THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
NOTICE OF HEALTH INFORMATION PRIVACY PRACTICES
To: Participants in health plans sponsored by The College of Wooster
The health plans or options sponsored by by The College of Wooster (referred to in this Notice as the “Health Plans”) may use or disclose health information about participants and their covered dependents as required for purposes of administering the Health Plans. Some of these functions are handled directly by by The College of Wooster. employees who are responsible for overseeing the operation of the Health Plans, while other functions may be performed by other companies under contract with the Health Plans (those companies are generally referred to as “service providers”). Regardless of who handles health information for the Health Plans, the Health Plans have established policies that are designed to prevent the misuse or unnecessary disclosure of protected health information.
Please note that the rest of this Notice uses the capitalized word, “Plan” to refer to each Health Plan sponsored by by The College of Wooster. including any by The College of Woosteremployees who are responsible for handling health information maintained by the Health Plans as well as any service providers who handle health information under contract with the Health Plans. This Notice applies to each Health Plan maintained by by The College of Woosterincluding plans or programs that provide medical, vision, prescription drug, dental, long term care and health care flexible spending account benefits. However, if any of the Plan’s health benefits are provided through insurance contracts, you will receive a separate notice, similar to this one, from the insurer and only that notice will apply to the insurer’s use of your health information.
The Plan is required by law to maintain the privacy of certain health information about you and to provide you this Notice of the Plan’s legal duties and privacy practices with respect to that protected health information. This Notice also provides details regarding certain rights you may have under federal law regarding medical information about you that is maintained by the Plan.
You should review this Notice carefully and keep it with other records relating to your health coverage. The Plan is required by law to abide by the terms of this Notice while it is in effect. This Notice is effective beginning 9/23/13 and will remain in effect until it is revised.
If the Plan’s health information privacy policies and procedures are changed so that any part of this Notice is no longer accurate, the Plan will revise this Privacy Notice. A copy of any revised Privacy Notice will be available upon request to the Privacy Contact Person indicated later in this Notice. Also, if required under applicable law, the Plan will automatically provide a copy of any revised notice to employees who participate in the Plan. The Plan reserves the right to apply any changes in its health information policies retroactively to all health information maintained by the Plan, including information that the Plan received or created before those policies were revised.
Protected Health Information
This Notice applies to health information possessed by the Plan that includes identifying information about an individual. Such information, regardless of the form in which it is kept, is referred to in this Notice as Protected Health Information or “PHI”. For example, any health record that includes details such as your name, street address, date of birth or Social Security number would be covered. However, information taken from a document that does not include such obvious identifying details is also Protected Health Information if that information, under the circumstances, could reasonably be expected to allow a person who receives or accesses that information to identify you as the subject of the information. Information that the Plan possesses that is not Protected Health Information is not covered by this Notice and may be used for any purpose that is consistent with applicable law and with the Plan’s policies and requirements.
How the Plan Uses or Discloses Health Information
Protected Health Information may be used or disclosed by the Plan as necessary for the operation of the Plan. For example, PHI may be used or disclosed for the following Plan purposes:
● Treatment. If a provider who is treating you requests any part of your health care records that the Plan possesses, the Plan generally will provide the requested information. (There is an exception for psychotherapy notes. If the Plan possesses any psychotherapy notes, those documents, with rare exceptions, will be used or disclosed only according to your specific authorization.)
For example, if your current physician asks the Plan for PHI in connection with a treatment plan the physician has for you, the Plan generally will provide that PHI to the physician.
● Payment. The Plan’s agents or representatives may use or disclose PHI about you to determine eligibility for plan benefits, facilitate payment for services you receive from health care providers, to review claims and to coordinate benefits. This includes, if appropriate, disclosing information to the Plan Sponsor, as needed to facilitate the Plan’s payment function.
For example, if the Plan needs to process a payment to your current physician, but requires additional PHI to process that payment, it may request that PHI from the physician.
● Other health care operations. The Plan also may use or disclose PHI as needed for various purposes that are related to the operation of the Plan. These purposes include utilization review programs, quality assurance reviews, contacting providers regarding treatment alternatives, insurance or reinsurance contract renewals and other functions that are appropriate for purposes of administering the Plan. This includes, if appropriate, disclosing information to the Plan Sponsor, as needed to facilitate the Plan’s health care operations function.
For example, if the Plan wishes to undertake a review of utilization patterns under the Plan, it may request necessary PHI from your physician.
In addition to the typical Plan purposes described above, PHI also may be used or disclosed as permitted or required under applicable law for the following purposes:
● Use or disclosure required by law. If the Plan is legally required to provide PHI to a government agency or anyone else, it will do so. However, the Plan will not use or disclose more information than it determines is required by applicable law.
● Disclosure for public health activities. The Plan may disclose PHI to a public health authority that is authorized to collect such information (or to a foreign government agency, at the direction of a public health authority) for purposes of preventing or controlling injury, disease or disability.
The Plan also may disclose PHI to a public health authority or other government agency that is responsible for receiving reports of child abuse or neglect.
In addition, certain information may be provided to pharmaceutical companies or other businesses that are regulated by the Food and Drug Administration (FDA), as appropriate for purposes relating to the quality, safety and effectiveness of FDA-regulated products.
Also, to the extent permitted by applicable law, the Plan may disclose PHI, as part of a public health investigation or intervention, to an individual who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.
● Disclosures about victims of abuse, neglect or domestic violence. (The following does not apply to disclosures regarding child abuse or neglect, which may be made only as provided under Disclosure for public health activities.)
If required by law, the Plan may disclose PHI relating to a victim of abuse, neglect or domestic violence, to an appropriate government agency. Disclosure will be limited to the relevant required information. The Plan will inform the individual if any PHI is disclosed as provided in this paragraph or the next one.
If disclosure is not required by law, the Plan may disclose relevant PHI relating to a victim of abuse, neglect or domestic violence to an authorized government agency, to the extent permitted by applicable law, if the Plan determines that the disclosure is necessary to prevent serious harm to the individual or to other potential victims. Also, to the extent permitted by law, the Plan may release PHI relating to an individual to a law enforcement official, if the individual is incapacitated and unable to agree to the disclosure of PHI and the law enforcement official indicates that the information is necessary for an immediate enforcement activity and is not intended to be used against the individual.
● Health oversight activities. The Plan may disclose protected health information to a health oversight agency (this includes federal, state or local agencies that are responsible for overseeing the health care system or a particular government program for which health information is needed) for oversight activities authorized by law. This type of disclosure applies to oversight relating to the health care system and various government programs as well as civil rights laws. This disclosure would not apply to any action by the government in investigating a participant in the Plan, unless the investigation relates to the receipt of health benefits by that individual.
● Disclosures for judicial and administrative proceedings. The Plan may disclose protected health information in the course of any judicial or administrative proceeding in response to an order from a court or an administrative tribunal. Also, if certain restrictive conditions are met, the Plan may disclose PHI in response to a subpoena, discovery request or other lawful process. In either case, the Plan will not disclose PHI that has not been expressly requested or authorized by the order or other process.
● Disclosures for law enforcement purposes. The Plan may disclose protected health information for a law enforcement purpose to a law enforcement official if certain detailed restrictive conditions are met.
● Disclosures to medical examiners, coroners and funeral directors following death. The Plan may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law. The Plan also may disclose PHI to a funeral director as needed to carry out the funeral director’s duties. PHI may also be disclosed to a funeral director, if appropriate, in reasonable anticipation of an individual’s death.
● Disclosures for organ, eye or tissue donation purposes. The Plan may disclose protected health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.
● Disclosures for research purposes. If certain detailed restrictions are met, the Plan may disclose protected health information for research purposes.
● Disclosures to avert a serious threat to health or safety. The Plan may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, (1) if it believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or (2) if it believes the disclosure is necessary for law enforcement authorities to identify or apprehend an individual because of a statement by an individual admitting participation in a violent crime that the Plan reasonably believes may have caused serious physical harm to the victim or where it appears that the individual has escaped from a correctional institution or from lawful custody.
● Disclosures for specialized government functions. If certain conditions are met, the Plan may use and disclose the protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission. Also, the Plan may use and disclose the PHI of individuals who are foreign military personnel to their appropriate foreign military authority under similar conditions.
The Plan may also use or disclose PHI to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities or for the provision of protective services to the President or other persons as authorized by federal law relating to those protective services.
● Disclosures for workers’ compensation purposes. The Plan may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs.
Uses and Disclosures That Are Not Permitted Without Your Authorization
The Plan will not use or disclose Protected Health Information for any purpose that is not mentioned in this Notice, except as specifically authorized by you. If the Plan needs to use or disclose PHI for a reason not listed above, it will request your permission for that specific use and will not use PHI for that purpose except according to the specific terms of your authorization.
Any authorization you provide will be limited to specified information, and the intended use or disclosure as well as any person or organization that is permitted to use, disclose or receive the information must be specified in the Authorization Form. Also, an authorization is limited to a specific limited time period and it expires at the end of that period. Finally, you always have the right to revoke a previous authorization by making a written request to the Plan. The Plan will honor your request to revoke an authorization but the revocation will not apply to any action that the Plan took in accord with the authorization before you informed the Plan that you were revoking the authorization.
No Use or Disclosure of Genetic Information for Underwriting
Under applicable law, the Plan generally may not use or disclose genetic information, including information about genetic testing and family medical history, for underwriting purposes. The Plan may use or disclose PHI for underwriting purposes, assuming the use or disclosure is permitted based on the above rules, but any PHI that is used or disclosed for underwriting purposes will not include genetic information.
“Underwriting purposes” is defined under federal law and generally includes any Plan rules relating to (1) eligibility for benefits under the Plan (including changes in deductibles or other cost-sharing requirements in return for activities such as completing a health risk assessment or participating in a wellness program); (2) the computation of premium or contribution amounts under the Plan (including discounts or payments or differences in premiums based on activities such as completing a health risk assessment or participating in a wellness program); (3) the application of any preexisting condition exclusion under the Plan; and (4) other activities related to the creation, renewal, or replacement of a contract for health insurance or health benefits. However, “underwriting purposes” does not include rules relating to the determination of whether a particular expense or claim is medically appropriate.
Your Health Information Rights
Under federal law, you have the following rights:
● You may request restrictions with regard to certain types of uses and disclosures. This includes the uses and disclosures described above for treatment, payment and other health care operations purposes. If the Plan agrees to the restrictions you request, it will abide by the terms of those restrictions. However, under the law, the Plan is not required to accept any restriction. If the Plan determines that a requested restriction will interfere with the efficient administration of the Plan or is otherwise inappropriate, it may decline the restriction. If you want to request a restriction, you should submit a written request describing the restriction to the Privacy Contact Person listed in this Notice.
● You may request that certain information be provided to you in a confidential manner. This right applies only if you inform the Plan in writing (submitted to the Privacy Contact Person listed in this Notice) that the ordinary disclosure of part or all of the information might endanger you. For example, an individual may not want information about certain types of treatment to be sent to his or her home address because someone else who lives there might have access to it. In such a case, the individual could request that the information be sent to an alternate address. The Plan will honor such a request if it is reasonable, but reserves the right to reject a request that would impose too much of an administrative burden or financial risk on the Plan.
● You may request access to certain medical records possessed by the Plan and you may inspect or copy those records. This right applies to all enrollment, claims processing, medical management and payment records maintained by the Plan and also to any other information possessed by the Plan that is used to make decisions about you or your health coverage. However, there are certain limited exceptions. Specifically, the Plan may deny access to psychotherapy notes and to information prepared in anticipation of litigation.
If you want to request access to any medical records, you should contact the Privacy Contact Person listed in this Notice. If you request copies of any records, the Plan may charge reasonable fees to cover the costs of providing those copies to you, including, for example, copying charges and the cost of postage if you request that copies be mailed to you. You will be informed of any fees that apply before you are charged.
● You may request that protected health information maintained by the Plan be amended. If you feel that certain information maintained by the Plan is inaccurate or incomplete, you may request that the information be amended. The Plan may reject your request if it finds that the information is accurate and complete. Also, if the information you are challenging was created by some other person or organization, the Plan ordinarily would not be responsible for amending that information unless you provide information to the Plan to establish that the originator of the information is not in a position to amend it. If you want to request that any medical record maintained by the Plan be amended, you should provide your request in writing to the Privacy Contact Person listed in this Notice. Your request should describe the records that you want to be changed, each change you are requesting and your reasons for believing that each requested change should be made.
The Plan normally will respond to a request for an amendment within 60 days after it receives your request. In certain cases, the Plan may take up to 30 additional days to respond to your request.
If the Plan denies your request, you will have the opportunity to prepare a statement to be included with your health records to explain why you believe that certain information is incomplete or inaccurate. If you do prepare such a statement, the Plan will provide that statement to any person who uses or receives the information that you challenged. The Plan may also prepare a response to your statement and that response will be placed with your records and provided to anyone who receives your statement. A copy will also be provided to you.
● You have the right to receive details about certain non-routine disclosures of health information made by the Plan. You may request an accounting of all disclosures or health information, with certain exceptions. This accounting would not include disclosures that are made for Treatment, Payment and other health plan operations, disclosures made pursuant to an individual authorization from you, disclosures made to you and certain other types of disclosures. Under current law, you can request an accounting of disclosures made up to six years before the date of your request. If applicable law changes to provide a different time limit for required accountings, the maximum time period for which you may request an accounting automatically be reduced to whatever new period applies under applicable law. You may receive an accounting of disclosures once every 12 months at no charge. The Plan may charge a reasonable fee for any additional requests during a 12 month period.
● You have the right to request and receive a paper copy of this Privacy Notice. If the Plan provides this Notice to you in an electronic form, you may request a paper copy and the Plan will provide one. You should contact the Privacy Contact Person identified at the end of this Notice if you want a paper copy.
● You have the right to be notified of a breach of unsecured PHI. If unsecured PHI is used or disclosed in a manner that is not permitted under applicable federal law, you will receive a notice about the breach of unsecured PHI, if such a notice is required by applicable law. Unsecured PHI is PHI that is either in paper form or is in an electronic form that is not considered secure.
Privacy Contact Person and Complaint Procedures
After reading this Notice, if you have questions or complaints about the Plan’s health information privacy policies or you believe your health information privacy rights have been violated, you should contact:
The College of Wooster
1189 Beall Ave, Wooster OH 44691
330-263-2526
In addition to your right to file a complaint with the Plan, you may file a complaint with the U.S. Department of Health & Human Services. (Details are available on the Internet at http://www.hhs.gov/ocr/privacy) You will never be retaliated against in any way as a result of any complaint that you file.