When a member enrolls with OSF HealthPlans, he/she also gives consent to release information upon signing the enrollment form. Following are the things a member is giving consent to:

Signing the OSFHP Enrollment Form Releases:

• Doctor to share medical information for you or your dependents with OSF HealthPlans
• Immunization information to government agencies
• Medical information in connection with quality assurance activities or for coordination of benefits

• Doctor to share medical information for you or your dependents with OSF HealthPlans
• A member's rights to go after third parties for damages
• Your agreement to give to OSF HealthPlans any consents, releases, assignments and other documents for you and your dependents requested by the Plan

• Allows Doctor to give medical information and information about mental health and substance abuse and any other records available to OSF HealthPlans and other Healthcare Professionals.
• OSFHP to give any information to HCFA so they can administer Title XVIII of the Social Security Act.

• OSFHP's behavioral health vendor asks members to sign a release that lets them give the member's information to their doctor.
• OSFHP does not give member information to other companies to use for marketing.
• A special consent will be obtained for workers' compensation or auto insurance claims.

OSFHP will follow the rules of the State of Illinois to get consent for our members who can not give it themselves. OSFHP will make sure that member information and records are kept safe when members are not able to themselves. Following is the order by which Illinois State Law says that OSFHP must get consent: (1) Power of Attorney, (2) Spouse, (3) Oldest Child, (4) Second Oldest Child, etc, (5) Next of kin, as applicable following children.

• OSFHP does not keep original medical records on site. Members have access to the original per state law.
• Members have the right to their own records and can ask for and receive them from their PCP or OSFHP (not to exceed 30 days for OSFHP; 60 days for network providers)
• All of OSFHP's network providers must keep members' medical records in a confidential manner. Files must be separated from the patient waiting area. Doctors can not give members' information out without a release of information form. There must be a single chart for each patient.

• OSFHP's FACETS database, patient care system and prescription data are protected by passwords. Each job has its own security profile and each employee's manager determines access.
• Management looks at monthly reports that show what staff members have looked up on the computer to make sure that they are legitimate inquiries.
• OSFHP includes language in vendor contracts that protect confidentiality of member information.
• OSFHP will not give an employer group a member's personal information. Claims reports do not include members' names, identification number, gender, age, date of birth or type of member (employee, spouse or dependent).
• OSFHP will deem Internal Review Board responsibilities to our network facilities or university faculty review board. OSFHP always maintains the right to veto any research project. If OSFHP participates in a research project, an appropriate release will be signed prior to beginning project.
• Doctors' offices must obey the following rules: medical records are to be protected from public access, the office has to have a system to maintain confidentiality, must have a single chart for each member, and release of information forms are required when patient information is released.

• All OSFHP medical record reviewers have signed a confidentiality statement that is on file.
• All medical record reviews occur in a private area in the office.
• Software used to get HEDIS measurements is put in a computer directory that can only be opened by the quality management staff.
• Quality management reports do not list the member's name.

• New employees of OSF HealthPlans sign confidentiality agreements at the time of hire.
• All OSF HealthPlans employees sign an annual confidentiality agreement along with their annual performance evaluation.
• Employees are asked to make sure that no member identifiable information is left on their computer or desk when they are away from their desk.
• An OSFHP employee escorts all visitors through the building.
• All explanation of benefits will be sent to the member's home unless they have signed a form that says it can be sent to their employer.
• OSFHP will only give out member information regarding themselves or their dependents. All other requests must have a valid release of information.
• OSFHP attempts to keep the most current fax numbers on record.

• OSFHP checks providers' fax numbers every 2 years during recredentialing.
• High volume PCP office fax numbers are checked annually as a part of the HEDIS data collection.

• All faxes state: "Please Note: The information contained herein is Privileged and Confidential and intended for use of the addressee listed above Only. If you are not the intended recipient of the employee or agent responsible for delivering this information to the intended recipient, please be aware that any reading, disclose, copying distribution or use of the contents of this information is Strictly Prohibited. Further disclosure by the receiving party is Prohibited".

The full text of this policy may be obtained by contacting the OSF HealthPlans' Customer Services Department at the following numbers: