The Plan and Your Privacy

Your Privacy Rights Under HIPAA

The federal Health Insurance Portability and Accountability Act (HIPAA) requires that health plans maintain the privacy of your health information. A description of your rights under HIPAA can be found in the Plan’s HIPAA Privacy Notice, which follows, and is available on request from the Funds Ofﬁce or via the Funds’ website: https://local4funds.org.

NOTICE OF PRIVACY PRACTICES

IUOE LOCAL 4 HEALTH AND WELFARE FUND

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.

This Notice is effective February 16, 2026 and revises the notice effective August 15, 2025.

If you have any questions or requests about this notice, please contact the IUOE LOCAL 4 HEALTH AND WELFARE FUND PRIVACY OFFICER, PO Box 680, 16 Trotter Drive, Medway, MA 02053, 508-533-1400 or 888-486-3524, or office@local4funds.org.

The federal Health Insurance Portability and Accountability Act (HIPAA) requires the Local 4 Health and Welfare Fund (“the Fund” or “We”) to maintain the privacy of your health information and to provide you with notice of its legal duties and privacy practices with respect to your Protected Health Information. This notice also describes the Fund’s legal obligations under the regulations governing the privacy of substance use disorder (“SUD”) treatment records found at 42 C.F.R. Part 2 (“Part 2”). The Fund is required to provide this notice to you pursuant to HIPAA and Part 2. The Fund must abide by the terms of the notice currently in effect.

The Fund must maintain the privacy of any information it creates or receives that can be identified as yours as it

Relates to payment of health care for you, or
Pertains to your physical or mental health condition.

Identifiable information refers to health information that

Is explicitly linked to you, and also
Has enough data included that allows for individual identification.

This is referred to as Protected Health Information, or PHI for short.

The Fund is legally obligated to abide by the terms of the current notice and to let you know when and under what circumstances it needs your authorization to use PHI and when or under what circumstances it does not need your authorization to use PHI. The Fund must also describe such uses in plain terms.

The purpose of this notice is to provide you with this information and to notify you of your rights under HIPAA and Part 2. The Fund reserves the right to change the terms of this notice and to make the new notice provisions effective for all PHI that it maintains. A revised notice will be provided to covered individuals as required by HIPAA when the Fund makes a material change or revision to the contents of this notice.

The IUOE Local 4 Health and Welfare Fund does not need your authorization to use and disclose PHI for the purposes of payment, treatment or health care operations.

If the Fund receives or maintains any information about you from a SUD treatment program that is covered by Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment or health care operations, the Fund may use and disclose your Part 2 Program record for treatment, payment and health care operations purposes as described in this notice with respect to your PHI. If the Fund receives or maintains your Part 2 Program record through specific consent you provide to the Fund or another third party, We will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to the Fund.

Some examples of how the Fund may use and disclose your PHI for these purposes are provided below:

Treatment: The Fund does not typically use or disclose your PHI for treatment purposes, but contracts with Blue Cross Blue Shield of Massachusetts to provide you access to a network of health care providers for treatment and to issue an explanation of benefits statement to you for you or any of your covered dependents. You can ask Blue Cross Blue Shield in writing to distribute explanation of benefit forms addressed only to the participant or dependent.

Payment: The Fund contracts with Blue Cross Blue Shield of Massachusetts for paying medical and dental claims for you and your eligible dependents, for utilization review or management of such claims. While not typical, the Fund may need to review your PHI for payment purposes if there is an issue involving the claims payment process.

Health Care Operations:

To notify providers of insurance benefits whether you or your dependents are eligible for coverage at the time of service.
For administrative purposes, such as obtaining or renewing stop loss coverage, or for underwriting, premium rating, and other activities related to the creation or renewal of a contract for insurance (though the Fund will not disclose PHI that is genetic for underwriting purposes).
To communicate with administrators or providers of Fund benefits, such as for the medical and dental plans of benefits or the prescription drug program.
To identify groups of people with similar health problems to give them information about treatment alternatives, educational programs, and disease management programs.
To comply with administrative requirements such as providing PHI as necessary to accountants and lawyers to enable them to provide accounting and legal services to the Fund.
To disclose PHI to a third-party clinical team for review of an appeal of denied medical, prescription drug, dental, vision, disability (loss of time), or hearing claims.
To disclose PHI to the sponsor of the plan (Board of Trustees), such as for processing an appeal of a denial of benefits or coverage.
To coordinate benefits if you or your spouse also have coverage through a secondary insurer or Medicare.

In addition, the IUOE Local 4 Health and Welfare Fund does not need your authorization to use or disclose PHI:

To comply with local, state or federal law, or for health care oversight activities authorized by law, as for example, when a disclosure is required by subpoena or to comply with a governmental health oversight board investigating complaints against physicians or other health care providers.
For public health activities, which generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products they may be using; reduce the risk for contracting or spreading a disease or condition.
For research under certain circumstances, including to study treatment outcomes, costs and benefit design, after we remove information that personally identifies you.
When the disclosure relates to victims of abuse, neglect, or domestic violence.
For law enforcement purposes, including to respond to a subpoena, warrant, summons, or similar process, or in some cases to identify or locate a suspect or report a crime, except as otherwise provided herein.
For specialized governmental functions, such as to disclose an individual’s PHI to authorized federal officials for the conduct of national security or intelligence-related activities authorized by law, including providing protection to the President or other authorized persons or foreign heads of state.
For the duties of a coroner, medical examiner, or funeral director, to identify the body of a deceased person, to determine a cause of death, or to perform other authorized duties.
For facilitating organ donation and transplants, including the release of necessary medical data to organizations engaged in the procuring, banking, or transplanting of human organs, eyes, or tissue.
To comply with workers’ compensation laws or other similar programs to the extent necessary.
To avert a serious threat to health or safety or to prevent or lessen an imminent threat to the health and safety of another person or the public.
For judicial proceedings, such as in response to a court order, subpoena or other lawful process, after the Fund is assured efforts have been made to notify you of the request or to obtain an order protecting the information requested, except as otherwise provided herein.
To Business Associates acting on the Fund’s behalf and providing services (such as legal, auditing, claims utilization review) to the Fund. All of our Business Associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract with them.
To provide legally required notices of unauthorized access to or disclosure of your health information.
To the correctional institution or law enforcement official if you are an inmate of a correctional institution or under the custody of a law enforcement official, if necessary: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) the safety and security of the correctional institution.

We may also make other uses and disclosures, which occur as a by-product of these permitted uses and disclosures of PHI.

Notwithstanding anything herein that may be interpreted to the contrary, neither the Fund nor any of its Business Associates may use or disclose PHI for the following purposes:

To conduct criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing or facilitating lawful reproductive health care, in vitro fertilization or gender affirming health care services.
To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care, in vitro fertilization or gender affirming health care services.
To identify any person for either purpose described above.

This prohibition applies when the health care services at issue are considered lawful within the Commonwealth of Massachusetts or would be lawful if such services had occurred entirely within the Commonwealth.

In addition and notwithstanding anything herein that may be interpreted to the contrary, in no event will the Fund use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any federal, state, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order.

The IUOE Local 4 Health and Welfare Fund must have your written authorization to disclose PHI for any other purpose, including disclosure of PHI relating to your health and welfare claims, to someone other than you. You may revoke such an authorization at any time in writing.

The types of uses and disclosures that require your authorization include:

The use and disclosure of psychotherapy notes, except by the originator of the notes for treatment, by the Fund for its own supervised training programs, or by the Fund to defend itself in a legal proceeding;
The use and disclosure of PHI for marketing, except if the communication is in the form of a face-to-face communication by the Fund to an individual or a promotional gift of nominal value by the Fund; and
The disclosure of PHI which is a sale of PHI as defined by HIPAA regulations.

The uses and disclosures that require us to give you an opportunity to object and opt out:

Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment.
We may disclose your PHI to disaster relief organizations that seek your PHI to coordinate your care, or notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever we practically can do so.

You have individual rights with respect to PHI. You have the right to:

An accounting of certain disclosures of PHI, including disclosures we have made of your PHI other than for treatment, payment, or health care operations, for the six years prior. You must submit your request in writing.
Inspect and copy your PHI. You must put your request in writing. The Fund has up to 30 days to make the information available to you and may charge a reasonable fee for the cost of copies, mailing or supplies associated with your request. If your PHI is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request, your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
Amend your PHI in certain circumstances with certain limitations, such as if you believe PHI about you is incorrect or incomplete. You must put your request in writing and give a reason.
Revoke your authorization to disclose PHI at any time in writing.
Request reasonable confidential communications of PHI by alternative means or to alternative locations (for example, your workplace). We may ask that you put such a request in writing, but we may not require an explanation of the reason for the request.
Request certain restrictions of use and disclosures of PHI. While you have the right to request a restriction on the Fund’s use and disclosure of your PHI, the Fund is not required to agree to a restriction. The Fund will agree to your request for restriction, however, if the disclosure is for payment or health care operations purposes and the PHI pertains solely to a health care item or service for which you have paid the Fund out of pocket in full.

You also have additional rights.

You have the right to a paper copy of this notice upon request.
You may file a complaint about our privacy practices by contacting the Privacy Officer at the address listed in this notice (page 1). You may also send a written complaint to the Secretary of the United States Department of Health and Human Services. You may not be penalized or retaliated against for filing such a complaint.

If the Fund experiences a breach of unsecured PHI, it will notify affected individuals within 60 days of discovery. The Fund will also notify the U.S. Department of Health and Human Services and local media outlets if the breach affects 500 or more individuals.

Sincerely,

Your Board of Trustees

Michael J. Bowes, Chairman
Paul C. DiMinico
David F. Shea, Jr.
James Reger
Angelo Colasante
David B. Marr, Jr.

IUOE Local 4

Michael J. Bowes, Business Manager

Administrator

Gregory A. Geiman, Esq.

HIPAA Privacy Policy

The Plan and Your Privacy

Your Privacy Rights Under HIPAA

NOTICE OF PRIVACY PRACTICES