combined medefense plus / e-md for social services...

12
- 1 - Revised 02/19/19 Combined MEDEFENSE ® Plus / e-MD ® For Social Services Agencies NAS Insurance’s MEDEFENSE ® Plus / e-MD ® program offers simplified underwriting for two of our most popular healthcare insurance products. Qualified social services agencies can simply complete the short application, choose a limit, and send in a bind request for their desired coverage. If MEDEFENSE ® Plus and e-MD ® are purchased together, there is a significant discount applied to the premium amount. MEDEFENSE ® Plus Coverage Components Billing Errors — coverage for defense costs and regulatory fines and penalties incurred in billing errors proceedings brought by governmental payors, contractors working on behalf of the government, such as Recovery Audit Contractors (RAC) and Zone Program Integrity Contractors (ZPIC), and Commercial Payors. Qui tam actions are also covered. Pre-approved Shadow Audits – billing errors proceedings coverage extends to shadow audit expenses incurred in pre-approved shadow audits, which are proven to significantly reduce restitution amounts. Voluntary Self-Disclosure - coverage for investigations/proceedings resulting from voluntary self-disclosure. HIPAA, EMTALA STARK — coverage for defense costs and regulatory fines and penalties incurred in proceedings/investigations brought by government agencies alleging violations of HIPAA (Patient Privacy), EMTALA (Emergency Medical Treatment and Active Labor Act) or STARK/anti-kickback laws (Self-Referral). Broad Policy Language eliminates the need to schedule Insured Persons. Full Unknown Prior Acts coverage is available. Free Choice of Counsel – reimbursement policy provides free choice of counsel for all covered proceedings. e-MD ® Coverage Components Multimedia Liability – Duty to defend coverage for third party claims alleging liability resulting from the dissemination of online or offline media material, including claims alleging copyright/trademark infringement, libel, slander, plagiarism or personal injury. Security & Privacy Liability – Duty to defend coverage for third party claims alleging liability resulting from a security breach or privacy breach, including failure to safeguard electronic or non-electronic confidential information or failure to prevent virus attacks, denial of service attacks or the transmission of malicious code from an insured computer system to the computer system of a third party. Privacy Regulatory Defense and Penalties - Duty to defend coverage for regulatory fines and penalties and/or regulatory compensatory awards incurred in privacy regulatory proceedings/investigations brought by federal, state, or local governmental agencies, such as proceedings/investigations alleging HIPAA violations. Breach Event Costs – Coverage for reasonable and necessary mitigation costs and expenses incurred as a result of a privacy breach, security breach or adverse media report, including legal expenses, public relations expenses, advertising and IT forensic expenses, postage, and the cost to provide call centers, credit monitoring and identity theft assistance. Proactive Privacy Breach Response Costs (sub-limit of Breach Event Costs) - Coverage for public relations expenses incurred in response to a security breach or privacy breach, but prior to the publication of an adverse media report, in an effort to avert or mitigate reputational harm which could result from the adverse media report. Voluntary Customer Notification Expenses (sub-limit of Breach Event Costs) - Coverage for expenses incurred in notifying parties of a privacy breach where there is no requirement by law to do so.

Upload: others

Post on 27-Jul-2020

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 1 - Revised 02/19/19

Combined MEDEFENSE® Plus / e-MD®

For Social Services Agencies

NAS Insurance’s MEDEFENSE® Plus / e-MD® program offers simplified underwriting for two of our most popular healthcare insurance products. Qualified social services agencies can simply complete the short application, choose a limit, and send in a bind request for their desired coverage. If MEDEFENSE® Plus and e-MD® are purchased together, there is a significant discount applied to the premium amount.

MEDEFENSE® Plus Coverage Components

• Billing Errors — coverage for defense costs and regulatory fines and penalties incurred in billing errors proceedings brought by governmental payors, contractors working on behalf of the government, such as Recovery Audit Contractors (RAC) and Zone Program Integrity Contractors (ZPIC), and Commercial Payors. Qui tam actions are also covered.

• Pre-approved Shadow Audits – billing errors proceedings coverage extends to shadow audit expenses incurred in pre-approved shadow audits, which are proven to significantly reduce restitution amounts.

• Voluntary Self-Disclosure - coverage for investigations/proceedings resulting from voluntary self-disclosure.

• HIPAA, EMTALA STARK — coverage for defense costs and regulatory fines and penalties incurred in proceedings/investigations brought by government agencies alleging violations of HIPAA (Patient Privacy), EMTALA (Emergency Medical Treatment and Active Labor Act) or STARK/anti-kickback laws (Self-Referral).

• Broad Policy Language eliminates the need to schedule Insured Persons.

• Full Unknown Prior Acts coverage is available.

• Free Choice of Counsel – reimbursement policy provides free choice of counsel for all covered proceedings.

e-MD® Coverage Components

• Multimedia Liability – Duty to defend coverage for third party claims alleging liability resulting from the dissemination of online or offline media material, including claims alleging copyright/trademark infringement, libel, slander, plagiarism or personal injury.

• Security & Privacy Liability – Duty to defend coverage for third party claims alleging liability resulting from a security breach or privacy breach, including failure to safeguard electronic or non-electronic confidential information or failure to prevent virus attacks, denial of service attacks or the transmission of malicious code from an insured computer system to the computer system of a third party.

• Privacy Regulatory Defense and Penalties - Duty to defend coverage for regulatory fines and penalties and/or regulatory compensatory awards incurred in privacy regulatory proceedings/investigations brought by federal, state, or local governmental agencies, such as proceedings/investigations alleging HIPAA violations.

• Breach Event Costs – Coverage for reasonable and necessary mitigation costs and expenses incurred as a result of a privacy breach, security breach or adverse media report, including legal expenses, public relations expenses, advertising and IT forensic expenses, postage, and the cost to provide call centers, credit monitoring and identity theft assistance.

• Proactive Privacy Breach Response Costs (sub-limit of Breach Event Costs) - Coverage for public relations expenses incurred in response to a security breach or privacy breach, but prior to the publication of an adverse media report, in an effort to avert or mitigate reputational harm which could result from the adverse media report.

• Voluntary Customer Notification Expenses (sub-limit of Breach Event Costs) - Coverage for expenses incurred in notifying parties of a privacy breach where there is no requirement by law to do so.

Page 2: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 2 - Revised 02/19/19

• BrandGuard® - Coverage for loss of net profit incurred as a direct result of an adverse media report or notification to affected individuals following a security breach or privacy breach.

• Network Asset Protection – Coverage for reasonable and necessary amounts incurred to recover and/or replace electronic data that is compromised, damaged, lost, erased or corrupted due to (1) accidental damage or destruction of electronic media or computer hardware, (2) administrative or operational mistakes in the handling of electronic data, or (3) computer crime/attacks including malicious code and denial of service attacks. Coverage also extends to business income loss and interruption expenses incurred because of a total or partial interruption of an insured computer system directly caused by any of the above events.

• Cyber Extortion – Coverage for extortion expenses incurred and extortion monies paid as a direct result of a credible cyber extortion threat.

• Payment Card Industry Data Security Standard (PCI DSS) Liability – Duty to defend coverage for assessments, fines, or penalties imposed by banks or credit card companies due to non-compliance with the Payment Card Industry Data Security Standard (PCI DSS) or payment card company rules.

• Cyber Crime – Coverage for loss of money or securities incurred due to financial fraud, including wire transfer fraud; charges incurred for unauthorized calls resulting from fraudulent use of an insured telephone system; expenses incurred to notify customers of phishing schemes that impersonate the Insured or the Insured’s brands, products or services, and the costs of reimbursing customers for losses resulting from such phishing schemes.

Program Highlights

▪ Broad Coverage for data that is stored with a third party including, including BPO service providers, outsourced IT providers and independent contractors

▪ Worldwide coverage - claims can be brought outside of the U.S. ▪ Network Asset Protection coverage triggers include accidental damage or destruction, administrative and

operational mistakes as well as computer crimes, including acts of cyber terrorism ▪ Separate Breach Event Costs Limit ▪ Property Damage exclusion does not apply to electronic data ▪ Includes coverage for breach of corporate information ▪ Acts committed by rogue employees are covered, as well as privacy claims brought by employees ▪ Multimedia Liability and Security & Privacy Liability includes coverage for liability assumed under contract ▪ Extended Reporting Period available for 1-3 years ▪ Dependent Business Interruption Sublimit is available by endorsement for additional premium

Program Qualifications

• Must not have experienced any privacy or security claims/incidents in the past 3 years

• Must have firewall and anti-virus system in place

• Must be a social services agency with revenues of $50,000,000 or less

Note - coverage cannot be bound under the terms and conditions of this program for Applicants that do not fall within the program qualifications; however, Applicants may be considered for coverage outside the program.

Page 3: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 3 - Revised 02/19/19

Risk Management Website Access

The purchase of e-MD® through this program now includes access to NAS Insurance’s Cyber Risk Management Website, which provides valuable training and resources to help mitigate a breach. The website offers quick and easy access to: Online Compliance Materials – Federal and state compliance materials regarding data security, data breaches and data privacy, including:

• Quick tips on many subjects

• Summaries of and links to relevant federal and state laws

• Sample policies and procedures

• Continuing updates and electronic notification of significant changes to online materials Training Programs

• Webinar training with podcasts

• Training bulletins

• Online training programs

• Awareness bulletins and posters Step-by-Step Procedures to Reduce Risk – Procedures and online forms to help you:

• Understand the scope of “personal information” (PI)

• Determine where PI is stored

• Collect and/or retain the minimum amount of PI as required for business needs

• Properly destroy PI that is no longer needed, including record destruction procedures Actions to Take When a Breach Occurs – Information you need to:

• Comply with breach notification laws

• Establish an incident response team

• Report a data breach

Page 4: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 4 - Revised 02/19/19

Limit

Limit is subject to and in excess of a self insured retention. Higher limit options available by request.

$1,000,000 LIMIT

I. Multimedia Liability $1,000,000

II. Security and Privacy Liability $1,000,000

III. Privacy Regulatory Defense and Penalties $1,000,000

IV. Breach Events Costs $1,000,000

Proactive Privacy Breach Response Costs Sublimit $25,000

Voluntary Notification Expenses Sublimit $1,000,000

V. BrandGuard® $1,000,000

VI. Network Asset Protection $1,000,000

VII. Cyber Extortion $1,000,000

VIII. Cyber Crime $250,000

IX. PCI DSS Liability $1,000,000

X. MEDEFENSE® Plus $1,000,000

Maximum Policy Aggregate Limit of Liability: $1,000,000

MEDEFENSE® Plus / e-MD® Program Rates Rates are valid through 12/31/2019

Aggregate Limit capped at $1,000,000

Gross Projected Revenues

Limits Per Claim/ Aggregate

MEDEFENSE® Stand-Alone

Premium

MEDEFENSE® Retroactive

Date*

e-MD® Stand-Alone Premium**

e-MD® Retroactive

Date *

MEDEFENSE® Plus / e-MD®

Combined Pricing

Retention

$0-$5M $1M / 1M $1,848 None $2,000 None $3,664 $2,500

$5.1M - $10M $1M / 1M $3,696 None $3,801 None $6,828 $2,500

$10.1M - $15M $1M / 1M $4,690 None $4,642 None $8,230 $2,500

$15.1M - $20M $1M / 1M $6,020 None $5,296 None $10,231 $2,500

$20.1M - $25M $1M / 1M $7,350 None $6,466 None $12,469 $2,500

$25.1M - $30M $1M / 1M $9,250 None $7,328 None $15,055 $5,000 $30.1M - $35M $1M / 1M $11,172 None $8,190 None $17,509 $5,000 $35.1M - $40M $1M / 1M $12,348 None $9,053 None $19,351 $5,000 $40.1M - $45M $1M / 1M $13,524 None $9,915 None $21,512 $5,000 $45.1M - $50M $1M / 1M $14,700 None $10,777 None $23,382 $5,000

Over $50M Refer to NAS

*Retroactive Date: None. Unknown prior acts covered. **Includes access to NAS’ Cyber Risk Management website. Click here for full details.

Page 5: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 5 - Revised 02/19/19

How to Purchase MEDEFENSE® Plus / e-MD®

1. Fully complete the MEDEFENSE® Plus / e-MD® Short Form Application, including the attached Surplus Lines form for non-CA risks or D1 Disclosure Notice for CA risks.

2. Calculate the premium from the premium chart. 3. Sign, date and return the completed application to your broker with your check for the premium, plus

state taxes, policy issuance fee and any applicable broker fee. The application must be signed by an owner, Principal, CEO or COO no later than 45 days prior to binding.

Policy & Endorsement Links

Rates apply to the MEDEFENSE® Plus / e-MD® Program, written by NAS on Policy Form P1818CE-0716 and endorsed with:

Nuclear Incident Exclusion Clause (E1818NIE-0111) U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) Advisory Notice to Policyholders

(E1818US-0315) Policyholder Disclosure Notice of Terrorism Insurance Coverage (E1856J-1117) Breach Event Costs Outside Limits (E1818CER-0816) Dependent Business Interruption Sublimit Blanket Provider Coverage (E1818CEEF-0217), if applicable

Page 6: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

A1818CMBO-0217 Page 6 of 12

e-MD®/MEDEFENSE® Plus

Application

NOTICE: THIS APPLICATION IS FOR CLAIMS-MADE AND REPORTED COVERAGE WITH DEFENSE COSTS

PAID WITHIN THE LIMITS OF LIABILITY. READ THE ENTIRE APPLICATION CAREFULLY. APPLICANT

IS REQUIRED TO MAKE INTERNAL INQUIRY BEFORE COMPLETING THIS APPLICATION.

I. APPLICANT INFORMATION (“You” or “Your” identified in this application shall mean the Applicant)

Name of Applicant (Legal Entity Name): (as it should appear on the policy)

Principal Address:

City: State: Zip Code:

Telephone: Facsimile: E-mail Address:

Website:

1. Total number of Full Time Equivalent (FTE) physicians in your group:

(1 full time physician counts as 1 FTE. 2 part time physicians count as 1 FTE)

2. Name of the Medical Malpractice carrier that insures the physicians. If none, please indicate “N/A” _____________

3. Date operations commenced under current ownership:

4. Description of operations:

5. Annual Revenues: Current Year: One Year Ago: Two Years Ago:

6. Do You own any subsidiaries?................................................................................................................. YES NO

If You answered “YES” to question 6 above, please provide a list of Your subsidiaries with an explanation of each

subsidiary’s a) nature of operations, b) relationship to You, and c) percentage of ownership by You. Please use a separate

sheet of paper, if necessary:

7. Do Your operations include chiropractic care, oncology, alternative medicine, wellness treatment,

acupuncture, anti-aging services, hormone modification, naturopathic services, pain management, or

physical or occupational therapy?............................................................................................................ YES NO

II. COVERAGE SELECTION

Type of Coverage: Standalone e-MD® Standalone MEDEFENSE® Plus Combined e-MD®/MEDEFENSE® Plus

Limit Desired: $ Requested Effective Date (mm/dd/yyyy): (coverage may not be backdated)

III. MEDEFENSE® PLUS QUESTIONS

Please complete Section III only if standalone MEDEFENSE® Plus or Combined e-MD®/MEDEFENSE® Plus

coverage is desired.

For question 8, if the answer is “NO”, please provide an explanation on a separate sheet of paper and submit with

this Application.

8. Are You utilizing a current edition of the CPT manual to ensure billing compliance?........................ YES NO

Page 7: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

A1818CMBO-0217 Page 7 of 12

For questions 9-16, if the answer is “YES”, please provide an explanation on a separate sheet of paper and submit with

this Application.

9. Do Your billings from federal and state health care programs, such as Medicare and Medicaid,

exceed $50,000,000?..............................................................................................................................

YES NO

10. Have You or any physician in Your group ever been audited or investigated, or received a request

for records or other documentation by or on behalf of a commercial payer or government

entity?.....................................................................................................................................................

YES NO

11. Have You or any physician in Your group ever been placed on pre-payment review for

Medicare/Medicaid billing practices or utilization of Medicare/Medicaid

services?.................................................................................................................................................

YES NO

12. Have You or any physician in Your group ever had to refund amounts to Public and/or Private

payers that exceed $10,000?.................................................................................................................

YES NO

a. If You answered “YES” to question 12, were these refunds due to an audit, allegation of

improper billing, or voluntary self-disclosure?...............................................................................

b. If You answered “YES” to question 12.a., please provide the total amount of refunds (list

refunds to public and private payers separately):

YES NO

13. Have You or any physician in Your group ever been accused of billing errors by any government

agency or commercial payer?................................................................................................................

YES NO

14. Have You or any physician in Your Group ever:

a. Been investigated or sanctioned by a state medical licensing board?.............................................

b. Been involved in a Stark/anti-kickback investigation?...................................................................

c. Been sued or deselected by a private commercial payer?...............................................................

d. Been investigated for EMTALA violations?...................................................................................

e. Been investigated for HIPAA violations?.......................................................................................

f. Voluntarily disclosed any billing errors or irregular billing practices?..........................................

YES NO

YES NO

YES NO

YES NO

YES NO

YES NO

15. Have You ever been non-renewed, placed on extension, or declined from similar

coverage?...............................................................................................................................................

YES NO

16. Do You or any individual proposed for this insurance have knowledge of any facts, circumstances,

allegations, situations, events, incidents or billing errors that could give rise to a regulatory

investigation, regulatory action, or demand for restitution?..................................................................

YES NO

IV. e-MD® QUESTIONS

Please complete Section IV only if standalone e-MD® or Combined e-MD®/MEDEFENSE® Plus coverage is desired.

17. Do You use a cloud provider to store data? YES NO

If “Yes”, please name the cloud provider:

If You use more than one cloud provider to store data, please name the cloud provider storing the largest quantity of

customer and/or employee records, including medical records, personal health information, social security numbers,

bank account details, and credit card numbers.

For questions 18–23, if the answer is “NO”, please provide an explanation on a separate sheet of paper and submit

with this Application.

18. Do You have a HIPAA compliance program in place?............................................................................ YES NO

Page 8: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

A1818CMBO-0217 Page 8 of 12

19. Do You use anti-virus software and firewall protection on all desktops, portable devices and mission

critical servers?..........................................................................................................................................

YES NO

20. Do You enforce privacy and security policies that must be followed by all employees, contractors, or

other individuals or organizations with access to patient information?....................................................

YES NO

21. If Your organization stores personal information on portable devices, including laptops, cell phones,

PDAs, back-up tapes, USB thumb drivers and external hard drives, is such data encrypted to industry

standards?..................................................................................................................................................

If You do not store personal information on portable devices, check here

YES NO

22. Do Your security and privacy policies include mandatory training for all employees?........................... YES NO

23. Do You accept, transmit, process or store any payment cardholder data?...............................................

If “YES”, are You compliant with the Payment Card Industry Data Security

Standard?..................................................................................................................................................

YES NO

YES NO

For questions 24-26, if the answer is “YES”, please provide an explanation on a separate sheet of paper and submit with

this Application.

24. Does the number of records you store, either electronic or paper, exceed 100,000?...............................

If “Yes”, please provide the total number of records stored by the Applicant(s): _____________

YES NO

25. Have You or any physician in Your group received any complaints or claims or been the subject in

litigation involving matters of privacy injury, identity theft, denial of service attacks, computer virus

infections, theft of information, damage to third-party networks or Your customer’s ability to rely on

Your network?..........................................................................................................................................

YES NO

26. Are You or any physician in Your group aware of any security breaches, privacy-related incidents, or

allegations of breach of privacy?.............................................................................................................. YES NO

V. NOTICE TO APPLICANT

A. The Applicant represents that the statements and information contained in this application are true and complete.

B. The Applicant acknowledges that the statements and information contained in this application shall be deemed material

to the risk assumed by the insurer; that any policy will have been issued in reliance upon the truth thereof; and that this

application will be deemed incorporated into and made a part of the policy, should a policy be issued.

C. The Applicant acknowledges and agrees that if the information supplied on this application changes between the date

of the application and the inception date of the policy period, the Applicant will immediately notify the insurer of such

change, and the insurer may modify or deny coverage.

Signed: Date: Authorized signature of the President, CEO or COO of the Applicant

Must be signed and dated no more than 45 days prior to binding coverage.

Print Name: Title:

Page 9: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

A1818CMBO-0217 Page 9 of 12

VI. PAYMENT INSTRUCTIONS

Premium: $

Taxes & Fees: $

Policy Issuance Fee*: $

Broker fee: $

TOTAL PAYMENT $

*Policy issuance fees may vary by state, with $175 being the maximum. If the Applicant is located outside of CA,

Underwriters will confirm the policy issuance fee at the time of binding.

If this risk is subject to surplus lines tax, you must arrange for filing the affidavit and for payment of the applicable

state tax/fees in addition to the premium.

• Policy fee is fully earned.

• Written policies are subject to a minimum earned premium of 25%.

• No flat cancellations.

VII. FILING INSTRUCTIONS

Please complete the D-1 Form for CA risks or the Surplus Lines Form for risks located outside CA (except for Kentucky).

Page 10: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

- 10 -

NOTICE: 1. THE INSURANCE POLICY THAT YOU ARE APPLYING TO PURCHASE IS BEING ISSUED BY AN

INSURER THAT IS NOT LICENSED BY THE STATE OF CALIFORNIA. THESE COMPANIES ARE CALLED “NONADMITTED” OR “SURPLUS LINE” INSURERS.

2. THE INSURER IS NOT SUBJECT TO THE FINANCIAL SOLVENCY REGULATION AND ENFORCEMENT THAT APPLY TO CALIFORNIA LICENSED INSURERS.

3. THE INSURER DOES NOT PARTICIPATE IN ANY OF THE INSURANCE GUARANTEE FUNDS CREATED BY CALIFORNIA LAW. THEREFORE, THESE FUNDS WILL NOT PAY YOUR CLAIMS OR PROTECT YOUR ASSETS IF THE INSURER BECOMES INSOLVENT AND IS UNABLE TO MAKE PAYMENTS AS PROMISED.

4. THE INSURER SHOULD BE LICENSED EITHER AS A FOREIGN INSURER IN ANOTHER STATE IN THE UNITED STATES OR AS A NON-UNITED STATES (ALIEN) INSURER. YOU SHOULD ASK QUESTIONS OF YOUR INSURANCE AGENT, BROKER, OR “SURPLUS LINE” BROKER OR CONTACT THE CALIFORNIA DEPARTMENT OF INSURANCE AT THE FOLLOWING TOLL-FREE TELEPHONE NUMBER: 1-800-927-4357 OR INTERNET WEB SITE WWW.INSURANCE.CA.GOV. ASK WHETHER OR NOT THE INSURER IS LICENSED AS A FOREIGN OR NON-UNITED STATES (ALIEN) INSURER AND FOR ADDITIONAL INFORMATION ABOUT THE INSURER. YOU MAY ALSO CONTACT THE NAIC’S INTERNET WEB SITE AT WWW.NAIC.ORG.

5. FOREIGN INSURERS SHOULD BE LICENSED BY A STATE IN THE UNITED STATES AND YOU MAY CONTACT THAT STATE’S DEPARTMENT OF INSURANCE TO OBTAIN MORE INFORMATION ABOUT THAT INSURER.

6. FOR NON-UNITED STATES (ALIEN) INSURERS, THE INSURER SHOULD BE LICENSED BY A COUNTRY OUTSIDE OF THE UNITED STATES AND SHOULD BE ON THE NAIC’S INTERNATIONAL INSURERS DEPARTMENT (IID) LISTING OF APPROVED NONADMITTED NON-UNITED STATES INSURERS. ASK YOUR AGENT, BROKER, OR “SURPLUS LINE” BROKER TO OBTAIN MORE INFORMATION ABOUT THAT INSURER.

7. CALIFORNIA MAINTAINS A LIST OF APPROVED SURPLUS LINE INSURERS. ASK YOUR AGENT OR BROKER IF THE INSURER IS ON THAT LIST, OR VIEW THAT LIST AT THE INTERNET WEB SITE OF THE CALIFORNIA DEPARTMENT OF INSURANCE: WWW.INSURANCE.CA.GOV.

8. IF YOU, AS THE APPLICANT, REQUIRED THAT THE INSURANCE POLICY YOU HAVE PURCHASED BE BOUND IMMEDIATELY, EITHER BECAUSE EXISTING COVERAGE WAS GOING TO LAPSE WITHIN TWO BUSINESS DAYS OR BECAUSE YOU WERE REQUIRED TO HAVE COVERAGE WITHIN TWO BUSINESS DAYS, AND YOU DID NOT RECEIVE THIS DISCLOSURE FORM AND A REQUEST FOR YOUR SIGNATURE UNTIL AFTER COVERAGE BECAME EFFECTIVE, YOU HAVE THE RIGHT TO CANCEL THIS POLICY WITHIN FIVE DAYS OF RECEIVING THIS DISCLOSURE. IF YOU CANCEL COVERAGE, THE PREMIUM WILL BE PRORATED AND ANY BROKER’S FEE CHARGED FOR THIS INSURANCE WILL BE RETURNED TO YOU.

Date:

Insured:

D-1 (Effective January 1, 2017)

Page 11: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

SLF – 102114 (7-2018) - 11 -

SURPLUS LINE FILING FORM

A completed Surplus Line (SL) Filing Form is required for all new business. A completed SL Filing Form is not required for renewal business unless the 1) policyholder is domiciled in New Jersey or 2) the policyholder’s surplus lines filer or broker has changed. NOTICE: THE SL FILER/LICENSEE SHOWN IN #5 BELOW SHALL ASSUME ALL OF THE FOLLOWING RESPONSIBILITIES WITH RESPECT TO THE INSURED’S CURRENT POLICY AND ALL SUBSEQUENT RENEWAL POLICIES: 1) FILING THE POLICY WITH THE STATE, 2) COLLECTING STATE TAXES AND/OR FEES FROM THE INSURED, 3) REMITTING TAXES AND FEES TO THE FILING STATE, ALONG WITH ALL REQUIRED AFFIDAVITS OR FORMS, AND 4) PROVIDING TO THE INSURED, AND/OR ATTACHING TO THE POLICY, ANY FORMS, DOCUMENTS, OR NOTICES THAT MAY BE REQUIRED BY THE FILING STATE. 1. Insured Name: 2. Filing State:

If New Jersey, Transaction Number: 3 SL Filing Agency: 4. Filing Agency Address: 5. Name of SL Filer / Licensee: 6. License Number (must be for filing state): 7. Person Completing This Form:

Full Name: Company: Title:

Page 12: Combined MEDEFENSE Plus / e-MD For Social Services …nasinsurance.com/smarter/wp-content/uploads/sites/...credible cyber extortion threat. • Payment Card Industry Data Security

All other terms and conditions of the Policy remain unchanged.

E1856J-1117 Page 1 of 1

POLICYHOLDER DISCLOSURE NOTICE OF TERRORISM INSURANCE COVERAGE – E1856J-1117

COVERAGE FOR ACTS OF TERRORISM IS ALREADY INCLUDED IN THE POLICY (INCLUDING ANY QUOTATION FOR INSURANCE) TO WHICH THIS NOTICE APPLIES. YOU SHOULD KNOW THAT, UNDER THE POLICY, ANY LOSSES CAUSED BY CERTIFIED ACTS OF TERRORISM WOULD BE PARTIALLY REIMBURSED BY THE UNITED STATES UNDER A FORMULA ESTABLISHED BY FEDERAL LAW. UNDER THIS FORMULA, THE UNITED STATES PAYS 85% THROUGH 2015; 84% BEGINNING ON JANUARY 1, 2016; 83% BEGINNING ON JANUARY 1, 2017; 82% BEGINNING ON JANUARY 1, 2018; 81% BEGINNING ON JANUARY 1, 2019 AND 80% BEGINNING ON JANUARY 1, 2020; OF COVERED TERRORISM LOSSES EXCEEDING THE STATUTORILY ESTABLISHED DEDUCTIBLE PAID BY THE INSURER PROVIDING THE COVERAGE. HOWEVER, YOUR POLICY MAY CONTAIN OTHER EXCLUSIONS WHICH MIGHT AFFECT YOUR COVERAGE, SUCH AS EXCLUSION FOR NUCLEAR EVENTS. THE TERM “ACT OF TERRORISM” MEANS ANY ACT THAT IS CERTIFIED BY THE SECRETARY OF THE TREASURY, IN CONSULTATION WITH THE SECRETARY OF HOMELAND SECURITY AND THE ATTORNEY GENERAL OF THE UNITED STATES, TO BE AN ACT OF TERRORISM; TO BE A VIOLENT ACT OR AN ACT THAT IS DANGEROUS TO HUMAN LIFE, PROPERTY, OR INFRASTRUCTURE; TO HAVE RESULTED IN DAMAGE WITHIN THE UNITED STATES, OR OUTSIDE THE UNITED STATES IN THE CASE OF AN AIR CARRIER OR VESSEL OR THE PREMISES OF A UNITED STATES MISSION; AND TO HAVE BEEN COMMITTED BY AN INDIVIDUAL OR INDIVIDUALS, AS PART OF AN EFFORT TO COERCE THE CIVILIAN POPULATION OF THE UNITED STATES OR TO INFLUENCE THE POLICY OR AFFECT THE CONDUCT OF THE UNITED STATES GOVERNMENT BY COERCION. THE TERRORISM RISK INSURANCE ACT, AS AMENDED, CONTAINS A $100 BILLION CAP THAT LIMITS U.S. GOVERNMENT REIMBURSEMENT AS WELL AS INSURERS' LIABILITY FOR LOSSES RESULTING FROM CERTIFIED ACTS OF TERRORISM WHEN THE AMOUNT OF SUCH LOSSES EXCEEDS $100 BILLION IN ANY ONE CALENDAR YEAR. IF THE AGGREGATE INSURED LOSSES FOR ALL INSURERS EXCEED $100 BILLION, YOUR COVERAGE MAY BE REDUCED. THE PORTION OF YOUR ANNUAL PREMIUM THAT IS ATTRIBUTABLE TO COVERAGE FOR CERTIFIED ACTS OF TERRORISM AS DEFINED IN THE TERRORISM RISK INSURANCE ACT OF 2002, AS AMENDED, IS 1%.

On behalf of certain underwriters at Lloyd’s 12 January 2015 LMA9105 (amended)

This endorsement is to take effect on «f4». Policy No.: «f1» Name: «f2» «f3» Policy Effective Date: «f4» Expiration: «f5» Endorsement No.: