CSEA Employee Benefit Fund Notice of Privacy Practices

THIS NOTICE OF PRIVACY PRACTICES IS ISSUED BY THE CSEA EMPLOYEE BENEFIT FUND (THE "EBF"). THIS NOTICE APPLIES TO ALL MEDICAL INFORMATION CREATED, RECEIVED, MAINTAINED, OR TRANSMITTED BY THE EBF IN CONNECTION WITH THE ADMINISTRATION OF ITS HEALTH BENEFIT PROGRAMS. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

OUR COMMITMENT TO YOUR PRIVACY

At the Employee Benefit Fund (EBF), we are dedicated to maintaining the privacy of your medical information. As used in this Notice, "medical information" refers to what federal law calls "protected health information" (PHI). In our daily operations, we will create records regarding our members and the services we provide. Such records will include information about treatment and services you have received as well as the payment for those services. We may also receive non-public information such as name, date of birth, address, and phone number. We do not disclose any medical information about our current or former members except as permitted by law or to provide services to our members.

The EBF restricts access to information to those EBF employees who need to know such information to provide services. The EBF also maintains physical, technical, and administrative safeguards that comply with federal and state laws and regulations, including the HIPAA Privacy Rule, to safeguard your information. When using or disclosing your medical information, or when requesting medical information from another covered entity, the EBF will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request to the extent the minimum necessary standard applies.

We are required by law to maintain the confidentiality of medical information that identifies you. We are also required by law to provide you with this notice of our legal duties and our privacy practices concerning your medical information, and to notify affected members following a breach of unsecured protected health information. By law, we must follow the terms of the notice of privacy practices that we have in effect at the time.

The EBF reserves the right to change this Notice of Privacy Practices as well as our privacy policies and procedures as required by business needs or changes in federal or state law. We reserve the right to make the terms of any revised Notice effective for all of your medical information that we maintain, including medical information we created or received before the effective date of the revised Notice. If there are significant changes to the privacy practices described in this Notice, a new Notice of Privacy Practices will be provided to our members by mail and by prominent posting on the EBF website, www.cseaebf.com.

If you have questions about any part of this Notice or, if you want more information about privacy practices at the EBF, please contact the CSEA EBF Privacy Officer at (800) 323-2732.

THE EFFECTIVE DATE OF THIS NOTICE IS AUGUST 24, 2026.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION

The following categories describe ways in which we may use and disclose your medical information without your consent or authorization:

Treatment: We may disclose your medical information to a health care provider for your treatment.

Payment:We may use and disclose your medical information to pay claims for covered services or to determine whether EBF is responsible for payment of services rendered to you. For example, before paying a provider’s bill, EBF may use your medical information to determine whether the terms of your benefit plan cover the care you received.

Health Care Operations: The EBF may use and disclose your medical information to operate our business. For example, your medical information may be used to evaluate the quality of care you received from a provider or to conduct cost management and business planning activities for the EBF. In some cases, we share your medical information with our outside consultants, known as our business associates, to help us perform our healthcare operations. We always require those business associates, through written agreements known as business associate agreements, to safeguard your medical information in accordance with applicable law and our policies.

Disclosures Required By Law: The EBF will use and disclose your medical information when we are required to do so by federal, state, or local law.

Disclosures to Individuals Involved with Your Care: Unless you notify EBF otherwise, EBF may disclose your medical information to your relative, friend or other person you identify, if the information relates to that person’s involvement with your care or payment for your care.

Public Health Risks: The EBF may disclose your medical information to public health authorities that are authorized by law to collect information for a specific purpose. Some examples would be to prevent or control disease, injury, or disability, to notify a person regarding potential exposure to a communicable disease or potential risk in spreading or contracting a disease or notifying individuals if a product or device has been recalled.

Health Oversight: The EBF may disclose your medical information to a health oversight agency for activities authorized by law. Oversight activities can include investigations, inspections, audits, surveys, licensure, and disciplinary actions. They may also include civil, administrative, and criminal procedures or actions as well as other activities necessary for the government to monitor programs, compliance with civil rights laws and the health care system in general.

Legal Proceedings: We may disclose your medical information in response to a court order or subpoena.

Law Enforcement: The EBF may disclose your medical information for law enforcement proceedings such as identifying or locating a suspect, fugitive, or material witness and for similar circumstances.

Serious Threats to Health and Safety: The EBF may use and disclose medical information to applicable persons or organizations that can help in reducing or preventing a serious threat to your health and safety or that of another individual or the public.

Military: If you are a member of the U.S. Armed Forces or a foreign military force, EBF may use or disclose your medical information if the appropriate military authority requires us to do so.

National Security: The EBF may disclose your medical information to federal officials for intelligence and national security activities authorized by law.

Inmates: We may disclose your medical information to correctional institutions or law enforcement officials if you are or become an inmate in their custody. This may be necessary for the institution to provide health care services to you, for the safety and security of the institution, and/or to protect your health and safety or that of another individual.

Abuse, Neglect, or Domestic Violence: The EBF may disclose your medical information to a government authority, including a social service or protective service agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence, to the extent that such disclosure is required or authorized by law.

Coroners, Medical Examiners, and Funeral Directors: The EBF may disclose your medical information to a coroner, medical examiner, or funeral director as necessary for them to perform their duties.

Organ and Tissue Donation: If you are an organ donor, the EBF may disclose your medical information to organizations that handle organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ, eye, or tissue donation and transplantation.

Research: The EBF may use or disclose your medical information for research purposes, subject to the conditions and protections provided by applicable law, including approval by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your medical information.

Disaster Relief: The EBF may disclose your medical information to an authorized public or private entity to assist in disaster relief efforts so that your family or others responsible for your care can be notified of your location, general condition, or death.

Personal Representatives: The EBF may disclose your medical information to a person who is your personal representative, such as a legal guardian, an agent under a health care power of attorney, or the executor or administrator of your estate, to the extent such disclosure is consistent with applicable law.

Decedents: The EBF may disclose the medical information of a deceased individual to a family member or other person who was involved in the individual's care or payment for care prior to the individual's death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the EBF.

Worker’s Compensation: The EBF may release your medical information to comply with workers’ compensation laws and similar programs providing benefits for work-related injuries or illnesses.

USES AND DISCLOSURES OF MEDICAL INFORMATION WITH AN AUTHORIZATION

Unless otherwise authorized by law, the EBF may use or disclose your medical information under circumstances that are not described above only if you provide permission by a signed authorization. You may revoke your authorization, in writing, at any time, by sending notice of the revocation to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110. If you revoke an authorization, the EBF will no longer use or disclose your medical information under the circumstances permitted by the authorization. However, your revocation will not be effective for information the EBF has already used or disclosed, relying on that authorization.

Genetic Information: The EBF is prohibited by law from using or disclosing genetic information about you for underwriting purposes.

Marketing and Fundraising: The EBF will not use or disclose your medical information for marketing or fundraising activities. Of course, the EBF will never sell your medical information.

YOUR MEDICAL INFORMATION RIGHTS

You have the following rights associated with your medical information:

Confidential Communication Right: You have the right to request that the EBF communicate with you about your medical information in a particular manner (for example, by email) or at a certain location (for example, at a post office box). To request that type of confidential communication, you must write to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110, specifying the requested method of contact, or location where you wish to be contacted. The EBF will accommodate reasonable requests.

Restriction Right: You have the right to ask for restrictions on the EBF's uses and disclosures of your medical information. You must make your request in writing to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110. The EBF is not required to agree to your restriction requests. However, if you pay for a service or health care item out of pocket in full, you have the right to ask that your medical information with respect to that service or item not be disclosed to a health plan for purposes of payment or health care operations, and the EBF is required to agree to that restriction.

Amendment Right: You have the right to ask us to correct your medical information or add missing information if you think there is a mistake. You must send us a request in writing to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110. We will respond to you in writing. If your request is approved, we will make the change to your medical information and advise you that the change has been made. We will also notify others who need to know of the change. We may deny your request if your medical information is: a) correct and complete; b) not made by us; c) not allowed to be disclosed; or d) not part of our records.

Accounting of Disclosures Right: You have the right to request a list of certain disclosures of your medical information that have been made by the EBF. All requests must be made in writing to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110 and state a period which is not to exceed six years. The first list you request within a 12-month period is free of charge, but you may be charged for additional lists within a 12-month period. We will notify you of the costs involved with additional requests and you may withdraw your request before you incur any costs.

Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with the EBF or with the Secretary of Health and Human Services. To file a complaint with us, write to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110. To file a complaint with HHS, write to U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, or visit www.hhs.gov/ocr/privacy/hipaa/complaints/. You will not be penalized or retaliated against for filing a complaint.

Right to Inspect and Copy. You have the right, in most cases, to inspect and copy your medical information maintained by or for the EBF. If your medical information is maintained in an electronic format, you also have the right to request that an electronic copy of your record be provided to you or transmitted to a third party in a readily producible electronic form and format. You must make your request in writing to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110. A reasonable, cost-based fee may be charged for providing copies.

Right to a Paper Copy of This Notice. You have the right to request a paper copy of this Notice, even if you have received this Notice electronically. You may make your request in writing to: HIPAA Privacy Officer, CSEA EBF, One Lear Jet Lane, Suite One, Latham, NY 12110.

Right to Notification of a Breach: You have the right to be notified following a breach of your unsecured protected health information.

NEW YORK LAW

In certain instances, New York law provides more stringent or extensive privacy protections than those applicable under the HIPAA Privacy Rule. In such instances, the EBF will adhere to applicable New York law as it relates to your medical information. For example, the EBF will not disclose or cause to be disclosed any HIV-related information except as authorized by you or your qualified representative. In addition, the EBF will comply with applicable New York law protections governing the confidentiality of substance use disorder treatment records, mental health records, and genetic testing information, which may impose additional restrictions on the use and disclosure of such information beyond those required by HIPAA.