HOME ABOUT US PRODUCTS REPORT A CLAIM CAREERS CONTACT TERMS AND CONDITIONS ATAIN SPECIALTY INSURANCE COMPANY AND ATAIN INSURANCE COMPANY PRIVACY POLICY Atain Specialty Insurance Company and Atain Insurance Company (also referred to collectively as “Company,” “we,” “our,” “us”) is in the business of acting as an insurance wholesaler, broker and managing general agent. What Information Do We Gather? What Do We Do With the Information We Collect? Who Can Use the Information We Collect and How? How Do We Protect the Personal Information We Collect? What Are Your Rights Regarding Your Personal Data? How Do You Opt-out of Personal Information Sharing with Our Business Partners? How Do You Correct and Update Your Personal Data? What is Our Privacy Policy If You Are an Underage Child? What Happens When You Link to a Third-Party Web Site? What Happens When We Update Our Privacy Policy? Your California Privacy Rights Your European Union Privacy Rights Non-Discrimination and Confidentiality Rights for New York Residents Who Have Been Victims of Domestic Violence What If You Have Questions? 1. What Information Do We Gather? When you visit our Website and Portal (“Site”), we collect only the information and personal data you have agreed to provide to us that is necessary to identify your needs and to provide you with better service. Through your use of the Site or registration as a new user, we may request personal data including, but not limited to: Name, company and job title Contact information including email address and cell phone number Demographic information including postal code, product preferences and interests Internet Protocol (“IP”) Address and other persistent identifiers Other information relevant to customer surveys and offers If you become a registered user or if you conduct transactions through this Site, we will collect information about the transactions you engage in while on the Site and other potential activities on the Site. This information may include, without limitation, areas of the Site that you visit, transaction type, content that you view, download or submit, transaction amount, payment, and billing information as well as the nature, quantity and price of the goods or services you exchange and the individuals or entities with whom you communicate or transact business. Some of this personal data, including name, company and contact information, will only be collected if you voluntarily provide it during the user registration process. We may also track information such as the domain name and the name of the web page from which you entered our Site, and how much time you spend on each of our pages. We collect information that is combined with other web visitors’ information, such as how many times visitors click on each web page and the methods by which our Site was found. We may collect IP addresses and website usage information from you when you visit our Site via the use of “cookies.” An IP address is a number that is assigned to your computer when you are using your browser on the Internet. A cookie is a small file that is stored on the hard drive of your computer ready for future access when you return to our Site. We use cookies to deliver web content specific to you and to keep track of your online order activity. Cookies cannot pass viruses, harm your computer or pass on private information such as an email address without the computer user’s intervention. Cookies contain session identification numbers that allow our systems to recall previous sessions for authentication efforts and assemble information from our gathered data. You can configure your computer’s browser to alert you when a site is attempting to send you a cookie and allow you to accept or refuse the cookie. Further information on how to prevent cookies from being stored on your device can be found on http://www.allaboutcookies.org under the ‘manage cookies’ section. Alternatively, you can access further information by going to the help menu within your internet browser. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout. We use cookies to give you the best experience on our Site. If you continue without changing your cookie settings, we assume that you consent to our use of cookies on this device. You can change your cookie settings at any time but if you do, you may lose some functionality on our Site. 2. What Do We Do With the Personal Information We Collect? You will be asked to provide personal data in certain fields on this Site that allow you to be able to use our Services. The personal data we collect is used only for the purpose we state at the time of collection or for purposes contained below. For example, our uses may include, but are not limited to, the following: To process transactions. COMPANY uses personal data such as name, physical address, telephone number, email address, and company/institution to engage in interactions with you, including contacting you about your transactions with the site. To process payments. We use financial/credit card and payment information to process your order and may need to share some of this information with delivery services, credit card clearing houses, and other third parties to complete the transaction. To provide support or other services. COMPANY may use your personal data to provide you with support or other services that you have ordered or requested. COMPANY may also use your personal information to respond directly to your requests for information, including registrations for newsletters, webinars, or other specific requests, or pass your contact information to the appropriate COMPANY distributor or reseller for further follow-up related to your interests. To provide information based on your needs and respond to your requests. COMPANY may use your personal data to provide you with notices of new product releases and service developments. To provide online forums and social networks. Some services available on the websites may permit you to participate in interactive discussions, post comments, opportunities, or other content to a Forum, or otherwise engage in networking activities. Some of these services may be moderated; all may be accessed for technical reasons (for example, for improvements or fixes). COMPANY does not control the content that users post to the Forums or social networks. You should carefully consider whether you wish to submit personal information to these forums or social networks and tailor any content you submit appropriately and in accordance with the relevant terms of use. You should also review any additional terms and conditions that may govern your use of these services, including terms related to sharing your personal information and receiving communications. To administer products. COMPANY may contact you if you purchase products to confirm certain information about your order (for example, that you did not experience problems in the download process). We may also use this information to confirm compliance with licensing and other terms of use and may share it with your company/institution. To select content, improve quality, and facilitate use of the websites. COMPANY may use your personal data, including the information gathered as a result of site navigation and electronic protocols and cookies (including third-party cookies), to help create and personalize website content, improve website quality, track marketing campaign responsiveness, evaluate page response rates, conduct usability testing, and facilitate your use of the websites (for example, to facilitate navigation and the login process, avoid duplicate data entry, enhance security, keep track of shopping cart additions, and preserve order information between sessions). To serve personalized advertising to you. We don’t share your personal data with advertisers without your consent. We allow advertisers to choose the characteristics of users who will see their advertisements, and we may use any of the non-personally-identifiable data attributes we have collected to select the appropriate audience for those advertisements. When you click on or otherwise interact with an advertisement, there is a possibility that the advertiser may place a cookie in your browser and that your attributes meet the criteria the advertiser selected. To assess usage of COMPANY products and services. COMPANY may track your usage of COMPANY products and services to determine your level of usage, and those usage statistics may be made available to COMPANY’s content licensors and your company/institution. To communicate with you about events. We may communicate with you about events hosted or co-sponsored by COMPANY or one of our business associates. This may include information about the event’s content, event logistics, payment, updates, and additional information related to the event. Information you provide when registering for or participating in a conference managed or co-sponsored by parties, other than or in addition to COMPANY may be shared with those parties, and the treatment of such information is further subject to the privacy policies of those parties. COMPANY and its conference co-sponsors may contact you after the event about the event, subsequent iterations of the event and related events. Please note that COMPANY event organizers, co-sponsors, exhibitors, and other third parties may directly request your personal information at their conference booths or presentations. Providing your information to them is optional, and you should review their privacy policies to address your particular needs and concerns about how they will treat your personal information. To update you on relevant COMPANY benefits, programs, and opportunities. COMPANY may communicate with you regarding relevant COMPANY benefits, programs, and opportunities available to you. To engage with third parties. COMPANY may share your personal data with third parties in connection with services that these individuals or entities perform for or with COMPANY. These third parties are restricted from using this data in any way other than to provide services for COMPANY or for the collaboration in which they and COMPANY are contractually engaged (for example, hosting a COMPANY database or engaging in data processing on COMPANY’s behalf, or mailing you information that you requested). These third parties are carefully selected by COMPANY and obligated to keep your data secure. From time to time, we may also share your information with third parties whom we think might provide content, products, or services of interest to you. To protect COMPANY content and services. We may use your personal data to prevent potentially illegal activities and to enforce our terms and conditions. We also use a variety of technological systems to detect and address anomalous activity and to screen content to prevent abuse, such as spam. These efforts may, on occasion, result in a temporary or permanent suspension or termination of some functions for some users. By using our Site, you acknowledge and agree that we may access, retain and disclose the personal data we collect and maintain about you if required to do so by law or in a good faith belief that such access, retention, or disclosure is reasonably necessary to: (a) comply with legal process (e.g. a subpoena or court order) or law; (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; (d) respond to your requests for customer service; and/or (e) protect the rights, property or personal safety of COMPANY, its agents and affiliates, its users and/or the public. This includes exchanging information with other companies and organizations for fraud protection, compliance with applicable law, and spam/malware prevention, and similar purposes. To get feedback or input from you. In order to deliver products and services of most interest to our customers, from time to time, we may ask members, customers, volunteers, and website visitors to provide us input and feedback (for example through surveys, usability studies, focus groups). To protect COMPANY information assets as well as your own personal data. The COMPANY Information Security Program protects the confidentiality, integrity, and availability of COMPANY information assets by following a risk management approach based on policies, standards, guidelines, and procedures to meet security objectives while supporting business and operational goals. To assist in Business Transfers. As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions, (including in contemplation of such transactions) user information may be among the transferred assets. If a portion or all of COMPANY’s assets are sold or transferred to a third-party, customer personal data (including your email address) would likely be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, COMPANY will comply with such restrictions. To the extent that we collect certain demographic information about you, we may use this information in our market research, but we will do so only after we “anonymize” or “pseudonymize” the data, i.e., remove information that would confirm your identity. We will not use your personal data, however, to send commercial or marketing messages to you unless we have a legal basis for doing so, such as your consent or a contract with us for which, in either case, you will have the ability to opt out of by sending an email to compliance@hwkaufman.com. This Site does not collect personal data when you browse the Site and request pages from our servers unless you voluntarily and knowingly provide such information to us. This means that we will not know your name, your email address, or any other personal data just because you browse the Site unless you: access the Site from a link in an email that we have sent to you; have created a profile and you either log-in to your account or choose to be remembered via your cookie or your web-enabled mobile device. In these cases we will know who you are based on the information you previously supplied to us. When you request a page from our Site, our servers log the information provided in the HTTP request header including the IP number, the time of the request, the URL of your request and other information that is provided in the HTTP header. We collect the HTTP request header information in order to make sure our Site functions correctly and provides you with the functionality that you expect to see. We also use this information to personalize content presented to you, better understand how visitors use our Site and how we can better tune it, its contents, and functionality to meet your needs. We only use your personally identifiable information for those activities listed at the time you submit your information to us. For example, if you provide us with an email to inform you of special events, then that is what we will use your email address to do. If we would like to use your personally identifiable information for an unrelated activity, we will first request your consent to do so. 3. Who Can Use the Information We Collect and How? We may provide your personal data to third parties, or third parties may collect personal data from you on our behalf if we have contracted with that third party to provide some part of the information or service that you have requested. Other than those who act on our behalf and except as explained in this Policy, personal data you provide at this Site will not be transferred to unrelated third parties, unless we have a legal basis to do so. However, please note that personal data provided to this Site is subject to disclosure pursuant to judicial or other government subpoenas, warrants or orders. We will only provide this information after approximately two weeks following receipt of a valid subpoena or other legal process in a civil case. 4. How Do We Protect the Personal Information We Collect? Security of Personal Data We are committed to protecting the security of your personal data. Depending on the circumstances, we may hold your information in hard copy and/or electronic form. For each medium, we use technologies and procedures to protect personal data. We review our strategies and update as necessary to meet our business needs, changes in technology, and regulatory requirements. We take our security obligations seriously and so should you. While we are responsible for maintaining the security of this Site, you must also access and use this Site in a manner that is responsible and secure. We adhere to internationally recognized security standards. In addition, we have implemented a series of policies, procedures, and training to address data protection, confidentiality, and security, and we update and review the appropriateness of these measures on a regular basis. Storage and Transfer of Personal Data Personal data collected by COMPANY may be stored and processed in your region, in the United States or in any other country where COMPANY, its affiliates or contractors maintain facilities, including outside the European Union. We take steps to ensure that the data we collect under this Privacy Policy is processed pursuant to the terms thereof and the requirements of applicable law wherever the data is located. COMPANY also collaborates with third parties such as cloud hosting services and suppliers located around the world to serve the needs of our business, workforce, and customers. In some cases, we may need to disclose or transfer your personal data within COMPANY or to third parties in areas outside of your home country. When we do so, we take steps to ensure that personal data is processed, secured, and transferred according to applicable law. If you would like to know more about our data transfer practices, please contact our Data Protection Officer through our compliance office at compliance@hwkaufman.com. Retention of Personal Data COMPANY retains personal data for as long as necessary to provide the services and fulfill the transactions you have requested, or for other business purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. We are required by law to keep some types of information for certain periods of time (e.g., statute of limitations). If your personal data is no longer necessary for the legal or business purposes for which it is processed, we will generally destroy or anonymize that information. 5. What Are Your Rights Regarding Your Personal Data? We respect your right to access and control your personal data. You have choices about the data we collect. When you are asked to provide personal data that is not necessary for the purposes of providing you with our Products and Services, you may decline. However, if you choose not to provide data that is necessary to provide a Service, you may not have access to certain features, Sites, Products, or Services. Access to personal data: In some jurisdictions, you have the right to request access to your personal data. In these cases, we will comply, subject to any relevant legal requirements and exemptions, including identity verification procedures. Before providing data to you, we will ask for proof of identity and sufficient information about your interaction with us so that we can locate any relevant data. We may also charge you a fee for providing you with a copy of your data (except where this is not permissible under local law). Correction and deletion: In some jurisdictions, you have the right to correct or amend your personal data if it is inaccurate or requires updating. You may also have the right to request deletion of your personal data. Please note that such a request could be refused because your personal data is required to provide you with the products or services you requested, e.g. to deliver a product or send an invoice to your email address, or that it is required by the applicable law. Portability: If you reside within the European Union, you have the right to ask for a copy of your personal data and/or ask for it to be ported to another provider of your choice. Please note that such a request could be limited to the only personal data you provided us with or that we hold at that given time and subject to any relevant legal requirements and exemptions, including identity verification procedures. Marketing preferences: If you have provided us with your contact information, we may, subject to any applicable Spam Act or similar regulation, contact you via email, postal mail or telephone about COMPANY products, services and events that may be of interest to you, including newsletters. E-mail communications you receive from COMPANY will generally provide an unsubscribe link allowing you to opt-out of receiving future email or to change your contact preferences. E-mail communications may also include a link to directly update and manage your marketing preferences. Please remember that even if you opt out of receiving marketing emails, we may still send you important Service information related to your accounts. If you are in the EU/UK, you have certain additional privacy rights that are listed below in Section 12. 6. How Do You Opt-out of Personal Information Sharing with Our Business Partners? We may use third party analytics vendors to evaluate and provide us with information about the use of our Services and viewing of our content. Some of the information you see on our Sites may be customized based on automated predictions about your interests, which predictions are generated from your visits over time and across different websites, using tools such as Google Analytics. This information allows us to create content of greater interest to you and can also be used to serve ads based on your past visits to our Sites. Note that you can opt out of a third-party vendor’s use of cookies, including use by Google, by visiting the Network Advertising Initiative opt-out page (http://www.networkadvertising.org/choices/). For more information about how targeted Network Advertising works, please visit: http://www.youradchoices.com/ or http://www.networkadvertising.org/understanding-online- advertising. You may opt-out of third party targeted advertising or analytics in two ways: 1) By directly notifying a Network Advertising service provider via its opt-out tools (Please see above), or 2) using your browser’s Do Not Track (DNT) settings to indicate that you do not wish to receive targeted advertising based on your overall internet usage. For more information about DNT and how it works, please visit the Future of Privacy Forum’s website: http://www.allaboutdnt.com. We will make a good faith reasonable effort to honor your DNT browser settings for opting out of receiving targeted third party advertising based on your overall Internet usage. Please note that various browsers frequently update technology or change their settings and business practices without advance notice, and we may not have the latest information on how to honor your preferences. If you exercise either opt-out option – the cookie opt-out or the browser opt-out – you will continue to receive advertising, but such advertising may not relate to your specific interests, previous purchases, or search history. However, you cannot opt-out of our contextual analytics and advertising, which is based on your usage of only our Services. We will continue to serve you contextual advertising. We will also continue to monitor your usage and search or transaction history to provide us with analytics on how well our Services, features, and activities are functioning and used. We will also share this information in an aggregated or anonymized form (meaning that no one individual person can be identified) within the Company. You can also opt out of our marketing emails at any time by contacting us at compliance@hawkaufman.com or by sending us a post card to “OPT OUT”, Atain Specialty Insurance Company, 220 Kaufman Financial Center, 30833 Northwestern Highway, Farmington Hills, Michigan 48334, Attn.: Compliance Department. 7. How Do You Correct and Update Your Personal Data? We aim to keep all personal data that we hold accurate, complete and up-to-date. While we will use our best efforts to do so, we encourage you to tell us if you change your contact details. If you believe that the information we hold about you is incorrect, incomplete or out-of-date, please contact compliance@hwkaufman.com. You can change or correct your personal data at any time. Just send an email with your old information and your corrections to compliance@hwkaufman.com with “Correction” in the subject line. 8. What is Our Privacy Policy If You Are an Underage Child? We understand the importance of protecting the privacy of all individuals, especially the very young. Our services are intended for United States audiences over the age of 18. Our Site and its Services are not directed to children, and you may not use our Services if you are under the age of 13. You must also be old enough to consent to the processing of your personal data in your country (in some countries we may allow your parent or guardian to do so on your behalf). You must be at least 16 years of age to use the Site Forums. Subscribing to our Services is restricted to adults who are either 18 years of age or older or as otherwise legally defined by the country of your residency. 9. What Happens When You Link to a Third-Party Web Site? If you click on a link and go to another site, you will be subject to that website’s privacy policy. We encourage you to read the posted privacy policy statement at any website before submitting any personal data at all. 10. What Happens When We Update Our Privacy Policy? We may on occasion update our Privacy Policy. Your acceptance of any minor changes to this Privacy Policy is indicated by your continued use of our Services. If we make any material changes to our Privacy Policy, we will post a notice about the change at a prominent location on our Site. We encourage you to periodically review our Site and this Privacy Policy for any changes. 11. Your California Privacy Rights If you are a California resident and have an established business relationship with us and want to receive information about how to exercise your third party disclosure choices, you must send a request to the following address with a preference on how our response to your request should be sent (email or postal mail). You may contact us in two ways. Send an email to compliance@hwkaufman.com. Alternatively, you may contact us at: Atain Specialty Insurance Company 220 Kaufman Financial Center 30833 Northwestern Highway Farmington Hills, Michigan 48334 Attn: Your California Privacy Rights c/o Privacy Administrator For requests sent via email, you must put the statement “Your California Privacy Rights” in the subject field of your email. All requests sent via postal mail must be labeled “Your California Privacy Rights” on the envelope or post card and clearly stated on the actual request. For all requests, please include your name, street address, city, state, and zip code. (Your street address is optional if you wish to receive a response to your request via email. Please include your zip code for our own recordkeeping.) We will not accept requests via the telephone or by facsimile. We are not responsible for responding to notices that are not labeled or not sent properly, or do not have complete information. If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to compliance@hawkaufman.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested. 12. Your European Union Privacy Rights If you are in the European Union, under the General Data Protection Regulation (Regulation EU 2016/679) (also known as GDPR), you may have certain rights as a data subject. A data subject is a person who can be identified by a name, identification number, location, online identifier, or other physical, physiological, genetic, mental, economic, cultural or social identity of the person. Under the GDPR, personal data is information that relates to a data subject. The processing of your data is either based on your consent or in case the processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract, cf. GDPR art. 6(1)(a)-(b). If the processing is based on your consent, you may at any time withdraw your consent by contacting us at compliance@hawkaufman.com. In order to enter into a contract to use our Services, you must provide us with the required personal data. If you do not to provide us with all the required information, it will not be possible to deliver the Service. To request information about or avail yourself of those rights, please send an email to compliance@hawkaufman.com with “GDPR Request” in the subject line. In the email please describe, with specificity, the GDPR right you are requesting assistance with. Please note additional information may be requested prior to initiation of a request and that COMPANY reserves the right to charge a fee with respect to certain requests. Upon COMPANY’s completion of its review you will be notified if your request has been granted, denied, or exemptions apply. The Data Controller and Processor for Personal Data A Data Controller is a company that collects people’s personal data and makes decisions about what to do with it. A Data Processor is a person or company that deals with personal data as instructed by a Data Controller for specific purposes and services. The Data Controller’s information is as follows: Atain Specialty Insurance Company 220 Kaufman Financial Center 30833 Northwestern Highway Farmington Hills, Michigan 48334 Phone: (248) 932-9000 The Data Processor’s information is as follows: Atain Specialty Insurance Company 220 Kaufman Financial Center 30833 Northwestern Highway Farmington Hills, Michigan 48334 Phone: (248) 932-9000 The Purpose and Legal Basis for Collection Under the GDPR, there must be a lawful basis for processing personal data. There are six lawful bases, and they are consent, contract, legal obligation, vital interests, public task, and legitimate interests. As part of our compliance with the GDPR, we intend to use your personal data for the purposes as set forth in Number 2, above. . Our lawful basis for collecting and processing your personal data is to ensure an efficient and productive relationship with our customers, clients, agents and carriers and to allow for internal marketing and data assessment. For more information, see Section 2 of our Privacy Policy above. The Legitimate Interest In Company’s adherence with the GDPR, we have a legitimate interest which allows us to process your personal data. This legitimate interest the relationship established between you and us as a result of your implicit approval by accessing and/or using our Site. Recipients of Your Data and Categories of Data Collected For more information, see Section 3 of our Privacy Policy above. Data Protection Officer Company is headquartered in Farmington Hills, Michigan, United States of America. The Company has appointed the following contact person for you to contact if you have any questions or concerns about the Company’s personal data policies or practices. The Company’s Contact’s name and contact information are as follows: Aaron Buck H.W. Kaufman Financial Group, Inc. 220 Kaufman Financial Center 30833 Northwestern Highway Farmington Hills, Michigan 48334 ajbuck@hwkaufman.com (248) 932-9000 Transferring personal data from the EU to the US or other jurisdictions The Company has its headquarters in Farmington Hills, Michigan, United States. Personal data we collect from you will be processed in the United States. United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. The Company relies on derogations for specific situations as set forth in Article 49 of the GDPR. In particular, the Company collects and transfers to the U.S. personal data only: with your consent; to perform a contract with you; or to fulfill a compelling legitimate interest of the Company in a manner that does not outweigh your rights and freedoms. The Company endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with the Company and the practices described in this Privacy Policy. The 8 Rights of Individuals Under the GDPR, You will benefit from increased rights including: The right to be informed The right to be informed encompasses the obligation to provide you with ‘fair processing information.’ It emphasizes the need for transparency over how your personal data is used. The right of access Under the GDPR, you will have the right to obtain confirmation that your data is being processed, access to your personal data, and other supplementary information. The right to rectification You are entitled to have your personal data rectified if it is inaccurate or incomplete. The right to erasure The right to erasure is also known as ‘the right to be forgotten.’ You may request the deletion or removal of personal data where there is no compelling reason for its continued processing. The right to restrict processing We are permitted to store your personal data, but not further process it without consent. The right to data portability The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. You may move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The right to object You have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), direct marketing (including profiling); and processing for purposes of scientific/historical research and statistics. Rights in relation to automated decision making and profiling The GDPR provides safeguards for you against the risk that a potentially damaging decision is taken without human intervention. 13. Non-Discrimination and Confidentiality Rights for New York Residents Who Have Been Victims of Domestic Violence New York Insurance Law §2612 prohibits property and casualty, life, disability and health insurance companies from discriminating against domestic violence victims. It specifically prohibits designating domestic violence as a preexisting condition and denying or canceling an insurance policy or requiring a higher premium or payment where the insured is or has been victim of domestic violence victim. New York Insurance Law §2612, with respect to all insurers regulated under the Insurance Law, provides that if any person covered by an insurance policy delivers to the insurer a valid order of protection against a policyholder or other person covered by the policy, then the insurer is prohibited for the duration of the order from disclosing to the policyholder or other person the address and telephone number of the insured, or of any person or entity providing covered services to the insured. If a child is a covered person, then the right established by this section may be asserted by the child’s parent or guardian. Insurance Law §2612 also requires a health insurer, as defined in that section, to accommodate a reasonable request made by a person covered by an insurance policy or contract to receive communications of claim related information by alternative means or at alternative locations if the person clearly states that disclosure of the information could endanger the person. If a child is the covered person, then this right may be asserted by the child’s parent or guardian. Except with the express consent of the person making the request, a health insurer may not disclose to the policyholder: (1) the address, telephone number, or any other personally identifying information of the person who made the request or child for whose benefit a request was made; (2) the nature of the health care services provided; or (3) the name or address of the provider of the covered services. The New York State Department of Financial Services (“Department”) has promulgated 11 NYCRR 244 (Insurance Regulation 168), which requires insurers to develop and implement confidentiality protocols. For health insurers, this also must include written procedures by which a person may make a reasonable request to receive communications of claim-related information by alternative means or at alternative locations and procedures for revoking such a request. For further information on domestic violence services, you can contact the New York State Domestic and Sexual Violence Hotline by dialing 1-800-942-6906 or by accessing the website for the New York State Office for the Prevention of Domestic Violence at the following link: http://www.opdv.ny.gov/help/dvhotlines.html. NY CLS Ins § 2612, provides as follows: “(a) No individual, insurer or entity subject to the supervision of the superintendent shall solely because a person is or has been a victim of domestic violence: “(1) refuse to issue or renew, deny or cancel any insurance policy or contract; “(2) demand or require a greater premium or payment from any person; “(3) designate domestic violence as a preexisting condition, for which coverage will be denied or reduced; “(4) fix any lower rate or discriminate in the fees or commissions of agents or brokers for writing or renewing such a policy. “(b) The fact that a person is or has been a victim of domestic violence is not a permitted underwriting criterion. “(c) For the purposes of this section, the following terms shall be defined as: “(1) “victim of domestic violence” shall be as defined by subdivision one of section four hundred fifty-nine-a of the social services law. (2) “insurer” shall mean an insurer, a corporation organized pursuant to article forty-three of this chapter, a municipal cooperative health benefit plan established pursuant to article forty-seven of this chapter, a health maintenance organization certified pursuant to article forty-four of the public health law or a provider issued a special certificate of authority pursuant to section four thousand four hundred three-a of such law, or an agent, representative or designee thereof regulated pursuant to this chapter. “(3) “policy” shall mean a policy of insurance issued pursuant to this chapter, a child health insurance plan issued pursuant to title one-A of article twenty-five of the public health law or medical assistance or health care services provided pursuant to title eleven or eleven-D of article five of the social services law. “(d) The prohibitions contained in subsection (a) of this section shall not preclude an insurer from taking any of the actions described in subsection (a) of this section so long as such insurer relies on underwriting criteria reasonably related to the physical or mental condition of a person, their property or claim history and the decision was based on sound underwriting and actuarial principles reasonably related to actual or anticipated loss experience. In such case the selection criteria permitted must be based on such principles. The insurer shall notify the insured of its specific reason or reasons for such decision. “(e) An insurer that complies with subsections (a), (f) and (g) of this section and acts reasonably and in good faith shall not be subject to civil or criminal liability on account of compliance with such subsections. “(f) If any person covered by an insurance policy issued to another person as the policyholder delivers to the insurer that issued the policy, at its home office, a valid order of protection against the policyholder, issued by a court of competent jurisdiction in this state, the insurer shall be prohibited for the duration of the order from disclosing to the policyholder the address and telephone number of the insured, or of any person or entity providing covered services to the insured. If a child is the covered person, the right established by this subsection may be asserted by, and shall also extend to, the parent or guardian of the child. The superintendent, in consultation with the commissioner of health and the office of children and family services and the office for the prevention of domestic violence, shall promulgate rules to guide and enable insurers to guard against the disclosure of the address and location of an insured who is a victim of domestic violence. “(g) If any person covered by a group insurance policy delivers to the insurer that issued the policy, at its home office, a valid order of protection against another person covered by the group policy, issued by a court of competent jurisdiction in this state, the insurer shall be prohibited for the duration of the order from disclosing to the person against whom the valid order of protection was issued the address and telephone number of the insured person covered by the order of protection, or of any person or entity providing covered services to the insured person covered by the order of protection. If a child is the covered person, the right established by this subsection may be asserted by, and shall also extend to, the parent or guardian of the child. The superintendent, in consultation with the commissioner of health, the office of children and family services and the office for the prevention of domestic violence, shall promulgate rules to guide and enable insurers to guard against the disclosure of the address and location of an insured who is a victim of domestic violence. “(h) “(1) For purposes of this subsection: “(A) “Claim related information” means all claim or billing information relating specifically to an insured, subscriber or person covered by an insurance policy or contract issued by the health insurer. “(B) “Health insurer” means an insurer licensed to write accident and health insurance or salary protection insurance in this state, a corporation organized pursuant to article forty-three of this chapter, a municipal cooperative health benefit plan established pursuant to article forty-seven of this chapter, a health maintenance organization certified pursuant to article forty-four of the public health law or a provider issued a special certificate of authority pursuant to section four thousand four hundred three-a of such law, or an agent, representative or designee thereof regulated pursuant to this chapter. “(2) “(A) A health insurer shall accommodate a reasonable request by a person covered by an insurance policy or contract issued by the health insurer to receive communications of claim related information from the health insurer by alternative means or at alternative locations if the person clearly states that disclosure of all or part of the information could endanger the person. “(B) If a child is covered by an insurance policy or contract issued by the health insurer, then the child’s parent or guardian may make a request to the health insurer pursuant to subparagraph (A) of this paragraph. “(3) A health insurer may require: a person to make a request pursuant to paragraph two of this subsection in writing; the request to contain a statement that disclosure of all or part of the claim related information to which the request pertains could endanger the person or child; and the specification of an alternative address, telephone number or other method of contact. “(4) With respect to an insurer authorized to write accident and health insurance in this state, this subsection shall apply only to a policy of accident and health insurance or a policy of salary protection insurance, as defined in subsection (a) of section one thousand one hundred thirteen of this chapter. “(5) Nothing in this subsection shall prevent, hinder, or otherwise affect the entry of an appropriate order made in the best interests of a child by a court of competent jurisdiction adjudicating disputed issues of child welfare or custody. “(6) Except with the express consent of the person making a request pursuant to subparagraph (A) of paragraph two of this subsection, a health insurer shall not disclose to the policyholder (i) the address, telephone number, or any other personally identifying information of the person who made the request or child for whose benefit a request was made; (ii) the nature of the health care services provided; or (iii) the name or address of the provider of the covered services. “(7) A health insurer that makes reasonable and good faith efforts to comply with this subsection shall not be subject to civil or criminal liability on the ground of non-compliance with this subsection. “(8) The superintendent, in consultation with the commissioner of health, the office of children and family services and the office for the prevention of domestic violence, shall promulgate rules to guide health insurers in guarding against the disclosure of the information protected pursuant to this subsection.” 14. What If You Have Questions? If you have questions or concerns regarding this statement, you should first contact us via email at compliance@hwkaufman.com. ©️2021 Atain Insurance Company. Products are underwritten by Atain Insurance Company and affiliated companies. Subject to underwriting guidelines, review and approval. The precise coverage offered is subject to the terms and conditions of the policies issued. Coverage may not be available in all jurisdictions. All Rights Reserved. | Privacy Policy | Terms and Conditions