Protecting our Data

Premera expects all records to be properly recorded and authorized by management. For example, making records appear as though payments were made to one person when, in fact, they were made to another, or submitting expense reports that do notaccurately reflect the true nature of an
expense, is not allowed.

Providing false information, verbally or in writing, is also prohibited. This includes intentionally misrepresenting facts during investigations, audits, process reviews, and any other fact-finding efforts taken on behalf of Premera orany regulators examining Premera. As with everything else we do, record keeping must be driven by honesty, authenticity, and integrity.

Q & A

What should I do if I suspect my manager is using company funds for personal use?

Employees with a reasonable basis for believing internal fraud has occurred have a responsibility to report such incidents to the Internal Audit Department. Premera prohibits employees from engaging in retaliation, retribution, or any form ofharassment against an employee for reporting fraud-related issues or concerns in good faith, or for participating in or cooperating with an investigation.

Premera provides email, chat, and video conferencing software for business purposes. All use must follow corporate and departmental policies. We reserve the right to monitor and disclose the contents of electronic media and communications, where permitted by law.

We must not use Premera resources to send offensive communications. This includes jokes or graphics that would violate our policies regarding unlawful retaliation, harassment, and discrimination. We should treat others as they want to betreated. Conduct all communications in a professional and respectful manner.

Part of delivering excellent service means using Premera’s assets in the way theyare intended to be used. These assets include, but are not limited to the following:

• Equipment
• Company property and buildings
• Corporate funds
• Office supplies
• Employees’ work time
• Business strategies and plans
• Financial data, records, and work files
• Other confidential information about our business and our customers

We must not use our assets for personal gain or for the benefit of others. Because such assets belong to Premera, they should not be transferred to others outside the course of normal business. For more information, see our Company Access to Information and Property Policy.

Premera, like other healthcare organizations, is frequently targeted by attackers who want to steal data or disrupt our operations. To protect our members’ sensitive information and ensure that we can provide uninterrupted service, it’s important thatall employees follow our cybersecurity policies, which include the following:

• Access Permissions
• Computer, Network, and Telephone Usage
• Computer Passwords
• Cryptography
• Cybersecurity Incident Response
• Device and Media Controls
• Email and Other Electronic Communications

Much of what we handle as employees is confidential and subject to government regulations. Private information includes Premera customer information and any information about our business, our employees, or any third party doing business with Premera that is not generally available to the public.

Confidentiality is key to how we conduct business. Improper use or disclosure ofthis information could cause harm to the company. We all need to actively protect Premera’s confidential information. Do the Right Thing continues even after an employee leaves Premera.

Examples of Premera’s confidential information include, but are not limited to:

• Protected personal information (PPI), which by definition includes protected health information (PHI)
• Financial data
• Internal systems data
• Pricing or product information
• Sales and marketing figures
• Underwriting information
• Lists of customer groups or individuals
• Changes in management or policies
• Provider reimbursement or contracting information
• Information about Premera’s relationships with government and regulatory agencies, as well as public and private organizations
• Plans for improving any of our products or services
• Confidential customer information
• Vendor contracts, terms, and pricing

Q & A

Is it okay to share Premera information with my sister who works at Kaiser Permanente and could use the help to do her job?

No, you must not use or disclose such information for any purpose other than to perform your job functions. You should take necessary precautions to prevent the inadvertent disclosure of confidential information to others.

Please note, if a family member works for a competitor or supplier, including any provider of medical services, or is employed by a governmental agency that may interact with Premera, it must be fully disclosed to Regulatory Compliance & Ethics.

Some employees will have access to trade secrets. It’s important that these not be shared. The Washington Uniform Trade Secrets Act (WUTSA), located at Chapter 108 of Title 19 of the Revised Code of Washington, protects our company’s trade secrets. This includes an employee’s work on confidential projects and business strategies for Premera. The WUTSA prohibits employees from disclosing not only written or electronic documents, but also information recreated from memory. Employees’ must continue to protect Premera’s trade secrets even after they stop working with Premera.

Employees need to safeguard the confidential and protected personal information (PPI) of our members. This requires constant care and vigilance. It’s something that we take seriously. For example, we should always be careful to avoid discussing matters related to work being done at Premera in public places and even in the common areas within our buildings. We must make sure that discussions involving member PPI or confidential information only occur around employees authorized to haveaccess to such information and who need to know the information to carry out their duties for Premera.

One way to protect confidential information is to ensure it is appropriately marked. The chart below contains basic information about marking your documents. For additional information, please see our Marking Guidelines.

If content is intended for public viewing, ensure it contains appropriate Premera branding.

Laws and regulations govern the length of time we must retain company records. If Premera is involved in a lawsuit or a government investigation or audit, related records must not be destroyed until the matter is closed. Destroying or changing documents related to a legal or regulatory matter is forbidden.

Before destroying any records, refer to the Records Management policy. Employees can also consult with their records coordinator or visit the Data Governance site.

Just as we take the confidentiality of customer information seriously, we do the same for our employees. We take necessary steps to prevent the accidental disclosure of employee information to others. Private employee information includes, but is not limited to these examples:

• Medical or claims information
• Social Security and bank account information
• Wage and salary information
• Performance information
• Reasons for termination of employment
• Demographic information such as age and address
• Other personal information

Only people who are authorized to process employee claims should have access to a limited subset of employee data to perform their duties. Employees may not have access to their data or their family members’ data. Employees may not review the data of a family member or even their own data as part of their work. If such information is needed, it must be accessed only through the member portal on the Premera member website. Anyone who has access to employee data without being on the authorized list of users should email the Group 14-16 mailbox immediately. Employees with past access who no longer need access to this data should have their manager submit a ServiceNow ticket to remove access.

Protecting confidential information about our third-party partners is just as important as what we do for our members and employees. These partners include suppliers and vendors. We project this type of information, including trade secrets, forour third-party vendors.

For example, laws prohibit employees’ unauthorized disclosure or use of another company’s trade secrets. Employees should also honor any contractual commitments they may be subject to that prohibit disclosure or use of any former employer’sconfidential or proprietary information.

Although Premera is not a publicly traded company, employees may become aware of non-public or “inside” information about other companies that may affect an investor’s decision to buy or sell investments. Employees who become aware of such information may not use it to buy or sell securities of that company and may not share that information with others.

Q & A

Whom can I contact with Privacy questions?

Your manager, your department Privacy Liaison.

We follow federal and state privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This law protects the financial and health information of our members. We use the following privacy principles to guide our actions:

Customers: We provide customers with a full array of privacy protections that align with federal and state privacy laws. This is a values-based approach focused on our primary core value: Do the Right Thing.

Employers: Employers that contract with Premera are not allowed to view all the health data of their employees. We will provide the level of employee health information to employers and producers (also known as brokers or agents) basedon the specific employer contract. Refer questions to the Privacy Program staff.

We create, collect, receive, maintain, transmit, use, and disclose protected personal information (PPI), such as name, date of birth, address, and claim information, to pay claims and otherwise serve our customers. We work diligently to comply with federaland state privacy laws that govern the ways we handle our customers’ PPI. Before handling this type of information, employees should discuss it with their department’s privacy liaison or Premera’s Privacy Program staff.

Where appropriate, we use technical and/or physical security safeguards, such as encrypted emails, badges to enter our buildings, and security guards, to ensure our privacy policies are followed.

Q & A

Whom can I contact with security questions?

You can email Information Security Awareness to reach Cyber Risk Management.

Premera maintains a culture of the highest ethical standards to protect the privacy and security of Premera Technology Resources. We expect company resources to be used in ways that are consistent with Premera’s business interests and align with the Code of Conduct.

Employees may have access to Premera technology resources to conduct business on behalf of Premera and are responsible for following all policies, procedures, and standards. All Premera technology resources and the data stored on them are always the property of Premera. Anyone with access to Premera technology resources should not expect privacy when using company equipment. It’s also important to know that any activity using Premera technology resources may be monitoredat any time without notice.

Q & A

If I need to send a file for business purposes that is too big to send via email, what should I do?

Never upload PPI or other business information to a file transfer website unless this has been specifically approved (check with your manager or your department’s Privacy Liaison if you aren’t sure). Instead, email Premera’s Electronic TransmissionCenter through the ETC mailbox and they can discuss other secure options with you.

We are committed to ensuring the security of our facilities and electronic systems to prevent unauthorized access to Premera’s and our customers’ PPI.

We are expected to be aware of and follow established corporate and departmental policies, processes, and procedures that are designed to secure our buildings and electronic systems in compliance with HIPAA security requirements. We are all responsiblefor maintaining the security of our campuses and buildings.

Q & A

Someone walked in the door behind me without “badging” in. Is that okay?

No, you should question the presence of the individual. Report the incident to Security immediately by calling 425-918-8888 or emailing safety&security@premera.com.

Employees are not allowed to use company assets to access and use social media sites, cloud storage sites, file transfer websites, or AI or machine learning technologies (such as generative AI) that are not approved by Premera. Widespread use of suchsites in the workplace can lead to increased risk of unauthorized disclosure of PPI, as well as increased risk of a malicious software infection.

Corporate Communications decides who, officially, represents Premera and may post information to social media sites about our company and our products. This includes answering questions from customers and other consumers. Employees who do not officiallyrepresent Premera should ensure that any comments made about Premera are clearly labeled as personal comments. Employees who have been approved to access social media sites from Premera assets are expected to use their best judgment, just as whenusing the phone or email. When in doubt, employees should discuss performance expectations with their manager.

Q & A

Who can I talk to for more information about social media?

You can contact Corporate Communications at: corpcomm@premera.com

Artificial Intelligence (AI) is rapidly emerging as a transformative technology that promises unprecedented opportunities and efficiencies across all industries, including healthcare. Premera has established a Responsible AI Program that is committedto the development, deployment, and governance of AI applications in a responsible, ethical, legally compliant, transparent, secure, and socially beneficial way while unlocking AI’s transformative potential.

Use good judgment when posting images such as clip art and photographs or including them in emails or other communications. Employees who take photographs in the workplace and share them online should ensure that no work products, includingimages such as computer screens, team noticeboards, and company documents, are visible. Additionally, no pictures of other employees should be shared without their permission.

Many of our corporate and departmental policies apply to online activities, such as the prohibition on sharing PPI. Specifically, employees must not disclose PPI or any other Premera confidential or proprietary information online. Just asPPI may never be sent via email without first being marked “confidential” to encrypt and secure it, PPI may never be sent to either an internal or external recipient via an internet file-transfer cloud service website that is not specificallyapproved for that purpose by Cyber Risk Management. Uses or disclosures of PPI that are allowed by corporate and departmental policy, but that are too large to be transferred by confidential email or other secure electronic channels, should bedone through the Electronic Transmission Center.