Notice of Privacy Practices
 

NOTICE OF PRIVACY PRACTICES

 

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

 

Effective Date of Notice: September 23, 2013

 

                This Notice of Privacy Practices ("Notice") is made in compliance with the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Standards") set forth by the U.S. Department of Health and Human Services ("HHS") pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA").  The Montrose County School District RE-1J Employee Benefit Plan (the "Plan") is required by law to take reasonable steps to ensure the privacy of your Protected Health Information ("PHI"), as defined below, and to inform you about:

 

                (1)           the Plan's uses and disclosures of PHI;

(2)           your privacy rights with respect to your PHI;

(3)           the Plan's duties with respect to your PHI;

(4)           your right to file a complaint with the Plan and with the Secretary of HHS; and

(5)           the person or office to contact for further information about the Plan's privacy practices.

 

The term "Protected Health Information" (PHI) includes all "Individually Identifiable Health Information" transmitted or maintained by the Plan, regardless of form (oral, written or electronic).

 

The term "Individually Identifiable Health Information" means information that:

  • Is created or received by a health care provider, health plan, employer or health care clearinghouse;
  • Relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; or genetic information of an individual; and
  • Identifies the individual, or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

 

Section 1.  Notice of PHI Uses and Disclosures

 

1.1          Required PHI Disclosures

               

Upon your request, the Plan is required to give you access to certain PHI. For further information pertaining to your rights in this regard, see Section 2 of this Notice.

 

                The Plan must disclose your PHI when required by the Secretary of HHS to investigate or determine the Plan's compliance with the Privacy Standards.

 

1.2          Permitted uses and disclosures to carry out treatment, payment and health care operations

 

                The Plan, its business associates, and their agents/subcontractors, if any, will use or disclose PHI without your consent, authorization or opportunity to agree or object, to carry out treatment, payment and health care operations.  The Plan will disclose PHI to a business associate only if the Plan receives satisfactory assurance that the business associate will appropriately safeguard the information. 

 

In addition, the Plan may contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.  The Plan will disclose PHI to Montrose County School District RE-1J ("Plan Sponsor") for purposes related to treatment, payment and health care operations.  The Plan Sponsor has amended its plan documents to protect your PHI as required by the Privacy Standards. 

 

                Treatment is the provision, coordination or management of health care and related services by one or more health care providers.  It also includes, but is not limited to, consultations and referrals between one or more of your providers.

 

For example, the Plan may disclose to a treating orthodontist the name of your treating dentist so that the orthodontist may ask for your dental X-rays from the treating dentist.

               

Payment means activities undertaken by the Plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the Plan, or to obtain or provide reimbursement for the provision of health care.  Payment includes, but is not limited to, actions to make eligibility or coverage determinations, billing, claims management, collection activities, subrogation, reviews for medical necessity and appropriateness of care, utilization review and pre-authorizations.

               

For example, the Plan may tell a doctor whether you are eligible for coverage or what percentage of the bill might be paid by the Plan.

 

                Health care operations means conducting quality assessment and improvement activities, population-based activities relating to improving health or reducing health care costs, contacting health care providers and patients with information about treatment alternatives, reviewing the competence or qualifications of health care professionals, evaluating health plan performance, underwriting, premium rating and other insurance activities relating to creating, renewing or replacing health insurance contracts or health benefits.  It also includes disease management, case management, conducting or arranging for medical review, legal services and auditing functions including fraud and abuse detection and compliance programs, business planning and development, business management and general administrative activities.

 

For example, the Plan may use information about your claims to refer you to a disease management program, project future benefit costs or audit the accuracy of its claims processing functions.

                               

1.3          Uses and disclosures that require your written authorization

 

                Uses and disclosures not described in this notice will only be made with your authorization. The Plan will not sell your PHI or use your PHI for marketing purposes without your express written authorization.       Your written authorization generally will be obtained before the Plan will use or disclose psychotherapy notes about you from your psychotherapist.  Psychotherapy notes are separately filed notes about your conversations with your mental health professional during a counseling session.  They do not include summary information about your mental health treatment.  The Plan may use and disclose such notes without authorization when needed by the Plan to defend against litigation filed by you.

 

                 You may revoke a written authorization by contacting the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

1.4          Disclosures that require that you be given an opportunity to agree or disagree prior to the disclosure

 

                The Plan may disclose to a family member, other relative, close personal friend of yours or any other person identified by you PHI directly relevant to such person's involvement with your care or payment for your health care when you are present for, or otherwise available prior to, a disclosure and you are able to make health care decisions, if:

 

  • The Plan obtains your agreement;
  • The Plan provides you with the opportunity to object to the disclosure and you fail to do so; or
  • The Plan infers from the circumstances, based upon professional judgment, that you do not object to the disclosure.

 

1.5          Uses and disclosures for which authorization or opportunity to agree or object is not required

 

Use and disclosure of your PHI is allowed without your authorization or opportunity to agree or object under the following circumstances:

 

  1. When required or authorized by law, provided that the use or disclosure complies with and is limited to the relevant requirements of such law.
  2. When permitted for purposes of public health activities. The Plan may disclose your PHI to a health oversight agency for oversight activities authorized by law.The Plan may disclose your PHI in the course of a judicial or administrative proceeding in response to an order of a court or administrative tribunal, provided that the Plan discloses only the PHI expressly authorized by such order, or in response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court of administrative tribunal if certain conditions are met.
  3. The Plan may disclose your PHI to a law enforcement official when required for law enforcement purposes.
  4. The Plan may use or disclose PHI for research, subject to certain conditions.
  5. When consistent with applicable law and standards of ethical conduct, the Plan may use or disclose PHI if the Plan, in good faith, believes the use or disclosure: (i) is necessary to prevent or lessen a serious and imminent threat to health or safety of a person or the public and is to person(s) able to prevent or lessen the threat, including the target of the threat, or (ii) is needed for law enforcement authorities to identify or apprehend an individual, provided certain requirements are met.
  6. When authorized by and to the extent necessary to comply with workers' compensation or other similar programs established by law.

 

1.6          Uses and Disclosures that are Prohibited

 

                If the Plan uses your PHI for underwriting purposes, the Plan may not disclose PHI that is genetic information to be used for that purpose.  “Genetic information” includes genetic tests and manifested diseases/disorders of family members.

 

Section 2:  Rights of Individuals

 

2.1          Right to Request Restrictions on PHI Uses and Disclosures

 

                You may request the Plan to restrict uses and disclosures of your PHI to carry out treatment, payment or health care operations, or to restrict disclosures to family members, relatives, friends or other persons identified by you who are involved in your care or payment for your care.  However, the Plan is not required to agree to your requested restriction.

 

                If the Plan agrees to a requested restriction, the Plan may not use or disclose PHI in violation of such restriction, except that, if you requested a restriction and later are in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment, the Plan may use the restricted PHI, or it may disclose such information to a health care provider, to provide such treatment to you.  If restricted PHI is disclosed to a health care provider for emergency treatment, the Plan must request that such health care provider not further use or disclose the information. 

 

                You or your personal representative will be required to request restrictions on uses and disclosures of your PHI in writing.  Such requests should be addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

2.2          Right to Request Confidential Communications of PHI

 

                You may request to receive communications of PHI from the Plan by alternative means or at alternative locations if you clearly state that the disclosure of all or part of the information to which the request pertains could endanger you.  The Plan will accommodate all such reasonable requests.  However, the Plan may condition the provision of a reasonable accommodation on:

 

  • When appropriate, information as to how payment, if any, will be handled; and
  • Specification by you of an alternative address or other method of contact.

 

                You or your personal representative will be required to request confidential communications of your PHI in writing.  Such requests should be addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

2.3          Right to Inspect and Copy PHI

 

                You have a right to inspect and obtain a copy of your PHI contained in a "designated record set," for as long as the Plan maintains PHI in the designated record set.  You may request an electronic copy or a paper copy of your PHI.

 

                "Designated Record Set" means a group of records maintained by or for a health plan that is enrollment, payment, claims adjudication and case or medical management record systems maintained by or for a health plan; or used in whole or in part by or for the health plan to make decisions about individuals. 

 

                The Plan will act on a request for access no later than 30 days after receipt of the request.  However, if the request for access is for PHI that is not maintained or accessible to the Plan on-site, the Plan must take action no later than 60 days from the receipt of such request.  The Plan must take action as follows:  if the Plan grants the request, in whole or in part, the Plan must inform you of the acceptance and provide the access requested.  However, if the Plan denies the request, in whole or in part, the Plan must provide you with a written denial.  If the Plan cannot take action within the required time, the Plan may extend the time for such action by no more than 30 days if the Plan, within the applicable time limit, provides you with a written statement of the reasons for the delay and the date by which it will complete its action on the request. 

 

                The Plan will provide you with access to the PHI in the form or format requested if it is readily producible in such form or format; or, if it is not, in a readable electronic or hard copy form or such other form or format as agreed to between you and the Plan.  If you request a copy of PHI, the Plan may impose a reasonable, cost-based fee. 

 

                If the Plan does not maintain the PHI that is the subject of your request for access, and the Plan knows where the requested information is maintained, the Plan will inform you where to direct the request for access. 

 

You or your personal representative will be required to request access to your PHI in writing.  Such requests should be addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

2.4          Right to Amend PHI

 

                You have the right to request the Plan to amend your PHI or a record about you in a designated record set for as long as the PHI is maintained in the designated record set. The Plan may deny your request for amendment if it determines that the PHI or record that is the subject of the request:

 

  • Was not created by the Plan, unless you provide a reasonable basis to believe that the originator of PHI is no longer available to act on the requested amendment;
  • Is not part of the designated record set;
  • Would not be available for your inspection under the Privacy Standards; or
  • Is accurate and complete.

 

You or your personal representative will be required to request amendment to your PHI in a designated record set in writing.  Such requests should be addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701. All requests for amendment of PHI must include a reason to support the requested amendment. 

 

2.5          Right to Receive an Accounting of PHI Disclosures

 

                At your request, the Plan will provide you with an accounting of disclosures by the Plan of your PHI during the six years prior to the date on which the accounting is requested, including disclosures to or by business associates of the Plan..  However, such accounting need not include PHI disclosures made: (a) to carry out treatment, payment or health care operations; (b) to individuals about their own PHI; (c) incident to a use or disclosure otherwise permitted or required by the Privacy Standards; (d) pursuant to an authorization; (e) to certain persons involved in your care or payment for your care; (f) to notify certain persons of your location, general condition or death; (g) as part of a "Limited Data Set" (as defined in the Privacy Standards), which largely relates to research purposes; or (h) prior to the compliance date of April 14, 2003.  You may request an accounting of disclosures for a period of time less than six years from the date of the request. 

 

You or your personal representative will be required to request an accounting of your PHI disclosures in writing.  Such requests should be addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

2.6          The Right to Receive a Notice of a Breach of your Unsecured PHI

 

                A “breach” is defined as the “unauthorized acquisition, access, use or disclosure of PHI in a manner which compromises the security or privacy of such information” and which poses “a significant risk of financial, reputational, or other harm to the individual.”  To determine whether an impermissible use or disclosure of PHI constitutes a breach, the Plan will perform a risk assessment to determine if there is significant risk of harm to you as a result of the impermissible use or disclosure.  If the Plan determines that a probability exists that your PHI may have been compromised, you will receive a notification by first-class mail regarding the breach at least sixty (60) days after the breach was discovered.

 

2.7          The Right To Receive a Paper Copy of This Notice Upon Request

 

                You have a right to obtain a paper copy of this Notice upon request.  To request a paper copy of this Notice, contact the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701, (970) 249-7726.

 

 

2.8          A Note About Personal Representatives

 

                You may exercise your rights through a personal representative.  Your personal representative will be required to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you.  Proof of such authority may include, but is not limited to, the following:

 

                (a)  a power of attorney for health care purposes, notarized by a notary public;

(b)  a court order of appointment of the person as the conservator or guardian of the individual; or

(c)  an individual who is the parent of a minor child.

 

Section 3:  The Plan's Duties

 

3.1          Notice

 

                The Plan is required by law to maintain the privacy of PHI and to provide individuals (participants and beneficiaries) with notice of its legal duties and privacy practices with respect to PHI. 

 

This Notice is effective beginning on the effective date set forth on Page 1 of this Notice, and the Plan is required to comply with the terms of this Notice.  However, the Plan reserves the right to change the terms of this Notice and to make the new revised notice provisions effective for all PHI that it maintains, including any PHI created, received or maintained by the Plan prior to the date of the revised notice. 

 

3.2          Minimum Necessary Standard

 

                When using or disclosing PHI or when requesting PHI from another covered entity, the Plan will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations.

 

                However, the minimum necessary standard will not apply in the following situations:

 

                (a)  disclosures to or requests by a health care provider for treatment;

(b)  uses or disclosures made to the individual;

(c)  disclosures made to the Secretary of HHS.

(d)  uses or disclosures that are required by law;

  1. uses or disclosures that are required for the Plan's compliance with the Privacy Standards; and
  2. uses or disclosures made pursuant to an authorization.

 

This Notice does not apply to information that has been de-identified.  De-identified information is health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.  It is not individually identifiable health information.

 

In addition, the Plan may use or disclose "summary health information" to the Plan Sponsor for obtaining premium bids or modifying, amending or terminating the group health plan.  Summary health information summarizes the claims history, claims expenses or type of claims experienced by individuals for whom a plan sponsor has provided health benefits under a group health plan, and from which identifying information has been deleted in accordance with the Privacy Standards.

 

Section 4:  Your Right to File a Complaint With the Plan or the HHS Secretary

 

If you believe that your privacy rights have been violated, you may complain to the Plan.  Any complaint must be in writing and addressed to the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701.

 

You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services, by writing to him at the following address: The Hubert H. Humphrey Building, 200 Independence Avenue, S.W., Washington, D.C. 20201. 

 

The Plan will not retaliate against you for filing a complaint.

 


Section 5:  Whom to Contact at the Plan for More Information

 

If you have any questions regarding this Notice or the subjects addressed in it, you may contact the following individual: Privacy Officer, P.O. Box 10000, 930 Colorado Ave., Montrose, CO  81402-9701, (970) 249-7726..

 

Conclusion

 

                PHI use and disclosure by the Plan is regulated by a federal law known as HIPAA.  You may find these rules at 45 Code of Federal Regulations Parts 160 and 164.  This Notice attempts to summarize the Plan’s obligations with regard to the Privacy and Security Standards.  The Privacy and Security Standards will supersede any discrepancy between the information in this Notice and the law.