UNIVERSITY OF THE SCIENCES IN PHILADELPHIA

 

NOTICE OF PRIVACY PRACTICES

 

The Legal Duty of the Plan

 

The University of the Sciences in Philadelphia (the “Plan”) is required by applicable federal and state laws to maintain the privacy of your PHI.  We are also required to give each of the participants in our health benefits plans this notice about our privacy practices, our legal duties, your rights and the rights of your dependents concerning PHI. You, and each of your covered dependents, are also sometimes referred to herein as a “Member.”  The Plan must follow the privacy practices that are described in this notice while it is in effect. 

The Plan reserves the right to change our privacy practices, and the terms of this notice, at any time, according to applicable law.  Before we make a material change in our privacy practices, we will change our notice and send the new notice to each of our enrolled Subscribers at the time of the change.  You may request a copy of our notice at any time.  The notice is also available on our website, www.usip.edu.  For more information about the Plan’s privacy practices, or to request an additional copy of this notice, please contact us by using the information listed at the end of this notice. 

PHI

 

PHI is a special term created by the government.  It is defined as “any information that is created or maintained by the Plan that relates to the past, present or future physical or mental health or condition of an individual or the provision of and/or payment for the provision of health care to an individual and which identifies the individual, or with which there is a reasonable basis to believe the information can be used to identify the individual.”  PHI includes information received or maintained in any form, including oral statements.  Examples of PHI are your name, address, Social Security number, birth date, dates of service, telephone number, fax number, account number, diagnosis code, and procedure code.

The Plan may receive PHI about you from various sources, such as from enrollment or other forms, which include your name, address, Social Security number, birth date, telephone number, health care provider, other health insurance coverage, and information about others in your household.  The Plan may also receive PHI about you from outside sources, such as employers, health care providers, federal and state agencies, or third-party vendors.

Except as described below, unless you specifically authorize the Plan to do so, the Plan will provide access to your PHI only to you, your authorized representative, and those persons who need the information to aid the Plan in the conduct of their business (“our Business Associates”).  You have the right to revoke an authorization, and we have described how to do so in this notice.

When using or disclosing PHI, the Plan will make every reasonable effort to limit the use or disclosure of that information to the minimum extent necessary to accomplish the intended purpose.  The Plan maintains physical, technical and procedural safeguards that comply with federal law and our Business Associates are limited by contract to using or disclosing PHI that we provide to them to only those purposes for which the information was disclosed.

Our Uses and Disclosures of PHI

 

The Plan is permitted to use and to disclose PHI in order to aid in your treatment, obtain payment for health care services provided to you and conduct our own “health care operations.”  Under limited circumstances, we may be able to provide PHI for the health care operations of other providers and health plans.  We may use your PHI for purposes of treatment, payment and health care operations without your authorization.  At times it will be necessary for the Plan to share PHI with our Business Associates so that they may assist us with our health care operations.  Specific examples of the ways in which PHI may be used and disclosed are provided below.  This list is representative only and not every use and disclosure in a category will be listed.

 

Treatment:  Although the Plan does not engage in treatment activities, we may disclose your PHI to a doctor or a hospital that asks us for it to assist them in providing you with treatment.

 

Payment:  The Plan may use and disclose your PHI to pay claims from doctors, hospitals and other providers for services delivered to you that are covered by the Plan.

 

·        Benefits and Claims:  The Plan will use PHI and will disclose this information for billing, claims management and medical necessity review in order to fulfill our responsibility to provide coverage and health care benefits as well as to provide payment for health care services.  For example, the Plan may use information it receives from a health care provider in order to process a claim.  We will then send the Subscriber an Explanation of Benefits that contains PHI about the care provided to you.  The Plan may also use and disclose PHI for billing and collection activities, including services provided by an outside billing agent or collection agency.  In addition, we may share PHI with a billing agent who is assisting a health care provider. 

·        Enrollment and Eligibility:  The Plan receives PHI including your name, address, Social Security number and birth date at the time of your enrollment.  This “enrollment information” is used by the Plan to provide coverage for health care benefits and for eligibility determinations.  We may share enrollment information with the “plan sponsor” of the Plan.  Our plan sponsor is University of the Sciences in Philadelphia.

·        Coordination of Benefits, Adjudication, Subrogation:  The Plan and other health plans use and disclose PHI to determine eligibility for benefits and periods of coverage.  For example, if you are covered under another health plan (e.g., Medicare or a spouse’s policy) it may be necessary for the Plan to disclose PHI to the other plans in order to determine eligibility and pay claims correctly (coordination of benefits).  Also, when processing a claim for health care benefits (adjudication), it may be necessary for the Plan to request information from, or share information with, a health care provider.  The Plan may also share information with an automobile carrier or Workers’ Compensation carrier to determine third-party liability coverage (subrogation).

 

Health Care Operations:  The Plan may use and disclose your PHI to rate our risk and determine our premiums for the health benefits it provides to you, to conduct quality assessment and improvement activities, to engage in care coordination or case management, and to properly conduct our business. 

 

·        Appeals and Complaints:  The Plan may use and disclose PHI to investigate a complaint or process an appeal by a Member.  In order to do so, it may be necessary for us to gather information or documents, including medical records, that are held both internally and externally by the Plan or others.  We may also share PHI with an independent medical reviewer to determine medical necessity and make recommendations to the Plan sponsor for use in the appeals process.

·        Customer Service: We may provide PHI to a provider, a health care facility, or another health plan that contacts us with questions regarding your health care coverage, including questions concerning eligibility, claim status, effective dates of coverage, or other issues.

·        Billing:  We receive PHI such as name, address, Social Security number and birth date at the time of your enrollment.  We may use this information to bill the Subscriber for the appropriate premiums.  The information may also be used to reconcile billings we receive from our Business Associates for services provided to you.

·        Fraud and Abuse Detection and Compliance Programs:  The Plan may use and disclose PHI for fraud and abuse detection and in activities required by our compliance program.  We may also share this information with Health Oversight Agencies or other appropriate entities.

·        Health Promotion and Disease Prevention:  The Plan may use PHI to identify and contact you for population-based activities relating to improving health or reducing health care costs, such as information about disease management programs or about health-related benefits and services or about treatment alternatives that may be of interest to you.

·        Litigation or When Required by Law:  In the event that you are involved in a lawsuit or other judicial proceeding, the Plan may use and disclose PHI in response to a court or administrative order as provided by law.  For example, we may be required to disclose PHI in response to a subpoena, warrant or other lawful process.   

·        Quality Improvement:  The Plan may use or disclose PHI to help us evaluate our performance.  For example, we may disclose names and addresses of our Members to a mailing house for use in mailing customer satisfaction surveys.

·        Research and Reporting:  The Plan may use your PHI in order to conduct an analysis of our data.  This information may be shared with internal departments such as auditing or it may be shared with our Business Associates, such as our actuaries.

·        Underwriting:  The Plan may use and disclose PHI for underwriting, premium rating or other activities relating to the creation, renewal or replacement of contracts for health insurance.

 

Other Uses and Disclosures of PHI

 

To You and with Your Authorization:  The Plan must disclose PHI to you, as described below in the Member’s Rights section of this notice.  You may, subject to the Plan’s policy for Authorizations, give us written authorization to use PHI or to disclose your PHI to anyone for any purpose.  You may revoke an Authorization in writing at any time; however, such revocation will not affect any use or disclosures that were made under the Authorization while it was in effect.  For additional information regarding revocation, use the contact information found at the end of this notice.  Without a written Authorization, the Plan may not use or disclose PHI for any reason other than in the performance of treatment, payment, or health care operations, and except for those purposes described in this notice.

Health Oversight Activities:  The Plan may share PHI, as provided by law, with Health Oversight Agencies, regulatory authorities or their appointed designees and reporting agencies.  These agencies include, but are not limited to, the Centers for Medicare and Medicaid Services. 

Business Associates: The Plan may disclose PHI to entities that perform a wide variety of services on our behalf.  For example, we work with auditors, attorneys, actuaries, consultants, and other health care plans who act as third-party administrators for the Plan.

To Individuals Involved in Your Care or Payment for Your Care:  We generally will not disclose PHI to your family members, close friends or others without your written authorization.  However, under certain circumstances, the Plan may disclose PHI to such persons.  For example, if you appear at the Plan office with your spouse and ask for PHI, we may ask you if we can provide you with your PHI in front of your spouse or even infer that it is permissible because you have brought your spouse with you.  However, this verbal or implied authorization only applies to the particular disclosure and future disclosures of PHI to family members will require a new authorization, either written or verbal, depending on the circumstances.  We may also disclose PHI for certain limited purposes to your family members, close friends or others in cases of a medical emergency where you are unable to provide authorization.

Disaster Relief:  The Plan may use or disclose your name, location and general condition or death to a public or private organization authorized by law or by its charter to assist in disaster relief efforts, such as the American Red Cross.

Plan Sponsor:  The Plan may disclose eligibility, enrollment, and limited disenrollment information to our plan sponsor in order to permit them to perform their plan administration functions on behalf of the Plan.  We may provide our plan sponsor with complete information relating to voluntary disenrollment information. We will limit the information we provide to the plan sponsor relating to involuntary disenrollment (termination of benefits) to a statement that the particular Member’s benefits have been terminated and, if applicable, the fact that a Health Oversight Agency has been notified. 

We may also disclose summary information about you and the participants enrolled in the Plan to our plan sponsor for them to use to obtain premium bids for the health insurance coverage we offer and/or to decide whether to modify, amend or terminate any of the benefits we currently offer through the Plan. The information we may disclose will simply summarize the claims history, claims expenses, or types of claims experienced by the participants in the Plan.  The summary information will be stripped of demographic information (e.g., name and address) but it is possible that the plan sponsor may be able to identify information about you or other participants contained in the summary information. In order to obtain any of the above information, the plan sponsor will be required to provide assurances to us that the confidentiality of the information will be protected and that the information will not be used in any employment-related decisions.  No other information will be shared with the plan sponsor without your Authorization, executed according to the Plan’s Authorization policy.

Public Health and Communicable Disease Reporting:  The Plan may disclose your PHI to a public health authority who is permitted by law to collect or receive the information.  Our reporting may be made in order to prevent or control disease, injury or disability, report child abuse or neglect, notify a person who may have been exposed to a disease or may be at risk for contracting a disease or condition or notifying the appropriate government authority if we believe a Member has been the victim of abuse, neglect or domestic violence, to name a few.

Research, Death, Organ Donation:  The Plan may use or disclose PHI for research purposes, in limited circumstances and with certain safeguards.  We may also disclose the PHI of a deceased person to a coroner, medical examiner, funeral director, or organ procurement organization for certain purposes.

Required by Law:  For example, the Plan must disclose your PHI to the U.S. Department of Health and Human Services if it asks to see it for purposes of determining whether we are in compliance with federal privacy laws.  We may also disclose your PHI when authorized by Workers’ Compensation or similar laws.

To Law Enforcement and for Public Safety:  Under certain circumstances, we may disclose your PHI for law enforcement purposes.  Examples include:  responding to court orders, warrants, or grand jury subpoenas; providing PHI in response to requests by law enforcement officials for identification and/or location of individuals; responding to inquiries by law enforcement relating to victims of crime; providing information to law enforcement with respect to crimes occurring on the Plan’s premises. In addition, under some circumstances, we may disclose your PHI in order to prevent or lessen a serious and imminent threat to the health or safety of a person or the public (including providing information to law enforcement authorities to apprehend a suspect or fugitive or advising an individual about threats made against them).  Finally, we may disclose your PHI if you are an inmate or other person in lawful custody and we are requested to do so by an appropriate law enforcement official or correctional institution.

Military and National Security:  Under certain circumstances, the Plan may disclose the PHI of armed forces personnel to military authorities.  We may also disclose PHI to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities.       

 

State Law Impact

 

To the extent that state law is more restrictive with respect to our ability to use or disclose your PHI or to the extent that it affords you greater rights with respect to the control of your PHI, we will follow state law.  This may arise if your PHI contains information relating to HIV/AIDS, mental health, alcohol and/or substance abuse, genetic testing, among others.

 

 

Member Rights

 

As a Member of the Plan, you have the following rights regarding your PHI:

 

·        Right to Inspect and Copy:  With limited exceptions, you have the right to inspect and/or obtain a copy of your PHI that the Plan maintains in a designated record set.  A “designated record set” consists of all documentation relating to your enrollment and the Plan’s use of your PHI including, for example, payment, claims adjudication and case or medical management.  You may request that we provide copies of your PHI to you in a format other than photocopies, which we will use unless we cannot practicably do so.  You must make a request in writing to obtain access to your PHI.

The Plan may charge you a reasonable cost-based fee to process and fulfill your request.  If you prefer, you may request that we prepare a summary or an explanation of your PHI for a fee.  Contact us using the information listed at the end of this notice for a full explanation of our fee structure.  If your request for access is denied, we will provide a written explanation for the denial and your rights regarding the denial.

The Plan does not receive or maintain a file of your treatment records.  You have a right to access these records through the treating physician, facility, or other provider that created and/or maintains the records.

 

·        Right to Amend:  You have the right to request that the Plan amend the PHI that we have created and that is maintained in our designated record set.  Your request must be in writing, and it must explain why the information should be amended.

The Plan cannot amend demographic information, treatment records or any other information created by others.  If you would like to amend any of this information, please contact your personnel office or, to amend your treatment records, you must contact the treating physician, facility or other provider that created these records.

We may deny your request if:  1) we did not create the information; 2) the information is not part of the designated record set maintained by the Plan; 3) you do not have access rights to the information; or 4) we believe the information is accurate and complete.

 

·        Right to an Accounting of Disclosures:  You have the right to receive an accounting of the instances in which the Plan or our Business Associates have disclosed your PHI.  You may request an accounting of disclosures made over the past six years or back to April 14, 2003, whichever period is shorter.  Your request for an accounting must be made in writing. 

We do not have to provide you with an accounting of certain excepted disclosures, such as those made for treatment, payment or health care operations purposes or made in accordance with an authorization, so these will not appear on the accounting. 

 

·        Right to Request Restrictions:  You have the right to request that the Plan place additional restrictions on the use or disclosure of your PHI for treatment, payment, health care operations purposes, and for disclosures made to persons involved in your care.  Your request for restrictions must be in writing to the Privacy Officer.

We are not required to agree to these additional restrictions and in some cases will be prohibited from agreeing to them, but if we do agree, we will abide by our agreement (except in an emergency).  Generally, the Plan will not agree to requests for restrictions on uses and disclosures of PHI for treatment, payment or health care operations.  It is necessary for us to use and disclose PHI for these purposes in order to provide the benefits that are afforded to you.  If we do agree to a restriction, our agreement will always be in writing and signed by the Privacy Officer.  

 

·        Right to Request Confidential Communications:  You have the right to request that we communicate with you in confidence about your PHI by using “alternative means” or an “alternative location” if the disclosure of all or part of that information to another person could endanger you.  We will accommodate such a request if it is reasonable, if the request specifies the alternative means or locations, and if it continues to permit the Plan to collect premiums and pay its claims.  To request confidential communication changes, you must make your request in writing to the Privacy Officer, and you must clearly state that the information could endanger you if it is not communicated in confidence as you request.

 

Right to Receive a Paper Copy of the Notice

 

If you receive this notice from our website or by e-mail, you are entitled to receive this notice in writing.  Please contact us using the information below to obtain this notice in written form.

 

Questions and Complaints

 

If you want more information about our privacy practices or have questions or concerns, please contact us using the information listed below.

If you are concerned that we may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you must submit your complaint in writing to the Privacy Officer.  You also may submit a written complaint to the U.S. Department of Health and Human Services (HHS).  The Plan supports your right to protect the privacy of your PHI. 

 

Eileen M. McGovern

HIPAA Privacy Officer

University of the Sciences in Philadelphia

600 South 43rd Street

Philadelphia, PA 19104-4495

Telephone:   (215) 596-8771

Fax:  (215) 895-1183

E-mail:  e.mcgove@usip.edu

 

Department of Health and Human Services

200 Independence Avenue, S.W.

Washington, D.C. 20201

Telephone: 1-202-619-0257

Toll-Free:  1-877-696-6775