• How the Trust Will Use Your Information
The Trust may use, share or disclose the personal health information the Trust creates, receives or maintains about you ("protected health information" or "PHI") to pay medical benefits, operate the Trust or for treatment by a health care provider. In addition,the Trust may use or disclose your information in other special circumstances described in the Notice. For any other purpose, the Trust will require your written authorization for the use or disclosure of your protected health information.

• Your Individual Rights
You have the right to inspect your protected health information, request an amendment of the information, request restrictions on the use and disclosure of the information, request that communications be made to you through alternate means or at an alternative location, and obtain an accounting of the information that the Trust has disclosed for reasons other than treatment, payment, health care operations, required or authorized disclosures. There are certain limitations on these rights as explained in the Notice.

• Questions and Complaints
You may contact the following person for more
information about the Trust's privacy practices, to
exercise your rights or to complain about how the
Trust is handling your protected health information:

Chief Privacy Officer
Christian Brothers Services
1205 Windham Parkway
Romeoville, IL 60446-1679
cpo@cbservices.org
800.807.0100

NOTICE OF PRIVACY PRACTICES FOR CHRISTIAN BROTHERS EMPLOYEE BENEFIT TRUST

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Why Am I Receiving This Notice?
The Christian Brothers Employee Benefit Trust (the "Trust") is subject to the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). The Trust is sponsored by the Trustees elected by organizations that have adopted the Trust. The privacy of your personal health information that is created, used, or disclosed by the Trust is protected by HIPAA. The Trustees are required by law to:

• maintain the privacy of your protected health information ("PHI");

•provide you with this Notice of the Trust's legal duties and privacy practices with respect to your PHI; and

• abide by the terms of this Notice.

2. What is PHI?
PHI, or protected health information, is the identifiable health information about you created, received or maintained by the Trust, regardless of the form or medium of the information. It does not include employment records held by your employer.

3. How will the Trust Use my PHI?
Under HIPAA, the Trust must disclose your PHI:

• to you or your legal representative when you ask for information;

•to the U.S. Department of Health and Human Services, if necessary, to make sure your privacy is protected; and

• where otherwise required by law.

The Trust, and the individuals who administer the Trust, may use, receive or disclose your PHI for treatment, payment or health care operations without obtaining a written authorization from you. These activities cover a broad range of activities, including:

• Treatment - The Trust may disclose protected health information to your providers for treatment, including the provision of care (diagnosis, cure, etc.) or the coordination or management of that care.

• Payment - The Trust may use and disclose your protected health information to pay benefits. Payment activities may include receiving claims or bills from your health care providers, processing payments, sending explanations of benefits (EOBs) to Trust participants, reviewing the medical necessity of the services rendered, conducting claims appeals and coordinating the payment of benefits between multiple medical plans.

• Health Care Operations - The Trust may use and disclose your protected health information for Trust operational purposes. For example, the Trust may use or disclose your protected health information for Trust administration activities such as enrollment, verification to your doctors or hospitals that you are eligible for benefits under the Trust, disease management programs and other Trust-related activities, including audits of claims.

The Trust may also use and disclose your protected health information to provide information to you about disease management programs, treatment alternatives or other health-related benefits and services that may be of interest to you.

The Trust may contract with other businesses for certain Trust administrative services. The Trust may release your health information to one or more of these "business associates" for Trust administration if the business associate agrees in writing to protect the privacy of your information.

The Trustees of the Trust, as the sponsor of the Trust, as well as employees and agents of Christian Brothers Services, the organization selected by the Trustees to administer the Trust, will also have access to your protected health information for Trust administration purposes. Access to your protected health information by Trustees or employees of Christian Brothers Services will be limited to persons responsible for Trust administration.

Unless you authorize the Trust otherwise in writing (or the individually identifying data is deleted from the information), your protected health information will be available only to individuals who need the information to conduct these Trust administration activities and the release of your PHI will be limited to the minimum disclosure required, unless otherwise permitted or required by law.

4. Under What Circumstances Would My PHI be Released for Other than Trust Administration?
The Trust is also permitted to use or disclose your protected health information, without obtaining a written authorization from you, in the following circumstances:

• For certain required public health activities (such as reporting disease outbreaks);

• To prevent serious harm to you or other potential victims, where abuse, neglect or domestic violence is involved;

• For health oversight agency for oversight activities authorized by law;

• In the course of any judicial or administrative proceeding in response to a court or administrative tribunal's order, subpoena, discovery request or other lawful process;

• For a law enforcement purpose to a law enforcement official if certain legal conditions are met (such as providing limited information to locate a missing person);

• For research studies that meet all privacy law requirements (such as research related to the prevention of disease or disability);

• To avert a serious threat to the health or safety of you or any other person; and

• To the extent necessary to comply with laws and regulations related to workers' compensation or similar programs.

Any other use or disclosure of your protected health information not identified within this Notice will be made only with your written authorization.

5. Does My State Privacy Law Also Apply to PHI?
If your applicable state laws provide more stringent privacy protections than HIPAA, the more stringent state law will apply to protect your rights. If you have a question about your rights under any particular federal or state law, please contact the person identified in section 9 as the Privacy Contact.

6. How Do I Authorize a Release of My PHI?
You will need to complete a written authorization form. An authorization form is available from our website, www.cbservices.org, or by calling us at 800-807-0100.
You have the right to limit the type of information that you authorize the Trust to disclose and the persons to whom it should be disclosed. You may revoke your written authorization at any time, and the revocation will be followed to the extent action on the authorization has not yet been taken.

7. What Are My Individual Rights With Respect to My PHI?
You have the right to:

• Request the Trust to restrict its uses and disclosures of your PHI. However, the Trust is not required to agree to a requested restriction. To request a restriction, please write to the Privacy Contact (identified at the end of this Notice) and provide specific information as to the disclosures that you wish to restrict and the reasons for your request. The Privacy Contact will respond in writing.

• Request that the Trust's confidential communications of your PHI be sent to another location or by alternative communicative means. For example, you may ask that we send all explanation of benefits statements (EOBs) to your office rather than your home address. The Trust is not required to accommodate your request unless your request is reasonable and you state that the Trust's ordinary communication process could endanger you.

• To inspect and obtain a copy of the PHI held by the Trust. However, access to psychotherapy notes, information compiled in reasonable anticipation of, or for use in legal proceedings and under certain other, relatively unusual, circumstances may be denied. Your request should be made in writing. A reasonable fee may be imposed for copying and mailing the requested information.

• Request that the Trust amend your protected health information or record if you believe the information is incorrect or incomplete.

• Receive a list of those individuals or entities who have accessed your PHI for reasons other than for treatment, payment or Trust operations or that you have authorized in writing.

• Get a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

8. How Do I Make A Complaint If I Think My Rights Have Been Violated?
You may file a complaint with the Trust's Privacy Contact and with the Secretary of the Department of Health and Human Services. Their addresses are available under contact information below. All complaints must be filed in writing. You will not be retaliated against for filing a complaint.

9. Who Is the Trust's Privacy Contact?
If you have any questions about this Notice, please contact the Trust's Privacy Contact:

Chief Privacy Officer
Christian Brothers Services
1205 Windham Parkway
Romeoville, IL 60446-1679
cpo@cbservices.org
800.807.0100

10. How Do I Contact The Federal Government If I Want To Make a Complaint or Inquiry?
To contact the Secretary of Health and Human Services, write to:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
(202) 619-0257
Toll free: 1-877-696-6775
http://www.hhs.gov/contacts/privacy.html

11. What is the Effective Date of This Notice?
The effective date of this Notice is April 14, 2003.

12. Can This Notice Be Changed?
The Trust reserves the right to change the terms of this Notice and its information practices and to make new provisions effective for all protected health information it maintains. Any amended Notice will be provided to you.