Health Net 2009 Annual Report Download - page 549

Section 13.3. Privacy Requirements.
(a) In providing the Administrative Services, and in connection with maintaining, administering, handling and transferring
the data of Contract Holders, Customers and other recipients of loss payments under the Administered Contracts, the Administrator
shall, and shall cause its Affiliates and any permitted Subcontractors to, comply in all material respects with all applicable
confidentiality and security obligations in connection with the collection, use, disclosure, maintenance and transmission of personal,
private, health or financial information about individual insureds, enrolled beneficiaries or loss payment recipients (collectively
“Nonpublic Personal Information”), that arise under (i) those Laws applicable to the Company that are currently in place or which
may become effective during the term of this Administrative Services Agreement, including the Gramm-Leach-Bliley Act and the
Standards for Privacy of Individually Identifiable Health Information and all other privacy or security regulations promulgated by the
U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996
(“HIPAA”), and (ii) the privacy policies of the Company attached as Exhibit 13.3(a) (the “Privacy Policies”), as such policies may be
amended with the Administrator’s prior written consent from time to time. The Administrator shall permit the Secretary of the U.S.
Department of Health and Human Services and such other Governmental Entities to audit the Administrator’s compliance herewith.
(b) The Administrator shall enable individual subjects of personally identifiable information, upon request from such
individuals, to review and correct information maintained by the Administrator about them.
(c) The Administrator shall promptly report to the Company any violation of this Section 13.3 of which the Administrator
becomes aware. The Administrator shall not during the term of this Administrative Services Agreement modify the Privacy Policies
under which information utilized by the Administrator in administering the Administered Contracts is gathered without the
Company’s prior written consent.
(d) The Administrator will for so long as it retains Nonpublic Personal Information, maintain adequate administrative,
technical and physical safeguards in accordance with standards maintained by the Company immediately prior to the Effective Date
(taking into account the winding up and running out of the Business as contemplated under the Business Transition
Agreement): (1) to insure the integrity, security and confidentiality of Nonpublic Personal Information and Customer records and
information, (2) to protect against any anticipated threats or hazards to the integrity, security or confidentiality of such records, and
(3) to protect against unauthorized access to or use of such records or information.
(e) As the Administrator is a Business Associate of the Company (as defined by HIPAA and its implementing privacy
regulations at 45 C.F.R. Parts 160 and 164, subparts A and E, and security regulations at 45 C.F.R. 160, 162 and 164, subpart C),
simultaneously with the execution of this Administrative Services Agreement, the Administrator shall execute the business associate
agreement attached as Exhibit 13.3(e).
34