Group Health Plan Notice of Privacy Practices
This Notice Describes How Medical Information About You May Be Used and Disclosed and How You Can Get Access to This Information. Please Read It Carefully.
Effective Date: April 14, 2004, as amended February 21, 2017
This notice outlines the ways in which the Cone Health group health plan (the “Plan”) may use and disclose Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
We reserve the right to change the terms of this Notice and to make new provisions regarding your protected health information that we maintain, as allowed or required by law. If we make any material change to this Notice, we will provide you with a copy of our revised Notice of Privacy Practices by mail to your last-known address on file.
The HIPAA Privacy Rule protects only certain medical information known as “Protected Health Information”. Protected Health Information is health information by which you could reasonably be identified which is collected from you or created or received by a health care provider, a health care clearinghouse, a health plan, or your employer on behalf of the Plan, that relates to:
(1) your past, present or future physical or mental health or condition;
(2) the provision of health care to you; or
(3) the past, present or future payment for the provision of health care to you.
This Notice outlines the Plan’s obligations and your rights regarding the use and disclosure of Protected Health Information. The Plan is required by law to maintain the privacy of your Protected Health Information, to provide you with this Notice of the Plan’s legal duties and privacy practices with respect to Protected Health Information about you, and to comply with the terms of the Notice that is currently in effect.
Use and Disclosure of Your Protected Health Information
The following describe different ways in which we may use and disclose Protected Health Information about you without your individual consent. The examples of use and disclosures described in these categories do not necessarily constitute current uses of your Protected Health Information, nor do they describe every specific use and disclosure that may be made. However, all of the ways we are permitted to use and disclose Protected Health Information about you will fall within one of the categories described below.
For Payment. We may use and disclose Protected Health Information about you to determine or fulfill the Plan’s responsibility for providing benefits under the Plan, to determine eligibility for benefits under the Plan, to facilitate or obtain payment for the treatment and services you receive from health care providers, or to coordinate Plan coverage. For example, we may share Protected Health Information about you with a utilization review or authorization service provider. We also may share such information about you with another entity to assist with the adjudication or subrogation of health benefit claims or to another health plan to coordinate benefit payments.
For Health Care Operations. We may use and disclose Protected Health Information about you for operations and management of the Plan. For example, we may use or disclose such information in connection with: conducting quality assessment and improvement activities; reviewing the competency, qualifications or performance of healthcare professionals and providers; underwriting, premium rating, bill review and other activities relating to Plan coverage; submitting claims for stop-loss (or excess loss) coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; required workers’ compensation disclosures; and other administrative activities. We may also use or disclose your Protected Health Information to carry out population-based and other health activities related to improving health or reducing health care costs or to inform you about treatment options and alternatives. We will not use or disclose genetic information about you for underwriting purposes.
To Business Associates. We may contract with individuals or entities known as Business Associates to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, Business Associates will receive, create, maintain, use and/or disclose your protected health information, but only after they agree in writing with us to implement appropriate safeguards regarding your protected health information. For example, we may disclose your protected health information to a Business Associate to administer claims, to assist in health activities designed to improve health or reduce health care costs, or to provide support services, such as utilization management, pharmacy benefit management or subrogation, but only after the Business Associate enters into a Business Associate Agreement with us.
As Required by Law. We will disclose Protected Health Information about you when required to do so by federal, state or local law. For example, we may disclose such when required by a court order in a litigation proceeding such as a malpractice action.
To Avert a Serious Threat to Health or Safety. We may use and disclose Protected Health Information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. For example, we may disclose such about you in a proceeding regarding revocation of the licensure of a physician involved with your medical plan.
Disclosure to Another Health Plan. Information may be disclosed to another health plan maintained by the Company for purposes of facilitating claims payments under that plan and shared between the constituent health plans comprising the Plan “organized health care arrangement” for health care operations and the management and operation of the arrangement.
To Plan Sponsors. For the purpose of administering the plan, we may disclose to certain employees of the Employer protected health information. However, those employees will only use or disclose that information as necessary to perform plan administration functions (which include treatment, payment, and health care operations) or as otherwise required by HIPAA, unless you have authorized further disclosures. Your protected health information cannot be used for employment purposes without your specific authorization.
Public Health Risks. We may disclose Protected Health Information about you for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and to notify the appropriate government authority if we believe an individual has been the victim of abuse, neglect or domestic violence. We will only make such a disclosure when required or authorized by law.
Law Enforcement. We may release Protected Health Information about you if asked to do so by a law enforcement official such as: in response to a court order, subpoena, warrant, summons or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; about an individual who is or is suspected to be a victim of a crime if, under certain limited circumstances, we are unable to obtain the individual’s agreement; about an individual who has died, whose death we suspect may be the result of criminal conduct, about criminal conduct occurring on the premises of the Company, and in emergency circumstances to report a crime, the location of the crime or victims or respecting the identity, description or location of the person who committed the crime.
Health Oversight Activities. We may disclose Protected Health Information about you to a health oversight agency for oversight activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose Protected Health Information about you in response to a court or administrative order. We also may disclose such information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if reasonable efforts have been made by the party seeking the information to notify you about the request or to obtain an order protecting the information requested.
Organ and Tissue Donation. If you are an organ donor, we may release Protected Health Information about you to organ procurement organizations or other entities, engaged in the procurement, banking and transportation of organs, eyes or tissue to facilitate organs, eyes or tissue donation and transplantation.
Military and Veterans. If you are a member of the armed forces, we may release Protected Health Information about you as required by military command authorities. We also may release such health information about foreign military service to the appropriate foreign military authority.
Workers’ Compensation. We may release Protected Health Information about you as authorized by workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Coroners, Medical Examiners and Funeral Directors. We may release Protected Health Information about you to a coroner or medical examiner to identify a deceased person, determine a cause of death, or for other such duties as authorized by law.
National Security and Intelligence Activities. We may release Protected Health Information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Inmates. We may release Protected Health Information about you to a correctional institution or law enforcement official having lawful custody, as necessary: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Specific Uses and Disclosures Requiring Your Written Authorization
The following uses or disclosures of Protected Health Information require your written authorization: use or disclosure of psychotherapy notes; use or disclosure for marketing purposes; or disclosure that constitutes a sale.
Other Uses of Protected Health Information
Other uses and disclosures of Protected Health Information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us written authorization to use or disclose Protected Health Information about you, you may revoke that authorization (also in writing), at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. However, any disclosures we make prior to revocation of your permission cannot be reversed. Unless use of your medical information in assisting you with a claim is clearly defined as related to “health care operations”, we will not use or disclose your Protected Health Information in this context before receiving your individual authorization.
Unauthorized Use or Disclosure
We will notify you if unsecured Protected Health Information about you is accessed, used or disclosed in a manner not permitted under HIPAA and such use or disclosure compromises the privacy or security of the Protected Health Information.