Standards of Conduct

Rights and Responsibilities

Every associate is obligated to adhere to these Standards of Conduct strictly, always, and under all circumstances. Any associate who is aware of violations or potential violations is obligated to immediately advise their manager, the Compliance & Ethics Department, an officer of the Company, or the Chief Compliance Officer. If an investigation determines that an associate had knowledge of a policy violation, misconduct, or issue of noncompliance and did not report the issue, that associate may be subject to disciplinary action up to and including termination. If an associate has any uncertainty regarding legal or ethical issues involving Company affairs, the associate should seek advice or clarification from the Compliance & Ethics Department, the Legal Department, or the Human Resources Department.

The failure to seek advice or report Standards of Conduct violations could be detrimental to the individual and to the Company. Each associate should be aware that legal implications arising from any act, written record, correspondence, or other document created or maintained by an associate may be subject to future scrutiny by government officials or third parties.

It is the right of every associate to report to, make an inquiry of, or ask the advice of their manager or an officer of the Company, up to and including the Chief Executive Officer, regarding any possible violation of these Standards of Conduct, without risk to the associate’s job status or position. To secure this right, each person to whom a report is made, or from whom advice is sought, shall use every reasonable means available to keep the identity of any associate who requests such protection confidential. Confidentiality may be waived if the matter is turned over to law enforcement, is part of a legal proceeding or is prohibited by local law.

Ethics

It is Company policy to observe all applicable laws. Even where the law is permissive, the Company shall choose the course of the highest integrity. Local customs and traditions differ from place to place. However, honesty and integrity are cornerstones of good business in any culture. A well-founded reputation for trustworthy dealings is an invaluable asset. All directors, officers, and associates must understand that at HealthAxis, we care how results are obtained, not just that they are obtained. Each director, officer, and associate must always be honest and forthcoming, even when it is awkward or uncomfortable.

Protection of Reputation and Financial Strength

HealthAxis is committed to encouraging candid communication and transparency by keeping complete and accurate records and implementing appropriate controls. This commitment includes general business and financial records. Accurate documentation is always a priority. No associate should enter into any transaction knowing that it is anything other than what is described in the agreement and supporting documentation.

All transactions must be transparent and properly recorded. There must be no disbursement or receipt of Company funds outside the Company’s system of accountability. Meaning, no “off-books” or “unofficial” funds, payments, or transactions; and all funds, payments, and transactions must be recorded following applicable accounting practices.

Our records must be complete and accurate, fully reflecting the Company’s activities and transactions, including claim payments, medical billing documentation, expenses, purchases, accounts receivable, and sales. The information derived from these records is provided to the Company’s shareholders, as appropriate, as well as governmental agencies; therefore, processes must follow applicable accounting principles and all relevant laws and regulations. HealthAxis’ reputation for integrity, as well as its financial strength, depends on this. It is difficult to delineate every practice that is or is not permissible, but certain general guidelines can be set forth.

A payment is not prohibited if:

• It is illegal
• It is inconsistent with HealthAxis’ defined values
• No record of its disbursement or receipt is entered into the Company’s accounting records
• It is entered into the Company’s accounting records in a manner that is false or misleading

The Company also adheres to all applicable local tax transfer pricing regulations, including documentation and notification requirements. Where an appropriate market price can be determined, intracompany transactions will be priced at a level consistent with fair market value. In the absence of market pricing, charges for intracompany transactions will be based on cost and reasonable profit data to approximate fair market value. Further, material intracompany transactions are supported by intracompany agreements, which among other things, identify the parties involved in the transaction and the basis for the pricing. For all intracompany transactions, transfer pricing will be regularly reviewed (including reviews by independent third parties) to ensure compliance with Company policies.

Fraud, Waste and Abuse (FWBA) Prevention Program

The Company is committed to developing a comprehensive program at the corporate and operating unit level for the prevention, detection, and reporting of fraud, waste, and abuse. The FWA Prevention Program encompasses industryrecommended practices and processes and implements them throughout the Company. HealthAxis’ Special Investigations Unit (SIU) oversees the FWA Prevention Program.

The FWA Prevention Program is designed to prevent and reduce fraud, waste, and abuse among providers, members, associates, and subcontractors. It may also help to prevent potential health risks to members. A toll-free Fraud, Waste, and Abuse Hotline is available to associates, clients, members, business partners, and providers. For more information, see ‘How to Report Concerns and Possible Violations’ in the Standards of Conduct.

False Claims Act

Under the U.S. False Claims Act (FCA), any individual or entity that knowingly keeps an overpayment or submits a false or fraudulent claim for payment of U.S. Government funds can be held liable for significant penalties and fines. The FCA applies to claims by health care organizations to Medicaid, Medicare, and other government sponsored health care programs. Potential fines for violating the FCA include a penalty of: (1) up to three times the amount of the damages sustained by the government for each false claim; (2) additional civil penalties for each false claim; and (3) payment of the cost of the civil action by the entity or individual that submitted the false claims. Criminal penalties may also apply. If found liable under the FCA, the entity or individual may also be excluded or suspended from participating in all federal health care programs.

The FCA contains “whistleblower provisions” that allow people with evidence of fraud against the government to sue, on behalf of the U.S. Government, to recover the stolen funds. In some cases, the U.S. Government may join the whistleblower suit. If a whistleblower suit is ultimately successful, the person who initially brought the suit may be awarded a percentage of the recovered funds.

The FCA also contains a provision that protects the whistleblower from retaliation by their employer. This provision applies to any associate who is discharged, demoted, suspended, threatened, harassed, or discriminated against because of the associate’s lawful acts in a whistleblower suit. HealthAxis affords associates all protections required by the FCA.

In addition to the U.S. FCA, several U.S. states and other countries also have false claims legislation with similar penalties that work to discourage fraud perpetrated against local governments.

Potential Violations of the False Claims Act

• Billing for goods and services that were never delivered or rendered
• Double-billing – charging more than once for the same goods or service
• Falsifying time sheets - billing for made up hours or employees not working
• Not reporting overpayments
• Being awarded a contract by offering kick- backs or bribes
• Inflating a bill with more expensive billing codes than what service was rendered
• Ordering unnecessary tests in order to received higher reimbursements
• Unbundling billing codes

Protecting Confidential Information

It is the duty of all associates to protect confidential and proprietary Company information.

What Does It Look Like?

• Obtaining a signed confidentiality agreement from client/vendor before sharing any Company information
• Not sharing passwords with co-workers or friends
• Locking laptop every time you walk away from it
• Not using unsecured shared wi-fi at coffee shops and other public spaces
• Locking file cabinets containing contracts
• Password protecting files sent electronically to clients or outside parties

Work Product

Any work product conceived, created, or changed by associates, individually or jointly, during employment belongs to the Company. This includes writings, models, processes, technologies, inventions, discoveries, ideas, and other work products of any nature. Associates may not share, publish, claim, or further develop any Company work product during or after their employment unless they have express, written permission to do so from the Legal Department.

Intellectual Property

HealthAxis respects the intellectual property of others, including clients, suppliers, vendors, business partners, providers and competitors.

Associates are expected to comply with applicable licensing, royalty, and rental agreements and may not make unauthorized copies of software or any other copyrighted material, and may not improperly download, share, or use competitor information. It is both illegal and unethical to break copyright laws or licensing agreements.

Data Privacy

As a healthcare-related organization with operations across the U.S., HealthAxis has access to protected and confidential personal data (e.g., health info, personally identifiable information, etc.) of members, providers and associates. The Company is committed to handling this data responsibly and respecting the rights of all data subjects. The Company and every associate has a responsibility to safeguard personal data maintained by the Company.

Whenever working with personal data, associates must ensure that they follow applicable policies and procedures and comply with local laws and regulations. For example, when accessing or disclosing personal information, associates must ensure that a legitimate business reason exists for the access or disclosure, they share only the minimum amount of information necessary to achieve that business purpose, and protected data is transmitted over a secure network consistent with the Company’s defined processes and data sharing agreements.

Several regulations govern the access and exchange of personal data, such as the Health Insurance Portability and Accountability Act (HIPAA). HealthAxis is committed to complying with these and all other relevant data privacy laws and regulations to ensure we appropriately safeguard confidential information.

Any confirmed or suspected breach of personal data must be reported immediately to your Chief Compliance Officer or a member of the Compliance & Ethics Department.

Records, Information Management & PHI

Many laws and regulations govern how we maintain Company records, including business, financial, employee and member records. Officers and associates are responsible for ensuring that Company records are retained and disposed of following all applicable laws, regulations, and the Company’s record management policies. Records include information stored in various media, including paper, electronic, audio, or video.

Record retention time frames and directives depend on the content, type of record involved, and which laws or regulations apply. Officers and associates are responsible for understanding the record retention schedule for our records. Never alter or destroy any records requested for a government investigation or legal proceeding, or documents that might be relevant to an expected investigation or proceeding.

The Company is committed to conducting business in compliance with national standards for privacy, security, and electronic transactions of Protected Health Information (PHI) as set forth in the Health Insurance Portability and Accountability Act (HIPAA) and modified by the HITECH Act.

All associates of the Company are expected to follow the Company’s HIPAA policies and procedures. Confidential and proprietary information regarding the client’s members, including but not limited to medical and financial information, must be protected.

Confidential information should not be disclosed to anyone outside of the Company, including friends, family, business or social acquaintances, customers or suppliers. Company associates are not permitted to disclose confidential member information to any unauthorized person. An associate’s obligation to not disclose such information exists both during and after employment or contract with the Company.

Information Security

Information security at HealthAxis is everyone’s responsibility. Social engineering, malware, phishing, and other cyber or physical threats can compromise the integrity, confidentiality, and availability of Company systems and result in significant breaches of confidential information.

As HealthAxis’ first line of defense against attacks, associates are essential to supporting HealthAxis’ culture of information security. HealthAxis works to protect information assets through several technical, administrative, and physical controls intended to proactively address security incidents and reduce their potential impact.

To minimize information security risk and help secure the Company’s information assets, it is the responsibility of every associate to adhere to the Company’s information security policies.

Best Practices

• Enabling multi-factor authentication to access Company systems
• Providing associate resources and training to promote information security awareness and reduce security risk
• Ensuring appropriate encryption technology is in place for the secure storage and exchange of confidential data
• Implementing automated tools for detecting and responding to threats