THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY
If you have questions about this notice please contact:
Lois J. Paynter - Privacy Officer
Vice President Operations
Saint Mary’s Health Plans
1510 Meadow Wood Lane
Reno, Nevada 89502
t: (775) 770-6232
f: (775) 770-6253
WHO WE ARE
This Notice describes the privacy practices of Saint Mary’s Heath Plans (“Health Plans”) and applies to any health services you receive through the Health Plans.
OUR PRIVACY OBLIGATIONS
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the rules to carry out this law (Privacy Rules), require health plans to notify participants and beneficiaries about the policies and practices the plan has adopted to protect the confidentiality of their health information, including health care payment information.
This Notice describes the privacy policies of Saint Mary’s Health Plans (“Health Plans”), sponsored by the employer that sponsors the group health plan, which offers health benefits. These policies protect medical information relating to your past, present and future medical conditions, health care treatment and payment for that treatment (Protected Health Information or PHI).
This law requires Health Plans to maintain the privacy of your PHI, to provide you with this Notice of its legal duties and privacy practices, and to abide by the terms of this Notice. In general, Health Plans may only use and/or disclose your PHI where required or permitted by law or when you authorize the use of disclosure. When we use or disclose (share) your PHI, we are required to follow the terms of this Notice or other notice in effect at the time we use or share the PHI. Finally, the law provides you with certain rights described in this Notice.
WHEN HEALTH PLANS MUST DISCLOSE YOUR PHI
Health Plans must disclose your PHI:
- To you;
- To the Secretary of the United States Department of Health and Human Services (DHHS) to determine whether the Plan is in compliance with HIPAA; and
- Where required by law. This means Health Plans will make the disclosure only when the law requires it to do so, but not if the law would just allow it to do so.
WHEN HEALTH PLANS MAY USE OR DISCLOSE YOUR PHI WITHOUT YOUR AUTHORIZATION
Health Plans may use and/or disclose your PHI as follows:
In many situations, we can use and share your PHI for activities that are common in many hospitals and clinics. In certain other situations, which are described herein, we must have your written permission (authorization) to use and/or share your PHI. We do not need any type of permission from you for the following uses and disclosures:
For Treatment. Health Plans does not provide medical treatment directly, but it may disclose your PHI to a health care provider who is giving treatment. For example, Health Plans may disclose the types of prescription drugs you currently take to an emergency room physician, if you are unable to provide your medical history due to an accident. In addition, we may contact you to tell you about other health-related benefits and services that might interest you.
For Payment. Health Plans may use and disclose PHI, as needed, to pay for your medical benefits. For example, Health Plans may tell a doctor whether you are eligible for coverage or what percentage of the bill Health Plans might pay. Health Plans may also use or disclose your PHI in other ways to administer benefits; for example, to process and review claims, to coordinate benefits with other health plans, including Medicare, or Medicaid, to exercise its subrogation rights, and to do utilization review and pre-authorizations.
For Healthcare Operations. Health Plans may use and disclose your PHI to make sure Health Plans is well run, administered properly and does not waste money. For example, Health Plans may use information about your claims to project future benefit costs or audit the accuracy of its claims processing functions. Health Plans may also disclose your PHI for a claim under a stop-loss or re-insurance policy. Among other things, Health Plans may also use your PHI to undertake underwriting, premium rating and other insurance activities relating to changing health insurance contracts or health benefits.
For Special Information. In addition to the Privacy Rule, special protections under state or other Federal law may apply to the use of disclosure of your PHI. Health Plans will comply with these state or federal laws where they are more protective of your privacy.
To the Company. In certain cases, Health Plans may disclose your PHI to the Company
- .Some of the people who administer the Plan work for the Company. Before your PHI can be used by or disclosed to these Company employees, the Company must certify that it has: 1) Amended the Plan documents to explain how your PHI will be protected; 2) Identified the Company employees who need your PHI to carry out their duties to administer the Plan; and 3) Separated the work of these employees from the rest of the workforce so that the Company cannot use your PHI for employment related purposes or to administer other benefit plans. For example, these designated employees will be able to contact an insurer or third party administrator to find out about the statues of your benefit claims without your specific authorization.
- Health Plans may disclose information to the Company that summarizes the claims experience of Plan participants as a group, but without identifying specific individuals, to get new benefit insurance or to change or terminate the Plan. For example, if the Company wants to consider adding or changing organ transplant benefits, it may receive this summary health information to assess the costs of those services.
- Health Plans may also disclose limited health information to the Company in connection with the enrollment or disenrollment of individuals into or out of the Plan.
To Your Other Health Care Providers. We may also share PHI with your doctor and other health care providers when they need it to provide Treatment to you, to obtain Payment for the care they give to you, to perform certain Health Care Operations, such as reviewing the quality and skill of health care professionals, or to review their actions in following the law.
To Business Associates. Health Plans may hire third parties that may need your PHI to perform certain services on behalf of the Plan. These third parties are “Business Associates” of the Plan. Business Associates must protect any PHI they receive from, or create and maintain on behalf of, Health Plans. For example, Health Plans may hire a third party administrator to process claims, an auditor to review how an insurer or third party administrator is processing claims, or an insurance agent to assess coverage and help with claim problems.
To Individuals Involved with Your Care or Payment for Your Care. Health Plans may disclose your PHI to adult members of your family or another person identified by you who is involved with your care or payment for your care if: 1) You authorize Health Plans to do so; 2) Health Plans informs you that it intends to do so and you do not object; or 3) Health Plans infers from the circumstances, based upon professional judgment, that you do not object to the disclosure. Whenever possible, Health Plans will try to get your written objection to these disclosures (if you wish to object), but in certain circumstance it may rely on your oral agreement or disagreement to disclosures to family members.
To Personal Representatives. Health Plans may disclose your PHI to someone who is your personal representative. Before Health Plans will give that person access to your PHI or allow that person to take any action on your behalf, it will require him/her to give proof that he/she may act on your behalf; for example, a court order or power of attorney granting that person such power. Generally, the parent of a minor child will be the child’s personal representative. In some cases, however, state law allows minors to obtain treatment (e.g., sometimes for pregnancy or substance abuse) without parental consent, and in those cases Health Plans may not disclose certain information to the parents. Health Plans may also deny a personal representative access to PHI to protect people, including minors, who may be subject to abuse or neglect.
For Fundraising Communications. We may contact you with information about the importance of contributions to the Saint Mary’s Foundation and invite you to participate. We may share with our fundraising staff limited information about you (e.g., your name, address, and phone number) including the dates on which we provided health care to you, without your written authorization. If you do not want to receive any fundraising requests in the future, you may contact the Foundation by phone at (775) 770-3020.
To Your Employer. Health Plans may disclose your PHI to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
For Treatment Alternatives or Health-Related Benefits and Services. Health Plans may contact you to provide information about treatment alternative or other health-related benefits or services that may be of interest to you.
For Public Health Purposes. Health Plans may:
- Report specific disease or birth/death information to a public health authority authorized to collect that information;
- Report health information to public health authorities for the purpose of preventing or controlling disease, injury, or disability;
- Report reactions to medication or problems with medical products to the Food and Drug Administration to help ensure the quality, safety, or effectiveness of those medications or medical products; or
- If authorized by law, disclose PHI to a person who may have been exposed to a communicable disease or who may otherwise be at risk of contracting or spreading a disease or medical condition.
To Report Violence and Abuse. Health Plans may report information about victims of abuse, neglect or domestic violence to the proper authorities.
For Health Oversight Activities. Health Plans may disclose PHI for civil, administrative criminal investigations, oversight inspections, licensure or disciplinary actions (e.g., to investigate complaints against medical providers), and other activities for the oversight of the health care system or to monitor government benefit programs.
For Lawsuits and Disputes. Health Plans may disclose PHI to an order of a court or administrative agency, but only to the extent expressly authorized in the order. Health Plans may also disclose PHI in response to a subpoena, a lawsuit discovery request, or other lawful process, but only if Health Plans has received adequate assurances that the information to be disclosed will be protected. Health Plans may also disclose PHI in a lawsuit if necessary for payment or health care operations purposes.
For Law Enforcement. Health Plans may disclose PHI to law enforcement officials for law enforcement purposes and to correctional institutions regarding inmates.
To Coroners, Funeral Directors and Medical Examiners. Health Plans may disclose PHI to a coroner or medical examiner; for example, to identify a person or determine the cause of death. Health Plans may also release PHI to a funeral director that needs it to perform his or her duties.
For Organ Donations. Health Plans may disclose PHI to organ procurement organizations to facilitate organ eye or tissue donations.
For Limited Data Sets. Health Plans may disclose PHI for use in a limited data set for purposes of research, public health or health care operations, but only if a data use agreement has been signed.
To Avert Serious and Imminent Threats to Health or Safety. Health Plans may disclose PHI to avert a serious and Imminent threat to your health or safety or that of members of the public.
For Special Governmental Functions. Health Plans may disclose PHI to authorized federal officials in certain circumstances. For example, disclosure may be made for national security purposes or for members of the armed forces if required by military command authorities.
For Workers’ Compensation. Health Plans may disclose PHI for workers’ compensation if necessary to comply with these laws.
For Research. Health Plans may disclose PHI for research studies, subject to special procedures intended to protect the privacy of your PHI.
For Emergencies and Disaster Relief. Health Plans may disclose PHI to organizations engaged in emergency and disaster relief efforts.
As Required By Law. We may use and share your PHI when required to do so by any other law not already referred to above.
In all other situations Health Plans will not use or disclose your PHI without your written authorization. The authorization must meet the requirements of the Privacy Rules. If you give Health Plans a written authorization, you may cancel your authorization, except for uses or disclosures that have already been made based on your authorization. Written “revocation” statements must be submitted to our Privacy Officer at the address listed above.
You may not, however, cancel your authorization if it was obtained as a condition for obtaining insurance coverage and if you cancellation will interfere with the insurer’s right to contest your claims for benefits under the insurance policy. Health Plans may condition your enrollment or eligibility for benefits on your signing an authorization, but only if the authorization is limited to disclosing information necessary for underwriting or risk rating determinations needed for Health Plans to obtain insurance coverage.
Highly Confidential Information. Federal and state laws require special privacy protections for certain highly confidential information about you (“Highly Confidential Information”), including any portion of your PHI that is: (1) kept in psychotherapy notes; (2) about mental health and developmental disabilities services; (3) about alcohol and drug abuse prevention, Treatment and referral; (4) about HIV/AIDS testing, diagnosis or Treatment; (5) about sexually transmitted disease(s); (6) about genetic testing; (7) about child abuse and neglect; (8) about domestic abuse of an adult with a disability; (9) about sexual assault; or (10) Invitro Fertilization (IVF) Before we share your Highly Confidential Information for a purpose other than those permitted by law, we must obtain your written permission.
For Marketing. We must also obtain your written permission (authorization) prior to using your PHI to send you any marketing materials. However, we may communicate with you about products or services related to your Treatment, case management, or care coordination, or alternative treatments, therapies, health care providers, or care settings without your permission. For example, we may not sell your PHI without your written authorization.
YOUR INDIVIDUAL RIGHTS
You have certain rights under the Privacy Rules relating to your PHI maintained by Health Plans. All requests to exercise those rights must be made in writing to the Privacy Official. Health Plans’ insurers and HMO’s keep their own records and you must make your requests relating to you PHI in those records directly to that insurer or HMO. Your rights are:
Right to Request Restrictions on Uses and Disclosures of Your PHI. You may request that Health Plans restrict any of the permitted uses and disclosures of your PHI listed above. Health Plans, however, does not always have to agree to your requested restriction. A restriction cannot prevent use or disclosures that are required by the Secretary of DHHS to determine or investigate Health Plans’ compliance with the Privacy Rules, or that are otherwise required by law. We must grant your request to a restriction on disclosure of your PHI to a health plan if you have paid for the health care item in full out of pocket.
Right to Access or Copy Your PHI. You generally have a right to access your PHI that is kept in Health Plans’ records, except for; 1) psychotherapy notes (as defined in the Privacy Rules); or 2) information complied in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding. Health Plans may deny you access to your PHI in Health Plans’ records. You may, under some circumstance, request a review of that denial. Health Plans may charge you a reasonable fee for copying the information you request and the cost of any mailing, but cannot charge you for time spent finding and assembling the requested information.
Right to an Accounting of Disclosures. At your request, Health Plans must provide you with a list of Health Plans’ disclosures of your PHI made within the six-year period just before the date of your request, except disclosures made:
- For purposes of treatment, payment or health care operations;
- Directly to you or close family members involved in your care;
- For purposes of national security;
- Incidental to otherwise permitted or required disclosures;
- As part of a limited data set;
- To correctional institutions or law enforcement officials;
- With your express authorization.
You may request one accounting, which Health Plans must provide at no charge, within a single 12-month period. If you request more than one accounting within the same 12-month period, Health Plans may charge you a reasonable fee.
Right to Amend. You may request that Health Plans change your PHI that is kept in Health Plans’ records, but Health Plans does not have to agree to your request. Health Plans may deny your request if the information in its records: 1) was not created by Health Plans; 2) is not part of Health Plans’ records; 3) would not be information to which you would have right of access; or 4) is deemed by Health Plans to be complete and accurate as it then exists.
Right to Request Restrictions and Confidential Communications. You have the right to request that Health Plans communicate with you in a confidential manner, for example, by sending information to an alternative address or by an alternative means. Health Plans will accommodate any reasonable request, though it will require that any alternative used must still allow for payment information to be effectively communicated and for payments to be made.
Right to File a Complaint. If you believe your rights have been violated, you have a right to file a written complaint with Health Plans’ Privacy Official or with the Secretary of the DHHS. Health Plans will not retaliate against you for filing a complaint and cannot condition your enrollment or your entitlement to benefits on your waiving these rights. If your complaint is with an insurer or HMO, you may file a complaint with the individual named in their Notice of Privacy Practices to receive complaints. If your complaint is with Health Plans, you may submit your complaint to the Privacy Official at the address at the end of this Notice. To file a complaint with the Secretary of the DHHS, you must submit your complaint in writing, either on paper or electronically, within 180 days of the date you knew or should have known that the violation occurred. You must state who you are complaining about and the acts or omissions you believe are violations of the Privacy Rules. Complaints sent to the Secretary must be addressed to the regional office of the DHHS’ Office of Civil Rights (OCR) for the state in which the alleged violation occurred. For additional information go to the OCR website at www.hhs.gov/ocr/hipaa/.
Right to Receive a Paper Copy of This Notice upon Request. You have a right to obtain a paper copy of this Notice upon request. To request a paper copy of the Notice, contact the Health Plans Privacy Official.
HEALTH INFORMATION NOT COVERED BY THIS NOTICE
This Notice does not cover:
- Health information that does not identify you and with respect to which there is no reasonable basis to believe that the information could be used to identify you; or
- Health information that the Company can have under applicable law e.g., the Family and Medical Leave Act, the Americans with Disabilities Act, worker’s compensation, federal and state occupational health and safety laws, and other state and federal laws), or that the Company properly can get for employment related purposes through sources other than Health Plans and that is kept as part of your employment records (e.g., pre-employment physicals, drug testing, fitness for duty examinations, etc.).
CHANGES TO THE NOTICE
Health Plans reserves the right to change the terms of this Notice to make the new revised Notice provisions effective for all PHI that it maintains, including any PHI created, received or maintained by SMPHI before the date of the revised Notice. If you agree, Health Plans may provide you with a revised Notice electronically. Otherwise, Health Plans will provide you with a paper copy of the revised Notice. In addition, Health Plans will post the revised Notice on its website used to provide information about Health Plans’ benefits.
If you believe that Health Plans has violated your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may file a complaint with Health Plans or with the Secretary of the Department of Health and Human Services.
To file a complaint with Health Plans, you must submit your complaint in writing to:
Lois J. Paynter - Privacy Officer
Vice President Operations
Saint Mary’s Health Plans
1510 Meadow Wood Lane
Reno, Nevada 89502
T: (775) 770-6232
F: (775) 770-6253
To file a complaint with the Secretary of the Department of Health and Human Services, you must submit your complaint in writing within 180 days to:
Michael Kruley, Regional Manager
Office for Civil Rights (Region IX - Nevada)
U.S. Department of Health and Human Services
90 7th Street, Suite 4-100
San Francisco, CA 94103
To file a Complaint with the Secretary of the Consumer Health Assistance you must submit your Complaint in writing to:
Consumer Health Assistance
555 East Washington Avenue, Suite 4800
Las Vegas, Nevada 89101
T: (702) 486-3587 or
T: (888) 333-1597