HIPAA

1. HIPAA ???????? What is it?

2. Health Insurance Portability & Accountability Act • Federal Law August 21, 1996 • Preserve Quality Health Care (Portability) • Protect Privacy Rights (April 2003) • Standardize the Electronic Exchange of Health Data (October 2003) • Maintain Security of Health Data (April 2005)

3. Why are Our Companies Affected? • We Sell Covered Health Plans • We Transmit, Receive or Maintain Health Information in Some Form or Medium • We Receive Information From Health Care Providers Electronically or in Some Other Form or Medium

4. Your Obligation In the Course of Normal Business Activity You May be Privy To Certain Policyholder Information: • Policyholder Full Name • Policyholder Full Address • Policyholder Date of Birth • Policyholder SSN

5. You May Also Be Privy to Certain Protected Health Information As It Relates To That Policyholder Information • Policyholder Dates of Service (Health Care) • Policyholder Claim Data • Policyholder Underwriting Details • Policyholder Health Questions • Policyholder Premium Billing or Payment Data

6. This Protected Health Information Is Considered To Be Individually Identifiable Health Information

7. Protection of Privacy Rights Under HIPAA Applies to: Protected Health Information (PHI) Under Federal Law, HIPAA, You may not disclose this information to Anyone, other than what is required in the normal course of submitting business We are permitted to use or disclose PHI for payment of Health Claims.

8. What are our Companies Doing to Comply With the Privacy Law? • Mailing HIPAA Notices to Policyholders Concerning Privacy Rights • Studying the Law In-Depth & Altering Processes Where Necessary • Conducting These Training Sessions on Privacy

9. What If You Have a Question Concerning Compliance? • Ask Your Branch Manager for Clarification

10. Privacy for our Policyholders

11. Examples of Information you receive each day that should be kept private: • Financial Information-Debts, Amount of Insurance coverage, Assets. • Health Information • Family Situations • Individual identifications- Social Security Numbers, etc. • Personal Information that should be kept confidential.

12. Our Violation of Privacy Rules Can Result In: • Loss of Policyholder Trust • Loss of Company’s Credibility • Loss of Company Revenue

13. Violations Can Result In: • Civil / Criminal Penalties Individuals – Companies • Company Sanctions for Wrongdoers • Warning – Termination of Appointment

14. Do Not CallLegislation

15. Do Not Call Overview • The National “Do Not Call” (DNC) legislation became effective October 1, 2003. The new legislation impacts insurance companies, insurance agencies, brokerage firms, and trade associations. • The recent federal legislation, which implemented the DNC registry, addressed two broad categories of activity: • telemarketing • fax solicitations • As most Branch activity falls under the category of telemarketing, this will be the focus of the presentation. However, please be advised that fax solicitations are also subject to federal regulation, and, as a general rule, you should refrain from sending unsolicited faxes.

16. Do Not Call Overview • The DNC Registry is a list of phone numbers of consumers who have indicated their preference not to receive in-coming telemarketing calls. In basic terms, and with some exceptions, if an individual’s telephone number appears on the National DNC Registry, then law prohibits telephone solicitation calls to the registered telephone number. • DNC legislation encompasses three tiers: • National • State • Company

17. Do Not Call National • The National Registry is jointly sponsored by the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) and has jurisdiction over intrastate and interstate sales calls placed to U.S. consumers.

18. Do Not Call National Exceptions • Current CustomersThe federal DNC rules exempt calls to those with whom you have an “established business relationship” (EBR). An EBR exists for the duration of your continued business and for 18 months after the last payment or financial transaction with the Company. This affects:Lapses - A lapsed LNL policyholder whose last premium payment occurred within the past 18 months is considered to have an EBR with LNL.Active Policyholder - An active policyholder has an established business relationship with LNL. Note: If a consumer asks a Company not to call, the Company may not call, even if there is an EBR. The consumer’s request not to be called terminates the EBR exemption.

19. Do Not Call National Exceptions • Applications or InquiriesAn individual who has completed an application or made an inquiry or request for information within the past three months is considered to have an EBR with LNL. People seeking directions to your office, asking about office hours, or posing similar questions still fall under DNC regulation.

20. Do Not Call National Exceptions • Personal ContactsThe FCC exempts calls to people with whom you have a personal relationship. This exemption covers family members, friends, and acquaintances.

21. Do Not Call National Exceptions • Businesses • DNC provisions apply only to calls to “residential telephone subscribers,” and the federal rules do not apply to “telephone calls between a telemarketer and any business.” Thus, when calling businesses, you do not need to use the national DNC list or refer to the company-specific DNC list. • However, the question is less clear concerning home-based businesses. Since home-based businesses may not have business telephone numbers, it is likely in many instances those phone numbers will be considered residential numbers. The most prudent course for any numbers not obtained from a business directory is to treat them as residential numbers.

22. Do Not Call Special Circumstances • 1. Referrals • Calls to referrals are not covered by any exception. The FCC was very clear that the personal relationship exemption applies only to people you know and not to people who are referred to you. • If the phone number of a person referred to you is on the national DNC list, you cannot initiate a call to the person, but you can return the person’s call if he or she calls you.

23. Do Not Call Penalties for DNC Violations • Federal ………………………………Up to $11,000 per call • State………………………….………….Up to $10,000 per call • Private Suits………………….…………Up to $500 per call • *Fine can be tripled for knowing and willful violations. *

24. Do Not Call State • Several states have established, or are in the process of establishing, State DNC registries. • The implementation of the National DNC registry does not alleviate the need to remain compliant with State DNC laws that may exist in your State. • Visit www.the-dma.org/government/donotcalllists.shtml or contact your State Attorney General’s Office for additional information regarding DNC legislation in your State. • You are obligated to keep abreast of the DNC or other telemarketing regulations that may exist in the States in which you operate.

25. Do Not Call Company • The National DNC provisions require all companies to maintain an internal, or company-specific, DNC list. • If any consumer specifically requests not to be contacted by the Company, then the Company is required to place the consumer’s telephone number on the Company’s internal DNC list. • The Company may not contact the consumer again.

26. Do Not Call Company • Liberty National maintains an internal DNC registry. • If an Agent or appointment setter makes contact and someone requests not to be called again, that information must be immediately recorded and sent to the Home Office (via e-mail or letter) to the attention of Customer Service. • In order for the individual’s telephone number to be added to our internal DNC list, you will need to provide the full name of the requesting party, phone number, policy number (if applicable), and address if available.

27. Do Not Call Compliance • Your compliance with all DNC regulation is crucial. The following are key items to enact in your Branch Offices: • You may make calls from the office, home, cell phone, etc. as long as the phone does not block caller identification information. • At the beginning of the call, you must give your name, the Company name, and the purpose of the call. • You can only make telephone solicitation calls from 8 am to 8 pm of the time zone you are calling. Do not make telephone solicitation calls on holidays.

28. Do Not Call Compliance • Your Responsibility When Buying Leads/Lists: • If you purchase a list of names and telephone numbers from an outside vendor, you must verify that the list you are purchasing has been “scrubbed” against the National and applicable State DNC registries.

29. Do Not Call Compliance • Your Responsibility When Buying Leads/Lists: • It is also your responsibility to submit your purchased list to the Home Office to be scrubbed against the Company’s DNC databases. • When you order from a lead vendor, request that the leads be sent in Excel format. • Save the leads to your desktop. • Log on to TMKONLINE, using your RMS email and password. • Follow the instructions for uploading the leads. • The scrubbed list will be emailed back to you. • Replace the uploaded leads with the scrubbed list. • NOTE: In order to ensure compliance with DNC law, Liberty National will purchase the National DNC registry. As a safeguard, LNL will scrub your purchased list against our National and Company registries and will automatically remove any phone numbers which match either registry.

30. Do Not Call Compliance • Your Responsibility When Buying Leads/Lists: • You may use Agent Services on libnat.com to enter individual telephone numbers for those occasions when they have one or two numbers to verify. • Liberty National will maintain a log that tracks: • Who requested the scrubbed list • Which telephone numbers were checked • Whether a match was found on the National and Company Registries • Please note that Agents are responsible for checking appropriate State DNC registries for compliance.

31. Do Not Call Compliance • Your Responsibility When Buying Leads/Lists: • Any list you purchase can only be used for 31 days from the date it was scrubbed and then you must have it scrubbed again. If you send your list to the Home Office for scrubbing, an expiration date will be included on a cover letter that is sent back with the cleaned list. The expiration date will tell you how long you may use the list before it must be scrubbed again. • Any invoices submitted for reimbursement from your lead account must indicate that the list purchased was scrubbed or you will not be reimbursed for the cost.