NOTICE OF PRIVACY PRACTICES

NOTICE OF PRIVACY PRACTICES

FOR

Pipeline Industry Benefit Fund (“PLAN”)

Effective Date of this Notice: February 16, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are committed to safeguarding your protected health information (“PHI”) and ensuring compliance with applicable federal privacy laws. Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), we are required to give you this Notice explaining your rights, and our privacy practices and legal duties, concerning your PHI. PHI is individually identifiable health information that we create or receive, and that relates to your health, health care, or payment for your health care. We will limit any permitted use or disclosure of your PHI to what is minimum necessary for the purpose, except when this limit does not apply such as, for example, disclosures to or authorized by you.

CONTACT INFORMATION FOR PLAN. For questions or notifications relating to this Notice or our privacy practices, or to exercise your rights, contact the Plan’s Privacy Officer as follows:                                           

Privacy Officer

Fund Director, P.O. Box 470950, Tulsa, OK 74147-0950

Telephone: (918) 280-4800

support@pibf.org

YOUR RIGHTS. You have the following rights for your PHI which must be exercised in writing.

  • “Get a Copy or See Your PHI”. You can ask to see or get a copy of the PHI we have about you. We will provide a copy or summary, usually within 30 days after receiving your request, and may charge a reasonable, cost-based fee. We may deny your request in limited circumstances permitted by law, but if we do, we will explain the reasons for denial, your review rights, and how to file a complaint with the Plan or U.S. Department of Health and Human Services (“HHS).
  • “Ask Us to Amend Your PHI”. You can ask us to amend your PHI if you think it is incorrect or incomplete. We may deny your request in certain circumstances permitted by law, but if we do, within 60 days after receiving your request we will explain the reasons for denial, your review rights and how to file a complaint with the Plan or HHS.
  • “Get a List of Our Disclosures of Your PHI”. You can ask for a list (accounting) of the times we have shared your PHI for up to six (6) years before the date of your request, who we shared it with, and why. We will provide a list of the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any authorized by you or made for law enforcement purposes or specialized government functions). We will provide one (1) accounting a year for free but will charge a reasonable cost-based fee if you ask for another one within 12 months.
  • “Ask Us to Limit What We Use or Share”. You can ask us not to use or share certain PHI for treatment, payment, or health care operations. We do not have to agree to your request, and we may say “no” if it would affect your care. 
  • “Request Confidential Communications”. You can ask us to contact you in a specific way (for example, by using your home or office phone or sending mail to a different address). We will consider all reasonable requests and will say “yes” if you tell us you would be in danger if we do not. 
  • “Get a Copy (Including a Paper Copy) of this Notice”. You are entitled to receive a copy of this Notice and can ask for a paper copy at any time, even if you agreed to receive the Notice electronically. We will provide a paper copy to you promptly after receiving your request.
  • “Right to be Notified of a Breach”. You have the right to be notified of a breach of your unsecured PHI, and we will notify you following discovery as required by law.  
  • “Choose Someone to Act for You”. You may authorize a person to act as your personal representative or attorney by providing us with sufficient notice and authorization. That person can exercise your rights and receive and make choices about your PHI. We will confirm the person is authorized and can act in your best interest before acting. A parent is usually the personal representative of an unemancipated minor child unless otherwise provided by state law or court order.
  • “File a Complaint if You Feel Your Rights Are Violated”. You can complain if you feel we have violated your privacy rights, or mishandled your substance use disorder records, by contacting the Plan using its contact information. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, visiting www.hhs.gov/ocr/privacy/hipaa/complaints/, or calling 1-877-696-6775. We will not retaliate against you for filing a complaint.  

HOW WE MAY USE AND DISCLOSURE YOUR PHI. By law, we may use or share your PHI in the following ways without your authorization. Examples are included to help you understand. Not every use or disclosure is listed, but they will all fall within one of the ways listed.

  • “Help Manage the Health Care Treatment You Receive”. Treatment means providing, coordinating, managing, or facilitating your health care treatment and services. Your PHI may also be used for communications to you about treatment alternatives or health-related benefits (we may not receive payment for these types of communications). Example: We may provide PHI to your physician for your treatment.
  • “For the Plan’s Health Care Operations”. Health care operations are the Plan’s business operations and activities related to its functioning as a health plan and providing health benefits to you. They include quality assessment, coordination of care, obtaining health insurance or reinsurance, legal services, auditing functions, and administrative activities. Example: We may share PHI with our consultants to project future benefit costs; however, we may not use your genetic information for underwriting purposes. 
  • “Payment for Your Health Services”. Payment means actions taken to ensure that your health care treatment and services are properly billed and paid by the Plan. They include coverage determinations, coordination of benefits, claims management, reimbursement, and collections. Example: If you have an inpatient stay, we may confirm your Plan coverage with the hospital for billing and payment. 
  • “To Plan Sponsor”. The Plan’s Board of Trustees is the Plan Sponsor. The Plan may provide PHI to the Trustees and Plan office employees as needed to perform administrative functions for the Plan. They are required to protect the privacy of all PHI they receive. PHI cannot be used for employment purposes. Example: We may share PHI with the Trustees to decide a participant’s appeal.
  • “To Business Associates”. Business Associates are persons or entities that provide services on the Plan’s behalf (such as consulting, actuarial, accounting, legal, and third-party administrative services). They are required to sign a written agreement obligating them to implement privacy safeguards to protect PHI before PHI is disclosed. Example: We may provide PHI to our attorney to assist in defending against a lawsuit.    
  • “To Family, Friends, and Others”. We may disclose PHI to a family member, close friend, or other person identified by you who is involved with your health care or payment. If you are unable to tell us your preference (for example, due to an emergency or lack of capacity), we may disclose your PHI to family members or others involved in your care if we believe it is in your best interest. 
  • “For Covered Dependents”. We may disclose an unemancipated minor’s PHI to the parent unless otherwise provided by law. The PHI for all other covered dependents (such as a spouse or child age 18 or older) will be disclosed to the dependent.  

How Else Can We Use or Share Your PHI? We are allowed or required to share your PHI as listed below, which are usually ways that contribute to the public good such as public health and research. We must meet many conditions in the law before we can share your PHI for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.  

  • “Help With Public Health and Safety Issues”. We can share your PHI for certain situations such as: (1) preventing or controlling disease or injury; (2) reporting births or deaths; (3) helping with product recalls; (4) reporting adverse reactions to medications; (5) reporting suspected abuse, neglect, or domestic violence; and (6) preventing or reducing a serious threat to anyone’s health or safety.
  • “Do Research”. We can use or share your PHI for health research when individual identifiers have been removed or an institutional or privacy review board has established privacy protocols and approved it.
  • “Comply With the Law”. We can share your PHI when required by applicable law, including with HHS regarding our compliance with federal privacy law.
  • “Respond to Organ and Tissue Donation Requests and Work With a Medical Examiner or Funeral Director”. We can share your PHI with organ procurement organizations to facilitate donation and transplantation, as well as with a coroner, medical examiner, or funeral director when an individual dies.
  • “Address Workers’ Compensation, Law Enforcement, and Other Government Requests”.  We can use and share your PHI for workers’ compensation or similar claims; for law enforcement purposes or with a law enforcement official; with health oversight agencies for activities authorized by law; to assist with disaster relief efforts as permitted by law; and for special government functions such as military (for military personnel), national security, and presidential protective services. 
  • “Respond to Lawsuits and Legal Actions”. We can share your PHI in response to a court or administrative order, or to a subpoena, discovery request or lawful process, subject to certain conditions.

Other Uses and Disclosures Requiring Your Authorization. Uses and disclosures that involve the following, and those not described above, will only be made with your written authorization that complies with HIPAA or as provided by applicable law. If you authorize us to use or share your PHI, you may change your mind at any time by notifying the Plan in writing, and it will be effective only for future uses and disclosures.

  • Marketing Purposes.
  • Sale of PHI.
  • Psychotherapy Notes (Limited Exceptions Apply).
  • Substance Use Disorder (SUD) Treatment Records. These are records for treatment from a federally assisted program that could identify you as having or having had a SUD. They are subject to stringent federal privacy protections under 42 CFR Part 2 (“Part 2”). We will not use or disclose your SUD treatment records, or testimony about them, in civil, criminal, administrative, or legislative proceedings against you without (a) your written consent, or (b) a court order accompanied by a subpoena or other legal mandate compelling disclosure. If we disclose your SUD treatment records to an entity not covered by HIPAA, that information may be redisclosed by the recipient and may no longer be protected by federal privacy laws. You have the right to request restrictions on how your SUD treatment records are used or disclosed for treatment, payment, or health care operations. A separate consent is required for the use and disclosure of SUD counseling notes (limited exceptions apply).

OUR RESPONSIBILITIES AND RIGHTS. We have the following responsibilities and rights as required by applicable federal law.

  • We are Required to Maintain the Privacy and Security of your PHI and Follow the Terms of Our Notice Currently In Effect.
  • We Must Notify You Promptly if We Discover a Breach of Your Unsecured PHI.
  • We Have the Right to Change this Notice for all PHI We Maintain. This Notice will remain in effect unless we replace it. If we do, we must provide the new Notice to you by mail, by posting on our website, and upon your request.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.