EFFECTIVE DATE:    Jan 16, 2004

Welcome to the Health Care Benefits Online Web site. Your privacy is very important to us. This privacy policy statement ("Privacy Policy Statement") tells you:

1. What personally identifiable information is collected from you through the Health Care Benefits Online Web site.
2. Who collects the information.
3. How the information is used.
4. With whom the information may be shared.
5. The kind of security procedures that are in place to protect the information submitted on the Health Care Benefits Online Web site.

National Account Service Company, LLC ("NASCO") Privacy Mission Statement

"We are committed to protecting the privacy of our customers' health information."

NASCO's corporate policy is to protect the privacy and confidentiality of our customer's health information. NASCO operates using the following privacy principles:

• The only information NASCO obtains about you is supplied voluntarily by you at the time of your registration to use the Health Care Benefits Online Web site (the "HCBO Web site").
• Information that could be used to identify or contact you, such as name, e-mail address or other personally identifiable information, will not be disclosed to anyone unless you indicate that NASCO may do so.
• NASCO may share statistical information about you as a group, such as usage habits, demographics and similar information that cannot be used to identify or contact you (e.g. aggregate information), with a contracted health plan.
• Personally identifiable information about an individual that is contained within e-health (HCBO Web site) transactions, reports and any other summaries that are derived from e-health transactions, or administrative information (user name, passwords, email address) that are necessary to access the HCBO Web site, that can be used to identify or contact you will be protected by NASCO as personally identifiable information in accordance with the requirements and definitions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Public Law 104-191) and any final regulations.

Information Collection and Use

National Account Service Company, LLC ("NASCO"), in cooperation with the Blue Cross Blue Shield Plans is the operator of the HCBO Web site. In order to use the HCBO Web site, you will be required to enter certain personally identifiable information including your Blue Cross Blue Shield contract number, date of birth and e-mail address. You will also be required to select a unique user ID, a password and a hint to help you remember your password when prompted. This is the only personally identifiable information that is collected and is specifically and willingly provided by you.

NASCO will not collect any other personally identifiable information from you unless you voluntarily provide it to us through e-mail or otherwise. The HCBO Web site is not intended for persons under the age of 18, nor does the HCBO Web site collect any personally identifiable information from persons under the age of 18. We do not knowingly collect or use information from persons under the age of 18 without the consent of a parent or guardian. We will not disclose any personally identifiable information to anyone about you unless you specifically grant permission to do so.

Any personally identifiable information about an individual contained within the HCBO Website is derived from the NASCO Processing System (NPS) maintained by NASCO and is displayed as read-only. This information is protected by NASCO as personally identifiable information in accordance with the requirements of the HIPAA Privacy Regulations and in accordance with this Privacy Policy Statement. The HCBO Web site is designed to provide you access to your health information, such as eligibility and claim status information.

We gather and analyze data regarding usage of the HCBO Web site, including domain name, number of hits, pages visited, length of user session, and so forth to evaluate the usefulness of the HCBO Web site. NASCO may provide this type of aggregate data (which does not contain personally identifiable information) to your health plan upon request.

We use IP addresses to analyze trends, administer the HCBO Web site, track user’s movement, identify unauthorized users, and gather broad demographic information for aggregate uses. An IP address is a number assigned to your computer for accessing the Internet. An IP address is the communication protocol for the Internet that allows computers to recognize and communicate with each other.

The HCBO Website utilizes click stream data to track and analyze patterns and track users while they are visiting the HCBO Web site. Through this process we are able to optimize its Web design and usage.

Registration Process

The HCBO Web site requires visitors to register either before accessing the HCBO Web site or as a requirement to access specific portions of the HCBO Web site. Registration includes the collection of contact information such as user name and e-mail address.

Cookies

What is a cookie?

A cookie is a piece of information that is sent to your browser along with a web page when you sign-on to a website. It is a unique identifier that a web server places on your computer. There are two types of cookies, (1) session cookies and (2) persistent cookies.

A session cookie is a text string (line of text) that is stored in computer memory temporarily. Session cookies are used to enable a web site to track the pages you visit during a session so that information can be customized for you. Once you exit the website, the session cookie is destroyed. Session cookies are utilized on the HCBO Web site.

Persistent cookies are small files used by a web server to deliver data to a Web client (user); request that the client store the information; and in certain circumstances, return the information to the web site. Web sites can thus "remember" user information, for example their preferences for a particular web site, and allow the use of user passwords. The web site may deliver one or more cookies to the client. The client stores cookie data in one or more files on its local hard drive. In most cases the user can control a client browser to allow the use of cookies or disallow its use. Persistent cookies are not utilized on the HCBO Web site.

Sharing

NASCO will not sell, share, or rent your provided information to others in ways different from what is disclosed in this statement. Any personally identifiable information you give us will be used only to provide the information you have requested, (e.g. a request for an ID card which sends a request to your health plan) or for which you registered. Your personally identifiable information, including your e-mail address, will not be sold, rented, licensed, or otherwise shared with third parties. The non-personally identifiable information we gather in aggregate form may be used to improve the HCBO Web site.

The HCBO Website restricts access to adult members (contract holder, spouse, members over 18 years old) only. This means that each adult member may view only his or her own health benefits information, with two exceptions: the contract holder may view their Explanation of Benefits (EOB) records and the EOB records of all members on the contract through the EOB feature. Adult members (other than the contract holder) may only view their individual EOB records. Also, the contract holder and the spouse may view minor dependent's Eligibility information. Privacy restrictions as set forth in this Privacy Policy Statement prohibit the display of health benefits information for any other adult members. The HCBO Web site restricts access to adult members only by validating the date of birth against the eligibility information maintained on NASCO's processing system (NPS) when the user first registers on the HCBO Web site.

If you experience problems navigating the HCBO Web site or have questions about the HCBO Web site, please contact your local health plan's Customer Service Department at the phone number on the back of your identification card. The Customer Service Representative of your health plan will request that you provide your contract number and date of birth. Once this information is entered and the caller identity verified, the Customer Service Representative would access your personally identifiable information (logged in as you) in order to assist with your question.

If you experience technical problems with the HCBO Web site, a web site administrator may view your personally identifiable information to assist in resolving the problem.

Links

In order to provide you with greater value, we may provide links to other third party web sites. NASCO EXERCISES NO AUTHORITY OVER LINKED SITES, EACH OF WHICH MAINTAINS INDEPENDENT PRIVACY AND DATA COLLECTION POLICIES AND PROCEDURES. NASCO ASSUMES NO RESPONSIBILITY OR LIABILITY FOR THESE INDEPENDENT METHODS OR ACTIONS AND IS NOT RESPONSIBLE FOR THE INDEPENDENT POLICIES OR PROCEDURES OF THE THIRD PARTY WEB SITES. NASCO ASSUMES NO RESPONSIBILITY FOR THE PRIVACY INITIATIVES OR CONTENT OF SUCH WEB SITES. THESE LINKS TO THIRD PARTY WEB SITES ARE PROVIDED ONLY FOR YOUR CONVENIENCE. ACCESS TO THESE THIRD PARTY WEB SITES IS AT YOUR OWN RISK.

Security

We use industry best practices to protect and secure our users' information. When you submit personally identifiable information on the HCBO Web site, your information is protected both online and off-line. In addition, users will have the option to log out to force the end of the secure session before leaving the Health Care Benefits Online-powered site.

During registration, users are asked to enter personally identifiable information and that information is encrypted and is protected using 128-bit Secure Socket Layer (SSL) encryption. While on a secure page, the lock icon on the bottom of Web browsers such as Netscape Navigator and Microsoft Internet Explorer becomes locked indicating that the communication is secure, as opposed to unlocked, or open, for instance, when you are just 'surfing'.

While we use SSL encryption to protect sensitive information online, we use industry recognized best practices to protect user information off-line. Access to users' information is restricted in our offices. Only employees who need the information to perform a specific job (for example, a customer service representative) are granted access to personally identifiable information. Finally, the servers on which we store personally identifiable information are kept in an access-restricted secure location.

Correction/Updating Personally Identifiable Information

The HCBO Web site does not allow you to change your personally identifiable information, such as your address and zip code. The only updates allowed are through the User Profile, which allow updates to your (1) password (2) email address and (3) password hint.

If your personally identifiable information changes (such as your zip code), you should contact your local health plan's Customer Service Department at the phone number on the back of your identification card.

Notification of Changes

If we decide to change our Privacy Policy Statement, we will post those changes as soon as reasonably possible on our Home Page and on any pages in which we collect personally identifiable information so that our users are always informed of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

Contacting the HCBO Web Site

The HCBO Web site is owned and operated by National Account Service Company LLC ("NASCO").

If you have any questions about this Privacy Policy Statement, or the online information practices of the HCBO Web site, please contact:

NASCO LLC
Attention: Privacy Official
1200 Abernathy Road
Suite 1000

Atlanta, Georgia 30328

For more information about NASCO, please visit www.nasco.com or contact us at:

NASCO LLC
1200 Abernathy Road
Suite 1000
Atlanta, Georgia 30328
678-441-0061

email us at: info@nasco.com

All inquiries will be directed to the appropriate NASCO group for response.

Agreement With This Privacy Policy Statement

Please check our Privacy Policy Statement periodically. Use of the HCBO Web site constitutes acceptance of the provisions of the Privacy Policy Statement and your continued usage after such changes are posted constitutes acceptance of the revised Privacy Policy Statement then in effect. If you do not agree to the terms of this Privacy Policy Statement or any revised policy, please do not use the HCBO Web site.