NOTICE OF PRIVACY PRACTICES

(As Required by HIPAA and HITECH)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

This Notice of Privacy Practices gives you information about the duties and privacy practices of Southland Benefit Solutions, LLC (“Southland”) to protect the privacy of your medical information as required by the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (together, the “HIPAA Privacy Rules”), as well as the Health Information Technology for Economic and Clinical Health Act (“HITECH”). Southland strongly believes in protecting the confidentiality and security of information we collect about you. You are being provided this Notice because of your insurance coverage with Southland.

This notice describes how we protect the personal health information we have about you which relates to your Southland insurance coverage (“Personal Health Information”), and how we may use and disclose this information. Personal Health Information includes individually identifiable information which relates to your past, present, or future health, treatment, or payment for health care services. This notice also describes your rights with respect to the Personal Health Information and how you can exercise those rights.

We are required by HIPAA to:

• maintain the privacy of your Personal Health Information;
• provide you this notice of our legal duties and privacy practices with respect to your Personal Health Information; and
• follow the terms of this notice.

We protect your Personal Health Information from inappropriate use or disclosure. Our employees, and those of companies that help us service your insurance, are required to comply with our requirements that protect the confidentiality of Personal Health Information. They may look at your Personal Health Information only when there is an appropriate reason to do so, such as to administer our products or services.

We will not disclose your Personal Health Information to any other company for their use in marketing their products to you. However, as described below, we will use and disclose Personal Health Information about you for business purposes relating to your insurance coverage.

Uses and Disclosures of Your Health Information Without Your Consent or Authorization

The main reasons for which we may use and may disclose your Personal Health Information are to evaluate and process any requests for coverage and claims for benefits you may make or in connection with other health-related benefits or services that may be of interest to you. The following describe these and other uses and disclosures, together with some examples.

Disclosure: We may disclose and/or share your Personal Health Information with health care professionals who provide treatment and/or services to you. Health information about you may also be disclosed to your family, friends, and/or other persons you choose to involve in your care, only if you agree that we may do so.

Payment: We may use and disclose Personal Health Information to pay for benefits under your insurance coverage. For example, we may review Personal Health Information contained on claims to reimburse providers for services rendered. We may also disclose Personal Health Information to other insurance carriers to coordinate benefits with respect to a particular claim. Additionally, we may disclose Personal Health Information to a health plan or an administrator of an employee welfare benefit plan for various payment-related functions, such as eligibility determination, audit, and review, or to assist you with your inquiries or disputes. Effective August 1, 2013 2

Healthcare Operations: We may also use and disclose Personal Health Information for our insurance operations. These purposes include evaluating a request for insurance products or services, administering those products or services, and processing transactions requested by you. We may also disclose Personal Health Information to business associates outside of Southland, if they need to receive Personal Health Information to provide a service to us and will agree to abide by specific HIPAA rules relating to the protection of Personal Health Information. Examples of business associates are: billing companies, data processing companies, or companies that provide general administrative services. Personal Health Information may be disclosed to reinsurers for underwriting, audit or claim review reasons. Personal Health Information may also be disclosed as part of a potential merger or acquisition involving our business in order to make an informed business decision regarding any such prospective transaction.

Treatment: We may disclose Personal Health Information to doctors, dentists, pharmacies, hospitals, and other health care providers who take care of you. For example, doctors may request medical information from us to supplement their own records. We also may use Personal Health Information by sending certain information to doctors for patient safety or other treatment-related reasons.

Disclosures to Other Covered Entities: We may disclose Personal Health Information to other covered entities or business associates of those entities for treatment, payment, and certain health care operations purposes.

Required by Law: We may use or disclose your Personal Health Information when we are required to do so by local, state or federal law, or to comply with legal proceedings, such as a court or administrative order or subpoena.

Abuse or Neglect: We may disclose your Personal Health Information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the possible victim of other crimes. This information will be disclosed only to the extent necessary to prevent a serious threat to your health or safety or that of others.

Public Health Responsibilities: We will disclose your Personal Health Information to report problems with products, reactions to medications, product recalls, disease/infection exposure and to prevent and control disease, injury, and/or disability.

National Security; Inmates; Armed Forces: We may use or disclose your Personal Health Information when requested by national security, intelligence, and other state and federal officials and/or if you are an inmate or otherwise under the custody of law enforcement. The Personal Health Information of Armed Forces personnel may be disclosed to military authorities under certain circumstances. If the information is required for lawful intelligence, counterintelligence, or other national security activities, we may disclose it to authorized federal, state, and local officials.

For Health-Related Benefits or Services: We may use Personal Health Information to provide you with information about benefits available to you under your current coverage or policy and, in limited situations, about health-related products or services that may be of interest to you.

Other: We may also use and disclose your Personal Health Information as follows:

Ø To your employer (for group health insurance plans), when we have been informed that appropriate language has been included in your plan documents, or when summary data is disclosed to assist in bidding or amending a group health plan.

Ø To law enforcement officials for limited law enforcement purposes.

Ø To a family member, friend, or other person, for the purpose of helping you with your health care or with payment for your health care, if you are in a situation such as a medical emergency and you cannot give your agreement to us to do this.

Ø To your personal representatives appointed by you or designated by law.

Ø For research purposes in limited circumstances, provided measures are taken to protect your privacy.

Ø To a coroner, medical examiner, or funeral director about a deceased person.

Ø To an organ procurement organization in limited circumstances.

Ø To avert a serious threat to your health or safety or the health or safety of others.

Ø To a governmental agency authorized to oversee the health care system or government programs.

Effective August 1, 2013 3

Ø To federal, state or local agencies engaged in disaster relief, as well as to private disaster relief or disaster assistance agencies to allow such entities to carry out their responsibilities in specific disaster situations.

Uses and Disclosures With Your Permission

We will not use or disclose your Personal Health Information for any other purposes unless you give us your written authorization to do so. For example, we will get your authorization (a) for marketing purposes that are unrelated to your benefits plan, (b) before disclosing any psychotherapy notes, (c) related to the sale of your Personal Health Information, and (d) for other reasons as required by law. If you give us written authorization to use or disclose your Personal Health Information for a purpose that is not described in this Notice, in most cases, you may revoke it in writing at any time. Your revocation will be effective for all your Personal Health Information we maintain, unless we have taken action in reliance on your authorization. You should understand that we will not be able to take back any disclosures we have already made with authorization.

Your Privacy Rights As A Consumer

Right to Notification Following Breach: You have the right to be notified following a breach involving your unsecured Personal Health Information.

Right to Inspect and Copy Your Personal Health Information: You have the right to request to inspect and obtain copies of your Personal Health Information that we maintain about you. Your request must be in writing. If we keep your Personal Health Information in electronic form, you have a right to obtain a copy of the Personal Health Information in electronic format. If you choose, you can direct us to transmit the copy directly to an entity or person designated by you. However, your choice must be clear, conspicuous, and specific. To receive a copy of your Personal Health Information, you may be charged a fee for the costs of copying, mailing or other supplies associated with your request. However, certain types of Personal Health Information will not be made available for inspection and copying. This includes Personal Health Information collected by us in connection with, or in reasonable anticipation of, any claim or legal proceeding. In very limited circumstances, we may deny your request to inspect and obtain a copy of your Personal Health Information. If we do, you may request that the denial be reviewed. The review will be conducted by an individual chosen by us who was not involved in the original decision to deny your request. We will comply with the outcome of that review.

Right to Amend Your Personal Health Information: You have the right to request an amendment of your Personal Health Information while it is kept by or for us, if you feel it is inaccurate or incomplete. Your request must be in writing and must include an explanation of why the Personal Health Information should be amended. We may deny your request if it is not in writing or does not include a reason that supports the request. In addition, we may deny your request if you ask us to amend Personal Health Information that:

• is accurate and complete;
• was not created by us, unless the person or entity that created the Personal Health Information is no longer available to make the amendment;
• is not part of the Personal Health Information kept by or for us; or
• is not part of the Personal Health Information which you would be permitted to inspect and copy.

Right to a List of Disclosures: You have the right to receive a list of disclosures we and our business associates have made of your Personal Health Information for certain purposes for the last six years. This list will not include disclosures made for treatment, payment, health care operations, for purposes of national security, made to law enforcement or to corrections personnel, or made pursuant to your authorization or made directly to you. In the case that we use or maintain an electronic health record with respect to your Personal Health Information, you have the right to receive a list of disclosures made within only the three years prior to your request. Your request must be in writing and state the time period from which you want to receive a list of disclosures, subject to the limitations above. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. We may charge you for responding to any additional requests. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. We may provide you with contact information for our business associates so that you may directly request a list of disclosures made by them. Effective August 1, 2013 4

Right to Request Restrictions: You have the right to request that we place additional restrictions on our use or disclosure of your Personal Health Information. While we will consider your request, we are not required to agree to it. If we do agree to it, we will comply with your request. To request a restriction, you must make your request in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply (for example, disclosures to your spouse or parent). We will not agree to restrictions on Personal Health Information uses or disclosures that are legally required, or which are necessary to administer our business.

Right to Request Confidential Communication: You have the right to request that we communicate with you in confidence about your Personal Health Information by a different means or at a different location than we are currently doing. We do not have to agree to your request unless such confidential communications are necessary to avoid endangering you. Your request must be in writing and must specify the alternative means or location for communication. You may specify a preference for us to notify you by electronic mail in the event that Southland experiences a Breach of security, as ”Breach” is defined in HITECH.

Genetic Information: Your genetic information cannot be used for underwriting purposes.

You may make any of the requests described above (if applicable), may request a paper copy of this notice, or ask questions regarding this notice by contacting our Privacy Officer as described below. In some cases, we may charge you a nominal, cost-based fee to carry out your request.

QUESTIONS AND COMPLAINTS

You have the right to file a written complaint with us and the Secretary of the U.S. Department of Health and Human Services if you feel we have violated your privacy rights. In order to file a complaint with us, you should request a Complaint Form from our Privacy Officer. We will not retaliate against you or penalize you in any way if you choose to file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services.

ADDITIONAL INFORMATION

Changes to This Notice: We reserve the right to change the terms of this notice at any time. We reserve the right to make the revised or changed notice effective for Personal Health Information we already have about you as well as any Personal Health Information we receive in the future. The effective date of this notice and any revised or changed notice may be found on the first page. You will receive a copy of any revised notice from Southland by mail or by e-mail, but only if e-mail delivery is offered by Southland and you agree to such delivery.

If you have any questions about this Notice, please contact us at the following address:

Southland National Insurance Corporation

ATTN: Compliance Officer

1812 University Blvd.

Tuscaloosa, Alabama 35401

(205) 343-1222

We are providing this notice to you on behalf of the following companies: Southland National Insurance Corporation and Southland Benefit Solutions, LLC. and

Health Partners America, LLC