HIPAA

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT A PARTICIPANT MAY BE USED AND DISCLOSED AND HOW A PARTICIPANT CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.

This Notice describes the legal obligations of Leslie Shields Insurance Services, LLC dba The Shields Agency (the "Business Associate") and its legal responsibilities regarding protected health information held by the Business Associate of participants of health plans ("Covered Entities") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"). This Notice has been drafted in accordance with the HIPAA Privacy Rule, contained in the Code of Federal Regulations at 45 CFR Parts 160 and 164. Terms not defined in this Notice have the same meaning as they have in the HIPAA Privacy Rule.

When we refer to participants in this Notice, we are referring to the participants of these Covered Entities.

Among other things, this Notice describes how this protected health information may be used or disclosed to carry out treatment, payment, or health care operations, or for any other purposes that are permitted or required by law on behalf of participants of these Covered Entities.

We are required to provide this Notice of Privacy Practices (the "Notice") to you pursuant to HIPAA. The HIPAA Privacy Rule protects only certain medical information known as "protected health information." Generally, protected health information is individually identifiable health information, including demographic information, collected from participants or created or received by a health care provider, a health care clearinghouse, a health plan, or the employer on behalf of its group health plan that relates to the participant's:

●      Past, present or future physical or mental health or condition;

●      Provision of health care; or

●      Past, present or future payment for the provision of health care.

If you have any questions about this Notice or about our privacy practices, please contact Leslie Shields Insurance Services, LLC dba The Shields Agency, located at 1617 Park Place Ave, Suite 110-LS, Fort Worth, TX 76110. Phone: 469.474.3106. Email: info@theshieldsagency.com.

Effective Date

This Notice is effective August19, 2026.

Our Responsibilities

We are required by law to:

●      Maintain the privacy of participant protected health information;

●      Provide participants with certain rights with respect to their protected health information;

●      Provide you with a copy of this Notice of our legal duties and privacy practices with respect to a participant's protected health information; and

●      Follow the terms of the Notice that is currently in effect.

We reserve the right to change the terms of this Notice and to make new provisions regarding a participant's protected health information that we maintain, as allowed or required by law. If we make any material change to this Notice, we will provide a participant with a copy of our revised Notice of Privacy Practices by mail to the last known address on file. Additionally, The Shields Agency will post its Notice of Privacy Practices on its website at www.theshieldsagency.com.

How We May Use and Disclose Participants' Protected Health Information

Under the law, we may use or disclose participant protected health information under certain circumstances without the participant's permission. The following categories describe the different ways that we may use and disclose a participant's protected health information. For each category of uses or disclosures we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment

We may use or disclose a participant's protected health information to facilitate medical treatment or services by providers. We may disclose medical information about a participant to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of a participant. For example, we might disclose information about a participant's prior prescriptions to a pharmacist to determine if prior prescriptions contraindicate a pending prescription.

For Payment

We may use or disclose a participant's protected health information to determine a participant's eligibility for benefits, to facilitate payment for the treatment and services a participant receives from health care providers, to determine benefit responsibility under the covered entity, or to coordinate covered entity's coverage. For example, we may tell a participant's health care provider about a participant's medical history to determine whether a particular treatment is experimental, investigational, or medically necessary, or to determine whether the Plan will cover the treatment. We may also share a participant's protected health information with a utilization review or pre-certification service provider. Likewise, we may share a participant's protected health information with another entity to assist with the adjudication or subrogation of health claims or to another health plan to coordinate benefit payments.

For Health Care Operations

We may use and disclose a participant's protected health information for other covered entity operations. These uses and disclosures are necessary to run the covered entity. For example, we may use medical information in connection with conducting quality assessment and improvement activities; underwriting, premium rating, and other activities relating to Plan coverage; submitting claims for stop-loss (or excess-loss) coverage; conducting or arranging for medical review, legal services, audit services, and fraud & abuse detection programs; business planning and development such as cost management; and business management and general administrative activities. If use or disclosure of protected health information is made for underwriting purposes, any such protected health information that is genetic information of an individual is prohibited from being used or disclosed.

To Other Parties

We may contract with other individuals or entities to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, these individuals will receive, create, maintain, use and/or disclose a participant's protected health information, but only after they agree in writing with us to implement appropriate safeguards regarding a participant's protected health information. For example, we may disclose a participant's protected health information to a third party to administer claims or to provide support services, such as utilization management, pharmacy benefit management or subrogation, but only after the third party enters into an agreement with us. No personal information will be shared with third parties or affiliates for marketing or promotional purposes.

As Required by Law

We will disclose a participant's protected health information when required to do so by federal, state or local law. For example, we may disclose a participant's protected health information when required by national security laws or public health disclosure laws.

To Avert a Serious Threat to Health or Safety

We may use and disclose a participant's protected health information when necessary to prevent a serious threat to a participant's health and safety, or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. For example, we may disclose a participant's protected health information in a proceeding regarding the licensure of a physician.

To Plan Sponsors

For the purpose of administering a Covered Entity, we may disclose protected health information to certain employees of an employer. However, those employees will use or disclose that information only as necessary to perform plan administration functions or as otherwise required by HIPAA, unless the participant whose PHI is in question has authorized further disclosures. A participant's protected health information cannot be used for employment purposes without a participant's specific authorization.

Special Situations

In addition to the above, the following categories describe other possible ways that we may use and disclose a participant's protected health information.

Public Health and Safety

We may disclose a participant's protected health information to support organ, eye, or tissue donation and transplantation, and for public health actions, including to prevent or control disease, injury, or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of product recalls; to notify a person who may have been exposed to a disease or condition; and to notify the appropriate government authority if we believe a participant has been the victim of abuse, neglect, or domestic violence, subject to the participant's agreement or legal requirement.

Specialized Government Functions

We may disclose a participant's protected health information as required by military command authorities if a participant is a member of the armed forces, or about foreign military personnel to the appropriate foreign authority; for workers' compensation or similar programs providing benefits for work-related injuries or illness; to correctional institutions or law enforcement officials if a participant is an inmate or in custody, where necessary for health care, safety, or security purposes; and to authorized federal officials for national security and intelligence activities authorized by law.

Legal and Law Enforcement Purposes

We may disclose a participant's protected health information in response to a court or administrative order, subpoena, warrant, summons, or similar lawful process, including in connection with a lawsuit or dispute (with efforts made to notify the participant or obtain a protective order where required), to health oversight agencies for activities such as audits, investigations, inspections, and licensure, and to law enforcement officials to identify or locate a suspect, report a crime, or address other legally permitted law enforcement purposes.

Coroners, Medical Examiners, and Funeral Directors

We may release protected health information to a coroner or medical examiner, for example to identify a deceased person or determine cause of death, and to funeral directors as necessary to carry out their duties.

Research

We may disclose a participant's protected health information to researchers when individual identifiers have been removed, or when an institutional review board or privacy board has reviewed the research proposal, established protocols to protect the privacy of the requested information, and approved the research.

Required Disclosures

Government Audits

We are required to disclose a participant's protected health information to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule.

Disclosures to a Participant

When a participant requests, we are required to disclose to a participant the portion of that participant's protected health information that contains medical records, billing records, and any other records used to make decisions regarding a participant's health care benefits. We are also required, when requested, to provide a participant with an accounting of most disclosures of a participant's protected health information where the disclosure was for reasons other than for payment, treatment or health care operations, and where the protected health information was not disclosed pursuant to a participant's individual authorization. Such requests must be made through the Covered Entity.

Other Disclosures

Personal Representatives

We will disclose a participant's protected health information to individuals authorized by a participant, or to an individual designated as a participant's personal representative, attorney-in-fact, etc., so long as a participant provides us with a written notice or authorization and any supporting documents (i.e., power of attorney). Note: Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief that a participant has been, or may be, subjected to domestic violence, abuse, or neglect by such person; that treating such person as a participant's personal representative could endanger a participant; or that, in the exercise of professional judgment, it is not in a participant's best interest to treat the person as a participant's personal representative.

Fundraising

Prior to disclosing a participant's protected health information in the case of fundraising efforts, the participant will be notified prior to receiving such fundraising communications. Such communication will provide the participant with the option of opting out of receiving such communications. Additionally, uses and disclosures of PHI for marketing purposes and disclosures that constitute a sale of PHI will require authorization.

Authorizations

Other uses or disclosures of a participant's protected health information not described above will only be made with a participant's written authorization. Where appropriate, most uses and disclosures of psychotherapy notes will require a participant's authorization. A participant may revoke written authorization at any time, so long as the revocation is in writing. Once we receive a participant's written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving a participant's written revocation.

A Participant's Rights

A participant has the following rights with respect to his or her protected health information:

Right to Access

A participant has the right to inspect and copy certain protected health information that may be used to make decisions about a participant's health care benefits. To inspect and copy a participant's protected health information, a participant must submit a request in writing to the Covered Entity. If a participant requests a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with the request. A participant also has the right to request electronic copies of certain protected health information in a designated record set, which we will provide in the electronic form and format requested if readily producible, or in a mutually agreed-upon readable electronic format otherwise. We may charge a reasonable fee for the labor and supplies involved. We may deny a request to inspect and copy in certain limited circumstances; a denied participant may request that the denial be reviewed by submitting a written request to the Covered Entity.

Right to Amend

If a participant feels that the protected health information we have about that participant is incorrect or incomplete, a participant may ask the Covered Entity to amend the information for as long as the information is kept by or for the Covered Entity. The request must be made in writing and include a supporting reason. We may deny the request if it is not in writing, does not include a reason, asks us to amend information not part of the medical information kept by or for the Plan, was not created by us (unless the original creator is no longer available to amend it), is not part of the information a participant would be permitted to inspect and copy, or is already accurate and complete. If we deny a request, the participant has the right to file a statement of disagreement, which will be included with any future disclosures of the disputed information.

Right to an Accounting of Disclosures

A participant has the right to request an accounting of certain disclosures of protected health information, not including disclosures for treatment, payment, or health care operations; disclosures made to the participant; disclosures made pursuant to authorization; disclosures to friends or family in the participant's presence or due to an emergency; disclosures for national security purposes; or disclosures incidental to otherwise permissible disclosures. Requests must be submitted in writing to the Covered Entity and must state a time period of not longer than six years, and should indicate the desired format. The first accounting requested within a 12-month period will be provided free of charge; additional requests may incur a reasonable fee, which we will disclose before proceeding.

Right to Request Restrictions

A participant has the right to request a restriction or limitation on protected health information used or disclosed for treatment, payment, or health care operations, or disclosed to someone involved in the participant's care or payment, such as a family member or friend. It is the participant's responsibility to notify any other entity that may be affected by the requested restriction. We are not required to agree to the request, but if we do, we will honor it until the participant revokes it or we notify the participant otherwise. Requests must be made in writing to the Covered Entity and specify what information to limit, whether the limit applies to use, disclosure, or both, and to whom the limit applies.

Right to Request Confidential Communications

A participant has the right to request that we communicate about medical matters in a certain way or at a certain location, for example, by contacting the participant only at work or by mail. Requests must be made in writing to the Covered Entity and specify how or where the participant wishes to be contacted; we will not ask the reason for the request and will accommodate all reasonable requests where disclosure could endanger the participant.

Right to Receive Notification of a Breach

A participant has the right to receive notification of any breach of protected health information. Notice will be provided within sixty (60) days of the breach being identified.

Right to a Paper Copy of This Notice

A participant has the right to a paper copy of this notice at any time, even if the participant has agreed to receive it electronically. A copy is available at www.theshieldsagency.com, or by contacting Leslie Shields Insurance Services, LLC dba The Shields Agency, located at 1617 Park Place Ave, Suite 110-LS, Fort Worth, TX 76110. Phone: 469.474.3106. Email: info@theshieldsagency.com.

Complaints

If you believe that your privacy rights have been violated, you may file a complaint with us or with the Office for Civil Rights. To file a complaint with us, contact Leslie Shields at Leslie Shields Insurance Services, LLC dba The Shields Agency, located at 1617 Park Place Ave, Suite 110-LS, Fort Worth, TX 76110. Phone: 469.474.3106. Email: info@theshieldsagency.com. All complaints must be submitted in writing. You will not be penalized, or in any other way retaliated against, for filing a complaint with the Office for Civil Rights or with us.