The Health Insurance Portability and Accountability Act (HIPAA) is a federal law. We are required by HIPAA to provide you with this notice.
This notice describes our privacy practices, legal duties, and your rights concerning your Protected Information. We must follow the privacy practices described in this notice while it is in effect.
As a company responsible for the information that we collect about you, your privacy is important to us. We are committed to protecting the confidential nature of your medical information to the fullest extent of the law. In addition to various laws governing your privacy, we have our own privacy policies and procedures in place. These are designed to protect our information. We understand how important it is to protect your privacy. We will continue to make this a priority.
We are required by applicable federal and state laws to keep certain information about you private. An example of this is your medical information. We treat your medical and demographic information that we collect as part of providing your coverage, as “Protected Information.” It is our policy to maintain the privacy of Protected Information in accordance with HIPAA, except to the extent that applicable state law provides greater privacy protections. This Notice of Privacy Practices was drafted to be consistent with the HIPAA privacy regulation. Any terms not defined in this Notice will have the same meaning as they have in the HIPAA privacy regulation.
The HIPAA Privacy Regulations generally do not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a state, or other federal laws, rather than the HIPAA Privacy Regulation, might impose a privacy standard that we are required to follow. For example, where such laws are in place, we will follow more stringent state privacy laws that relate to use and disclosure of Protected Information about HIV or AIDS, mental health, substance abuse, chemical dependency, genetic testing, reproductive rights, etc.
We reserve the right to change the terms of this notice. We may make the new notice provisions effective for all the Protected Information that we maintain. This includes information that we created or received before we made the changes. Any revised notice will be provided to you by one of the following means. (1) By mail to the named insured under the terms of your coverage. (2) By delivery of the notice by the named insured’s employer, school or group.
Anyone may request a copy of our notice at any time. For more information about our privacy practices, or for additional copies of this notice, please contact the appropriate office listed at the end of this notice.
We may use and disclose your Protected Information without your specific authorization for the purposes of treatment, payment, and health care operations. To illustrate:
Health Care Operation Activities. Activities such as credentialing, business planning and development, quality assessment and improvement, premium rating, enrollment, underwriting, claims processing, customer service, medical management, fraud and abuse detection, obtaining legal and auditing services, and business management. For example, we may use your Protected Information for underwriting, premium rating or other activities associated with the creation, renewal or replacement of a contract of health insurance or health benefits to the extent not prohibited by applicable state law. We may also disclose Protected Information to other health plans for certain health care operation activities of their own as described in the HIPAA privacy regulation.
When using and disclosing your Protected Information in our payment and health care operation activities, we may only request, use, and disclose the minimum amount of your Protected Information necessary to complete the activity.
We may contract with others to assist us with Payment, underwriting, or health care operation activities that involve the use of your Protected Information. Such third parties are referred to as our business associates. We require business associates to agree, in writing, to contract terms. These terms are specifically designed to safeguard Protected Information before it is shared with them. We may also have business associates assist in the activities described in the following section that involve permitted uses and disclosures.
You and on Your Authorization. We must disclose your Protected Information to you. This is described in the Individual Rights section of this notice, below. You may also give us written authorization to use or disclose your Protected Information to anyone for any purpose. If you give us an authorization, you may revoke it in writing at any time. Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect. Without your written authorization, we may not use or disclose your Protected Information for any reason except as described in this notice. The following is a description of other possible ways we may (and are permitted by law to) use and/or disclose your Protected Information without your specific authorization.
Research. We may use or disclose your Protected Information for research purposes in limited circumstances specified in the HIPAA privacy regulation.
Public Health and Safety. We may disclose some of your Protected Information permitted by state law to the extent necessary to avert a serious and imminent threat to your health or safety or the health or safety of others. We may disclose your Protected Information to a government agency that oversees the health care system or government programs or its contractors, and to public health authorities for public health purposes.
Required by Law. We may use or disclose your Protected Information when we are required to do so by law. For example, we must disclose your Protected Information to the U.S. Department of Health and Human Services upon request in order to determine if we are in compliance with federal privacy laws. We may disclose your Protected Information to comply with workers’ compensation or similar laws.
Legal Process and Proceedings. We may disclose your Protected Information in response to a court or administrative order, subpoena, or other lawful process. These disclosures are subject to certain administrative requirements imposed by the HIPAA privacy regulation and permitted by state law.
Access. You have the right to inspect and obtain copies of your Protected Information for as long as your information is maintained in our designated record set. Our designated record set includes records from our enrollment, billing, claims, and medical management systems, as well as any other records we maintain in order to make decisions about your health care benefits. Your right of access to Protected Information does not extend to certain information. This includes information compiled in reasonable anticipation of, or for use in a civil, criminal or administrative proceeding.
Any request to exercise your individual right of access to your Protected Information must be in writing. You may obtain a form to request access by using the contact information listed at the end of this notice. We will respond to your request for access within 30 days of receiving the request. If all or any part of your request is denied, our response will detail any appeal rights you may have with respect to that decision.
Amendment. You have the right to request that we amend your Protected Information that we keep in our designated record set if you believe it is inaccurate. A request that your Protected Information be amended must be done in writing. You may obtain a form to request amendment by using the contact information listed at the end of this notice. We will respond to your request for amendment within 30 days of receiving the request.
If we accept your request to amend the information, we will notify you. We will make reasonable efforts to inform other persons, including those identified by you as having received your Protected Information and needing the amendment. We will also include the changes in any future disclosure of that information. If we deny your request for reasons permitted by the HIPAA privacy regulations, our notice to you will explain any appeal rights you may have with respect to that decision.
Disclosure Accounting. You have the right to request and receive an accounting of disclosures of your Protected Information made by us. We are not required under the HIPAA privacy regulation to provide you with an accounting of certain types of disclosures. The most significant types include:
- Any disclosures made prior to April 14, 2003
- Disclosures for treatment, payment or health care operations activities
- Disclosures to you or pursuant to your authorization
- Disclosures to persons involved in your care
- Disclosures for disaster relief, national security or intelligence purposes
- Disclosures that are incidental to a permitted use or disclosure
To request an accounting of disclosures, you must send a written request to the contact office listed at the end of this notice. You may request one such accounting at no charge every 12 months. You may request that the accounting cover up to a 6-year period of reportable disclosures from the date of your request. We will respond within 60 days of your request. We reserve the right to impose a reasonable charge for requests made more than once per year.
Confidential Communications. You may believe that you will be in danger if we communicate Protected Information to you to your address of record. If so, you have the right to request that we communicate with you about your Protected Information at an alternative location or by alternate means. We will make reasonable efforts to accommodate your request if you specify an alternate address.
Restriction Request. You have the right to request that we restrict the use or disclosure of your Protected Information for treatment, payment or health care operation activities. You also have the right to request that we restrict disclosures to relatives, friends, or other individuals that may be involved in your care or payment for your health care. We are not required to agree to such a request for restriction. To request a restriction, you must direct your request to the contact office listed at the end of this notice.
Please contact NAHGA Claim Services:
You may also submit a written complaint to the Department of Health and Human Services if you believe your privacy rights have been violated.
