Mitsubishi Motors North America, Inc. Manufacturing Division Notice of Privacy Practices This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. MMNA's group health plans and medical facility operations subject to the Health Insurance Portability and Accountability Act (HIPAA), referred to as Covered Entities, are required by federal and state regulations to protect the privacy of your protected health information. "Protected Health Information" (PHI), as defined by HIPAA, is information that may identify you and that relates to your past, present and future physical and mental health conditions and related health care services. MMNA's Covered Entities provide you with this Notice describing the privacy practices, their legal obligations, and your individual rights regarding your PHI. This Notice will take effect April 14, 2003. The Covered Entities are required to abide by the terms of this Notice until a new Notice is provided or the law requires an immediate change. The right to change privacy practices and the terms of this Notice at any time is reserved, pursuant to applicable law. Upon changes in the terms of the privacy practices and this Notice, a new Notice will be made available upon request. The right to make changes in privacy practices and the terms of any Notice applicable to PHI already possessed by the Covered Entities is reserved and any changes would also apply to PHI received after implementation of the new Notice provisions. It is the policy of the Covered Entities, when using or disclosing PHI or when requesting PHI from another covered entity (such as a treating physician), to make reasonable efforts to limit PHI to the minimum reasonably necessary to accomplish the intended purpose of the use, disclosure or request, with the exception that a health care provider may obtain information as requested for treatment. In the course of providing you with health care coverage, benefits and related services, the Covered Entities must collect, receive exchange and maintain PHI. Uses and disclosures of PHI are made with respect to treatment, payment and health care operations. Treatment Treatment has been defined by HIPAA and includes, but is not limited to, the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient from one health care provider to another. Information regarding treatment is necessary for the Covered Entities to fulfill their roles in terms of providing the benefits and services that you have requested or needed. Payment Payment has been defined by HIPAA to include, but not be limited to, those activities to obtain premiums, fulfill responsibilities for coverage and provision of benefits, payment or receipt of reimbursements, determinations of eligibility or coverage, coordination of benefits, adjudication or subrogation of claims, billing, claims management, collection activities, health care data processing; making determinations with respect to medical necessity, coverage, appropriateness of care, justification of charges, utilization reviews and making limited disclosures to consumer reporting agencies. Information regarding payment is necessary for the Covered Entities to fulfill their roles in terms of paying for benefits and services that you have requested or needed. Health Care Operations Health care operations has been defined by HIPAA to include, but not be limited to, conducting quality assessment and improvement activities, underwriting, premium rating or other activities relating to the establishment, renewal or replacement of a contract of health insurance or benefits, placing a contract for reinsurance, conducting or arranging for medical review, legal services and auditing functions (including fraud and abuse detection and compliance programs), business planning and development, business management, general administrative activities, customer service and resolution of internal grievances. PHI may be necessary for the Covered Entities to perform these services. Other Uses and Disclosures HIPAA permits and sometimes requires additional uses and disclosures. As authorized, permitted and within the restrictions set forth in the HIPAA regulations the following represents other potential uses and disclosures. The meanings of the terms are set forth primarily in Section 164.512 of the HIPAA regulations. Uses and disclosures: Required by law; For public health activities (government authority authorized) Involving victims of abuse, neglect or domestic violence (as required by law) For health oversight activities such as government public benefits For Judicial and Administrative proceedings For Law enforcement purposes Regarding deaths of individuals for law enforcement purposes For organ, tissue and eye donation facilitation of donor requests For serious threats to health or safety in accordance with applicable law For specialized government functions associated with military personnel For workers' compensation purposes Other Uses and Disclosures of PHI may be made with your validly executed authorization and only then within any restrictions set forth in the authorization. You may revoke your authorization in writing at any time, except to the extent that a Covered Entity has taken action in reliance upon the authorization or to the extent that the authorization was obtained as a condition of obtaining insurance coverage. Please note that the Covered Entities may from time to time disclose PHI to the plan sponsor. The plan sponsor will not use any PHI for employment related decisions. Uses and disclosures are also made in conjunction with insurance carriers and claims administrators under Business Associate agreements that restrict uses and disclosures. Any Business Associate receiving PHI will be limited in the use and disclosure of PHI, as the Covered Entity is limited. Any individual has a right to receive a paper copy of this Notice, including those individuals who have agreed to receive notices electronically. Uses and disclosures other than those listed above will require your written authorization. For example, MMNA may disclose PHI about you to an authorized person or entity provided you complete and sign an Authorization for Release Form. You may revoke this authorization in writing at any time, however, rescinding your authorization will not affect any prior uses or disclosures that took place while the authorization was in effect. Designating a Personal Representative MMNA may disclose PHI about you to a Personal Representative (for example, your spouse, U.A.W. Benefits Representative, relative, friend, etc.) provided you complete and sign an Authorization for Release Form. The PHI provided to your Personal Representative must be related to that person’s involvement with your treatment, payment for health care or the health care operations associated with your group health care plan. For example, if you would like a U.A.W. Benefits Representative to act on your behalf regarding a concern, you must complete an Authorization for Release Form. You may revoke your Personal Representative’s authorization in writing at any time, however, rescinding your authorization will not affect any prior uses or disclosures that took place while the authorization was in effect. Individual’s Rights You have the right to request restrictions on the uses and disclosures of your PHI related to Treatment, Payment and Health Care Operations purposes and as provided in any written authorization. Although your request will be considered, MMNA is not required to allow your requested restrictions in all cases. You also have the right to request MMNA to restrict disclosures to family members, relatives, close personal friends or any other persons involved in your health care. You have the right to receive confidential communications of PHI by alternative means or at alternative locations. For example, you may want PHI sent to an alternative mailing address other than your home mailing address. MMNA will accommodate reasonable requests. You have the right to inspect and obtain a copy of your PHI that is maintained by MMNA in a designated record set; which includes medical records, billing records, and other records used for enrollment, payment, claims adjudication, and other medical management decisions. MMNA may ask you to submit your request in writing and to the extent permitted by the regulations may charge you the reasonable cost based fees to cover the labor, copying and postage expenses associated with your request. Under certain circumstances, MMNA may deny your request. You have the right to request amendment of your PHI or a specific record that is in a designated record set. You will be required to submit your request for amendment in writing and provide a reason to support your request. If your request to amend your PHI is denied, you have the right to file a written statement of disagreement. You have the right to receive an accounting of disclosures of your PHI that have been made about you since April 14, 2003, except for certain circumstances, including disclosures related to Treatment, Payment and Health Care Operations. MMNA may ask you to submit your request in writing and may charge you the reasonable cost based fees to cover the labor, copying and postage expenses associated with your request. Whenever you believe your privacy rights have been violated, you may make your complaint by contacting MMNA’s designated “Contact Person” or the Secretary of the U.S. Department of Health and Human Services. MMNA is committed to protecting the privacy of your PHI and will not retaliate if you file a complaint. The MMNA Contact Person is: Manager, Compensation and Benefits Administration, Human Resources Department, Mitsubishi Motors North America, Inc. – Manufacturing Division, 100 North Mitsubishi Motorway, Normal, IL 61761, (309) 888-8579. For further information regarding this notice, please contact the Compensation and Benefits Administration Department at the address or telephone number as set forth above.