Security Incident Management Requirements For a Health Insurance Business

Transcription

1 Providing Quality Brokerage Products To Shelter Since 1996 UniCare Contracting Instructions (PLEASE FOLLOW CAREFULLY) 1. Please print the following contract, and completely fill out all its pages. 2. Make a copy of your CURRENT insurance license. 3. Obtain a copy of your E&O from Bea Hill at your home office. You may contact her at , or at bhill@shelterinsurance.com. 4. Please fax all of the below directly to Gateway Insurance Marketing Completed, entire contract A copy of your current insurance license A copy of your E&O obtained from Bea Hill FA TO: Gateway Insurance Marketing Attn: UniCare Contracting If you have any questions about this process, or UniCare products, please call Gateway at , or send to damiengs@ipa.net. Thanks, Gateway Insurance Marketing Team

2 UniCare Life & Health Insurance Company UniCare Health Insurance Company of the Midwest (IN and IL only) UniCare Health Plans of the Midwest, Inc. (HMO only in IL/IN) UniCare Health Insurance Company of Texas (Texas only) UniCare Health Plans of Texas, Inc. (HMO only in Texas) Section 1. Agency Information (Please Print) Please state name and address exactly as it appears on file with the IRS AGEN T / AGENCY APPLICAT ION FOR APPOIN T MEN T COMPANY NO. MBU RSR# RSM 252, 253, 276, or 365 ISG PLEASE DESIGNATE STATE IN WHICH YOU ARE REQUESTING APPOINTMENT. Full name of Agency Please note that name and Tax I.D. must correspond. Incorrect information may result in a withholding tax of 31% on commissions. BUSINESS MAILING ADDRESS ARE YOU A RESIDENT OF THIS STATE? YES NO Pay commissions to: agency writing agent Please initial your selection. Check here if you are a Farmers Agent PLEASE CHECK APPROPRIATE ITEM: INDIVIDUAL/SOLE PROPRIETOR PARTNERSHIP CORPORATION OTHER (Please identify) Federal Employer Identification Number (Tax I.D. Number) CITY STATE ZIP CODE PHONE NO. FA NO. ADDRESS Section 2. Writing Agent Information Full name of Writing Agent Please note that name and Tax I.D. must correspond. Incorrect information may result in a withholding tax of 31% on commissions. BUSINESS MAILING ADDRESS Social Security Number that corresponds to legal name as provided CITY STATE ZIP CODE DATE OF BIRTH PHONE NO. FA NO. ADDRESS PHYSICAL BUSINESS ADDRESS (If different from business mailing address) CITY STATE ZIP CODE RESIDENT MAILING ADDRESS (IF APPLICABLE) RESIDENT COUNTY RESIDENT CITY STATE ZIP CODE RESIDENT PHONE NO. RESIDENT FA NO. BENEFICIARY BENEFICIARY RELATIONSHIP Social Security Number that corresponds to legal name as provided BENEFICIARY MAILING ADDRESS (IF APPLICABLE) BENEFICIARY COUNTY BENEFICIARY CITY STATE ZIP CODE PHONE NO.

3 Section 3. Writing Agent Qualifications 1. HAVE YOU EVER BEEN CONVICTED OF A FELONY INVOLVING FRAUD OR DECEIT? NO YES If yes, explain: 2. HAS YOUR AGENT S LICENSE EVER BEEN SUSPENDED, REVOKED OR TERMINATED? NO YES If yes, explain: 3. ARE YOU CURRENTLY INVOLVED IN AN INSURANCE DEPARTMENT HEARING? NO YES If yes, explain: 4. DO YOU CURRENTLY HAVE ERRORS AND OMISSIONS COVERAGE? NO YES Carrier Name: 6. DO YOU WANT YOUR NAME TO APPEAR ON COMPANY PUBLICATIONS? NO YES Policy No: 5. DO YOU UNDERSTAND THAT REQUIREMENTS FOR MAINTAINING YOUR CONTRACT WITH UNICARE INCLUDE COMPANY AVERAGE PERSISTENCY, PROFITABLE LOSS RATIO AND PRODUCTION AS AGREED UPON WITH YOUR REGIONAL SALES MANAGER? (if applicable) Expiration : 7. ARE YOU FLUENT IN A FOREIGN LANGUAGE? NO YES If yes, please list: SPEAK READ WRITE 8. I ACKNOWLEDGE THAT I HAVE READ AND WILL ABIDE BY THE UNICARE AGENT CODE OF ETHICS. YES YES Agent/Sub-Agent UniCare Regional Sales Representative Please print name (as it appears on your Department of Insurance License) Agent/Sub-Agent Signature (as it appears on your Department of Insurance License) Please print name Signature Agency UniCare Regional Sales Manager Please print name (as it appears on your Department of Insurance License) and Title Agency Signature (as it appears on your Department of Insurance License) Please print name Signature Mike Murphy Vice President, ISG Sales

4 Fair Credit Reporting Act: Public law requires that we advise you that a routine inquiry may be made which will provide applicable information concerning character, general reputation, personal characteristics, and mode of living. Upon written request, additional information and scope of the report, if one is made, will be provided. I understand that UniCare is not and shall not be liable to me nor shall liability to me be implied for any of the obligation owed to me by the agent/agency to which I am appointed. I understand that all commissions are payable to the agency/agent listed above. My compensation and/or reimbursement for expenses, if any, is strictly and solely a matter between the agency/agent listed above and myself; and under no circumstances whatsoever shall I have any claim against UniCare for compensation, commissions, expenses or any other payment. I agree to be bound by and to abide by the terms and conditions which exist under the agent agreement entered into between the agent/agency to which I am appointed and UniCare. UniCare shall have the right to enforce the agent agreement which exists between the agent/agency and UniCare as against me directly and may proceed against me directly. I understand that UniCare reserves the right to terminate my appointment. I agree that this Application for Employment and any subsequent appointment only pertains to the UniCare company or companies for which the agent/agency to which I am appointed has an Agent Agreement in effect. I hereby authorize UniCare and/or its agent to make independent investigation of my background, references, character, past employment, education, criminal or police records including those maintained by both public and private organizations and all public records of the purpose of confirming the information contained on my Application and/or obtaining other information which may be material for my qualification for appointment. I release UniCare and/or its agents and any person or entity, which provides information pursuant to this authorization from any and all liabilities, claims, or lawsuits in regards to the information obtained from any and all of the above referenced sources used. I, the applicant or individual on behalf of an agency applicant, acknowledges that I have personally read, understood and completed this application. I certify that all information that I have provided is true and correct to the best of my knowledge. If an agency is applying, the agency warrants that and certifies that the individual signing on the agency behalf is authorized by the agency to complete and sign this agreement. I, the undersigned applicant or individual on behalf of an agency applicant agree to the following: This agreement consists of this Agent/Agency Agreement and Application for Appointment, the attached Terms and Conditions to the Agent Agreement, and attached commission schedule(s). I acknowledge that I have personally read, understood and completed this Agent/Agency Agreement and Application for Appointment, the attached Agent Agreement Terms and Conditions, and attached commission schedule(s) in their entirety. I agree to all terms and conditions. For Kentucky and Ohio Applicants only (required statewide background investigation information) MAIDEN NAME OR OTHER NAMES USED DRIVER S LICENSE NUMBER STATE OF LICENSE Previous address if you have lived at your current address for less than 2 years. CITY STATE HOW LONG? RACE* SE* DATE OF BIRTH* * NOTE: The above information is required for identification purposes only, and is in no manner used as qualifications for agent appointment. UniCare is an equal opportunity employer and does not discriminate on the basis of Sex, Race, Religion, Age (40 and over), Handicap or National origin. Agent/Sub-Agent Agency Please print name (as it appears on your Department of Insurance License) Agent/Sub-Agent Signature (as it appears on your Department of Insurance License) Please print name (as it appears on your Department of Insurance License) and Title Agency Signature (as it appears on your Department of Insurance License)

5 Insurance or health maintenance organization ("HMO") coverage underwritten by UniCare Life & Health Insurance Company, UniCare Health Insurance Company of Texas (Texas only), UniCare Health Plans of Texas, Inc. (HMO only in Texas), UniCare Health Plans of the Midwest, Inc. (HMO only in IL/IN) or UniCare Health Insurance Company of the Midwest (IN and IL only). Registered Mark and SM Service Mark of WellPoint, Inc WellPoint, Inc /06

6 April 15, 2005 Dear Valued Business Associate: IMPORTANT HIPAA INFORMATION ACTION REQUIRED! The HIPAA Security Rule will go into effect on April 20, This is a companion rule to the Privacy Rule that went into effect in April Essentially, the Security Rule better defines the types of security standards covered entities and their business associates must address, in order to protect the confidentiality, integrity and availability of Protected Health Information that is in electronic form. Q: What is a Security Incident? You will note you have an obligation, as our Business Associate, to notify WellPoint, Inc. ( WellPoint ) if you have a Security Incident. The Security Rule defines a Security Incident as an attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system, involving Protected Health Information that is created, received, maintained or transmitted by or on behalf of WellPoint in electronic form. Q: How do we achieve compliance with the requirement to report attempted Security Incidents? Since the Security Rule includes attempted unauthorized access, use, etc., we need to have notice of attempts to bypass your security mechanisms that protect electronic Protected Health Information. We recognize that the significant number of unauthorized, meaningless attempts to access, use, disclose, modify or destroy Protected Health Information in your information systems could make the reporting requirement formidable for you and for us. We believe we meet compliance with the notice requirement by understanding what types of attempted incidents you experience today. Q: When do I need to notify WellPoint of a Security Incident? Through the implementation of an extensive defense-in-depth security protection model, we help secure our information systems and the data within, from thousands of daily attempts to breach our network security. The following is a high level description of what we face in the area of attempted Security Incidents: pings on our firewall, port scans, attempts to log on to a system or enter a database with an invalid password or username, denial-of-service attacks that do not result in a server being taken off-line, malware, such as worms or viruses, which do not penetrateour perimeter. If you believe your attempted Security Incident activity is different than WellPoint s, please provide us with a description of it. If we do not hear back from you, we will assume your attempted Security Incident activity is similar to WellPoint s (adjusted for the size and complexity of your information systems). We recognize that no set of defensive measures is foolproof and security breaches are a continuing possibility. We need to be promptly notified if you experience any Security Incident that impacts the confidentiality, integrity or availability of WellPoint data. Below are some examples: What Types of Incidents to Report? Your information systems are exposed to malicious code, such as a virus or worm, and such code could be transmitted to WellPoint data or systems. Unauthorized access is granted or obtained to servers or workstations that contain WellPoint data or you discover that WellPoint data is being used, copied or destroyed inappropriately. You experience an attack or the compromise of a server or workstation containing WellPoint information requiring that it be taken offline. Unauthorized access or disclosure has occurred involving Protected Health Information, which is an obligation under the HIPAA Privacy Rule.

7 Q: How do I report a Security Incident to WellPoint? Should a reportable incident occur, promptly call We will need you to provide us with a description of the event, the steps taken to mitigate the damage incurred, and any measures taken to ensure a similar event does not reoccur. In summary, WellPoint is requiring a communication from you beginning April 20, 2005, if the types of Security Incidents you experience are different than described above, or if you face a Security Incident that results in an impact to the confidentiality, integrity, or availability of WellPoint Information Systems or WellPoint data. If we do not receive a response from you, we will assume your experience with Security Incidents is similar to WellPoint s. The HIPAA Report Must Include The date and time when the event was discovered. Contact information for communications regarding the incident. A complete description of the event, its cause, and the effect it had on WellPoint systems and data. This should include the names of the affected systems, servers, programs and data. A description of the initial mitigation steps taken to contain the incident and an assessment of the level of compromise to WellPoint data incurred by the business associate. A description of the plan to correct the compromises to WellPoint data and to prevent reoccurrence of the event in the future. We encourage you to contact your professional and legal advisors for further guidance on how the HIPAA Security mandate impacts you. For general information about HIPAA Security, please go to: to review the final rule and associated documents from CMS. Should you have questions specific to this communication, please contact your WellPoint Representative. As always, WellPoint, Inc. and our affiliates are committed to maintaining the privacy and security of our member s personal health information and our information systems. We thank you for your continued support. Registered Mark of WellPoint, Inc. 4/05