The following is the Notice of Privacy Practices for health plan beneficiaries of the University of St. Thomas Health Plans. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
The effective date of this Notice of the University of St. Thomas Benefits Plans Information Privacy Practices (the “Notice”) is April 14, 2006.
University of St. Thomas Benefits Plans (the “Plan”) provide health benefits to eligible employees of the University of St. Thomas (the “University”) and their eligible dependents as described in the summary plan description(s) for the Plan. The Plan creates, receives, uses, maintains and discloses health information about participating employees and dependents in the course of providing these health benefits.
For ease of reference, in the remainder of this Notice, the words “you,” “your,” and “yours” refers to any individual with respect to whom the Plan receives, creates or maintains Protected Health Information, including employees, retirees and COBRA qualified beneficiaries, if any, and their respective dependents.
The Plan is required by law to take reasonable steps to protect your Protected Health Information from inappropriate use or disclosure.
Your “Protected Health Information” (PHI) is information about your physical or mental health condition, the provision of health care to you, or payment for health care provided to you, but only if the information identifies you or there is a reasonable basis to believe that the information could be used to identify you.
The Plan is required by law to provide notice to you of the Plan’s duties and privacy practices with respect to your PHI, and is doing so through this Notice. This Notice describes the different ways in which the Plan uses and discloses PHI. It is not feasible in this Notice to describe in detail all of the specific uses and disclosures the Plan may make of PHI, so this Notice describes all of the categories of uses and disclosures of PHI that the Plan may make and, for most of those categories, gives examples of those uses and disclosures.
The Plan is required to abide by the terms of this Notice until it is replaced. The Plan may change its privacy practices at any time and, if any such change requires a change to the terms of this Notice, the Plan will revise and re-distribute this Notice. Accordingly, the Plan can change the terms of this Notice at any time. The Plan has the right to make any such change effective for all of your PHI that the Plan creates, receives or maintains, even if the Plan received or created that PHI before the effective date of the change.
The Plan is distributing this Notice, and will distribute any revisions, only to participating employees, retirees and COBRA qualified beneficiaries, if any. If you have coverage under the Plan as a dependent of an employee, retiree or COBRA qualified beneficiary, you can get a copy of the Notice by requesting it from the contact named at the end of this Notice.
Please note that this Notice applies only to your PHI that the Plan maintains. It does not affect your doctor’s or other health care provider’s privacy practices with respect to your PHI that they maintain.
The Plan may disclose your PHI to, and allow use and disclosure of your PHI by, the University and Business Associates without obtaining your authorization.
Plan Sponsor: The University is the Plan Sponsor and Plan Administrator. The Plan may disclose to the University, in summary form, claims history and other information so that the University may solicit premium bids for health benefits, or to modify, amend or terminate the Plan. This summary information omits your name and Social Security Number and certain other identifying information. The Plan may also disclose information about your participation and enrollment status in the Plan to the University and receive similar information from the University. If the University agrees in writing that it will protect the information against inappropriate use or disclosure, the Plan also may disclose to the University a limited data set that includes your PHI, but omits certain direct identifiers, as described later in this Notice.
The Plan may disclose your PHI to the University for plan administration functions performed by the University on behalf of the Plan, if the University certifies to the Plan that it will protect your PHI against inappropriate use and disclosure.
Business Associates: The Plan and the University hire third parties, such as a third party administrator (the “Claims Administrator”), to help the Plan provide health benefits. These third parties are known as the Plan’s “Business Associates.” The Plan may disclose your PHI to Business Associates, like the Claims Administrator, who are hired by the Plan or the University to assist or carry out the terms of the Plan. In addition, these Business Associates may receive PHI from third parties or create PHI about you in the course of carrying out the terms of the Plan. The Plan and the University must require all Business Associates to agree in writing that they will protect your PHI against inappropriate use or disclosure, and will require their subcontractors and agents to do so, too.
For purposes of this Notice, all actions of the University and the Business Associates that are taken on behalf of the Plan are considered actions of the Plan. For example, health information maintained in the files of the Claims Administrator is considered maintained by the Plan. So, when this Notice refers to the Plan taking various actions with respect to health information, those actions may be taken by the University or a Business Associate on behalf of the Plan.
The Plan may use and disclose your PHI for the following purposes without obtaining your authorization.
Your Health Care Treatment: The Plan may disclose your PHI for treatment (as defined in applicable federal rules) activities of a health care provider.
Making or Obtaining Payment for Health Care or Coverage: The Plan may use or disclose your PHI for payment (as defined in applicable federal rules) activities, including making payment to or collecting payment from third parties, such as health care providers and other health plans.
The Plan’s use or disclosure of your PHI for payment purposes may include uses and disclosures for the following purposes, among others.
The Plan also may disclose your PHI for purposes of assisting other health plans (including other health plans sponsored by the University), health care providers, and health care clearinghouses with their payment activities, including activities like those listed above with respect to the Plan.
Health Care Operations: The Plan may use and disclose your PHI for health care operations (as defined in applicable federal rules) which includes a variety of facilitating activities.
Example: If claims you submit to the Plan indicate that the stop-loss coverage that the University has purchased in connection with the Plan may be triggered, the Plan may use or disclose your PHI to inform the stop-loss carrier of the potential claim and to make any claim that ultimately applies.
The Plan’s use and disclosure of your PHI for health care operations purposes may include uses and disclosures for the following purposes.
The Plan also may use or disclose your PHI for purposes of assisting other health plans (including other plans sponsored by the University), health care providers and health care clearinghouses with their health care operations activities that are like those listed above, but only to the extent that both the Plan and the recipient of the disclosed information have a relationship with you and the PHI pertains to that relationship.
The Plan also may use or disclose your PHI for purposes of assisting other health plans for which the University is the plan sponsor, and any insurers with respect to those plans, with their health care operations activities similar to both categories listed above.
Limited Data Set: The Plan may disclose a limited data set to a recipient who agrees in writing that the recipient will protect the limited data set against inappropriate use or disclosure. A limited data set is health information about you and/or others that omits your name and Social Security Number and certain other identifying information.
Legally Required: The Plan will use or disclose your PHI to the extent required to do so by applicable law. This may include disclosing your PHI in compliance with a court order, or a subpoena or summons. In addition, the Plan must allow the U.S. Department of Health and Human Services to audit Plan records.
Health or Safety: When consistent with applicable law and standards of ethical conduct, the Plan may disclose your PHI if the Plan, in good faith, believes that such disclosure is necessary to prevent or lessen a serious and imminent threat to your health or the health and safety of others.
Law Enforcement: The Plan may disclose your PHI to a law enforcement official if the Plan believes in good faith that your PHI constitutes evidence of criminal conduct that occurred on the premises of the Plan. The Plan also may disclose your PHI for limited law enforcement purposes.
Lawsuits and Disputes: In addition to disclosures required by law in response to court orders, the Plan may disclose your PHI in response to a subpoena, discovery request or other lawful process, but only if certain efforts have been made to notify you of the subpoena, discovery request or other lawful process or to obtain an order protecting the information to be disclosed.
Workers’ Compensation: The Plan may use and disclose your PHI when authorized by and to the extent necessary to comply with laws related to workers’ compensation or other similar programs.
Emergency Situation: The Plan may disclose your PHI to a family member, friend, or other person, for the purpose of helping you with your health care or payment for your health care, if you are in an emergency medical situation and you cannot give your agreement to the Plan to do this.
Personal Representatives: The Plan will disclose your PHI to your personal representatives appointed by you or designated by applicable law (a parent acting for a minor child, or a guardian appointed for an incapacitated adult, for example) to the same extent that the Plan would disclose that information to you.
Public Health: To the extent that other applicable law does not prohibit such disclosures, the Plan may disclose your PHI for purposes of certain public health activities, including, for example, reporting information related to an FDA-regulated product’s quality, safety or effectiveness to a person subject to FDA jurisdiction.
Health Oversight Activities: The Plan may disclose your PHI to a public health oversight agency for authorized activities, including audits, civil, administrative or criminal investigations; inspections; licensure or disciplinary actions.
Coroner, Medical Examiner, or Funeral Director: The Plan may disclose your PHI to a coroner or medical examiner for the purposes of identifying a deceased person, determining a cause of death or other duties as authorized by law. Also, the Plan may disclose your PHI to a funeral director, consistent with applicable law, as necessary to carry out the funeral director’s duties.
Organ Donation: The Plan may use or disclose your PHI to assist entities engaged in the procurement, banking, or transplantation of cadaver organs, eyes, or tissue.
Specified Government Functions: In specified circumstances, federal regulations may require the Plan to use or disclose your PHI to facilitate specified government functions related to the military and veterans, national security and intelligence activities, protective services for the president and others, and correctional institutions and inmates.
Except as stated above, the Plan will not use or disclose your PHI unless it first receives written authorization from you. If you authorize the Plan to use or disclose your PHI, you may revoke that authorization in writing at any time, by sending notice of your revocation to the contact person named at the end of this Notice. To the extent that the Plan has taken action in reliance on your authorization (entered into an agreement to provide your PHI to a third party, for example) you cannot revoke your authorization.
The Plan may contact you for various reasons, usually in connection with claims and payments and usually by mail.
You should note that the Plan may contact you about treatment alternatives or other health-related benefits and services that may be of interest to you.
Confidential Communication by Alternative Means: If you feel that disclosure of your PHI could endanger you, the Plan will accommodate a reasonable request to communicate with you by alternative means or at alternative locations. For example, you might request the Plan to communicate with you only at a particular address. If you wish to request confidential communications, you must make your request in writing to the contact person named at the end of this Notice. You do not need to state the specific reason that you feel disclosure of your PHI might endanger you in making the request, but you do need to state whether that is the case. Your request also must specify how or where you wish to be contacted. The Plan will notify you if it agrees to your request for confidential communication. You should not assume that the Plan has accepted your request until the Plan confirms its agreement to that request in writing.
Request Restriction on Certain Uses and Disclosures: You may request the Plan to restrict the uses and disclosures it makes of your PHI. The Plan is not required to agree to a requested restriction, but if it does agree to your requested restriction, the Plan is bound by that agreement, unless the information is needed in an emergency situation. There are some restrictions, however, that are not permitted even with the Plan’s agreement. To request a restriction, please submit your written request to the contact person identified at the end of this Notice. In the request please specify: (1) what information you want to restrict; (2) whether you want to limit the Plan’s use of that information, its disclosure of that information, or both; and (3) to whom you want the limits to apply (a particular physician, for example). The Plan will notify you if it agrees to a requested restriction on how your PHI is used or disclosed. You should not assume that the Plan has accepted a requested restriction until the Plan confirms its agreement to that restriction in writing.
Paper Copy of This Notice: You have a right to request and receive a paper copy of this Notice at any time, even if you received this Notice previously, or have agreed to receive this Notice electronically. To obtain a paper copy please call or write the contact person named at the end of this Notice.
Right to Access Your PHI: You have a right to access your PHI in the Plan’s enrollment, payment, claims adjudication and case management records, or in other records used by the Plan to make decisions about you, in order to inspect it and obtain a copy of it. Your request for access to this PHI should be made in writing to the contact person named at the end of this Notice. The Plan may deny your request for access, for example, if you request information compiled in anticipation of a legal proceeding. If access is denied, you will be provided with a written notice of the denial, a description of how you may exercise any review rights you might have, and a description of how you may complain to Plan or the Secretary of Health and Human Services. If you request a copy of your PHI, the Plan may charge a reasonable fee for copying and, if applicable, postage associated with your request.
Right to Amend: You have the right to request amendments to your PHI in the Plan’s records if you believe that it is incomplete or inaccurate. A request for amendment of PHI in the Plan’s records should be made in writing to the contact person named at the end of this Notice. The Plan may deny the request if it does not include a reason to support the amendment. The request also may be denied if, for example, your PHI in the Plan’s records was not created by the Plan, if the PHI you are requesting to amend is not part of the Plan's records, or if the Plan determines the records containing your health information are accurate and complete. If the Plan denies your request for an amendment to your PHI, it will notify you of its decision in writing, providing the basis for the denial, information about how you can include information on your requested amendment in the Plan’s records, and a description of how you may complain to Plan or the Secretary of Health and Human Services.
Accounting: You have the right to receive an accounting of certain disclosures made of your health information. Most of the disclosures that the Plan makes of your PHI are not subject to this accounting requirement because routine disclosures (those related to payment of your claims, for example) generally are excluded from this requirement. Also, disclosures that you authorize, or that occurred prior to April 14, 2006, are not subject to this requirement. To request an accounting of disclosures of your PHI, you must submit your request in writing to the contact person named at the end of this Notice. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2006. Your request should indicate in what form you want the accounting to be provided (for example on paper or electronically). The first list you request within a 12-month period will be free. If you request more than one accounting within a 12-month period, the Plan will charge a reasonable, cost-based fee for each subsequent accounting.
Personal Representatives: You may exercise your rights through a personal representative. Your personal representative will be require to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. The Plan retains discretion to deny a personal representative access to your PHI to the extent permissible under applicable law.
If you believe that your privacy rights have been violated, you have the right to express complaints to the Plan and to the Secretary of the Department of Health and Human Services. Any complaints to the Plan should be made in writing to the contact person named at the end of this Notice. The Plan encourages you to express any concerns you may have regarding the privacy of your information. You will not be retaliated against in any way for filing a complaint.
The Plan has designated Deborah Sagstetter, Rewards and Recognition Manager, as its contact person for all issues regarding the Plan’s privacy practices and your privacy rights. You can reach this contact person at: 2115 Summit Avenue, AQU217, St. Paul, Minnesota, 55105. All HIPAA related documentation and release forms can be obtained from the University of St. Thomas’s Human Resources Department.