Health Privacy Practices Notice for the Oxford Life^® Family of Companies^*

Our Policy Regarding Privacy of Your Health Information Effective as of April 14, 2003

We care about your privacy. We believe you have a right to know what we do with the information we gather about you in connection with the products you seek or have with the Oxford Life^® Family of Companies. We also want to assure you that we are safeguarding this important information. Our privacy policy is based on the laws governing privacy, and on our own high standards of protecting privacy. Further, we are required by law to maintain the privacy of your protected health information and to provide you with notice of our legal duties and privacy practices with respect to your protected health information.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice describes how we may use and disclose your protected health information to carry out treatment, payment or health care operations, and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. “Protected health information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. If the practices described in this Notice are acceptable to you, there is nothing you need to do. If you would like to request that we not share information, we may honor your written request in certain circumstances described below. If you have any questions about this notice, please contact our Privacy Officer at:

Oxford Life Insurance Company^®
Privacy Officer
7th Floor
2721 North Central Avenue
Phoenix, Arizona 85004

We are required to abide by the terms of this Notice. We may change the terms of our Notice at any time. The new notice will be effective for all protected health information that we maintain at that time. We will provide you with any revised Health Privacy Practices Notice. You may also obtain a copy of our Health Privacy Practices Notice by accessing our website http://www.cflic.com, calling us at 888-757-3732 and requesting that a revised copy be sent to you in the mail or via e-mail, or by writing to our Privacy Officer at the address indicated at the beginning of this Notice. You have the right to obtain a paper copy of this Notice from us, upon request, even if you have agreed to accept this Notice electronically.

1. Uses and Disclosures of Protected Health Information for Treatment, Payment and Health Care Operations. Your protected health information may be used and disclosed by us and others outside of our company that are involved in your care and treatment for the purpose of providing health care services to you.

The following are examples of the types of uses and disclosures of your protected health care information that we are permitted to make. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our company.

Treatment: Your protected health information will be used, as needed, to pay for your health care services. This may include activities that we may undertake before we approve or pay for the health care services your health care providers recommend for you, such as making a determination of eligibility or coverage for insurance benefits, pre-certification of certain services, reviewing services provided to you for medical necessity, and undertaking utilization review activities.

Payment: We may share your protected health information with providers for payment purposes. We may share your protected health information with third party “business associates” that perform various activities (e.g. collecting and transmitting health care claims billing information, re-pricing of health care claims, independent medical reviews/evaluations) for our company. Whenever an arrangement between our company and a business associate involves the use or disclosure of your protected health information, we will have a written contract that contains terms that will protect the privacy of your protected health information.

Healthcare Operations. We may use or disclose, as needed, your protected health information in order to support the business activities of our company. These activities include, but are not limited to, quality assessment activities; underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits; ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance); conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating our company, including development or improvement of methods of payment or coverage policies; business management and general administrative activities; and nominal or face-to-face marketing activities.

We may disclose your protected health information to claims examiners who are being trained to handle claims similar to yours. We may also use medical information to evaluate the performance of our staff in handling your medical claims. We may use or disclose your protected health information, as necessary, to contact you to discuss your eligibility for health care insurance, enrollment, and payment of health care services provided to you.

We may use your health care claim information for actuarial analysis. We may use health care claim information to estimate the amount of funds we will need to pay future health care claims. We may also provide the health care information when requested by governmental regulatory agencies.

Your name and address may be used to send you information regarding your policy, including changes to your policy, as mandated by various federal and state laws.

2. Other Permitted and Required Uses and Disclosures That May Be Made Without Your Consent, Authorization or Opportunity to Object. We may use or disclose your protected health information in the following situations without your consent or authorization. These situations include:

Required By Law. We may use or disclose your protected health information to the extent that the use or disclosure is required by law. The use or disclosure will be compliant with the law and will be limited to the relevant requirements of the law. If the applicable law requires, we will notify you of any such uses or disclosures.

Public Health: We may disclose your protected health information to a public health authority for public health activities and purposes if law permits the public health authority to collect or receive the information. We may also disclose your protected health information, when directed by a public health authority, to a foreign government agency that is collaborating with the public health authority.

Health Oversight. We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections.

Abuse or Neglect. We may disclose your protected health information to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information, consistent with applicable federal and state laws, if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information.

Legal Proceedings. We may disclose protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and in response to a subpoena, discovery request, or other lawful process.

Military Activity and National Security. When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military services. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President.

3. Other Permitted and Required Uses and Disclosures That May Be Made With Your Consent, Authorization or Opportunity to Object. We may use and disclose your protected health information in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your protected health information. If you are not present or able to agree or object to the use or disclosure of the protected health information, then we may, using professional judgment, determine whether the disclosure is in your best interest. In this case, only the protected health information that is relevant to your health care will be disclosed.

Others Involved in Your Healthcare. Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your protected health information that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. Unless you object or instruct otherwise, all Explanations of Benefits (EOBs) will be addressed to the primary insured.

Communication Barriers. We may use and disclose your protected health information if, using professional judgment, we determine that you intended to consent to use or disclosure under the circumstances.

4. Uses and Disclosures of Protected Health Information Based upon Your Written Authorization. We may engage in other uses and disclosures of your protected health information upon receiving your original written authorization, unless otherwise permitted or required by law. You may revoke an authorization, in writing, at any time, except to the extent that an action has been taken in reliance on the use or disclosure indicated in the authorization.

5. Your Rights. Following is a description of your rights with respect to your protected health information and a brief description of how you may exercise your rights.

Inspect and Copy Your Protected Health Information. You may inspect and obtain a copy of protected health information about you that is in a designated record set for as long as we maintain the protected health information. A “designated record set” contains medical and billing records and any other records that we use for making decisions about your health care coverage. However, under federal law, you may not inspect or copy psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and protected health information that is subject to law that prohibits access to the protected health information. Your request must be in writing and sent to our Privacy Officer at the address indicated at the beginning of this Notice. We may request sufficient identification prior to releasing any information to you. A decision to deny access may be reviewable, and you may have a right to request that our decision to deny access be reviewed. Please contact our Privacy Officer if you have questions about access to your medical record. California, Connecticut, Georgia, Illinois, Maine, Massachusetts, Minnesota, Montana, Nevada, New Jersey, North Carolina, Ohio, Oregon, Virginia & Wisconsin residents may inspect and copy their applicable records in person after sending a written request and providing sufficient identification. Residents in other states may make a written request to inspect and copy their applicable records in person.

Request a Restriction of Your Protected Health Information. You may ask us to not use or disclose any part of your protected health information for the purposes of treatment, payment or healthcare operations. You may also request that any part of your protected health information not be disclosed to family members or friends who may or may not be involved in your care. Your request must be in writing, your request must state the specific restriction requested, your request must state to whom the restriction applies, and your request must be sent to our Privacy Officer at the address indicated at the beginning of this Notice.

We Do Not Have to Agree to a Restriction. We are not required to agree to a restriction that you may request. In the event that we do agree to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment.

Alternative Means of Receiving Confidential Communications. If you believe that disclosure of all or part of your protected health information could endanger you, then you have the right to request that we send and/or receive confidential communications by an alternative means or through an alternative location. We will accommodate your reasonable requests. We may require that you provide us with a specific alternative address and/or method of contact, and any other specific information we need to accommodate your reasonable request. We will not request an explanation from you for the request, however, your request must state that the disclosure of all or part of your protected health information could endanger you. Please make your request in writing to our Privacy Officer at the address indicated at the beginning of this Notice. Washington state residents are not required to state that disclosure of all or part of their protected health information regarding reproductive health, sexually transmitted diseases, chemical dependency and mental health may endanger them as part of the restriction request. Washington state residents only are not require to state that disclosure of all or part of their protected health information could endanger them.

Amend Your Protected Health Information. You may request an amendment to your protected health information in a designated record set for as long as we maintain this information. Your request must be in writing, provide a reason to support the requested amendment, and send the request to our Privacy Officer at the address indicated at the beginning of this Notice. In certain cases, we may deny your request for an amendment. If we deny your request for an amendment, you have the right to submit a statement of disagreement to us and we may prepare a rebuttal to your statement. We will provide you with a copy of any rebuttals prepared in response to your statement of disagreement. Please contact our Privacy Officer at the address indicated at the beginning of this Notice if you have questions about amending your medical record.

Receive an Accounting of Certain Disclosures. You have a right to request and receive an accounting of certain disclosures of your protected health information that we have made. You have the right to receive specific information regarding disclosures or your protected health information. The right to receive an accounting does not include any disclosures we have made for purposes of treatment, payment or healthcare operations as described in this Notice. Nor does the right to receive an accounting include any disclosures that we may have made to you, to family members or friends involved in your care, or for notification purposes. The right to receive this information is subject to certain exceptions, restrictions and limitations, such as, but not limited to, not receiving information in excess of a 6-year period (you may request a shorter timeframe). Your request must be in writing, state that you are requesting an accounting of disclosures subject to an accounting, state the time period for which you are requesting an accounting, and must be sent to our Privacy Officer at the address indicated at the beginning of this Notice. California, Connecticut, Georgia, Illinois, Maine, Massachusetts, Minnesota, Montana, Nevada, New Jersey, North Carolina, Ohio, Oregon, Virginia & Wisconsin residents only: You are entitled to an accounting of all disclosures of your recorded personal medical information within 2 years prior to the request.

Complaints. You have a right to complain to us or to the Secretary of Health and Human Services if you believe your privacy rights have been violated by us. You may file a complaint with us by notifying our Privacy Officer at the address indicated at the beginning of this Notice. We will not retaliate against you for filing a complaint.

^* The Oxford Life^® Family of Companies includes: Oxford Life Insurance Company^®; Dallas General Life Insurance Company^™; North American Insurance Company^®; Christian Fidelity Life Insurance Company^®; and Oxford Life^® as the third party administrator for Medicare supplement insurance policies issued by Celtic Insurance Company or USAble.