C-P FLEXIBLE PACKAGING, INC. EMPLOYEE BENEFIT PLAN
HIPAA NOTICE OF PRIVACY PRACTICES -
Effective Date: 4/14/2004

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE, PLEASE CONTACT THE C-P FLEXIBLE PACKAGING, INC. EMPLOYEE BENEFIT PLAN PRIVACY OFFICER (Nancy Schrum) THROUGH THE HUMAN RESOURCES DEPARTMENT.

Protected Health Information (PHI) is information, including demographic information, that may identify you and that relates to health care services provided to you, the payment of health care services provided to you, or your physical or mental health or condition, in the past, present or future. This Notice of Privacy Practices describes how we may use and disclose your PHI. It also describes your rights to access and control your PHI.

As a group health plan we are required by Federal law to maintain the privacy of PHI and to provide you with this notice of our legal duties and privacy practices.

We are required to abide by the terms of this Notice of Privacy Practices, but reserve the right to change the Notice at any time. Any change in the terms of this Notice will be effective for all PHI that we are maintaining at that time. If a change is made to this Notice, a copy of the revised Notice will be provided to all individuals covered under the C-P Flexible Packaging, Inc. Employee Benefit Plan at that time.

PERMITTED USES AND DISCLOSURES

Treatment, Payment and Health Care Operations
Other Uses and Disclosures Allowed Without Authorization

Federal law also allows a group health plan to use and disclose PHI, without your consent or authorization, in the following ways:

Treatment. Treatment refers to the provision and coordination of health care by a doctor, hospital or other health care provider. As a group health plan we do not provide treatment; however, we may disclose your PHI, for example, the name of your treating dentist, to a treating orthodontist, so that the orthodontist may ask for your dental x-rays from your treating dentist.

Payment. Payment refers to the activities of a group health plan in collecting premiums and paying claims under the plan for health care services you receive. Examples of uses and disclosures under this section include the sending of PHI to an external medical review company to determine the medical necessity or experimental status of a treatment; sharing PHI with other insurers to determine coordination of benefits or settle subrogation claims; providing PHI to the plan's utilization review ("UR") for precertification or case management services; providing PHI in the billing, collection and payment of premiums and fees to plan vendors such as PPO Networks, UR Companies, Prescription Drug Card Companies and reinsurance carriers; and sending PHI to a reinsurance carrier to obtain reimbursement of claims paid under the plan.

Health Care Operations. Health Care Operations refers to the basic business functions necessary to operate a group health plan. Examples of uses and disclosures under this section include conducting quality assessment studies to evaluate the plans performance or the performance of a particular network or vendor; the use of PHI in determining the cost impact of benefit design changes; the disclosure of PHI to underwriters for the purpose of calculating premium rates and providing reinsurance quotes to the plan; the disclosure of PHI to stop-loss or reinsurance carriers to obtain claim reimbursements to the plan; disclosure of PHI to plan consultants who provide legal, actuarial and auditing services to the plan; and use of PHI in general data analysis used in the long term management and planning for the plan and company.

Other Uses and Disclosures Allowed Without Authorization
Federal law also allows a group health plan to use and disclose PHI, without your consent or authorization, in the following ways:

• To you, as the covered individual,
  
• ?To a personal representative designated by you to receive PHI or a personal representative designated by law such as the parent or legal guardian of child, or the surviving family members or representative of the estate of a deceased individual.
  
• To the Secretary of Health and Human Services (HHS) or any employee of HHS as part of an investigation to determine our compliance with the HIPAA Privacy Rules.
  
• To a Business Associate as part of a contracted agreement to perform services for the group health plan.
  
• To a health oversight agency, such as the Department of Labor (DOL), the Internal Revenue Service (IRS) and the Insurance Commissioner's Office, to respond to inquiries or investigations of the plan, requests to audit the plan, or to obtain necessary licenses.
  
• To public health officials to prevent public health risks, including (a) to prevent or control disease, injury or disability; (b) to report births and deaths; (c) to report child abuse or neglect; (d) to report reactions to medications or problems with products; (e) to notify people of recalls of products they may be using; (f) to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and (g) to notify the appropriate government authority if we believe you have been the victim of abuse, neglect or domestic violence.
  
• To military authorities, as required, if you are a member or veteran of the armed forces.
  
• To authorized federal officials for intelligence, counterintelligence and national security activities authorized by law, or to conduct special investigations and provide protection to the President of the United States.
  
• In response to a court order, subpoena, discovery request or other lawful judicial or administrative proceeding.
  
• As required for law enforcement purposes. For example to notify authorities of a criminal act.
  
• As required to comply with Workers' Compensation or other similar programs established by law.
  
• To the Plan Sponsor, as necessary to carry out administrative functions of the plan such as evaluating renewal quotes for reinsurance of the plan, funding check registers, reviewing claim appeals, approving subrogation settlements and evaluating the performance of the plan.
  
• In providing you with information about treatment alternatives and health services that may be of interest to you as a result of a specific condition that the plan is case managing. The examples of permitted uses and disclosures listed above are not provided as an all inclusive list of the ways in which PHI may be used. They are provided to describe in general the types of uses and disclosures that may be made.

OTHER USES AND DISCLOSURES

Other uses and disclosures of your PHI will only be made upon receiving your written authorization. You may revoke an authorization at any time by providing written notice to us that you wish to revoke an authorization. We will honor a request to revoke as of the day it is received and to the extent that we have not already used or disclosed your PHI in good faith with the authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the benefits provided to you through the C-P Flexible Packaging, Inc. Employee Benefit Plan.

YOUR RIGHTS IN RELATION TO PROTECTED HEALTH INFORMATION

Right to Request Restrictions on Uses and Disclosures
You have the right to request that the plan limit its uses and disclosures of PHI in relation to treatment, payment and health care operations or not use or disclose your PHI for these reasons at all. You also have the right to request the plan restrict the use or disclosure of your PHI to family members or personal representatives. Any such request must be made in writing to the Privacy Contact listed in this Notice and must state the specific restriction requested and to whom that restriction would apply.

The plan is not required to agree to a restriction that you request. However, if it does agree to the requested restriction, it may not violate that restriction except as necessary to allow the provision of emergency medical care to you.

Right to Receive Confidential Communications
You have the right to request that communications involving PHI be provided to you at an alternative location or by an alternative means of communication. The plan is required to accommodate any reasonable request if the normal method of disclosure would endanger you and that danger is stated in your request. Any such request must be made in writing to the Privacy Contact listed in this Notice.

Right to Access to Your Protected Health Information
You have the right to inspect and copy your PHI that is contained in a designated record set for as long as the plan maintains the PHI. A designated record set contains claim information, premium and billing records and any other records the plan has created in making claim and coverage decisions relating to you. Federal law does prohibit you from having access to the following records: psychotherapy notes; information complied in reasonable anticipation of, or for use in a civil, criminal or administrative action or proceeding; and PHI that is subject to a law that prohibits access to that information. If your request for access is denied, you may have a right to have that decision reviewed. Requests for access to your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Amend Protected Health Information
You have the right to request that PHI in a designated record set be amended for as long as the plan maintains the PHI. The plan may deny your request for amendment if it determines that the PHI was not created by the plan, is not part of designated record set, is not information that is available for inspection, or that the PHI is accurate and complete. If your request for amendment is declined, you have the right to have a statement of disagreement included with the PHI and the plan has a right to include a rebuttal to your statement, a copy of which will be provided to you. Requests for amendment of your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Receive an Accounting of Disclosures
You have the right to receive an accounting of all disclosures of your PHI that the plan has made, if any, for reasons other than disclosures for treatment, payment and health care operations, as described above, and disclosures made to you or your personal representative. Your right to an accounting of disclosures applies only to PHI created by the plan after April 14, 2003 and cannot exceed a period of six years prior to the date of your request. Requests for an accounting of disclosures of your PHI should be directed to the Privacy Contact listed in this Notice.

Right to Receive a Paper Copy of this Notice
You have the right to receive a paper copy of this Notice upon request. This right applies even if you have previously agreed to accept this Notice electronically. Requests for a paper copy of this Notice should be directed to the Privacy Contact listed in this Notice.

COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with the plan or the Secretary of Health and Human Services. Complaints should be filed in writing with the Privacy Contact listed in this Notice. The plan will not retaliate against you for filing a complaint.

PRIVACY CONTACT
You may contact the Privacy Officer for the plan (Nancy Schrum) through your employer's Human Resources Department at (717) 764-1193.