Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

WHEN THIS NOTICE APPLIES
THE HEALTH PLAN'S OBLIGATIONS
HOW THE HEALTH PLAN MAY USE AND DISCLOSE ENROLLEE HEALTH INFORMATION
SPECIAL CIRCUMSTANCES
YOUR RIGHTS
HOW TO EXERCISE YOUR RIGHTS
CHANGES TO THIS NOTICE
COMPLAINTS AND QUESTIONS

WHEN THIS NOTICE APPLIES
This notice summarizes the privacy practices of the CareFirst BlueCross BlueShield Medical Plan, Delta Dental Plan, and Express Scripts Pharmacy Plan (each a "Health Plan" [and collectively the "Health Plans"]). With respect to the Health Plan, this notice informs you how the plan may use and disclose health information about you for purposes described in this notice, including disclosures to the plan sponsor that may be necessary for Health Plan administration purposes.

THE HEALTH PLAN'S OBLIGATIONS
We have a long-standing commitment to protecting our Health Plan enrollees' privacy rights. In keeping with this commitment, and as we are required by law, we will:

• Maintain the confidentiality of health information;
• Give you this notice of the Health Plan's duties and privacy practices regarding your health information; and
• Follow the terms of the Health Plan's notice of privacy practices that is currently in effect.

HOW THE HEALTH PLAN MAY USE AND DISCLOSE ENROLLEE HEALTH INFORMATION
The following categories of activities describe the ways that the Health Plan may use and disclose health information that identifies you ("Enrollee Health Information"). Some of the categories include examples, but not every type of use or disclosure included in a category is listed. Except for the purposes described in this notice, the Health Plan will use and disclose Enrollee Health Information only with written permission from you. If you give the Health Plan permission to use or disclose Enrollee Health Information for a purpose not listed in this notice, you may revoke that permission at any time by sending a written request to the Health Plan's Chief Privacy Officer at the address listed at the end of this notice. The Health Plan has amended the Health Plan documents to protect your Enrollee Health Information as required by federal law.

1. For Treatment. The Health Plan may use or disclose Enrollee Health Information to aid in your treatment or to provide or coordinate your health care services. The Health Plan may disclose Enrollee Health Information to doctors, nurses, technicians, or other personnel. For example, the Health Plan may tell your primary physician about care provided to you by a specialist to provide you with additional services as appropriate for treatment purposes.
   
   
2. For Payment. The Health Plan may use and disclose Enrollee Health Information so that the Health Plan may make coverage and payment determinations. Such determinations include, but are not limited to, billing, claims management, subrogation, reimbursements, medical necessity determinations and utilization review determinations. For example, the Health Plan may tell a doctor whether you are eligible for coverage or what percentage of the bill will be paid by the Health Plan
   
   
3. For Health Care Operations. The Health Plan may use and disclose Enrollee Health Information for health care operations, which are administrative activities involved in providing and managing your health benefits. These uses and disclosures are necessary to maintain high quality care under the Health Plan and for the proper administration of the Health Plan. For example, the Health Plan may use Enrollee Health Information to review the adequacy and quality of the care that participants receive or to evaluate the efficiency of the Health Plan's activities.
   
   
4. Individuals Involved in Your Care or Payment for Your Care. The Health Plan may disclose Enrollee Health Information to a person, such as a family member or friend, who is involved in your medical care or helps pay for your care to the extent you have agreed to such disclosure or failed to object to such disclosure when given an opportunity. The Health Plan also may notify such individuals about your location or general condition or disclose such information to an entity assisting in a disaster relief effort.
   
   
5. To Health Plan Administrators for Health Plan Administration Functions. The Health Plan may disclose Enrollee Health Information to certain designated entities to which the Health Plan has delegated certain Health Plan administrative functions in connection with these functions. For example, the Health Plan has delegated the administration of the Medical Plan to CareFirst BlueCross BlueShield and it must disclose to CareFirst BlueCross BlueShield the information that it needs in order to perform these administrative functions.
   
   
6. Research. Under certain circumstances, the Health Plan may use and disclose Enrollee Health Information for research purposes. For example, a research project may involve comparing the health and recovery of all enrollees who received one medication or treatment to those who received another, for the same condition. Before the Health Plan uses or discloses Enrollee Health Information for research, the project will go through a special approval process. This process evaluates a proposed research project and its use of Enrollee Health Information to balance the benefits of research with the need for privacy of Enrollee Health Information. Even without special approval, the Health Plan may permit researchers to look at records to help them identify enrollees who may be included in their research project or for other similar purposes, so long as they do not remove or take a copy with them of any Enrollee Health Information.
   
   
7. Disclosure to Howard University as a Plan Sponsor. The Health Plan may disclose Enrollee Health Information to the Health Plan sponsor to the extent necessary to fulfill its administrative functions to the Health Plan.

SPECIAL CIRCUMSTANCES

In addition to the above, the Health Plan may use and disclose Enrollee Health Information in the following special circumstances:

8. As Required by Law. The Health Plan will disclose Enrollee Health Information when required to do so by international, federal, state or local law.
   
   
9. To Avert a Serious Threat to Health or Safety. The Health Plan may use and disclose Enrollee Health Information when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, will be to someone who may be able to help prevent the threat.
   
   
10. Business Associates. The Health Plan may disclose Enrollee Health Information to the Business Associates that the Health Plan engages to provide services on its behalf if the information is necessary for such services. For example, the Health Plan may use another company to perform billing services on its behalf. All of the Health Plan's Business Associates are obligated, under contract with us, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract with them.
    
    
11. Organ and Tissue Donation. If you are an organ donor, the Health Plan may release Enrollee Health Information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary, to facilitate organ or tissue donation and transplantation.
    
    
12. HIV Test Results. If you received an HIV test and did not give us permission to use and disclose the results, we will use and disclose the results of HIV tests that identify you only.
    
    
13. Military and Veterans. If you are a member of the armed forces, the Health Plan may release Enrollee Health Information as required by military command authorities. The Health Plan also may release Enrollee Health Information to the appropriate foreign military authority if you are a member of a foreign military.
    
    
14. Workers' Compensation. The Health Plan may disclose Enrollee Health Information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.
    
    
15. Public Health Risks. The Health Plan may disclose Enrollee Health Information for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products they may be using; track certain products and monitor their use and effectiveness; if authorized by law, notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and conduct medical surveillance of our offices and/or facilities in certain limited circumstances concerning workplace illness or injury. The Health Plan also may release Enrollee Health Information to an appropriate government authority if the Health Plan believes an enrollee has been the victim of abuse, neglect or domestic violence; however, the Health Plan will only release this information if the enrollee agrees or when the Health Plan is required or authorized by law.
    
    
16. Health Oversight Activities. The Health Plan may disclose Enrollee Health Information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure of our facilities and providers. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
    
    
17. Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, the Health Plan may disclose Enrollee Health Information in response to a court or administrative order. The Health Plan also may disclose Enrollee Health Information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
    
    
18. Law Enforcement. The Health Plan may release Enrollee Health Information if asked by a law enforcement official as follows: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime if, under certain limited circumstances, the Health Plan is unable to obtain the person's agreement; (4) about a death the Health Plan believes may be the result of criminal conduct; (5) about criminal conduct on our premises; and (6) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
    
    
19. Coroners, Medical Examiners and Funeral Directors. The Health Plan may release Enrollee Health Information to a coroner or medical examiner. In some circumstances, this may be necessary, for example, to identify a deceased person or determine the cause of death. The Health Plan also may release Enrollee Health Information to funeral directors as necessary for their duties.
    
    
20. National Security and Intelligence Activities. The Health Plan may release Enrollee Health Information to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
    
    
21. Protective Services for the President and Others. The Health Plan may disclose Enrollee Health Information to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
    
    
22. Inmates or Individuals in Custody. In the case of inmates of a correctional institution or that are under the custody of a law enforcement official, the Health Plan may release Enrollee Health Information to the appropriate correctional institution or law enforcement official. This release would be made only if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
    

YOUR RIGHTS
You have the following rights, subject to certain limitations, regarding Enrollee Health Information that the Health Plan maintains about you:

1. Right to Inspect and Copy. You have the right to inspect and copy Enrollee Health Information that may be used to make decisions about your care or payment for your care.
   
   
2. Right to Amend. If you feel that Enrollee Health Information that the Health Plan has is incorrect or incomplete, you may ask the Health Plan to amend the information. You have the right to request an amendment for as long as the information is maintained by or for us. You must tell us the reason for your request.
   
   
3. Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of Enrollee Health Information that the Health Plan has made.
   
   
4. Right to Request Restrictions. You have the right to request a restriction or limitation on the Enrollee Health Information that the Health Plan uses or discloses for treatment, payment, or health care operations. You have the right to request a limit on the Enrollee Health Information that the Health Plan discloses about you to someone who is not involved in your care or the payment for your care, like a family member or friend. For example, you could ask that the Health Plan not share information about your surgery with your spouse. The Health Plan is not required to agree to your request. If the Health Plan agrees to your request, the Health Plan will comply with your request unless the Health Plan needs to use the information in certain emergency treatment situations.
   
   
5. Right to Request Confidential Communications. You have the right to request that the Health Plan communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that the Health Plan contact you only by mail or at work. Your request must specify how or where you wish to be contacted. The Health Plan will accommodate reasonable requests where a disclosure of all or part of the Enrollee Health Information could endanger you.
   
   
6. Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. For a copy please contact:

   Howard University
   Office of Total Compensation
   2244 10th St., N.W., Suite 422
   Washington, D.C. 20059
   Attn: Cynthia Henderson

HOW TO EXERCISE YOUR RIGHTS
To exercise any of your rights as described in this notice for the CareFirst BlueCross BlueShield Plan, please Contact:

CareFirst BlueCross BlueShield
10455 Mills Run Circle
Owing Mills, MD 21117-5559
WWW.CAREFIRST.COM

For the Express Scripts, please contact:

Express Scripts, Inc.
PO Box 6561
St. Louis, MO 66561-6561

For Delta Dental, please contact:
Howard University
Office of Total Compensation
22 44 10th St., N.W., Suite 422
202/806-1280
Attn: Cynthia Henderson

NO OTHER PERSON, INCLUDING A HUMAN RESOURCES EMPLOYEE, IS AUTHORIZED TO ACCEPT A REQUEST TO EXERCISE YOUR RIGHTS.

CHANGES TO THIS NOTICE
The Health Plan reserves the right to change this notice and to make the revised or changed notice effective for Enrollee Health Information that the Health Plan already has as well as any information the Health Plan receives in the future. The Health Plan will post a copy of the current notice on the Howard University Intranet and at various Human Resources bulletins where other employee notices are posted. The notice will contain the effective date on the first page, in the top right-hand corner.

COMPLAINTS AND QUESTIONS
If you believe your privacy rights have been violated, you may file a complaint with the Health Plan or the Secretary of the U.S. Department of Health and Human Services. To file a complaint with the Health Plan, contact our Health Plan's Chief Privacy Officer at the address listed above. All complaints must be made in writing. You will not be penalized for filing a complaint.

If you have any questions about this notice, please contact the Health Plan's Chief Privacy Officer at 806-1280.