Security Incident Management Requirements For a Health Insurance Business

  Providing Quality Brokerage Products To Shelter Since 1996   

UniCare Contracting Instructions   (PLEASE FOLLOW CAREFULLY) 

1. Please print the following contract, and completely fill out all its pages.  2. Make a copy of your CURRENT insurance license. 

3. Obtain a copy of your E&O from Bea Hill at your home office.  You may contact her at 573‐214‐ 6919, or email at bhill@shelterinsurance.com. 

4. Please fax all of the below directly to Gateway Insurance Marketing  • Completed, entire contract 

• A copy of your current insurance license  • A copy of your E&O obtained from Bea Hill 

FAX TO: 

Gateway Insurance Marketing  Attn: UniCare Contracting  800‐553‐6440 

If you have any questions about this process, or UniCare products, please call Gateway at 800‐979‐ 6711, or send email to damiengs@ipa.net. 

Thanks, 

Social Security Number that corresponds to legal name as provided

BUSINESS MAILING ADDRESS

CITY STATE ZIP CODE

DATE OF BIRTH PHONE NO. FAX NO. E-MAIL ADDRESS

PHYSICAL BUSINESS ADDRESS (If different from business mailing address)

CITY STATE ZIP CODE

RESIDENT MAILING ADDRESS (IF APPLICABLE) RESIDENT COUNTY

RESIDENT CITY STATE ZIP CODE

RESIDENT PHONE NO. RESIDENT FAX NO. BENEFICIARY

BENEFICIARY RELATIONSHIP

BENEFICIARY MAILING ADDRESS (IF APPLICABLE) BENEFICIARY COUNTY

BENEFICIARY CITY STATE ZIP CODE PHONE NO.

AGEN T / AGENCY APPLICAT ION FOR APPOIN T MEN T

Section 1. Agency Information

Please state name and address exactly as it appears on file with the IRS

COMPANY NO. MBU RSR# RSM

ARE YOU A RESIDENT OF THIS STATE? PLEASE DESIGNATE STATE IN WHICH

YOU ARE REQUESTING APPOINTMENT. PLEASE CHECKAPPROPRIATE

ITEM: Full name of Agency

Please note that name and Tax I.D. must correspond. Incorrect information may result in a withholding tax of 31% on commissions.

Federal Employer Identification Number (Tax I.D. Number)

INDIVIDUAL/SOLE PROPRIETOR PARTNERSHIP CORPORATION OTHER (Please identify)

BUSINESS MAILING ADDRESS

CITY STATE ZIP CODE

PHONE NO. FAX NO. E-MAIL ADDRESS

( )

( )

252, 253, 276, or 365

ISG

YES NO

Pay commissions to:







Section 2. Writing Agent Information

Full name of Writing Agent Please note that name and Tax I.D. must correspond. Incorrect information may result in a withholding tax of 31% on commissions.

Social Security Number that corresponds to legal name as provided

( )

( )

( )

( ) ( )

UniCare Life & Health Insurance Company

UniCare Health Insurance Company of the Midwest (IN and IL only) UniCare Health Plans of the Midwest, Inc. (HMO only in IL/IN) UniCare Health Insurance Company of Texas (Texas only)

UniCare Health Plans of Texas, Inc. (HMO only in Texas) _{Please initial your selection.}

X

506-76-8011 Jeffrey R Stanley / Gateway Insurance Marketing

PO Box 550

Stockton MO 65785

417 276-4400 417 276-6798 gatewayi@ipa.net

Section 3. Writing Agent Qualifications

1. HAVE YOU EVER BEEN CONVICTED OF A FELONY INVOLVING FRAUD OR DECEIT? NO YES If yes, explain:

2. HAS YOUR AGENT’S LICENSE EVER BEEN SUSPENDED, REVOKED OR TERMINATED? NO YES If yes, explain:

3. ARE YOU CURRENTLY INVOLVED IN AN INSURANCE DEPARTMENT HEARING? NO YES If yes, explain:

4. DO YOU CURRENTLY HAVE ERRORS AND OMISSIONS COVERAGE? NO YES Carrier Name:

7. ARE YOU FLUENT IN A FOREIGN LANGUAGE?

NO YES If yes, please list:___________________________________________________ SPEAK READ WRITE

YES

6. DO YOU WANT YOUR NAME TO APPEAR ON COMPANY PUBLICATIONS?

NO YES

5. DO YOU UNDERSTAND THAT REQUIREMENTS FOR MAINTAINING YOUR CONTRACT WITH UNICARE INCLUDE COMPANY AVERAGE PERSISTENCY, PROFITABLE LOSS RATIO AND PRODUCTION AS AGREED UPON WITH YOUR REGIONAL SALES MANAGER? (if applicable)

Policy No: _________________________ Expiration Date: _________________________

8. I ACKNOWLEDGE THAT I HAVE READ AND WILL ABIDE BY THE UNICARE AGENT CODE OF ETHICS. YES

Agent/Sub-Agent

Please print name (as it appears on your Department of Insurance License)

Agent/Sub-Agent Signature (as it appears on your Department of Insurance License)

Date

UniCare Regional Sales Manager Please print name

Signature

Date Agency

Please print name (as it appears on your Department of Insurance License) and Title

Agency Signature (as it appears on your Department of Insurance License)

Date

X

X

UniCare Regional Sales Representative

Please print name

Signature

Date

X

X

Mike Murphy

Vice President, ISG Sales Jeffrey R Stanley

Agent/Sub-Agent

Please print name (as it appears on your Department of Insurance License)

Agent/Sub-Agent Signature (as it appears on your Department of Insurance License)

Date

Fair Credit Reporting Act: Public law 91-508 requires that we advise you that a routine inquiry may be made which will provide applicable information concerning character, general reputation, personal characteristics, and mode of living. Upon written request, additional information and scope of the report, if one is made, will be provided.

I understand that UniCare is not and shall not be liable to me nor shall liability to me be implied for any of the obligation owed to me by the agent/agency to which I am appointed. I understand that all commissions are payable to the agency/agent listed above. My compensation and/or reimbursement for expenses, if any, is strictly and solely a matter between the agency/agent listed above and myself; and under no circumstances whatsoever shall I have any claim against UniCare for compensation, commissions, expenses or any other payment. I agree to be bound by and to abide by the terms and conditions which exist under the agent agreement entered into between the agent/agency to which I am appointed and UniCare. UniCare shall have the right to enforce the agent agreement which exists between the agent/agency and UniCare as against me directly and may proceed against me directly. I understand that UniCare reserves the right to terminate my appointment. I agree that this Application for Employment and any subsequent appointment only pertains to the UniCare company or companies for which the agent/agency to which I am appointed has an Agent Agreement in effect.

I hereby authorize UniCare and/or its agent to make independent investigation of my background, references, character, past employment, education, criminal or police records including those maintained by both public and private organizations and all public records of the purpose of confirming the information contained on my Application and/or obtaining other information which may be material for my qualification for appointment.

I release UniCare and/or its agents and any person or entity, which provides information pursuant to this authorization from any and all liabilities, claims, or lawsuits in regards to the information obtained from any and all of the above referenced sources used.

I, the applicant or individual on behalf of an agency applicant, acknowledges that I have personally read, understood and completed this application.

I certify that all information that I have provided is true and correct to the best of my knowledge.

If an agency is applying, the agency warrants that and certifies that the individual signing on the agency behalf is authorized by the agency to complete and sign this agreement.

I, the undersigned applicant or individual on behalf of an agency applicant agree to the following:

This agreement consists of this Agent/Agency Agreement and Application for Appointment, the attached Terms and Conditions to the Agent Agreement, and attached commission schedule(s).

I acknowledge that I have personally read, understood and completed this Agent/Agency Agreement and Application for Appointment, the attached Agent Agreement Terms and Conditions, and attached commission schedule(s) in their entirety. I agree to all terms and conditions.

For Kentucky and Ohio Applicants only

(required statewide background investigation information)

MAIDEN NAME OR OTHER NAMES USED DRIVER’S LICENSE NUMBER STATE OF LICENSE

CITY STATE HOW LONG?

RACE* SEX* DATE OF BIRTH*

Previous address if you have lived at your current address for less than 2 years.

* NOTE: The above information is required for identification purposes only, and is in no manner used as qualifications for agent appointment. UniCare is an equal opportunity employer and does not discriminate on the basis of Sex, Race, Religion, Age (40 and over), Handicap or National origin.

Agency

Please print name (as it appears on your Department of Insurance License) and Title

Agency Signature (as it appears on your Department of Insurance License)

Date

X

X

Insurance or health maintenance organization ("HMO") coverage underwritten by UniCare Life & Health Insurance Company, UniCare Health Insurance Company of Texas (Texas only), UniCare Health Plans of Texas, Inc. (HMO only in Texas), UniCare Health Plans of the Midwest, Inc. (HMO only in IL/IN) or UniCare Health Insurance Company of the Midwest (IN and IL only). ® Registered Mark and SM Service Mark of WellPoint, Inc. © 2005 WellPoint, Inc. 10114 7/06

Q: What is a “Security Incident”?

You will note you have an obligation, as our Business Associate, to notify WellPoint, Inc. (“WellPoint”) if you have a “Security Incident”. The Security Rule defines a “Security Incident” as an attemptedor successfulunauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system, involving Protected Health Information that is created, received, maintained or transmitted by or on behalf of WellPoint in electronic form.

Q: How do we achieve compliance with the

requirement to report “attempted” Security

Incidents?

Since the Security Rule includes attempted unauthorized access, use, etc., we need to have notice of attempts to bypass your security mechanisms that protect electronic Protected Health Information. We recognize that the significant number of unauthorized, meaningless attempts to access, use, disclose, modify or destroy Protected Health Information in your information systems could make the reporting requirement formidable for you and for us. We believe we meet compliance with the notice requirement by

understanding what types of attempted incidents you experience today.

Q: When do I need to notify WellPoint of a

Security Incident?

Through the implementation of an extensive defense-in-depth security protection model, we help secure our information systems and the data within, from thousands of daily attempts to breach our network security. The following is a high level description of what we face in the area of “attempted” Security Incidents:

•pings on our firewall, •port scans,

•attempts to log on to a system or enter a database with an invalid password or username,

•denial-of-service attacks that do not result in a server being taken off-line,

•malware, such as worms or viruses, which do not penetrateour perimeter.

If you believe your “attempted” Security Incident activity is different than WellPoint’s, please provide us with a description of it.If we do not hear back from you, we will assume your “attempted” Security Incident activity is similar to WellPoint’s (adjusted for the size and complexity of your information systems).

We recognize that no set of defensive measures is foolproof and security breaches are a continuing possibility.

We need to be promptly notifiedif you experience any Security Incident that impacts the confidentiality, integrity or availability of WellPoint data. Below are some examples: April 15, 2005

Dear Valued Business Associate:

The HIPAA Security Rule will go into effect on April 20, 2005. This is a companion rule to the Privacy Rule that went into effect in April 2003. Essentially, the Security Rule better defines the types of security standards covered entities and their business associates must address, in order to protect the confidentiality, integrity and availability of Protected Health Information that is in electronic form.

• Your information systems are exposed to malicious code, such as a virus or worm, and such code could be

transmitted to WellPoint data or systems. • Unauthorized access is granted or

obtained to servers or workstations that contain WellPoint data or you discover that WellPoint data is being used, copied or destroyed inappropriately.

• You experience an attack or the compromise of a server or workstation containing WellPoint information requiring that it be taken offline. • Unauthorized access or disclosure has

occurred involving Protected Health Information, which is an obligation under the HIPAA Privacy Rule.

What Types of Incidents to Report?

IMPORTANT HIPAA INFORMATION

ACTION REQUIRED!

Q: How do I report a Security Incident to

WellPoint?

Should a reportable incident occur, promptly call 1-800-717-3662. We will need you to provide us with a description of the event, the steps taken to mitigate the damage incurred, and any measures taken to ensure a similar event does not reoccur.

In summary, WellPoint is requiring a communication from you beginning April 20, 2005, if the types of Security Incidents you experience are different than described above, or if you face a Security Incident that results in an impact to the confidentiality, integrity, or availability of WellPoint Information Systems or WellPoint data. If we do not receive a response from you, we will assume your experience with Security Incidents is similar to WellPoint’s.

We encourage you to contact your professional and legal advisors for further guidance on how the HIPAA Security mandate impacts you. For general information about HIPAA Security, please go to:

http://www.cms.hhs.gov/hipaa/hipaa2/default.asp

to review the final rule and associated documents from CMS. Should you have questions specific to this communication, please contact your WellPoint Representative. As always, WellPoint, Inc. and our affiliates are committed to maintaining the privacy and security of our member’s personal health information and our information systems.

We thank you for your continued support. • The date and time when the event was

discovered.

• Contact information for communications regarding the incident.

• A complete description of the event, its cause, and the effect it had on WellPoint systems and data. This should include the names of the affected systems, servers, programs and data.

• A description of the initial mitigation steps taken to contain the incident and an assessment of the level of

compromise to WellPoint data incurred by the business associate.

• A description of the plan to correct the compromises to WellPoint data and to prevent reoccurrence of the event in the future.

The “HIPAA Report” Must Include