friends and in emergencies Sharing & Disclosure
• Share information in an emergency or disaster relief situation.
• • You can tell the company to share with family or friends and in emergencies Sharing & Disclosure

If you can’t tell us your preference, for example in an emergency, or if you’re unconscious, we may share your PHI if we believe it’s in your best interest. We may also share your information when needed to lessen a serious and likely threat to your health or safety.

• If you cannot state a preference, PHI may be shared if in your best interest Sharing & Disclosure
• Information may be shared to lessen a serious and likely threat Sharing & Disclosure

Other reasons we may use or share your information:

We are allowed, and in some cases required, to share your information in other ways — usually for the good of the public, such as public health and research. We can share your information for these specific purposes:

• Information may be shared for other reasons, usually for the public good Sharing & Disclosure

• Helping with public health and safety issues, such as:
• • Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

– Preventing disease

• Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

– Helping with product recalls

• Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

– Reporting adverse reactions to medicines

• Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

– Reporting suspected abuse, neglect, or domestic violence

• Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

– Preventing or reducing a serious threat to anyone’s health or safety

• Sharing for public health and safety, including reporting suspected abuse Sharing & Disclosure

• Doing health research.
• • Information may be shared for health research Sharing & Disclosure
• Obeying the law, if it requires sharing your information.
• • Information may be shared when the law requires, in lawsuits and for HHS enforcement Legal Rights & Agreement Rules
• Responding to organ donation groups for research and certain reasons.
• • Information may be shared with organ donation groups Sharing & Disclosure
• Addressing workers’ compensation, law enforcement, and other government requests, and to alert proper authorities if we believe you may be a victim of abuse or other crimes.
• • Information may be shared for workers' compensation, law enforcement and government requests Sharing & Disclosure
• Responding to lawsuits and legal actions.
• • Information may be shared when the law requires, in lawsuits and for HHS enforcement Legal Rights & Agreement Rules
• Responding to the Secretary of Human and Health Services for HIPAA rules compliance and enforcement purposes.
• • Information may be shared when the law requires, in lawsuits and for HHS enforcement Legal Rights & Agreement Rules

If you’re enrolled with us through an employer, we may share your PHI with your group health plan. If the employer pays your premium or part of it, but doesn’t pay your health insurance claims, your employer can only have your PHI for permitted reasons and is required by law to protect it.

• PHI may be shared with your group health plan when enrolled through an employer Sharing & Disclosure

Authorization:

We’ll get your written permission before we use or share your PHI for any purpose not stated in this notice. You may cancel your permission at any time, in writing. We will then stop using your PHI for that purpose. But if we’ve already used or shared your PHI with your permission, we cannot undo any actions we took before you told us to stop.

• Written permission is needed before PHI is used for any purpose not stated in the notice Use & Processing
• You can cancel your permission in writing, but past uses cannot be undone Account & Service Control

Genetic information:

We cannot use your genetic information to decide whether we’ll give you coverage or decide the price of that coverage.

• Genetic information is not used to decide coverage or price Use & Processing

Race, ethnicity, language, sexual orientation, and gender identity:

We may collect, infer, receive, and/or maintain race, ethnicity, language, sexual orientation, and gender identity information about you and protect this information as described in this notice. We may use this information to help you, including identifying your specific needs, developing programs and educational materials, and offering interpretation services. We don’t use race, ethnicity, language, sexual orientation, and gender identity information to decide whether we’ll give you coverage, what kind of coverage, and the price of that coverage. We don’t share this information with unauthorized persons.

• Race, ethnicity, language, sexual orientation and gender identity information may be collected and used to help you Data Access & Collection
• That information is not used for coverage decisions or shared with unauthorized persons Use & Processing

Your rights

Under federal law, you have the right to:

• Federal rights are listed and exercised through Member Services Account & Service Control

• Send us a written request to see or get a copy of your PHI, including a request for a copy of your PHI through email. Remember, there’s a risk your PHI could be read by a third party when it’s sent unencrypted, meaning regular email. So, we will first confirm that you want to get your PHI by unencrypted email before sending it to you. We will provide you a copy of your PHI usually within 30 days of your request. If we need more time, we will let you know.
• • Right to see or get a copy of your PHI, with an email warning Account & Service Control
• Ask that we correct your PHI that you believe is wrong or incomplete. If someone else, such as your doctor, gave us the PHI, we’ll let you know so you can ask him or her to correct it. We may say “no” to your request, but we’ll tell you why in writing within 60 days.
• • Right to ask for corrections to your PHI Account & Service Control
• Send us a written request not to use your PHI for treatment, payment, or healthcare operations activities. We may say “no” to your request, but we’ll tell you why in writing.
• • Right to ask the company not to use your PHI for treatment, payment or operations Use & Processing
• Request confidential communications. You can ask us to send your PHI or contact you using other ways that are reasonable. Also, let us know if you want us to send your mail to a different address if sending it to your home could put you in danger.
• • Right to request confidential communications Account & Service Control
• Send us a written request to ask us for a list of those with whom we’ve shared your PHI. We will provide you a list usually within 60 days of your request. If we need more time, we will let you know.
• • Right to a list of those with whom your PHI was shared Sharing & Disclosure
• Ask for a restriction for services you pay for out of your own pocket: If you pay in full for any medical services out of your own pocket, you have the right to ask for a restriction. The restriction would prevent the use or sharing of that PHI for treatment, payment, or operations reasons. If you or your provider submits a claim to us, we may not agree to a restriction (see “Your rights” above). If a law requires sharing your information, we don’t have to agree to your restriction.
• • Right to ask for a restriction on services you pay for yourself Sharing & Disclosure
• Call Member Services at the phone number on your ID card to use any of these rights. A representative can give you the address to send the request. They can also give you any forms we have that may help you with this process.
• • Federal rights are listed and exercised through Member Services Account & Service Control

How we protect information

We’re dedicated to protecting your PHI, and we’ve set up a number of policies and information practices to help keep your PHI secure and private. If we believe your PHI has been breached, we must let you know.

• The company has policies to keep PHI secure and will tell you of a breach it believes occurred Security & Safeguards

We keep your oral, written, and electronic PHI safe using the right procedures, and through physical and electronic ways. These safety measures follow federal and state laws. Some of the ways we keep your PHI safe include securing offices that hold PHI, password-protecting computers, and locking storage areas and filing cabinets. We require our employees to protect PHI through written policies and procedures. These policies limit access to PHI to only those employees who need the data to do their jobs. Employees are also required to wear ID badges to help keep unauthorized people out of areas where your PHI is kept. Also, where required by law, our business partners must protect the privacy of data we share with them as they work with us. They’re not allowed to give your PHI to others without your written permission, unless the law allows it and it’s stated in this notice.

• Physical, electronic and staff safeguards protect PHI Security & Safeguards
• Business partners must protect shared data where the law requires Sharing & Disclosure

Potential impact of other applicable laws

HIPAA, the federal privacy law, generally doesn’t cancel other laws that give people greater privacy protections. As a result, if any state or federal privacy law requires us to give you more privacy protections, then we must follow that law in addition to HIPAA. One example is with Substance Use Disorder (SUD) information we may receive from Providers or programs regulated by federal law (42 CFR Part 2). All disclosures of such SUD information must comply with applicable Federal and State privacy laws, including 42 CFR Part 2. We are allowed to Use and Disclose SUD information for certain Treatment, Payment, and Health Care Operations activities. You have the right to consent to the disclosure of SUD information in certain circumstances. You can revoke this consent in writing at any time.

• State or federal laws that give more protection are followed in addition to HIPAA Legal Rights & Agreement Rules
• Substance use disorder information has its own consent rules under 42 CFR Part 2 Sharing & Disclosure

To see more information

To read more information about how we collect and use your information, your privacy rights, and details about other state and federal privacy laws, please visit our Privacy web page at www.anthem.com/privacy.

• More detail on collection, use and privacy rights is on the Anthem privacy web page Legal Rights & Agreement Rules

Calling or texting you

We, including our affiliates and/or vendors, may call or text you by using an automatic telephone dialing system and/or an artificial voice. But we only do this in accordance with the Telephone Consumer Protection Act (TCPA). The calls may be about treatment options or other health-related benefits and services for you. If you don’t want to be contacted by phone, just let the caller know or call 1-844-203-3796 to add your phone number to our Do Not Call list. We will then no longer call or text you.

• The company, affiliates and vendors may call or text using automated dialing or an artificial voice Use & Processing
• You can stop calls and texts by telling the caller or joining the Do Not Call list Account & Service Control

Complaints

If you think we haven’t protected your privacy, you can file a complaint with us at the Member Services phone number on your ID card. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by visiting hhs.gov/ocr/privacy/hipaa/complaints/. We will not take action against you for filing a complaint.

• You can complain to the company or to the federal Office for Civil Rights Legal Rights & Agreement Rules
• The company will not take action against you for filing a complaint Account & Service Control

Contact information

You may call us at the Member Services phone number on your ID card. Our representatives can help you apply your rights, file a complaint, or talk with you about privacy issues.

• Member Services can help apply your rights and file complaints Account & Service Control

Copies and changes

You have the right to get a new copy of this notice at any time. Even if you have agreed to get this notice by electronic means, you still have the right to ask for a paper copy. We reserve the right to change this notice. A revised notice will apply to PHI we already have about you, as well as any PHI we may get in the future. We’re required by law to follow the privacy notice that’s in effect at this time. We may tell you about any changes to our notice through a newsletter, our website, or a letter.

• You can get a new copy of this notice at any time, including on paper Account & Service Control
• The company can change the notice, and the revised notice applies to PHI it already has Legal Rights & Agreement Rules
• Changes may be announced through a newsletter, the website or a letter Legal Rights & Agreement Rules

Effective date of this notice

The original effective date of this Notice was April 14, 2003. The most recent revision is noted in the footer at the end of this document.

• Original effective date is April 14, 2003; the latest revision is noted in the footer Legal Rights & Agreement Rules

FOR MAINE RESIDENTS: Maine Notice of Additional Privacy Rights

• Maine residents have additional rights under the Maine Insurance Information and Privacy Protection Act Legal Rights & Agreement Rules

The Maine Insurance Information and Privacy Protection Act provides consumers in Maine with the following additional rights.

• Maine residents have additional rights under the Maine Insurance Information and Privacy Protection Act Legal Rights & Agreement Rules

The right to:

• Maine: access, correction and a rebuttal statement for recorded personal information Account & Service Control

• Obtain access to the consumer’s recorded personal information in the possession or control of a regulated insurance entity.
• • Maine: access, correction and a rebuttal statement for recorded personal information Account & Service Control
• Request correction if the consumer believes the information to be inaccurate.
• • Maine: access, correction and a rebuttal statement for recorded personal information Account & Service Control
• Add a rebuttal statement to the file if there is a dispute.
• • Maine: access, correction and a rebuttal statement for recorded personal information Account & Service Control
• Know the reasons for an adverse underwriting decision (previous adverse underwriting decisions may not be used as the basis for subsequent underwriting decisions unless the carrier makes an independent evaluation of the underlying facts).
• • Maine: right to know reasons for an adverse underwriting decision Account & Service Control
• With very narrow exceptions, not be subjected to pretext interviews.
• • Maine: protection from pretext interviews, with very narrow exceptions Account & Service Control

Breast reconstruction surgery benefits

A mastectomy that’s covered by your health plan includes benefits that comply with the Women’s Health and Cancer Rights Act of 1998, which provides for:

• Covered mastectomies include Women's Health and Cancer Rights Act benefits Legal Rights & Agreement Rules

• Reconstruction of the breast(s) that underwent a covered mastectomy.
• • Covered mastectomies include Women's Health and Cancer Rights Act benefits Legal Rights & Agreement Rules
• Surgery and reconstruction of the other breast to restore a symmetrical appearance.
• • Covered mastectomies include Women's Health and Cancer Rights Act benefits Legal Rights & Agreement Rules
• Prostheses and coverage for physical complications related to all stages of a covered mastectomy, including lymphedema.
• • Covered mastectomies include Women's Health and Cancer Rights Act benefits Legal Rights & Agreement Rules

You’ll pay your usual deductible, copay, and/or coinsurance. For details, contact your plan administrator.

• You pay your usual deductible, copay or coinsurance for these benefits Charges & Financial Obligations

For more information about the Women’s Health and Cancer Rights Act, go to the United States Department of Labor website at dol.gov/agencies/ebsa/laws-and-regulations/laws/whcra.

• More on the Women's Health and Cancer Rights Act is on the Department of Labor website Legal Rights & Agreement Rules

It’s important we treat you fairly

We follow federal civil rights laws in our health programs and activities. We don’t discriminate, exclude people, or treat them differently based on race, color, national origin, sex, age, or disability. If you have disabilities, we offer free aids and services. If your main language isn’t English, we offer help for free through interpreters and other written languages. Call the Member Services number on your ID card for help (TTY/TDD: 711).

• The company follows federal civil rights laws and does not discriminate Legal Rights & Agreement Rules
• Free aids and services for disabilities, and free language help Account & Service Control

If you think we failed to offer these services or discriminated based on race, color, national origin, age, disability, or sex, you can file a complaint, also known as a grievance. You can file a complaint through one of these ways:

• How to file a discrimination complaint Legal Rights & Agreement Rules

• Write to Compliance Coordinator, P.O. Box 27401, Mail Drop VA2002-N160 Richmond, VA 23279.
• • How to file a discrimination complaint Legal Rights & Agreement Rules
• File a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at 200 Independence Avenue, SW; Room 509F, HHH Building; Washington, D.C. 20201.
• • How to file a discrimination complaint Legal Rights & Agreement Rules
• Call 1-800-368-1019 (TDD: 1-800-537-7697).
• • How to file a discrimination complaint Legal Rights & Agreement Rules
• Go online at https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf and fill out a complaint form at https://www. hhs.gov/ocr/complaints/index.html.
• • How to file a discrimination complaint Legal Rights & Agreement Rules

Get help in your language

One more right that you have is to get this information in your language for free. If you’d like extra help to understand this in another language, call the Member Services number on your ID card (TTY/TDD: 711).

• You can get this information in your language for free Account & Service Control

Aside from helping you understand your privacy rights in another language, we also offer this notice in a different format for members with visual impairments. If you need a different format, please call the Member Services number on your ID card.

• The notice is also offered in a different format for members with visual impairments Account & Service Control

Anthem Blue Cross and Blue Shield is the trade name of: In Colorado: Rocky Mountain Hospital and Medical Service, Inc. HMO products underwritten by HMO Colorado, Inc. In Connecticut: Anthem Health Plans, Inc. In Indiana: Anthem Insurance Companies, Inc. In Georgia: Blue Cross Blue Shield Healthcare Plan of Georgia, Inc. and Community Care Health Plan of Georgia, Inc. In Kentucky: Anthem Health Plans of Kentucky, Inc. In Maine: Anthem Health Plans of Maine, Inc. In Missouri (excluding 30 counties in the Kansas City area): RightCHOICE® Managed Care, Inc. (RIT), Healthy Alliance® Life Insurance Company (HALIC), and HMO Missouri, Inc. RIT and certain affiliates administer non-HMO benefits underwritten by HALIC and HMO benefits underwritten by HMO Missouri, Inc. RIT and certain affiliates only provide administrative services for self-funded plans and do not underwrite benefits. In Nevada: Rocky Mountain Hospital and Medical Service, Inc. HMO products underwritten by HMO Colorado, Inc., dba HMO Nevada. In New Hampshire: Anthem Health Plans of New Hampshire, Inc. HMO plans are administered by Anthem Health Plans of New Hampshire, Inc. and underwritten by Matthew Thornton Health Plan, Inc. In 17 southeastern counties of New York: Anthem HealthChoice Assurance, Inc. and Anthem HealthChoice HMO, Inc. In these same counties Anthem Blue Cross and Blue Shield HP is the trade name of Anthem HP, LLC. In Ohio: Community Insurance Company. In Virginia: Anthem Health Plans of Virginia, Inc. trades as Anthem Blue Cross and Blue Shield, and its affiliate HealthKeepers, Inc. trades as Anthem HealthKeepers providing HMO coverage, and their service area is all of Virginia except for the City of Fairfax, the Town of Vienna, and the area east of State Route 123. In Wisconsin: Blue Cross Blue Shield of Wisconsin (BCBSWI) underwrites or administers PPO and indemnity policies and underwrites the out-of-network benefits in POS policies offered by Compcare Health Services Insurance Corporation. Compcare underwrites or administers HMO or POS policies. Independent licensees of the Blue Cross and Blue Shield Association. Anthem is a registered trademark of Anthem Insurance Companies, Inc.

• Anthem Blue Cross and Blue Shield is a trade name of different companies in each state Legal Rights & Agreement Rules
• Some entities underwrite benefits and others only administer, including self-funded plans Charges & Financial Obligations
• The companies are independent licensees of the Blue Cross and Blue Shield Association Legal Rights & Agreement Rules