Benefit & Risk Management Services Privacy Policy

This notice describes the privacy policy of Benefit and Risk Management Services (BRMS™). This Privacy Policy applies to BRMS users of family of websites located at www.vbas.com, www.MyHealthBenefits.com or any website or service maintained by BRMS that links to or refers to this Policy (collectively, the "Web Sites"). For existing BRMS customers, your access and use of the Web Sites are governed by the terms and conditions of the agreements already entered into with BRMS, and are not subject to this policy.

We carefully guard your confidential, individual-identifiable information (commonly referred to as your personal information). Personal information includes information that identifies you, such as your name, address, telephone number, email address, social security number and date of birth, wage and job classification, and information related to your health coverage. BRMS obtains your personal information through its administrative, clinical management, network services and various services related to health plans, and insurance policies, and when you send information to us (through these Web Sites or otherwise). We limit our collection and use of information to the minimum required to deliver health benefits services.

User Information Gathered by Our Web Sites

We gather these types of information through our Web Sites:

• Information You Give Us: We receive and store any information you give us to respond to your requests and to communicate with you. Such information will be deemed the minimum necessary to provide the services contracted by your employer.
• Automatic Information: We receive and store information whenever you interact with us. For example, through "cookies," we obtain information when your Web browser accesses our Web Sites. A "cookie" is a small amount of data that is stored on your computer for record keeping purposes and aids in tracking your preferences, and navigation through our Web Sites. The cookie does not extract personal information.

Sharing Information

We only use the information gathered by our Web Sites, or provided by you on our Web Sites, for health benefits services. This information is shared with other entities providing health benefit services to you; however, we do work with business partners under non-disclosure agreements and may share with them certain information to develop a relationship with them.

• Affiliated Businesses We Do Not Control: We may provide certain de-identified visitor information under non-disclosure agreements to our affiliated businesses and partners to assist us in developing a relationship with you.
• Compliance with the Law: We may release account and other personal information to comply with law, or to protect the rights, property, or safety of BRMS, our users, or others. Such release includes responding to subpoenas, compliance with court orders and legal requests.

Personal Health Information

BRMS undertakes to comply with all health information privacy laws that apply to us. Information about you may include Protected Health Information (PHI) as defined by the Health Insurance Portability & Accountability Act of 1996 (HIPAA), and Title 45, Parts 160 through 164 of the Code of Federal Regulations and other associated laws and regulations. Consistent with our respect for you and your privacy, we will not use or share your PHI for purposes other than treatment, payment or health care operations (including, but not limited to, quality assessment, fraud detection, regulatory and mandatory legal activities), or for other purposes as allowed under HIPAA.

Conditions of Use, Notices, and Revisions

If you choose to visit our Web Sites, your visit and any dispute over privacy is subject to this Policy. Please send any concerns you may have about privacy on our Web Sites to the following email address: info@brmsonline.com. BRMS will respond to your request and attempt to resolve any matters that violate BRMS policies. Our business changes constantly. This Policy may change, and use of information that we gather now is subject to the Privacy Policy in effect at the time of use. We may send, via e-mail, periodic reminders of our notices, unless you have instructed us not to, but please check our Web Sites frequently for recent changes.