The privacy regulations of the Health Insurance Portability and Accountability Act (HIPAA) became effective April 14, 2003. These federal regulations require covered entities, such as health plans, to provide plan participants with a notice of privacy practices describing the health-related information that is collected, how it is used and the ways in which the regulations permit it to be disclosed. These privacy notices also provide information on a participant's right to access, review and, if necessary, to have this information amended.

The following HIPAA Notice of Privacy Practices for the self-insured health plans sponsored by BNY Mellon details the uses and disclosure that the BNY Mellon self-insured health plans may make of your health information, along with your rights and BNY Mellon's self-insured health plan's obligations with respect to that information.

BNY Mellon's benefits program includes both self-insured and insured plans. This notice contains a list of all of these plans, indicating which are self-insured and which are not. If you are enrolled in an insured plan, the applicable insurance company or HMO is obligated to provide its HIPAA Notice of Privacy Practices to you.

BNY Mellon and its health plans strive to take all appropriate measures to protect the privacy of your health information. We take this responsibility very seriously and consider it our obligation to you and to your family, not simply a legal requirement that we must fulfill. Not only do the self-insured BNY Mellon health plans place limits on disclosing your health information to outside parties, but we also take precautions regarding who can access that information internally. Your health information is not disclosed to outside parties for the purpose of marketing products and services.

If you have questions, please contact the BNY Mellon Benefit Solutions Service Center at 1-800-947-4748, option 2, Monday through Friday, 8:30 a.m. to 8 p.m. Eastern Time.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes the medical information practices of BNY Mellon's self-insured health plans and programs, which are listed below, and of any third party (called a "business associate") in connection with functions or services that party provides in the administration of those plans and programs.

"We," "us" and "Plan" refer to all the health plans and programs listed above. "Plan Sponsor" refers to BNY Mellon. ''You" or "yours" refers to individual participants in the Plans.

If you participate in one of the insured health plans sponsored by BNY Mellon, you will receive a notice from the appropriate insurance company or HMO regarding the policies and procedures it will follow related to the use and disclosure of your Protected Health Information (PHI).

PHI is information that may identify you and that relates to past, present or future health care services provided to you, payment for health care services provided to you, or your physical or mental health or condition. This Notice of Privacy Practices describes how regulations permit us to use and disclose your PHI. It also describes your rights to access and control your PHI.

We are required by the Health Insurance Portability and Accountability Act (HIPAA) to:

We protect your PHI from inappropriate use or disclosure. Our employees and those of our business associates are required to protect the confidentiality of PHI. They may look at your PHI only when there is an appropriate reason to do so, such as to determine coordination of benefits or services.

We will not disclose your PHI to anyone for marketing purposes. We will not sell your PHI to anyone in violation of HIPAA.

The main reasons for which we may use and may disclose your PHI are in order to administer our health benefit programs effectively and to evaluate and process requests for coverage and claims for benefits. The following describe these and other uses and disclosures, together with some examples.

In addition to using and disclosing your PHI for treatment, payment and health care operations purposes, we may (and are permitted to) use or disclose it in the following circumstances:

The following is a description of disclosures we are required by law to make:

We generally may use or disclose psychotherapy notes about you or use or disclose your PHI for marketing purposes only with your written authorization, unless a specific exception to those rules applies. We may not sell your PHI without your written authorization.

Other uses and disclosures of your PHI that are not described above will be made only with your written authorization. You may revoke an authorization at any time by providing written notice to us. We will honor a request to revoke as of the day it is received and to the extent that we have not already used or disclosed your PHI in reliance on the authorization. To obtain an Authorization for Release of Information, call the BNY Mellon Benefit Solutions Service Center at 1-800-947-4748, option 2 (Monday through Friday, 8:30 a.m. to 8 p.m. Eastern Time). You may revoke an authorization by contacting the Health Information Privacy Officer identified at the end of this Notice.

Genetic Information

The Privacy Regulations prohibit us from using or disclosing your family members genetic information for underwriting purposes.

You may ask us to restrict uses and disclosures of your PHI for treatment, payment or health care operations purposes, or to restrict disclosures to family members, relatives, friends or other persons identified by you who are involved in your care or payment for your care, or to restrict disclosures for notification purposes. However, we are not generally required to comply with your request for restrictions, except in those situations where the requested restriction relates to the disclosure to the Plan for purposes of carrying out payment or health care operations (and not for treatment) and the PHI pertains solely to a health care item or service for which the individual, or a person other than the Plan on behalf of the individual has paid in full. You may exercise this right by contacting the Health Information Privacy Officer identified at the end of this Notice, who will provide you with additional information including what information is required to make a restriction request.

As long as we maintain records containing your PHI, you have a right to inspect and copy such information. If you request an electronic copy of this information, we will provide you with the information in the electronic form and format you request, if it is readily reproducible in that form or format or, if not, in a readable form and format to which we and you agree. These rights are subject to certain limitations and exceptions. For example, if the requested information contains psychotherapy notes or may endanger someone, it may not be available. You may request a review of any denial to access. If you believe your PHI held and created by us is incorrect or incomplete, you may request that we amend your PHI. You will be required to provide the reason the amendment is necessary. Requests for access to your PHI or amendment of your records should be in writing and directed to the Health Information Privacy Officer identified at the end of this Notice.

You have a right to an accounting of certain disclosures of your PHI by us. The accounting will not include those items which are not required to be provided such as disclosures made at your request or disclosures made for treatment, payment or health care operations. A request for a list of disclosures should be directed to the Health Information Privacy Officer identified at the end of this Notice.

We will accommodate a reasonable request by you to receive communications from us by alternative means or at an alternative location if you believe that disclosure of your PHI could pose a danger to you. For example, you may request that we only contact you by mail or at work. Requests for confidential communications should be in writing and directed to the Health Information Privacy Officer identified at the end of this Notice.

You have the right to be notified in the event that we (or a Business Associate) discover a breach of unsecured PHI.

You have the right to receive a paper copy of this Notice from the Plan upon request, even if you have previously agreed to receive copies of this Notice electronically. Requests for a paper copy should be in writing and directed to the Health Information Privacy Officer identified at the end of this Notice.

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. If we change this Notice, you will receive a new Notice. Active employees will receive the Notice by distribution in the workplace; inactive employees (including retirees) will receive the Notice by mail.

If you believe that your privacy rights have been violated, you may complain to us in writing at the location described below under "Health Information Privacy Officer'' or with the office for Civil Rights of the Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Avenue SW, Washington, DC 20201. No one can retaliate against you for filing a complaint.

You may exercise the rights described in this Notice by contacting the office identified below, which will provide you with additional information.

This Notice is effective as of January 2018.